Chapter 1 — The incident
Iran, 8 January 2026 — what exactly happened
In January 2026, the economic situation in Iran drove millions of people onto the streets. The currency was in freefall and inflation had passed the 42 percent mark. The government responded — not with concessions, but by shutting down the internet.
What followed took only a few hours:
11:50 UTC
IPv6IPv6Internet Protocol Version 6 — the modern version of internet addressing with a near-unlimited address space. Gradually replacing the older IPv4. In Iran, 98.5% of IPv6 routes collapsed within minutes. routes disappear. These are the modern addresses through which a large proportion of internet traffic flows — 98.5% of them dropped within minutes. Measured by Kentik, a network analysis firm.
16:30 UTC
The older IPv4IPv4Internet Protocol Version 4 — the original addressing system of the internet with "only" 4.3 billion possible addresses. Being gradually replaced by IPv6, but still widely used. traffic also begins to drop. Anyone still online now notices: something is wrong.
18:45 UTC
Near-total blackout. Around 90 million people are cut off from the global internet. Unlike previous shutdowns, Iran's National Information Network (SHOMA) also goes completely offline in 2026 — even banking and government sites are unreachable.
80%
Drop in e-commerce during the shutdown
450,000
Points lost on the Tehran Stock Exchange in four days
> 6,000
Documented deaths from the uprising — concealed by the shutdown
Amnesty International described the shutdown as a "cover for human rights violations": when no one can film, report or communicate, what happens in the dark happens without witnesses.
🔍
"Stealth outage" — a new method. In 2019 Iran simply withdrew all BGP routesBGP routeA set of directions on the internet. BGP tells other networks: "To reach me, send data this way." Without this announcement, a network is invisible to the rest of the internet. — immediately visible to external observers. In 2026 it worked differently: instead of withdrawing BGP routes, the authorities sabotaged Transport Layer Security (TLS) and DNS directly — the protocols that make the internet usable at a technical level. External monitoring tools partly showed a normal state; internally, nothing worked. This makes it harder to document and harder to prove.
Chapter 2 — The technology explained simply
How the internet actually works
To understand how you shut down the internet, you first need to understand briefly how it works at all. It sounds more complicated than it is.
DNS — the internet's phone book
When you type "google.com" into your browser, your computer does not know where Google is. It therefore asks a DNS serverDNS serverA directory service that translates names like "google.com" into IP addresses like "142.250.185.14" — similar to a phone book that converts names into numbers.: "What IP addressIP addressInternet Protocol address — a number combination like 142.250.185.14 that uniquely identifies every computer on the internet. Comparable to a house number: without it, the internet does not know where to send data. does google.com have?" The DNS server replies, and the browser connects.
When a state blocks DNS, the server either gives the wrong answer or no answer at all. The website would technically be reachable — but your browser cannot find it. It is like someone tearing pages out of the phone book.
Bypassable? Yes — anyone using a different DNS server (e.g. 1.1.1.1 from Cloudflare instead of their provider's) can usually get around DNS blocks.
BGP — the internet's road map
The Border Gateway ProtocolBGP — Border Gateway ProtocolThe protocol through which networks on the internet communicate with each other about how to reach them. Simply put: BGP is the internet's road map. Without BGP announcements, a network does not exist for others. is more complex and more powerful. It governs how networks tell each other: "To reach me, send data this way." Every network on the internet announces itself in this way.
What happens when that announcement is missing? An example you may know: in October 2021, Facebook accidentally withdrew its own BGP routes. For six hours, Facebook, Instagram and WhatsApp were offline worldwide — not because the servers were broken, but because the internet had forgotten the way to get there.
The same thing happened in Iran in 2026 — but deliberately. The state withdrew the routes. Iran simply ceased to exist for the global internet.
The crucial difference from blocking a website: Blocking a website is like locking a door. Shutting down BGP routing is like erasing the entire road network leading to a city. You cannot get there — regardless of which route you take.
Chapter 3 — Escalation levels
The four levels of internet suppression
Not all internet shutdowns are equal. There is an escalation ladder — from easily bypassed to nearly impossible to overcome:
1
Blocking individual websites or apps (DNS block)
The provider blocks specific domains. Twitter is blocked, Google is not. The most common form of state censorship.
