Iran is widely known for censoring all kinds of websites and social networks, but this year it is attempting to revamp filtering with a new technical approach to social media censorship known as “intelligent” filtering. Its first target is Instagram. Why Instagram? Because its technical features make it possible.
Since the 2009 protest movement, the Iranian government has seen the Internet as a space of chronic vulnerability for national security. The unrest that ensued in 2009, with the aid of communication technology devices such as Facebook, active blogs, and online TV streams of opposition candidates Mehdi Karroubi and Mir Hossein Mousavi, resulted in a mandate for heavy centralization of the online space and subsequent shutdowns and censorship of many websites, including Facebook and Twitter. Iranian government statistics show that 70% of Iran’s youth , the largest demographic in the country, are bypassing these filters through circumvention tools.
Saddled with a censorship regime that is both exhaustive and ineffective, Iranian authorities are now trying to regain control of the Internet through “intelligent” filtering, a process whereby they filter select content on a social media platform, rather than the entire site. The first known instance of intelligent filtering on social media platforms in Iran was recently implemented over the Instagram API.
For this small-scale research project, we studied the technical layers of this process as best we could, observing the techniques implemented by Iranian censors to block individual pages and particular types of content on the platform. We also sought to determine where this filtering was happening within the broader framework of Iran’s filtering system. And we compared the blocking of Instagram pages with associated or similar webpages, in order to better understand how threats are perceived across different forms of Internet media.
Contrary to popular western human rights narratives, we found that very few political figures or activists had their pages blocked. Individuals such as Kambiz Hosseini, who is well known for his satirical talk shows Parazit and Poletik, which are viewed on illegal satellites or blocked platforms such as youtube.com or radiofarda.com inside the country, are accessible on Instagram. Pages deemed politically sensitive such as the US White House, or the page belonging to jailed dissident blogger Hossein Ronaghi , are also open on Instagram, while pages for celebrities like Kim Kardashian and Justin Bieber are not. This suggests that Iranian authorities do not see Instagram as a platform for political dissent.
What exactly is “intelligent” filtering?
Iran is experiencing a new wave of Internet control where authorities embed themselves in social platforms in order to effectively monitor and censor their content piece-by-piece, rather than wholesale. The case of Instagram does well to illustrate this shift, as it is the first and only known application of intelligent filtering on social media in Iran. In December of 2014, ICT Minister Mahmoud Vaezi declared  that the intelligent filtering program was in its pilot phase, blocking immoral and criminal content. Iran’s cyber police, Gerdab, however did state  that the intelligent filtering program is not functional on websites that use SSL protocol. In other words, this approach only works when users access a site through HTTP — if they are using HTTPS, which encrypts data as it is sent through the network, the system cannot see what is being sent, and therefore cannot identify problematic content.
The government has indicated that they want to build a stronger national Internet infrastructure and to implement sophisticated technology in the practices of both surveillance and censorship online. One example is a project called Ankaboot – a locally-developed “spider” or crawler tool used to monitor and collect information from the web. Tools like Ankaboot suggest that authorities are resigned to the likelihood that Iranian Internet users will continue to rely on US corporate platforms through circumvention tools, even when local alternatives are available.
In announcing  Ankaboot's launch, the Revolutionary Guards explained that the program would identify activities that spread “corruption” and western-inspired lifestyles. Officials say it will extend to Instagram, Viber and WhatsApp, where it will reportedly collect data on “likes” to identify potential offenders. This indicates a general will to keep these platforms accessible for Iranians, as long as authorities can adequately control how they are used.
We wrote a program to facilitate the detection of filtered Instagram accounts based on a list of accounts we knew were filtered. We were able to test a sample of 15,238 accounts, a small but still informative sample. All of the measurements we present here were taken in mid-April , thus results might vary depending on time and location.
