Iran marries surveillance infrastructure, national ID to control population: report

The Iranian regime has been leveraging tools from its digital public infrastructure (DPI), combining them with its limited network of CCTV cameras and human informants to crack down on dissent, according to new research published by analysis group Raaznet.

The organization notes that combining data from e-government, mobile SIM registration and other databases has enabled it to overcome the lack of sophisticated AI surveillance tools, such as facial recognition cameras. The country is also using digital identity infrastructure to go beyond street surveillance and monitor its citizens’ movements online.

“Contrary to popular belief, identifying citizens in public does not necessarily require complex facial recognition systems,” says the report.

Iran has been relying on a network of urban, traffic control and banking surveillance cameras. Authorities then combine visual data with identity credentials, such as national ID cards or SIM cards, and various databases. The “hybrid approach” uses facial images and geolocation data to identify, warn and penalize citizens, the research notes.

“The data backbone of surveillance projects in the Islamic Republic is supported by a constellation of national databases that contain biometric and civil identity information,” says the report. “These include the Smart National ID Card system (HODA), the Civil Registry Organization, judicial authentication platforms such as SANA, driver’s license and passport databases, and banking institutions, all of which serve as potential sources for cross-referencing image data with personal identity profiles.”

An example of this system is the Nazer app, which reports the geolocation and license plate numbers of women who are not wearing a hijab. The information is processed by the police, resulting in SMS warnings or fines. The system is reportedly integrated with national identity and vehicle registration systems.

Another example is the 2025 hijab enforcement campaign, during which the police relied not on facial biometric scans but on vehicle plate numbers, ownership records, mobile data, and civil registry databases. Two of the main systems used were Shahkar, which links SIM cards to national ID numbers, and Hamta, which is used to track mobile devices.

Digital infrastructure in the service of control

Public services such as this have been boosted by Iran’s 7th Development Plan, a digital development strategy that aims to boost the economy by expanding digital infrastructure and boosting e-government services. The strategy also plays a crucial role in developing identity authentication systems for public services – which, says Raaznet, are likely to evolve into tools of surveillance and social control.

The country has been developing its Reliable Digital Identity Framework since 2019. According to more recent rules, all platforms must integrate their authentication systems with the centralized infrastructure developed under the Reliable Digital Identity Framework by the National Organization for Civil Registration of Iran (NOCR). User identities are verified against the national registry maintained by the Ministry of Interior.

The 2024 Guidelines for the Protection of User Privacy on Cyberspace Systems and Platforms were introduced in order to “minimize the collection of identity data by platforms and systems,” according to the government. Raaznet, however, argues that this makes centralized identity checks mandatory for every online interaction.

“Centralized authentication, combined with the aggregation of databases and the interconnection of systems, allows the state to repurpose access itself as an instrument of digital repression against users,” the report says.

At the same time, digital public infrastructure tools are being used to further the government’s reach. This includes User Authentication Network Shahkar, which authenticates users by matching national ID numbers with their mobile phone numbers, the Siam Integrated System for Telecommunication Inquiries, the Hamta system for registering and tracking device IMEI numbers, the Shamsa National lawful intercept data archive system and the Eshraf Oversight System for Cyberspace.

“From a technical perspective, their design enables systematic interception, tracking, data aggregation, and the enforcement of access restrictions in a centralized manner,” the report says. “In practice, these systems form the backbone of the state’s surveillance and security infrastructure.”

Article Topics

biometric data  |  digital government  |  digital identity  |  facial recognition  |  Iran  |  national ID  |  Nazer app  |  video surveillance