✓ Bypassable with VPN
2
App store blocks
VPNVPNVirtual Private Network — an encrypted tunnel between your device and a server abroad. Your provider only sees encrypted data, not which websites you visit. In many countries the most important tool against censorship. apps are removed from the app store — anyone without a VPN can no longer download one. Iran and China use this deliberately.
~ More difficult
3
Time-based blocks / Deep Packet InspectionDPIA surveillance technique that not only looks at where data is going, but also inspects what is inside it. This allows a state to identify and selectively block VPN connections — even if the destination address is not blocked.
Specific protocols are detected and blocked. VPN traffic looks different from normal traffic — and is filtered. Iran has spent decades building this technology.
~ Partially bypassable
4
Full BGP shutdown / whitelist modelWhitelistOnly pre-approved websites and services remain accessible — everything else is blocked. The opposite of a blacklist (blocking individual sites). In Iran only banking and government sites stayed online.
All international connections are severed. Only pre-approved services remain reachable on the national intranet. Iran in 2026 went further still: even the national network went completely offline.
✗ Barely bypassable
The Iran model: why it works so easily there. Iran has centralised its entire internet infrastructure over decades. The country has only two international gatewaysGatewayA transition point between the national and the international internet. Iran has only two — both state-controlled: the Telecommunication Infrastructure Company (TIC) and the IPM Institute. A single command to these two points is enough to cut around 90 million people off from the internet. — both state-controlled: the Telecommunication Infrastructure Company (TIC) and the IPM Institute. A single command to these two points is enough to take the country offline. In addition there is a national intranetIntranetA self-contained network with no connection to the global internet. In Iran it is called the National Information Network (SHOMA) — designed to keep banking and government sites running even when the "real" internet is switched off. designed to keep state services running even without global internet — though in 2026, SHOMA also went completely offline.
Chapter 4 — Global overview
Other countries, other methods
Iran is not an isolated case. Internet shutdowns are a growing phenomenon worldwide — with different methods and triggers.
🇮🇷
Iran
TLS/DNS sabotage (2026), BGP shutdown, Deep Packet Inspection. Used during protests in 2019, 2022, 2025 and 2026 — each time more sophisticated. The world's most advanced shutdown infrastructure.
🇨🇳
China
Great FirewallGreat FirewallChina's state censorship system, filtering all internet traffic since 2003. Permanently blocks Google, Facebook, Wikipedia and thousands of other websites. The world's most sophisticated internet censorship system.: permanent filtering rather than temporary shutdown. In Xinjiang: 312 days completely offline (2009–2010) following unrest.
🇲🇲
Myanmar
Complete shutdown following the 2021 military coup. The military used the internet vacuum to suppress resistance.
🇹🇷
Turkey
Since 2016, a law has permitted "partial or complete" internet shutdowns. Used following the coup attempt.
🇮🇳
India
The world's most frequent internet shutdowns. Mostly regionally limited, during protests, elections or religious unrest. Jammu & Kashmir was affected for years.
🇹🇿
Tanzania
Social media block for five days around the 2025 national election. A typical pattern: targeted ahead of votes.
Chapter 5 — Germany check
Germany check: technical and legal
The obvious question: could this happen here too? The short answer is: a complete kill switch like Iran's — no. Partial restrictions — theoretically yes.
Why a complete shutdown would be so difficult
The decisive difference lies in the infrastructure. In Iran: two state gateways. In Germany: dozens of international connection points, many undersea cables and hundreds of internet providers (ISPsISPInternet Service Provider — companies that provide you with internet access: Deutsche Telekom, Vodafone, 1&1, etc. Iran has only two state ISPs — Germany has hundreds of private ones.). After the Iran shutdown, German daily taz.de wrote: "A complete internet blockade would be barely feasible in Germany. There are simply too many individual 'bridgeheads' to the global internet."
The most important hub is DE-CIXDE-CIX FrankfurtThe German Commercial Internet Exchange in Frankfurt is one of the largest internet exchange points in the world. Thousands of networks meet here and exchange traffic — with a capacity of over 10 terabits per second. in Frankfurt — one of the largest internet exchange points in the world. Crucially, DE-CIX is privately operated, not under direct state control. And even if it were switched off, there are alternative routes via Amsterdam, London or Paris.
