Hardline media outlets in Iran claim the country’s security forces hacked the Telegram channel of Iran International, a Persian-language broadcaster that has extensively covered the year-old “Woman Life Freedom” protests. The outlets claim the regime intercepted messages in which Iranian citizens sent amateur images related to the protests to the UK-based broadcaster for publication. The channel denies it was hacked, and a FRANCE 24 review of the supposedly intercepted messages found no evidence that any of the amateur content was ever broadcast by Iran International.
With a news blackout in place in Iran on the protests that followed the death of Mahsa Amini last September, many Iranians have turned to Persian-language media broadcasting from overseas. With independent media barred from working in Iran, such channels rely heavily on amateur images published on social media or sent in by Iranian citizens. Videos filmed by citizens and sent to these media outlets outside Iran have become the main source for many Iranians of independent information about what is happening inside their country.
In what appears to be an attempt to discourage these ties, media affiliated with Iran’s hardline Revolutionary Guard Corps (IRGC) have targeted Iran International, publishing what they say are messages in which Iranian citizens sent amateur videos for publication by the UK-based channel. Launched in the UK in 2017, the channel, which reportedly receives funding from Saudi sources, is one of the favourite destinations for amateur videos shot inside Iran. Iranian authorities have branded it a "terrorist organisation”.
Iran International denies the hacking. “I can state categorically that our Telegram account has not been hacked, or compromised in any way. It never has been. Such claims from the IRGC or its associates are false and are designed to frighten and intimidate people,” spokesperson Adam Baillie told FRANCE 24. “We are characterised by the Iranian authorities as a terrorist channel, which provides quasi-legal cover for threats against our staff and the harassment, often brutal, of their families in Iran.”
The designation of Iran International as a terrorist organisation means that Iranians accused of sending information to the channel could face severe penalties in Iranian courts.
‘Alert to people who cooperate with enemy media’
Media affiliated with the IRGC, including the Fars News Agency, have published at least six online videos saying an unspecified “group of hackers” intercepted messages sent to Iran International. The videos, posted since mid-September, feature amateur images supposedly sent to the UK-based channel via Telegram, along with screenshots of the senders’ messages and usernames with the account name blurred. The amateur images show protests and other anti-regime initiatives such as strikes by shopkeepers.
One video, published on Telegram on September 15, showed screenshots of messages sent by a user named “Milad” in which he sent a video of an anti-regime protest along with this caption: “Aryashahr (a neighbourhood in Tehran), 17th or 18th Aban (September 8 or 9, 2022). Regime agents savagely beat up a young man.” FRANCE 24 was unable to confirm the sender’s identity or the context of the video, but Iranian web users suggested the claims of a hack were fabricated.
‘Fars News Agency’s claim is BS’
Iranian web users have been skeptical about the claims of a hack. "As someone who has sent many photos and videos [to Iran International], I can confirm Fars News Agency’s claim is BS," said one tweet posted on September 20.
“If they had hacked the channel, they would have shown off about it by announcing they had hacked it and changing the profile picture,” another user wrote, referring to a common practice when the Iranian security forces hack into anti-regime accounts.
A third user wrote: "Hacking? That's a joke! The IRGC fanboys can't do anything more complex than basic HTML coding."
‘Hacking Telegram is very difficult’
Amin Sabeti is an Iranian cybersecurity expert based in London. He closely follows the activities of hackers close to the Islamic republic's regime.
“In general, hacking the servers of a messaging app like Telegram is a very difficult task, not just for Iranians, but for any hacker in the world. The screenshots of the user messages supposedly sent to Iran International’s Telegram account are in a format that would only be visible by the Iran International Telegram account owner. I closely follow hackers working for the Iranian regime and I have never seen any indication that they are capable of directly hacking Telegram's servers to access any account.
All the Iranian hackers have done so far is to trap the “end user”, using various techniques like phishing. For example, they send emails to account holders pretending to be from the Telegram company saying that someone is trying to hack your account or change your password.
There are two sides to the question of the safety of Iranians who turn to foreign media such as the BBC or Iran International. Concerning the news organisations, I know that the security measures of these media outlets are really good. They are up-to-date in keeping their accounts secure. That is why we have never had such a case so far.
The only possible problem, however, could be the Iranians who contact these news organisations, because they too need to protect their accounts. They need to update their apps and software, and make sure they do not have malware on their phones. And once they have sent their messages, they need to delete them themselves.”
No trace of the videos on Iran International accounts
FRANCE 24 analysed the six video reports published by Fars and other IRGC-affiliated Telegram accounts. The IRGC reports featured more than 30 amateur videos supposedly sent to Iran International. The FRANCE 24 team then searched for other publications of the videos on social media, including archives of Iran International’s Telegram, X (formerly Twitter) and Instagram accounts over the last 12 months.
Of the around 30 videos supposedly sent to Iran International by Iranian citizens:
- None were published on Iran International’s social media accounts, including Telegram, X and Instagram.
- Reverse image searches found no publication of the videos on other social media accounts.
- In at least in one case, the video could not have been recorded on the date it claimed because the environment is not the same as it was during the 2022 protests.
Video supposedly filmed in November 2022 was filmed in 2023
One video, published by Fars News on September 20, featured messages supposedly sent to Iran International in November 2022 by a Telegram user called “Nilo0o”. The supposed user sent a video showing closed businesses on a street with a caption saying: “General strike by the population in Rasht on 17 November 2022.”
The video was filmed in the Golsar neighbourhood in the city of Rasht. It shows a bank, Melal Credit Institution, on Golsar Street between alleys 92 and 96, in a complex called the Blanca Palace.
But other information indicates that the Golsar branch of the bank moved to that location in 2023. A video of Golsar Street filmed in January 2023 shows the same location vacant, with a banner giving contact information for the complex.
Yellow Pages information indicate that Melal Credit had a branch at a different location on Golsar Street, 500 metres away near alley 109.
A posting by a business at that location in February 2023 said: ““I am the new owner at alley 109, pls Bank update your contact info!”
The video supposedly intercepted by hackers could not have been filmed in November 2022.
‘If the regime succeeds in cutting this line, we will have a total information freeze’
Bahram [not his real name] is an Iranian journalist who has been arrested or interrogated multiple times in recent years over his reporting on current affairs in Iran. He says that with widespread censorship in Iran, many Iranians turn to overseas broadcasters like Iran International for reliable news.
Iranians now record everything with their mobile phones: strikes, protests, police violence ... and send the videos to organisations that will publish them. The amateur videos people send to overseas broadcasters are our only source of information. If the regime succeeds in cutting this line of communication, we will have a total information freeze in our country. We will not know what is going on: we’ll know absolutely nothing.
The regime has done its best to drive us into such a blackout. They have blocked social media, but people use VPN proxy servers to get access.
They have tried to discredit these media or activists through propaganda smear campaigns. Now the latest attempt is to scare people. They’re saying: “If you send them something, we will find you, so don’t send them anything.” However, I am not sure it will ultimately benefit the regime. Maybe in the short term people will hesitate for a few days to send videos to this or that media or activist, but in the long term I think nothing will change. You will not give up your water source, no matter how tiny it is, in a desert.
