- Internet-based sanctions undermine the integrity of global digital networks and disproportionately harm those they purported to protect.
- In Iran, Internet-based sanctions are blocking access to critical cloud services and Internet technologies that significantly improve speed, security, and performance.
- Marginalized communities, including women, ethnic minorities, and rural populations, bear the brunt of these restrictions due to prohibitively expensive bypassing solutions such as VPNs.
Iran’s digital ecosystem is under unprecedented strain, not just from internal government-imposed restrictions but also from the far-reaching impact of international sanctions.
These sanctions, particularly those targeting cloud services, developer platforms, and critical Internet protocols, have created profound technical barriers that fragment Iran’s access to the global Internet. While introduced as tools to pressure the Iranian regime, the technical ramifications of these sanctions extend far beyond their intended scope, severely impacting Iran’s developers, businesses, and ordinary users.
Sanctions and Internet Protocols: A Layered Disruption
Internet-based sanctions are, by nature, unpredictable and uncontrollable. While they are designed to target specific governmental entities, their technical effects produce unintended consequences impacting millions of ordinary users.
In Iran, Internet-based sanctions are blocking access to critical cloud services such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud, as well as critical Internet technologies such as HTTP/3 and QUIC—protocols that significantly improve speed, security, and performance. These restrictions force Iranian developers and users to rely on less reliable, insecure, and outdated alternative web and security services and outdated protocols, which are less efficient and more vulnerable to interception and control.
As a result, developers and ordinary users experience slower load times, degraded security (see below), and a diminished Internet experience, compounding the challenges of maintaining connectivity in Iran.
Sanctions have severely weakened Iran’s cybersecurity by limiting access to advanced tools and secure Virtual Private Networks (VPNs), forcing users to rely on insecure, free alternatives.
This increases the risk of data breaches and cyberattacks, as seen in incidents like the 2023 TAPSI hack and the 2024 breach of the Iranian judiciary records. Without access to advanced systems like Endpoint Detection and Response (EDR), Iranian networks are more vulnerable to malware, turning devices into potential tools for cybercriminals. The combination of digital isolation and reliance on insecure VPNs creates a fragile cybersecurity landscape where sanctions inadvertently expose Iranian users to greater risks.
The Adobe Case: A Web of Restrictions and DNS Spoofing
Abode’s cloud services provide a clear example of the unintended impact of the sanctions being placed on Iran. Adobe’s Endpoints Matrix shows that its users must access at least 531 domains to receive its full range of services. Our analysis at the Tehran E-Commerce Association indicates that at least 60 of these domains are blocked because of AWS sanctions, while internal restrictions obstruct others. In some cases, these domains are blocked by both external and internal measures, creating a complex web of restrictions that leaves Iranian users with little to no access to Adobe’s services.
Moreover, the issue of Domain Name System (DNS) spoofing further complicates Internet access in Iran. DNS queries for some blocked Adobe domains are manipulated to return the address 10.10.34.36—an internal IP address that should never appear on the public Internet. This technique disrupts connectivity even when users employ VPNs, as the traffic is diverted to a non-routable internal address. Despite attempts to bypass filtering, this makes specific sites entirely inaccessible, highlighting how deeply sanctions disrupt Internet access in Iran.
Iranian developers’ inability to use modern cloud infrastructure severely hampers their ability to innovate and compete globally.
The Hidden Cost: Digital Discrimination
Sanctions on Internet access do not impact all Iranians equally. Marginalized communities, including women, ethnic minorities, and rural populations, bear the brunt of these restrictions. These groups already face systemic barriers offline, and the digital divide caused by sanctions further exacerbates their exclusion.
For many, bypassing these sanctions is prohibitively expensive. VPNs, often used to circumvent sanctions and government filters, cost around $5 to USD 6 per month—nearly double what many Iranians pay for mobile data. For marginalized populations, this additional cost is often too much, leaving them entirely cut off from essential digital services.
Women who depend on global websites like Elsevier for education or cloud services to run small businesses find their opportunities limited even further, deepening their social and economic exclusion.
This disproportionate impact highlights the failure of Internet-based sanctions to discriminate between a government and its people. Instead of supporting civil society, these sanctions create layers of digital discrimination, with the heaviest burdens placed on those already facing the most hardship.
The Iranian case should serve as a cautionary tale as the world continues to grapple with the consequences of Internet-based sanctions. The Internet was not built to be a geopolitical tool, and using it as such only harms the very citizens it should empower. Ordinary citizens are the actual victims of the expanding infrastructure-driven approach to digital sovereignty. Despite their vigilance, skepticism, and sophistication, they have endured countless controls, with their awareness offering little practical defense. The future of the Internet depends on its continued openness and interoperability, and any attempt to weaponize it through sanctions threatens that future for all.
Imad Payande is a Digital Governance Researcher at Data for Governance Lab.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of the Internet Society.