"The key difference from the pre-protest filternet arrangement is that, while internet platforms were extensively censored before, the regime is selectively whitelisting only a handful of services it deems critical for business needs.
"Even this selective access is sporadic, which means the censorship is likely still in the test phase," he added. "In practice though, ordinary users remain offline."
Toker described how the digital darkness "is in fact getting darker because the information controls are getting tighter."
"Where international links were tolerated as a window to trade, the regime is approaching each of these as potential threats," he said before adding that the regime "sees its own citizens’ ability to communicate with the rest of the world as an existential threat because the people are disaffected."
According to the hacked Iran’s national broadcaster, briefly interrupting state television to air protest messages and calls from Reza Pahlavi, the exiled son of Iran’s last shah and a prominent opposition figure.
"We aren’t able to see the specific hack here," Toker explained. "The lack of up-to-date security is an issue for Iran."
"It is caused directly by the country’s digital isolation," he said. "Iran’s internet systems are outdated, and security tools aren’t available due to internet restrictions."
Toker added that embargoes force widespread use of pirated software, which often contains hidden vulnerabilities that can be exploited to breach critical networks.
He said cyber warfare played a major role during the June 2025 clashes between Israel and Iran, prompting the blackout as a defensive measure against digital attacks. Israel, he noted, also restricted parts of its own network at the time.
"In 2026, we haven’t seen the same focus on cyber incidents, but it’s clear there’s an ongoing battle between state actors as well as individual hackers," Toker said.