Chapter 1 — The incident

01Iran, 8 January 2026 — what exactly happened

In January 2026, the economic situation in Iran drove millions of people onto the streets. The currency was in freefall and inflation had passed the 42 percent mark. The government shut down the internet.

What followed took only a few hours:

11:50 UTC
IPv6IPv6Internet Protocol Version 6 — the modern version of internet addressing with a near-unlimited address space. Gradually replacing the older IPv4. In Iran, 98.5% of IPv6 routes collapsed within minutes. routes disappear. These are the modern addresses through which a large proportion of internet traffic flows — 98.5% of them dropped within minutes. Measured by Kentik, a network analysis firm.
16:30 UTC
The older IPv4IPv4Internet Protocol Version 4 — the original addressing system of the internet with "only" 4.3 billion possible addresses. Being gradually replaced by IPv6, but still widely used. traffic also begins to drop. Anyone still online now notices: something is wrong.
18:45 UTC
Near-total blackout. Around 90 million people are cut off from the global internet. Unlike previous shutdowns, Iran's National Information Network (SHOMA) also goes completely offline in 2026 — even banking and government sites are unreachable.
80%
Drop in e-commerce during the shutdown
450,000
Points lost on the Tehran Stock Exchange in four days
> 6,000
Documented deaths from the uprising — concealed by the shutdown

Amnesty International described the shutdown as a "cover for human rights violations": when no one can film, report or communicate, what happens in the dark happens without witnesses.

!

"Stealth outage" — a new method.

In 2019 Iran simply withdrew all BGP routesBGP routeA set of directions on the internet. BGP tells other networks: "To reach me, send data this way." Without this announcement, a network is invisible to the rest of the internet. — immediately visible to external observers. In 2026 it worked differently: instead of withdrawing BGP routes, the authorities sabotaged Transport Layer Security (TLS) and DNS directly — the protocols that make the internet usable at a technical level. External monitoring tools partly showed a normal state; internally, nothing worked. This makes it harder to document and harder to prove.

Chapter 2 — The technology explained simply

02How the internet actually works

To understand how you shut down the internet, you first need to understand briefly how it works at all.

DNS — the internet's phone book

When you type "google.com" into your browser, your computer does not know where Google is. It therefore asks a DNS serverDNS serverA directory service that translates names like "google.com" into IP addresses like "142.250.185.14" — similar to a phone book that converts names into numbers.: "What IP addressIP addressInternet Protocol address — a number combination like 142.250.185.14 that uniquely identifies every computer on the internet. Comparable to a house number: without it, the internet does not know where to send data. does google.com have?" The DNS server replies, and the browser connects.

When a state blocks DNS, the server either gives the wrong answer or no answer at all. The website would technically be reachable, but your browser cannot find it. It is like someone tearing pages out of the phone book.

Bypassable? Yes — anyone using a different DNS server (e.g. 1.1.1.1 from Cloudflare instead of their provider's) can usually get around DNS blocks.

BGP — the internet's road map

The Border Gateway ProtocolBGP — Border Gateway ProtocolThe protocol through which networks on the internet communicate with each other about how to reach them. Simply put: BGP is the internet's road map. Without BGP announcements, a network does not exist for others. is more complex and more powerful. It governs how networks tell each other: "To reach me, send data this way." Every network on the internet announces itself in this way.

What happens when that announcement is missing? An example you may know: in October 2021, Facebook accidentally withdrew its own BGP routes. For six hours, Facebook, Instagram and WhatsApp were offline worldwide — not because the servers were broken, but because the internet had forgotten the way to get there.

The same thing happened in Iran in 2026, but deliberately. The state withdrew the routes. Iran simply ceased to exist for the global internet.

›

The crucial difference from blocking a website

Blocking a website is like locking a door. Shutting down BGP routing is like erasing the entire road network leading to a city. You cannot get there — regardless of which route you take.

Chapter 3 — Escalation levels

03The four levels of internet suppression

Not all internet shutdowns are equal. There is an escalation ladder, from easily bypassed to nearly impossible to overcome:

1
Blocking individual websites or apps (DNS block) The provider blocks specific domains. Twitter is blocked, Google is not. The most common form of state censorship.
Bypassable with VPN
2
App store blocks VPNVPNVirtual Private Network — an encrypted tunnel between your device and a server abroad. Your provider only sees encrypted data, not which websites you visit. In many countries the most important tool against censorship. apps are removed from the app store — anyone without a VPN can no longer download one. Iran and China use this deliberately.
~ More difficult
3
Time-based blocks / Deep Packet InspectionDPIA surveillance technique that not only looks at where data is going, but also inspects what is inside it. This allows a state to identify and selectively block VPN connections — even if the destination address is not blocked. Specific protocols are detected and blocked. VPN traffic looks different from normal traffic — and is filtered. Iran has spent decades building this technology.
~ Partially bypassable
4
Full BGP shutdown / whitelist modelWhitelistOnly pre-approved websites and services remain accessible — everything else is blocked. The opposite of a blacklist (blocking individual sites). In Iran only banking and government sites stayed online. All international connections are severed. Only pre-approved services remain reachable on the national intranet. Iran in 2026 went further still: even the national network went completely offline.
Barely bypassable
›

The Iran model: why it works so easily there.