A further protective factor: the privatisation of telecommunications in the 1990s. A political shutdown order today would have to be enforced legally against private companies — which have their own fundamental rights protection.
It is thin ice. A complete internet outage in Germany is not impossible.
— Prof. Jochen Schiller, Freie Universität Berlin (ZDF heute, January 2026) — pointing to two vulnerabilities: undersea cables and DE-CIX
⚠️
The 70-percent problem. Today around 70% of German internet traffic runs through just three major carriersCarrierLarge telecommunications companies that operate the network infrastructure: lines, masts, data centres. In Germany, Telekom, Vodafone and Telefónica together control around 70% of internet traffic.: Deutsche Telekom, Vodafone and Telefónica. A centralised command to these three companies would be technically effective. Legally it would be nearly impossible to enforce in Germany — but the technical concentration is real.
What the Basic Law protects
Germany has no kill switch law and no legal basis for blanket internet blocks. Two fundamental rights directly protect internet access:
✓ Legal protection
Art. 5(1) Basic LawBasic Law Art. 5The fundamental right to freedom of information: "Everyone has the right to inform themselves without hindrance from generally accessible sources." The internet is one such source — a shutdown would be a massive infringement of this right.: Freedom of information — the right to "inform oneself without hindrance from generally accessible sources"
Art. 10 Basic LawBasic Law Art. 10Protects the confidentiality of telecommunications: phone calls, emails, chats — and internet access. The state may only intervene under strict conditions (judicial order, proportionality).: Secrecy of communications — protects confidential communication
Interventions must be proportionate and withstand judicial review
✗ Technical reality
70% of traffic through three carriers — technically concentrated
DE-CIX as a central hub with a potential vulnerability
Undersea cablesUndersea cablesFibre-optic cables on the ocean floor connecting continents. Over 95% of international internet traffic runs through these cables. Whoever controls or severs them can isolate entire countries. as physical connections — limited in number
Chapter 6 — The grey zone
The grey zone: what already exists in Germany
No kill switch law does not mean: no risk. Mechanisms that enable internet blocks already exist — and are criticised by civil liberties advocates.
CUII — internet blocks and the July 2025 reform
Since 2021, the "Clearingstelle Urheberrecht im InternetCUIIA private organisation in which large internet providers and the entertainment industry jointly coordinate DNS blocks. Until July 2025 this happened without a court order — since then a judicial order is required. Critics still see the existing infrastructure as a precedent for privatised internet control in Germany." (CUII — Clearing House for Copyright on the Internet) has existed. Telekom, Vodafone and Telefónica blocked websites jointly with the entertainment industry — until July 2025 without a court order. The process operated outside the judiciary.
Update July 2025: Following sustained criticism — including from a then 17-year-old student who systematically documented errors in the CUII blocklist — the Federal Network Agency demanded a change. Since July 2025, the CUII may only block websites on the basis of a judicial blocking order. The extrajudicial procedure has been abolished.
Felix Reda, a former MEP and internet law expert, had previously described the old procedure to netzpolitik.org as a dangerous precedent: the CUII paves the way for further extrajudicial internet blocks. The principle — providers blocking on demand — can be extended to other content. The abolition of the extrajudicial procedure is a step in the right direction — but the infrastructure for coordinated DNS blocks remains in place.
The failed Zugangserschwerungsgesetz (2009)
Under Federal Minister Ursula von der Leyen, the Federal Criminal Police Office (BKA) was to maintain a blocklist — providers would have to block certain websites without a judicial order. The law was sharply criticised as "Lex Lolita" and as building a censorship infrastructure, and was repealed in 2011.
The lesson from this: Creating the infrastructure for internet blocks is dangerous — even when the original intention appears legitimate. Whoever builds a blocking infrastructure builds it for all future governments too.
The German connection to the Iran shutdown
A detail that barely featured in German reporting: Correctiv, taz and netzpolitik.org revealed in 2022 that Softqloud GmbH from North Rhine-Westphalia operates data centres in Frankfurt and the Netherlands for the Iranian cloud provider ArvanCloud.