We developed our sample group from pages we knew to be blocked, including that of American pop singer @justinbieber , @khatamifans  and @therichkidsoftehran , as well as a few popular unblocked pages belonging to Iranian elites. Of the 15,238 pages we tested, a total of 983 pages were blocked. To understand the type of content the Iranian filters were targeting on the Instagram API, we took a sample of 78 of the ‘blocked pages’, and 55 of the ‘not blocked pages’. We then categorized and cross-referenced this list with web pages belonging to the same users.
Our research found that Instagram content was filtered using Deep Packet Inspection  on the Instagram website backend that hosts and sends content for Instagram mobile applications. This selective filtering was possible because there is no encryption of data sent between Instagram servers and its mobile application. Without encryption, authorities can easily see what kind of data is traveling through the network, and censor data that they find objectionable.
When we tried to load a blocked account through the Instagram mobile app, it resulted in a loading error. We found ourselves looking at the notorious M5-8 page , which Iranian users encounter every time they try to access a censored website. Accounts appear to be censored based on a unique identifier that is not the account username. Testing proved that changing the username will not circumvent the block. Even when accounts have been removed from the platform, the URL still leads to the M5-8 page. We have no evidence that any keyword or hashtag-based filtering is taking place to filter content on Instagram.
We shared our findings with Facebook Security Team, now in charge of Instagram. Within days of our report, an Instagram update was released that loads user profiles, timelines and content over HTTPS in their mobile applications.
Blocked on Instagram: fashion, commerce, Justin Bieber
Forty-six out of 78 blocked pages belonged to online fashion magazines, models, photographers and other entities in the fashion industry. Fashion pages for Vogue and VICE were among the blocked online fashion publications. While Vogue's website is also blocked in Iran, VICE’s website, i-d.vice.com appears to be accessible there. We also found a disparity between the official Instagram pages and websites of the designer labels.
One can access websites for Burberry, Gucci, and Jimmy Choo, but their Instagram accounts are blocked. Why some designer labels are blocked, while others are accessible is not outright apparent, but an initial overview of the images shared on these fashion pages indicates that posts shared by Chanel and Michael Kors can be perceived as more conservative in nature. We were perplexed to find that filters allowed access to the Calvin Klein page . The label is notorious for images of skin-bearing models in their underwear – including Justin Bieber, whose Instagram page is blocked in Iran.
Western celebrities were also a popular target. Pages belonging to celebrities such as Madonna, Rihanna, Beyonce, Jennifer Lopez, Kim Kardashian and other members of the Kardashian family were all blocked.
The commonality among celebrity and fashion pages seems to be their focus on women, who were often provocatively dressed. The exception here is Justin Bieber , the only male celebrity whose page is blocked. Celebrities with blocked Instagram pages typically had their websites blocked as well, except in few cases including the website of tennis player Serena Williams.
A handful of other blocked pages featured provocatively dressed women such @boobs_n_vodka, and private pages with Persian language bios such as @khoshtipmr , which translates as “good-looking mister”, and features various Iranian men in different locations in Iran, often shirtless. The description for this particular page has a disclaimer that states “The laws of the Islamic Republic dictate that political comments = block. We do not post photos without hijab.” The page has not been updated since December 2014, perhaps a good indicator for when the page was blocked.
Other blocked pages include Iranian celebrities now living in exile, such as the rapper Shahin Najafi  and actress Golshifteh Farahani . Their associated websites are also blocked. We can surmise that these pages are targeted because both individuals are controversial Iranians who have taken opposition to a number of political and social norms inside of Iran.
Within this sample we also discovered four blocked accounts that were operating businesses inside of Iran off of an Instagram page, presenting a direct contact email or Iranian phone number for Iranians to purchase features merchandise. One such account, @tehranmedia sold cellphone cases, available through a Viber number. The account is in Persian, with 61,000 followers and roughly 300-400 likes per post.
