Open-source evidence documented Iranian government’s use of military-grade weapons and communications blockade
Open-source evidence documenting the ongoing protests in Iran has exposed the government’s particularly brutal, and at times lethal, crackdown on demonstrators.
In November, an increase in fuel prices in Iran sparked a series of demonstrations across the country. The protests grew out of anger at the gross economic disparity as well as corruption in — and lack of accountability for — the government. The government responded to the unrest with a brutal crackdown, resulting in the deadliest political unrest to sweep the country since the Islamic Revolution.
The DFRLab examined several videos taken on the ground and found that the Iranian security forces fired military-grade weapons at civilians, worked in tandem with paramilitary groups to identify, target, and arrest protesters, and throttled secure messaging traffic in an effort to impede mobilization efforts. Besides suppressing secure messaging apps, the Iranian government also shut down access to the Internet for approximately six days.
Use of automatic weapons
On November 26, a video surfaced online showing Iranian police officers using military-grade weapons shooting at protesters in the city of Shahriar.
Police of #Iran's Islamic Regime can be seen shooting at unarmed protesters using AK-47 Assault rifles while they were fleeing in #Shahriar during the second day of recent #IranProtests on 16 November. They were being chased because of killing three protesters minutes before this pic.twitter.com/RwTY37Xg4C
— Babak Taghvaee – Μπάπακ Τακβαίε – بابک تقوایی (@BabakTaghvaee) November 26, 2019
The officer in the video appeared to have been prepared to fire with his hand on the trigger and ended up firing accidentally while he was running away from the protesters.
The DFRLab used sound forensic techniques — in this case, slowing down the audio to isolate the timeframe in which the shots were fired — to determine the type of weapon used in the incident. The first bullet sound occurred at 17.070 seconds in the video, while the second bullet sound occurred at the 17.170-second mark. The 0.10-second difference between shots fired confirmed that the weapon used was likely an AK-47. The cyclic rate of fire of an AK-47 is around 10 rounds a cycle but can vary depending on the length of time the shooter keeps his hand on the trigger.
In November, Rouhani’s chief of staff, Mahmoud Vaezi, confirmed that a massacre took place in Mahshahr, saying it was a “strange turn of events,” as a group of individuals were shot down. Radio Farda reported that the Iranian forces had deployed tanks and used automatic weapons.
Located in the oil-producing Khuzestan province, Mahshahr is dotted with petrochemical plants and other oil-related facilities. Amir Hossein Ghazi Zadeh Hashemi, a member of parliament, stated that “Don’t they know what would happen if they decide to attack the main energy lines?,” implying that the protesters were shot because they tried to impair a key energy source.
Firing at civilians from the rooftops
Amnesty International reported that snipers shot at protesters from rooftops and helicopters on multiple occasions during the protests. On November 18, a video surfaced on Twitter showing one such case, in which several men opened fire on the street from the top of a courthouse building in Javanrud, a city in Kermanshah province.
The surfaced video was only 18 seconds long and did not provide many geolocation details. Three men could be clearly identified on the rooftop aiming their weapons down at the street. The men fired four gunshots throughout the course of the video but it was unclear whether they managed to hit anyone.
این فیلم کوتاه ۲۰ ثانیهای گزارش مستند چگونگی کشتار مردم است.
ماموران انتظامی و امنیتی از بالای ساختمان دادگستری جوانرود با سلاح جنگی و با هدف گیری به مردم معترض در خیابان شلیک میکنند. اینگونه کشتار کردهاند و جوانرود را به خون کشیدهاند …
منبع ویدیو:شبکه حقوق بشر کردستان pic.twitter.com/G53Rg4y5LX
— Shahed Alavi (@ShahedAlavi) November 17, 2019
The tweet mentioned, in Persian, that the men were firing from the roof of the “Javanrud Justice building.” Google search helped to verify that a building in the video was indeed seen from the roof of Javanrud’s city courthouse.