ArvanCloud was publicly recommended by the Iranian Communications Minister and operates infrastructure that was exempt from the shutdown — meaning it was on the regime's whitelist. Reporters Without Borders called on ArvanCloud to cease cooperation with the regime. No response was forthcoming.
Chapter 7 — Circumvention options
What helps — and what doesn't
For people in countries with internet blocks, the question of circumvention is not theoretical. Here is a realistic overview:
🛰️
StarlinkStarlinkElon Musk's satellite internet — thousands of small satellites in Earth's orbit deliver internet directly from the sky. Bypasses terrestrial infrastructure entirely: no cable, no provider, no state hub required. in Iran: a lethal risk. Despite the Iranian ban, the US has smuggled around 6,000 Starlink terminals into the country to give protesters internet access. Under current law, anyone in Iran who possesses or uses a terminal risks up to ten years in prison — or worse.
What remains
A complete internet kill switch like Iran's is technically difficult and legally near-impossible to enforce in Germany. Decentralised infrastructure, private operators and constitutional rights protection form real barriers.
Even so, it is worth keeping an eye on the grey zone: the CUII reformed its extrajudicial blocking procedure in July 2025, requiring court orders from that point on. But the infrastructure for coordinated DNS blocks remains in place. Whoever builds a blocking infrastructure once, builds it for all the future.
And as for Iran: the shutdown of January 2026 was no exception. It was the fourth major shutdown in seven years — and each time it became more sophisticated. The technology keeps developing. The intent behind it does not.
🔄
Update February/March 2026: second shutdown — still ongoing. Following Israeli-US strikes on Iran on 28 February 2026, the regime imposed a further shutdown. NetBlocks reported internet connectivity collapsing to 4% of normal levels — even more complete than in January. As of 17 March 2026 the blackout is still ongoing.
Source: Wikipedia — 2026 Internet Blackout in Iran
Sources & references
01
Kentik — "Iran Goes Dark" (8 January 2026)
Real-time network analysis of the Iran shutdown with IPv6/IPv4 traffic data
kentik.com
02
Cloudflare Radar — Iran shutdown IPv6 data
Real-time data and visualisation of the Iranian internet traffic collapse
blog.cloudflare.com
03
Wikipedia — 2026 Internet Blackout in Iran
Overview article with timeline, economic damage and political context
en.wikipedia.org
04
Amnesty International — Statement on the Iran shutdown (9 January 2026)
Human rights assessment; shutdown described as "cover for human rights violations"
amnesty.org
05
IODA / Georgia Tech — Historical comparison of Iran shutdowns
Academic analysis of Iranian shutdown methods 2019–2026
hra-iran.org
06
taz.de — FAQ Iran shutdown: could it happen in Germany too?
Explainer with Germany comparison and quote on decentralised infrastructure
taz.de
07
ZDF heute — Prof. Jochen Schiller, FU Berlin (January 2026)
Expert assessment of the technical feasibility of a shutdown in Germany
zdf.de
08
Correctiv — ArvanCloud & Softqloud GmbH (20 October 2022)
Investigative research into the German connection to Iranian internet infrastructure
correctiv.org
09
Netzpolitik.org — CUII criticism (Felix Reda)
Analysis of extrajudicial internet blocks by the CUII copyright clearing house
netzpolitik.org
10
Wirtschaftswoche — Country comparison of internet shutdowns
Iran, DRC, Germany compared: infrastructure and legal frameworks
wiwo.de
11
Internet Society — Position on internet shutdowns
Global data on shutdowns, economic costs and human rights
pulse.internetsociety.org
13
Tagesspiegel Interaktiv — Visualisation of Iran escalation levels
Interactive display of the various escalation levels of Iranian internet censorship
interaktiv.tagesspiegel.de
14
Filterwatch — Technical breakdown of the January 2026 shutdown (16 January 2026)
Detailed investigative report on the Iranian regime's TLS/DNS sabotage method
filter.watch
15
NPR — At least 6,126 killed in Iran crackdown (27 January 2026)
Documented death toll from the protests and massacres of 8–9 January 2026
npr.org