Iran was plunged into an internet blackout Saturday after Israel and the U.S. launched military strikes around the country, according to a global internet monitor.
Within hours of the strikes — which officials said targeted infrastructure and killed dozens of senior regime figures at a compound in Tehran—Operation Epic Fury, President Donald Trump said on Truth Social that the "heavy and pinpoint" bombing in Iran "will continue uninterrupted throughout the week or as long as necessary to achieve our objective of PEACE THROUGHOUT THE MIDDLE EAST AND, INDEED, THE WORLD!"
He claimed Iranian security forces and members of the regime’s powerful Islamic Revolutionary Guard Corps were already seeking immunity. He urged them to "peacefully merge with the Iranian Patriots."
"We are hearing that many of their IRGC, Military, and other Security and Police Forces no longer want to fight and are looking for Immunity from us," Trump said in the post. "As I said last night, ‘Now they can have Immunity; later they only get Death!’"
Toker argued the timing of the blackout suggested it was imposed deliberately as the regime sought to secure communications amid fears of further targeting.
"The Iranian regime will have deployed this new blackout to counter potential cyberattacks during their own military operation, but also to avoid leaking the locations of senior regime figures through metadata and user-generated content," he said.
"Communications would have been limited, and Iran's leadership would have proceeded with the assumption that all communications, including satellite or whitelisted networks, carry risks," he said before claiming that "paranoia would be well grounded at this point, with the blackout a belated but direct response to that."
"Those participating directly would already know to avoid technology that could betray their whereabouts," Toker said.
"However, the metadata may well have played a part in determining that the meeting of regime leaders was being held at the Tehran compound, who was in attendance, and at what time."
Toker revealed that the broader network around the regime leaders and around the compound wouldn't have had the same strict restrictions.
"This kind of adjacent ‘background noise’ can be correlated against other intelligence sources to build an understanding of activity on the ground," he added.
"Smartphones are a readily available, almost ‘free’ source of intelligence, and even when locked down, they eventually connect to international online services and generate insights that can be used to pinpoint regime figures," Toker said.
"In the aftermath of Saturday’s strike, this concern will have been high on the remaining Iranian leadership’s minds, especially if they didn't have a clear and specific understanding of how the meeting was compromised."
Iran has previously imposed sweeping internet shutdowns during periods of domestic unrest, including nationwide protests in January, which saw thousands killed, often seeking to curb the spread of information and restrict coordination.