Cyberspace chief says Iran has tested systems to locate and disrupt Starlink

Iran has tested systems to locate Starlink terminals and disrupt their connections, Mohammad Amin Aghamiri, secretary of the Supreme Council of Cyberspace and head of the National Cyberspace Center, said on October 13.

Aghamiri said the products were ready and that authorities had used one of the technologies during unrest last winter. He did not disclose the principal method or provide results establishing its reach. The remarks expanded on his October 5 claim that Iran had disabled Starlink.

At the same press conference, he defended restrictions on internet access as a national-security measure, while acknowledging their technical and economic costs. He also outlined plans involving access to foreign platforms, domestic infrastructure and public cybersecurity rankings.

Detection and disruption claims

Aghamiri cited foreign reports of 80% packet loss, the failure of data packets to reach their destination, as evidence of an effective loss of connectivity. He argued that a method used successfully in one location could be used elsewhere. His remarks did not identify the reports or establish nationwide disruption.

He said conventional satellite-television jamming equipment was unsuitable for Starlink’s narrow-beam antennas and that Iran was using different technology. GPS spoofing, which supplies false positioning signals, had been tested and worked in some circumstances, he said, but was not the main method.

Locating terminals was the more important issue, he said. He referred to a 3% error in conventional detection methods without explaining what that figure measured, and claimed other tested technologies made terminals easier to find. He dismissed political criticism of the claimed capability and said Iran was prepared to share the technology with aligned countries.

Aghamiri accused Starlink of supporting military command, espionage and intelligence collection. He also questioned equipment shipments into Iran and media campaigns promoting the service, presenting them as threats to Iranian sovereignty.

Regulatory dispute and military-target claim

Aghamiri said Iran had repeatedly taken complaints to the International Telecommunication Union and obtained favorable decisions. He challenged explanations that terminals could not be located, contrasting Iran with countries where he said service was disabled geographically.

The ITU’s Radio Regulations Board has previously urged Norway and the United States to act to disable unauthorized Starlink terminals in Iran. Its published record concerns telecommunications authorization; it does not establish Aghamiri’s separate allegations of military use.

He also argued that equipment used in warfare becomes a legitimate military target, citing Articles 52 and 53 of the Geneva Convention.

Shutdown defense and conflicting measurements

Aghamiri said a complete internet shutdown had occurred only once, for a few hours during the Iranian month of Dey last winter, describing other measures as restrictions. Elsewhere in the same briefing, he said internet access had been cut during the final 72 hours of the 12-day war. He did not clarify how those descriptions fit together.

Independent measurements show a much longer collapse in international connectivity in January. Cloudflare reported that traffic from Iran fell to near zero on January 8 and remained there until January 21, followed by brief recoveries and a stronger recovery beginning January 27. Those measurements do not establish that every domestic service stopped, but they show disruption extending well beyond a few hours. Cloudflare’s traffic analysis

Aghamiri said crisis decisions were collective and primarily involved security institutions and the national security council. Proposals aimed to protect essential commercial, scientific and other activity during restrictions, he said, without detailing how they would operate.

He argued that reducing outside connectivity removed less-skilled attackers and allowed security teams to concentrate on professional hacking groups. He also described attacks originating from compromised devices inside Iran, including software downloaded from unofficial sources.

Changing network routes created problems for application programming interfaces and domain-name-system updates, he acknowledged. He said the disruption was justified by the protection of lives and national security, while conceding that attackers had achieved some successes.

Aghamiri credited the National Information Network, Iran’s domestic network infrastructure, with keeping payment terminals, school services and domestic social platforms available. He acknowledged difficulties for activities dependent on the international internet.

Domestic network and foreign-platform policy

Aghamiri put completion of the National Information Network at 60%. Search services, SSL-related infrastructure and government cloud systems needed more work, he said. He promised another progress report within a month of the briefing, covering the network’s position at the end of the previous Iranian year.

He said a 32-point resolution on access to foreign platforms emerged from a review of earlier policies and widespread use of blocked services. The plan was divided into four stages because of concerns raised by some agencies.

He said the document had been declassified that week and was going through publication procedures in the Official Gazette, with publication expected during the week of the briefing. Other documents, including some security-related material, would gradually follow, he said.

Discussing VPNs, Aghamiri said estimates of usage differed and cited surveys suggesting most users chose free versions. He accused the United States of financing circumvention tools such as Psiphon and alleged that Israel spent billions of dollars on VPNs used by Iranians.

Bank security rankings and network quality

Aghamiri said bank cybersecurity rankings would be published in the week following the October 13 briefing, with university rankings nearly ready. An associated SMS information service would also be announced.

Under the assessment process he described, institutions receive their findings and have one month to address weaknesses before reassessment and public disclosure. He presented rankings as a way to influence user choice and encourage institutions to improve security.

He said the Communications Ministry and the Communications Regulatory Authority were responsible for network quality. Faults needed to be traced across access networks, aggregation, transmission and other infrastructure, rather than left unresolved. He assigned access-layer responsibility to fixed and mobile operators and cited the Telecommunication Infrastructure Company’s role in the internet gateway, core and transmission layers.

Content revenue sharing remains delayed

Aghamiri said administrative disputes and discretionary decisions had impeded a policy to give content creators a share of revenue from the internet traffic they generate. Implementing rules had been approved, he said, but obstacles remained. He linked the policy to supporting production of Iranian cultural content.

Asked about enforcement of council decisions, he said institutions should resolve disputes through the legal hierarchy and interagency coordination. Publishing lists of compliant and noncompliant agencies would damage cooperation, he argued. He said his office was working with the president’s office to arrange a Supreme Council of Cyberspace meeting.