Iran has ordered foreign messaging apps to store all data on its citizens within the country's borders, Reuters reports, giving the companies one year to comply. Iran's Supreme Council of Cyberspace announced the measures on Sunday, saying they are based on the "guidelines and concerns of the supreme leader" Ayatollah Ali Khamenei, according to the local IRNA news agency.
"Foreign messaging companies active in the country are required to transfer all data and activity linked to Iranian citizens into the country in order to ensure their continued activity," the council said.
Iran has long held tight control over the internet, censoring objectionable content and blocking access to services like Facebook and Twitter. Some web users have circumvented the blocks through virtual private networks (VPNs) and other software, though the government has recently cracked down on social media. This month, authorities arrested eight Instagram users — including some prominent fashion models — as part of an operation against women who post photos of themselves without a headscarf. (Iranian law requires women to cover their hair.)
The regulations on messaging apps could have a particularly significant impact on Telegram, an app for encrypted messaging that has gained popularity in Iran. A poll published by an Iranian news agency this year estimated that 20 million Iranians use Telegram — roughly a quarter of its population — and the company says that about 20 percent of its monthly active users are based in Iran. The app has gained popularity in part due to its strong security, though there are concerns that the new regulations could make it easier for authorities to monitor or censor conversations.
"There have been similar announcements in Russia and China but the practical ability to enforce these kinds of regulations is questionable," Edin Omanovic, a research officer at the London watchdog Privacy International, said in an email. "Nevertheless, it is an extremely worrying trend."
Update May 31st, 8:03AM ET: This article has been updated to include a comment from Privacy International.