The pages for @khatamifans and @therichkidsoftehran were already well-known censored pages on Instagram. The Rich Kids of Tehran was censored in October 2014, when the conservative weblognews.ir  explained the page was blocked due to its “vulgar” content. Mohammad Khatami has been blocked since February 2015, when the judiciary announced that any mention of the popular former reformist President would be banned from Iranian media. Twitter users first reported  the block on Instagram for @khatami fans on April 5. Again, because of the vocal stance authorities have taken against both Khatami and the Rich Kids of Tehran, we believe these accounts to be another instance of targeted filtering.
Instagram pages for the jailed activist Hossein Ronaghi, the US White House, BBC Persian, the newspaper associated with the Green Movement Kaleme, the American conservative news channel Fox News, and Global Voices were all accessible, despite their websites being blocked in Iran. It should be noted that we discovered for the first time this April that Global Voices’ HTTP version is blocked in Iran .
There were also very few instances of blockages of political figures or activists. Individuals such as Kambiz Hosseini, who is well known for his satirical talk shows Parazit and Poletik, which are viewed on illegal satellites or blocked platforms such as youtube.com or radiofarda.com inside the country, are accessible on Instagram.
These findings indicate a general incoherence in filtering policy in Iran. While a number of public figures and companies’ Instagram accounts are blocked, their associated web pages are still accessible. This could be due to the emphasis Instagram has on images, while websites typical feature textual and other materials. In general, the demographic that is typically found on Instagram is young, as such Iranian authorities might worry about the images that youth see, and the potential anti-establishment morals and norms they propagate.
All this suggests that Iranian authorities see Instagram not as a platform for political dissent, but rather as a place where authorities are concerned primarily with harmful and immoral images, often related to the provocative representations, typically of women, and some men.
Minimizing “harm” while preserving benefits
There has been much discussion regarding the policy on filtering these popular social networks. An article in the Young Journalists Club  online newspaper (affiliated with state-run television) quoted local experts who suggested that intelligent filtering was needed to more effectively censor the Internet, as all-out filtering had led Iranians to turn to circumvention tools in mass numbers. The general logic here, according to one of the referenced experts Hamed Alvandi, was to “track the anti-Islam, immoral and anti-government webpages.” In effect, the goal was to create a technology that would crawl the web and censor these individual pages. But at the time of these announcements, there seems to have been little reference to the technical infrastructure needed to implement this new kind of filtering.
The concept of intelligent filtering first arose during Mahmoud Ahmadinejad’s presidency when a Facebook page was created for the Supreme Leader Ali Khamenei in 2012. This caused many to speculate that Iranian authorities were rethinking policies regarding the filtering of Facebook and Twitter. Soon thereafter hardline elements inside Iran, such as chief of police Esmail Ahmadi Moghadam, went on to promote the notion of filtering in controlling social networks , rather than censoring them wholesale. This way, as he put it, the “harm of social networking websites would be avoided, and at the same time, people could benefit from their useful features.”
The current administration has made many promises and statements about opening the Internet. The administration of Hassan Rouhani has been successful in deterring decisions by hardline governing bodies  outside of the authority of the president, including the judiciary, from blocking popular mobile applications such as WhatsApp, Line and Tango.
With HTTPS, intelligent filtering won't last
With Instagram adopting HTTPS in the latest releases of their mobile apps, we suspect that the intelligent filtering capabilities of Iran will become obsolete. Currently, a few options are still open to them such as filtering on a per image basis (instead of a per user basis) since images are sent over HTTP from Instagram’s content delivery network. This would prevent an offensive image from being displayed within a user’s profile page while the number of followers, biography, likes and comments of pictures would still be able to load, as these are sent over HTTPS. After Instagram shifts all of its activities to HTTPS, Iran’s options will be limited. This will force them to choose between blocking it all, or letting it be.
Mahsa Alimardani is an expert on Internet filtering in Iran and a researcher at the University of Amsterdam. She is also the Iran editor for Global Voices. Frederic Jacobs  is a security expert and developer at Open Whisper Systems .
In the coming days, we will publish a comprehensive report on our findings and the technical procedures we used to obtain our data. In the meantime, take a look at some of our samples below. Questions? Contact us on Twitter at @maasalan  and @FredericJacobs