Friday 14 October 2022
The decentralized hacker movement has vowed to free the people of Iran.
Iranian protesters found an ally in Anonymous.
Since September 17, 2022, Iran has experienced yet another round of mass protests followed by bloody crackdowns. The tragic death of 22-year-old Mahsa “Zhina” Amini in police custody on September 16 sparked the current wave of demonstrations. Amini, originally from Kurdistan province, was on a visit with her family to Iran’s capital city of Tehran when she was detained for “re-education” by the so-called morality police.
In detention, she was reportedly beaten in the head and began experiencing concussion-like symptoms. She was hospitalized where she went into a coma and died three days after her arrest. Official reports claim that pre-existing medical conditions led to her death, but Amini’s family has categorically denied these claims and demanded the perpetrators be held accountable.
Amini’s death spurred a wave of nationwide protests across Iran, with women taking the lead. Her death at the hands of a force claiming to safeguard “Islamic values” was seen as symbolic of years of gender-based persecutions and women’s rights violations in Iran.
In addition to the feminist outcry, Amini’s Kurdish roots awakened ethnic sentiments beyond Iranian borders and brought together a variety of Kurdish political parties and rights groups, including in Syria and Turkey.
By the evening of September 21, Instagram and WhatsApp — the two most popular international platforms in Iran — were unavailable on mobile networks. Similarly, access to foreign websites was blocked while a limited number of domestic services remained operational. Iran is capable of separating global and domestic internet traffic in large part due to a costly national telecommunication project known as the National Information Network (NIN).
Enter Anonymous.
Amid these reports of internet restrictions and deadly protest crackdowns in Iran, hacktivist collective Anonymous, known for its activities during Occupy Wall Street and the Arab Spring, pledged its support for the people of Iran.
On September 20, a person wearing a Guy Fawkes mask appeared in a video announcing a campaign called #OpIran, and vowed to shut down the government of Iran. A new Twitter account, @anonymousopiran, appeared as well, which has since been promoted by existing Anonymous accounts. As a decentralized collective of volunteers, there is no singular social media account representing all of the movements goals and activities, though some accounts like @YourAnonNews and @YourAnonOne have been around for years.
Since the YouTube video first appeared, Anonymous has allegedly hacked more than 1,000 CCTV cameras across Iran and launched distributed denial of service (DDoS) attacks against websites of multiple state bodies, including the Central Bank of Iran; official websites of the executive branch, including president.ir; the official portal of Supreme Leader Ali Khamenei; and the website for the Telecommunications Company of Iran (TCI), a state-owned telecom entity. Anonymous also leaked the purported bank information of government officials and phone numbers of members of parliament — all in the name of #OpIran and Mahsa Amini.
Protesters welcomed the actions of Anonymous and began to include #OpIran in their tweets and Instagram posts. At the time of writing, #OpIran had been tweeted more than 83 million times alongside variations of Amini’s name in Persian and English, including #MahsaAmini, #Mahsa_Amini, and #مهسا_امینی. In addition to these hack-and-leak activities, Anonymous blamed Instagram for content take downs related to the Iran protests and accused WhatsApp of blocking Iranian phone numbers, a rumor that was widely circulated online. Both platforms are owned by Meta, parent company of Facebook. Anonymous pressing the matter, coupled with public outrage, prompted WhatsApp to issue a statement insisting that it was not blocking Iranian numbers and pledging to keep the service running for all Iranians.
The recent protests are not the first time Anonymous has targeted the Iranian government. In June 2009, amid the Green Movement protests that emerged in response to the disputed re-election of Mahmoud Ahmadinejad, Anonymous launched an earlier version of Operation Iran (OpIran) — in this case a DDoS campaign targeting government websites and government-affiliated organizations.
Two years later in February 2011, as Iranians took to the streets to support the Arab Spring, Iran sought to suppress the protests through mass arrests, renewed censorship, and jamming satellite news channels. In response, OpIran was resurrected, launching DDoS attacks against government websites, including the websites of the Supreme Leader and the president.
Later that year, in the run-up to the anniversary of the 2009 Iranian presidential election, Anonymous leaked more than 10,000 emails from the Ministry of Foreign Affairs that contained visa requests and passport images of non-Iranians. However, these incidents were not widely noted by Iranians at the time.
What makes Anonymous appealing to Iranians.
While Anonymous pursues tactics similar to its previous activities in Iran, the traction they have recently garnered from Iranians is different. Anonymous has vowed to shut the Iranian government down and free the people of Iran, mirroring the chants of protesters on the street. As protests persist in Iran, Anonymous shows its solidarity by taking down new targets and leaking sensitive information, inspiring protesters further. In other words, the continuous actions on one side feed into the other.
For the leaderless and grassroots movement currently taking on the Iranian regime, Anonymous’s actions are meaningful as they come from an equally leaderless and hierarchically flat collective, claiming to hold those in power accountable with cyber-enabled tactics. The absence of alternatives combined with persistent actions and powerful optics has created a sense of trust and solidarity between many Iranian protesters and Anonymous.
Anonymous hack-and-leak tactics may not impair the government in the long term, but they extend the frustration of protesters to the virtual doorsteps of a highly unpopular regime and encourage solidarity with the public. Like the protests themselves, however, these online measures lack concrete direction and leadership, and remain contingent upon whatever leakable materials Anonymous can get its hands on. Nonetheless, they have expanded the possibilities at the intersection of civil disobedience and cyberattacks to an irreversible point. What comes next remains to be seen.
— By Simin Kargar (excerpt from the article).
Cite this case study:
Simin Kargar, “Analysis: Why Iranian protesters are embracing Anonymous ”
— Digital Forensic Research Lab (DFRLab), October 13, 2022,
Simin Kargar is a Non-Resident Fellow at the DFRLab. She is currently a doctoral researcher at the School of Advanced International Studies (SAIS) at Johns Hopkins University.
