Secure Communication Tools

Communication tools are the primary target of state surveillance and censorship. The government actively monitors SMS, intercepts unencrypted traffic, and blocks access to foreign platforms. For Iranian users, choosing the right communication tool is not just a matter of privacy—it is often a matter of physical safety.

This guide evaluates communication tools based on their ability to resist interception, protect metadata, and function within Iran's restricted internet environment (filtering/filternet).

The Golden Rule: End-to-End Encryption (E2EE)

Before selecting a tool, understand the non-negotiable requirement: End-to-End Encryption (E2EE).

• Standard Encryption (Transport Layer): Protects data between you and the company's server (e.g., Telegram Cloud Chats, Gmail). The company can read your messages and may be forced to hand them over to authorities.
• End-to-End Encryption (E2EE): Encrypts data from your device to the recipient's device. The company (Signal, WhatsApp, etc.) cannot read the message content, even if subpoenaed or pressured by the government.

Warning regarding SMS & Regular Phone Calls: Never use standard SMS or phone calls for sensitive discussions in Iran. Telecommunication providers (MCI, Irancell, Rightel) are legally required to provide access to security agencies. SMS is unencrypted text and is easily intercepted and stored.

---

Recommended Instant Messengers

1. Signal (The Gold Standard)

Signal is widely considered the most secure messaging app available. It is open-source, uses state-of-the-art E2EE for everything (messages, calls, stories), and stores virtually no metadata about its users.

• Why it is recommended for Iran:

  • Minimal Metadata: Signal does not know who you are talking to or when. If Signal servers were seized, there would be almost no data to find.
  • Censorship Circumvention: Signal supports Proxies. If the app is blocked, you can configure a proxy to bypass the filter without a VPN (though a VPN is still recommended for better anonymity).
  • Registration Lock: Prevents SIM-swap attacks (common in Iran) where an attacker hijacks your phone number to take over your account.
  • Usernames: You can now connect with people without sharing your phone number.

• Essential Hardening Steps:

  1. Set a Registration Lock PIN: Go to Settings > Account > Registration Lock. This prevents the government from hijacking your account via SMS interception.
  2. Hide Phone Number: Go to Settings > Privacy > Phone Number and set "Who can see my number" to "Nobody".
  3. Disappearing Messages: Enable this by default for all new chats (Settings > Privacy > Disappearing Messages).
  4. Screen Security: Enable to prevent screenshots and hide the app content in the recent apps list.

• Accessing Signal in Iran: Since Signal is blocked, you will likely need a VPN or a Signal Proxy to connect initially. You can find proxies on Twitter/X via hashtags like #SignalProxy.

2. WhatsApp (Secure but Metadata-Heavy)

WhatsApp uses the same encryption protocol as Signal, meaning the content of your messages is secure. However, it is owned by Meta (Facebook), which collects significant metadata (who you talk to, how often, your location, device info).

• The Risk: While the Iranian government cannot read your WhatsApp messages, they could theoretically determine who creates a network of activists if they gain access to metadata or seize a device.
• Recommendation: Use for communicating with family or non-sensitive contacts. Avoid for high-risk activism.
• Critical Setting: Go to Settings > Chats > Chat Backup and turn it OFF or enable End-to-End Encrypted Backups. Standard backups to Google Drive or iCloud are not encrypted and can be accessed by authorities via subpoenas to Google/Apple.

3. Telegram (Popular but Risky)

Telegram is the most popular messenger in Iran, but it is NOT secure by default.

• The Danger: "Cloud Chats" (the default) are stored on Telegram's servers. Telegram holds the encryption keys. If Telegram's servers are compromised or if they cooperate with a state actor, your message history is visible.
• Secret Chats: You must use the "Secret Chat" feature for E2EE. Secret Chats are device-specific and not stored on the cloud.
  • To start: Open profile > Tap "..." > Start Secret Chat.
• Recommendation: Use Telegram for consuming news (Channels) and public broadcasting. Do not use standard Telegram chats for sensitive organizing.

4. Molly (Advanced Android Alternative)

Molly is a hardened fork of Signal for Android. It supports Tor routing and unified push (working without Google Play Services). It is an excellent choice for high-risk users who want Signal's network but require stronger device security.

---

Secure Email Providers

Standard email (Gmail, Yahoo) scans your emails for advertising and complies with US jurisdiction. For sensitive communications, use encrypted email providers based in privacy-friendly jurisdictions.

1. Proton Mail

Based in Switzerland. Uses Zero-Access encryption.

• Pros: Easy to use, requires no personal info to sign up, built-in VPN option.
• Usage: Emails between Proton users are automatically E2EE. Emails to non-Proton users can be password-protected.

2. Tuta (formerly Tutanota)

Based in Germany. Encrypts the entire mailbox, including subject lines (which Proton does not encrypt).

• Pros: Desktop and mobile apps, strong privacy protections, removing IP addresses from emails.

Tip: For anonymous account creation, access these services via Tor Browser.

---

Whistleblowing and File Submission

If you need to send documents to journalists or human rights organizations (like Amnesty or localized human rights groups) without revealing your identity:

SecureDrop

SecureDrop is an open-source submission system used by major news organizations. It requires the use of Tor Browser.

• How it works: You visit a specific .onion address provided by the organization. You upload documents. The system does not log your IP address or browser info.
• Iranian Context: Tor is heavily blocked in Iran. You will need "Bridges" (Snowflake or obfs4) to connect to the Tor network.

OnionShare

A tool that allows you to securely and anonymously share files of any size directly from your computer to another person using the Tor network. It avoids third-party cloud servers entirely.

---

Obtaining Apps in a Restricted Environment

Google Play and the Apple App Store are often restricted or filtered in Iran. Downloading apps from unofficial Persian markets (like Cafe Bazaar) creates a high risk of installing malware or modified versions of apps with backdoors.

Safe ways to get apps:

1. F-Droid (Android): An installable catalogue of FOSS (Free and Open Source Software) applications. It is censorship-resistant.
2. Aurora Store: An anonymous frontend for the Google Play Store. It allows you to download apps directly from Google's servers without a Google account.
3. Direct APK Downloads: Only download APKs from the official websites (e.g., signal.org/android/apk/).
4. Verification: If downloading manually, verify the SHA256 fingerprint of the APK file to ensure it hasn't been tampered with by intermediaries.

---

Video and Voice Calls

Voice over IP (VoIP) is safer than cellular calls, but bandwidth throttling in Iran can make video difficult.

• Signal Calls: E2EE and secure. Go to Settings > Privacy > Advanced and enable Always Relay Calls. This routes your call through Signal's server, hiding your IP address from the person you are calling (protecting your location).
• Jitsi Meet: An open-source video conferencing tool. No account required. You simply create a meeting link (e.g., meet.jit.si/MySecureMeeting). It works well in browsers and has apps.

---

Summary Checklist for Iranian Users

1. Switch to Signal for all sensitive operational communication.
2. Enable Registration Lock on Signal to prevent SIM hijacking.
3. Use a VPN (like Mullvad, ProtonVPN, or a private Outline server) to mask traffic from your ISP (MCI/Irancell).
4. Avoid SMS and regular calls for anything other than trivial coordination.
5. Treat Telegram with caution. Only use "Secret Chats" for private conversations; assume Cloud Chats are visible.
6. Verify contacts. Always check "Safety Numbers" (Signal) or encryption keys in person or via a secondary channel to ensure no Man-in-the-Middle (MITM) attack is occurring.