The building’s architectural details, including the placement of the entrance to the rooftop, also matched those of the city courthouse. The men in question were highly likely to be working for the Iranian regime, as they had unrestricted access to a government building.
A day earlier, on November 17, a similar video surfaced online. The individual who posted the video claimed to have captured militia members shooting at protesters in the city of Karaj. Similar gunshots can be heard in this video, and protesters are shown with cartridge cases that they claim were dropped by the militia.
The cartridge cases seen in the video resembled those of automatic or semi-automatic weapons, with one of the cases looking highly similar to an AK-47 7.62mm round. Since the militias were shooting from the roof, it is unclear how the protesters collected the cartridges.
In one of the videos, the DFRLab found what looks like an Iranian military officer standing on a rooftop with a military-grade weapon.
The weapon used in the video could be an AK-47 or Nakhjir 3 (without scope), a sniper weapon common in the region. The weapon’s length suggested it was a shoulder-assisted weapon.
Besieged by the Basij
In some of the videos, members of the Basij Resistance Force, a paramilitary volunteer militia, assisted the Iranian police and military in arresting protesters.
The Basij are one of the five forces that comprise the Iranian Revolutionary Guard Corps (IRGC) — alongside the army, navy, air force, and the Quds Force (IRGC-QF) — and are tasked with, among other duties, upholding domestic security.
Marking the protesters
In one of the videos, Basij members are seen shooting protesters with paintball guns as a means of marking the protesters.
According to previous reports, the Basij used paintball guns to mark protesters as a means of identifying them for police. Videos also surfaced on Twitter that showed a DES 516 B, a type of anti-riot truck with a 26-gallon paint drum, being deployed against the protesters.
As coverage of the protests began to emerge on social media platforms, the Iranian government started throttling encrypted traffic on popular secure messaging apps.
83% packet loss on https://t.co/yeEFhNl4Q6 on ISP level in Iran. Looks like Iran is trying to block @signalapp #Iran #iranprotest
با این ۸۳ درصد پکت لاست به نظر میاد تلاشها برای فیلتر کردن سیگنال در سطح ISP شروع شده است. pic.twitter.com/Zkkt5pNSVL
— AmiR Rashidi (@Ammir) November 16, 2019
The DFRLab spoke with Amir Rashidi, an Iranian internet security researcher. Rashidi observed that the Iranian government was blocking encrypted messaging app Signal. He also observed that the Google Play Store and Apple App Store were blocked in the country, “mainly to block protesters from downloading apps and to promote their homegrown alternatives to Telegram and other communication apps.” Some Iranian Reddit users also reported that Signal was not working in the country.
During the internet shutdown, Iran’s Supreme Leader, Ayatollah Ali Khamenei, tweeted from his own account, demonstrating that the blackout was administered selectively.
According to Google’s Transparency Report, which includes information on traffic and disruptions to Google, there was a clear disruption in web search traffic from November 16 to November 23 in Iran.
The internet shutdown during the protests both restricted communication between everyday Iranians and quashed the efforts of protesters to disseminate protest-related news and updates on social media platforms.
The open-source material documenting the current protests on social media shed light on the tactics employed by the Iranian military, allied paramilitary organizations, and law enforcement to suppress the demonstrations. The DFRLab managed to corroborate some of the reports from human rights organizations and citizen journalists documenting the regime’s brutal response to the unrest.
According to Amnesty International, the confirmed death toll from the government crackdown has risen to 208, and “the real figure is likely to be higher.”
As the protests continue throughout Iran, the DFRLab will continue to monitor open-source material. If you have any videos and images from the protests requiring verification and further investigation, you can send it to us via Twitter (@DFRLab) or via email (firstname.lastname@example.org).
Kanishk Karan is a Research Associate with the Digital Forensic Research Lab.
Lukas Andriukaitis is an Associate Director with the Digital Forensic Research Lab.
Mas and Sam contributed to this reporting.
Follow along for more in-depth analysis from our #DigitalSherlocks.