Iran has centralised its entire internet infrastructure over decades. The country has only two international gatewaysGatewayA transition point between the national and the international internet. Iran has only two — both state-controlled: the Telecommunication Infrastructure Company (TIC) and the IPM Institute. A single command to these two points is enough to cut around 90 million people off from the internet. — both state-controlled: the Telecommunication Infrastructure Company (TIC) and the IPM Institute. A single command to these two points is enough to take the country offline. In addition there is a national intranetIntranetA self-contained network with no connection to the global internet. In Iran it is called the National Information Network (SHOMA) — designed to keep banking and government sites running even when the "real" internet is switched off. designed to keep state services running even without global internet — though in 2026, SHOMA also went completely offline.

Chapter 4 — Global overview

04Other countries, other methods

Internet shutdowns are a growing phenomenon worldwide, with different methods and triggers.

Iran
TLS/DNS sabotage (2026), BGP shutdown, Deep Packet Inspection. Used during protests in 2019, 2022, 2025 and 2026 — each time more sophisticated. The world's most advanced shutdown infrastructure.
China
Great FirewallGreat FirewallChina's state censorship system, filtering all internet traffic since 2003. Permanently blocks Google, Facebook, Wikipedia and thousands of other websites. The world's most sophisticated internet censorship system.: permanent filtering rather than temporary shutdown. In Xinjiang: 312 days completely offline (2009–2010) following unrest.
Myanmar
Complete shutdown following the 2021 military coup. The military used the internet vacuum to suppress resistance.
Turkey
Since 2016, a law has permitted "partial or complete" internet shutdowns. Used following the coup attempt.
India
The world's most frequent internet shutdowns. Mostly regionally limited, during protests, elections or religious unrest. Jammu & Kashmir was affected for years.
Tanzania
Social media block for five days around the 2025 national election. A typical pattern: targeted ahead of votes.
Chapter 5 — Germany check

05Germany check: technical and legal

Could this happen here too? A complete kill switch like Iran's would fail on German infrastructure. Partial restrictions are technically possible.

Why a complete shutdown would be so difficult

The decisive difference lies in the infrastructure. In Iran: two state gateways. In Germany: dozens of international connection points, many undersea cables and hundreds of internet providers (ISPsISPInternet Service Provider — companies that provide you with internet access: Deutsche Telekom, Vodafone, 1&1, etc. Iran has only two state ISPs — Germany has hundreds of private ones.). After the Iran shutdown, German daily taz.de wrote: "A complete internet blockade would be barely feasible in Germany. There are simply too many individual 'bridgeheads' to the global internet."

The most important hub is DE-CIXDE-CIX FrankfurtThe German Commercial Internet Exchange in Frankfurt is one of the largest internet exchange points in the world. Thousands of networks meet here and exchange traffic — with a capacity of over 10 terabits per second. in Frankfurt — one of the largest internet exchange points in the world. Crucially, DE-CIX is privately operated, not under direct state control. And even if it were switched off, there are alternative routes via Amsterdam, London or Paris.

A further protective factor: the privatisation of telecommunications in the 1990s. A political shutdown order today would have to be enforced legally against private companies, which have their own fundamental rights protection.

It is thin ice. A complete internet outage in Germany is not impossible.
— Prof. Jochen Schiller, Freie Universität Berlin (ZDF heute, January 2026) — pointing to two vulnerabilities: undersea cables and DE-CIX
!

The 70-percent problem.

Today around 70% of German internet traffic runs through just three major carriersCarrierLarge telecommunications companies that operate the network infrastructure: lines, masts, data centres. In Germany, Telekom, Vodafone and Telefónica together control around 70% of internet traffic.: Deutsche Telekom, Vodafone and Telefónica. A centralised command to these three companies would be technically effective. Legally it would be nearly impossible to enforce in Germany, but the technical concentration is real.

What the Basic Law protects

Germany has no kill switch law and no legal basis for blanket internet blocks. Two fundamental rights directly protect internet access:

Legal protection
Art. 5(1) Basic LawBasic Law Art. 5The fundamental right to freedom of information: "Everyone has the right to inform themselves without hindrance from generally accessible sources." The internet is one such source — a shutdown would be a massive infringement of this right.: Freedom of information — the right to "inform oneself without hindrance from generally accessible sources"
Art. 10 Basic LawBasic Law Art. 10Protects the confidentiality of telecommunications: phone calls, emails, chats — and internet access. The state may only intervene under strict conditions (judicial order, proportionality).: Secrecy of communications — protects confidential communication
Interventions must be proportionate and withstand judicial review
Technical reality
70% of traffic through three carriers — technically concentrated
DE-CIX as a central hub with a potential vulnerability
Undersea cablesUndersea cablesFibre-optic cables on the ocean floor connecting continents. Over 95% of international internet traffic runs through these cables. Whoever controls or severs them can isolate entire countries. as physical connections — limited in number
Chapter 6 — The grey zone

06The grey zone: what already exists in Germany

Mechanisms that enable internet blocks already exist, and civil liberties advocates criticise them.

CUII — internet blocks and the July 2025 reform

Since 2021, the "Clearingstelle Urheberrecht im InternetCUIIA private organisation in which large internet providers and the entertainment industry jointly coordinate DNS blocks. Until July 2025 this happened without a court order — since then a judicial order is required. Critics still see the existing infrastructure as a precedent for privatised internet control in Germany." (CUII — Clearing House for Copyright on the Internet) has existed. Telekom, Vodafone and Telefónica blocked websites jointly with the entertainment industry — until July 2025 without a court order. The process operated outside the judiciary.

Update July 2025: Following sustained criticism — including from a then 17-year-old student who systematically documented errors in the CUII blocklist — the Federal Network Agency demanded a change. Since July 2025, the CUII may only block websites on the basis of a judicial blocking order. The extrajudicial procedure has been abolished.

Felix Reda, a former MEP and internet law expert, had previously described the old procedure to netzpolitik.org as a dangerous precedent: the CUII paves the way for further extrajudicial internet blocks. The principle — providers blocking on demand — can be extended to other content. The abolition of the extrajudicial procedure is a step in the right direction — but the infrastructure for coordinated DNS blocks remains in place.

The failed Zugangserschwerungsgesetz (2009)

Under Federal Minister Ursula von der Leyen, the Federal Criminal Police Office (BKA) was to maintain a blocklist — providers would have to block certain websites without a judicial order. The law was sharply criticised as "Lex Lolita" and as building a censorship infrastructure, and was repealed in 2011.

›

The lesson from this

Creating the infrastructure for internet blocks is dangerous, even when the original intention appears legitimate. Whoever builds a blocking infrastructure builds it for all future governments too.

The German connection to the Iran shutdown

A detail that barely featured in German reporting: Correctiv, taz and netzpolitik.org revealed in 2022 that Softqloud GmbH from North Rhine-Westphalia operates data centres in Frankfurt and the Netherlands for the Iranian cloud provider ArvanCloud.

ArvanCloud was publicly recommended by the Iranian Communications Minister and operates infrastructure that was exempt from the shutdown, meaning it was on the regime's whitelist. Reporters Without Borders called on ArvanCloud to cease cooperation with the regime. No response was forthcoming.

Chapter 7 — Circumvention options

07What helps — and what doesn't

For people in countries with internet blocks, the question of circumvention is not theoretical. Here is a realistic overview:

Tool
Helps with...
Does not help with...
VPN
DNS blocks, simple IP blocks (levels 1–2)
Full BGP shutdown; Deep Packet Inspection detects many VPNs
TorTorThe Onion Router — a network that routes your internet traffic through three random servers worldwide and encrypts it multiple times. Makes you largely anonymous but is slow and actively blocked in many countries.
Application-level censorship, anonymisation
Full infrastructure shutdown; actively blocked in many countries
StarlinkStarlinkElon Musk's satellite internet — thousands of small satellites in Earth's orbit deliver internet directly from the sky. Bypasses terrestrial infrastructure entirely: no cable, no provider, no state hub required.
Almost everything — satellite access bypasses terrestrial infrastructure
State bans: in Iran illegal since 2026, possession can be punished with up to 10 years in prison or the death penalty
Alternative DNS
Level 1 DNS blocks (e.g. 1.1.1.1 instead of provider DNS)
All blocks from level 2 upwards
Bluetooth mesh networksMesh networkA network in which devices communicate directly with each other — without internet, without a provider. Each device forwards messages to the next. Range: only a few hundred metres, but in protest situations that can be enough.
Local communication without internet (e.g. Briar appBriarA messenger that works entirely without internet. Messages are forwarded via Bluetooth, Wi-Fi or Tor. Developed for activists and journalists in countries with internet blocks. Available for Android.)
Access to the global internet — local communication only
!

Starlink in Iran: a lethal risk.

Despite the Iranian ban, the US has smuggled around 6,000 Starlink terminals into the country to give protesters internet access. Under current law, anyone in Iran who possesses or uses a terminal risks up to ten years in prison — or worse.

What remains

A complete internet kill switch like Iran's is technically difficult and legally near-impossible to enforce in Germany. Decentralised infrastructure, private operators and constitutional rights protection form real barriers.

Even so, it is worth keeping an eye on the grey zone: the CUII reformed its extrajudicial blocking procedure in July 2025, requiring court orders from that point on. But the infrastructure for coordinated DNS blocks remains in place.

And as for Iran: the shutdown of January 2026 was no exception. It was the fourth major shutdown in seven years, and each time it became more sophisticated.

!

Update May 2026: second shutdown, 88 days.

Following Israeli-US strikes on Iran on 28 February 2026, the regime imposed a further shutdown. NetBlocks reported internet connectivity collapsing to 4% of normal levels, even more complete than in January. On 27 May 2026, access was partially restored after 88 days, with NetBlocks measuring 86% of usual traffic volumes. It was the longest nationwide shutdown on record. The filternet remained in place and WhatsApp stayed restricted. Source: Wikipedia — 2026 Internet Blackout in Iran