Last month, the European Union’s update to its Iran sanctions list had one notable development: the removal of Abr Arvan, the Iranian cloud technology company that the EU had sanctioned in November 2022 for human rights violations related to internet censorship.
The timing of this decision is surprising. After every major uprising, the Iranian regime develops new policies to counter threats from activists, and this moment is no different. Following the regime’s crackdown on the Woman, Life, Freedom movement that began in 2022, Iran’s Supreme Council of Cyberspace—the central internet authority directly under the purview of Supreme Leader Ali Khamenei—has aggressively pushed to nationalize the country’s internet infrastructure and suppress dissent. Women and activists continue to face horrific repression. Authorities are ensuring anyone pushing for women’s liberation through loosened hijab requirements is coerced—sometimes violently—back into submission. Meanwhile, activists and protesters arrested during the movement continue to face death sentences—most recently, the dissident rapper Toomaj Salehi.
The stakes at present are high, which is why the EU’s move is so peculiar. Ultimately, the EU’s reversal sets a concerning precedent for how democracies will respond to digital repression actions undertaken in Iran.
Sanctioned for Complicity
In September 2022, after Mahsa Jina Amini’s death in police custody sparked uprisings across Iran and captured the world’s attention, the regime unleashed violent repression aided by digital technology to squash the protests. Many called for accountability from companies that had enabled the government’s coercive agenda.
The original EU designation in 2022 highlighted the link between Abr Arvan—also known as ArvanCloud—and the Iranian government:
Since 2020, it is a major partner . . . to set up a separate, Iranian version of the internet. Such a national intranet with connecting points to the global internet will help control the flow of information between the Iranian intranet and the global internet. As such, Arvan Cloud is involved in censorship and efforts of the Iranian government to shut down the internet in response to recent protests in Iran. Arvan Cloud is also associated with persons responsible for serious human rights violations in Iran, notably the EU-listed Iranian Minister of Information and Communications Technology.
Abr Arvan has long been known to Iranian civil society and activists because of leaked contracts between the company and the government to build “Abr Iran,” or “Iran Cloud.” Their agreement explicitly supports strengthening Iran’s “national information network” to limit the country’s dependence on the global internet. Following the EU’s sanctions, Abr Arvan announced it had terminated its government contracts. Yet in an interview with the Persian language podcast Tabaghe 16 that was released one week before the sanctions, Abr Arvan founder and CEO Pouya Pirhosseinloo said that he would not hesitate to enter into the same contract with the Iranian regime again, if given the opportunity.
Abr Arvan landed on the EU’s radar for its alleged ties to Softqloud, a company based in Düsseldorf, Germany. Although both Abr Arvan and Softqloud maintain they are separate entities, German media dug up evidence indicating that Softqloud serves as Abr Arvan’s European shell company. Several German investigations revealed the role of both entities in working with Iranian authorities on digital repression projects funded by Pasargad Bank, which was sanctioned by the U.S. Treasury in 2022 for its ties to the Revolutionary Guards Forces, Quds Forces, and Hezbollah.
Technologists inside Iran consistently highlight Abr Arvan’s support for these systems of repression. Longtime technology blogger Amir Emad Mirmirani, known by the nickname Jadi, exposed Abr Arvan’s government contracts in 2021 and its role in helping the regime centralize control of Iran’s internet. (Jadi was arrested at the start of the uprising for his strong statements on digital rights.) Abr Arvan has also received public support from Mohammad Javad Azari Jahromi, a former minister of information, communication, and technology, whom the United States later sanctioned for his role in the November 2019 internet shutdown that helped facilitate the killing of an estimated 1,500 protesters.
Understanding the EU’s Latest Decision
The EU’s removal notice contains no reasoning for the reversal of its 2022 decision. One anonymous EU official told Radio Free Europe/Radio Liberty that, during a confidential review of the sanctions list, member states “agreed that the reasons to keep [Abr Arvan] on the list are no longer there.” The lack of transparency around the sanctions removal process is concerning.
But there are clues about why the EU changed course. Abr Arvan appealed the EU’s designation through the European Court of Justice, claiming that regulators failed to “meet applicable quality standards” related to violating proportionality and infringing on “equal treatment of the applicant.” A leaked document verified through the British human rights organization Article 19 indicates that the administration of Iranian President Ebrahim Raisi—who is also accused of crimes against humanity by human rights organizations and UN investigators—supported Abr Arvan’s EU appeal and offered to pay its legal fees. This occurred months after the company had announced the end of its Abr Iran government contract.
Recently, the human rights organization Justice Beyond Borders (JBB) submitted a legal analysis to the EU about Abr Arvan’s role in human rights abuses. It argued that the reasons for sanctioning Abr Arvan in November 2022 remain the same today. JBB lawyer Shadi Sadr, who assisted in compiling the submission, told me that JBB only received unofficial feedback from the EU that its analysis did not convince decisionmakers to uphold the sanctions. Sadr said the EU believed that “Abr Arvan never aided in censorship or filtering,” which she describes as “categorically incorrect based on available evidence.” The EU also said that because Abr Arvan ended its contract with the Iranian government, “any claims of being implicated in human rights abuses are no longer valid,” Sadr reported.
Sadr describes the EU’s logic as “at best inconsistent.” She cites former government official Saeed Mortazavi, who has been called the “torturer of Tehran” and is sanctioned in the EU for human rights violations, as an example. Sadr notes that Mortazavi stopped working for the government years ago and even spent time in an Iranian prison, yet he remains on the sanctions list for his previous actions. “That a sanction designation can end if the government relationship ends has never been how human rights sanctions work,” Sadr said. The EU’s removal of Abr Arvan’s designation “did not have human rights reasons underpinning it, and they ignored human rights interventions and reasons,” she concluded.
Balancing Human Rights Impacts
The EU’s application and removal of sanctions against Abr Arvan raises questions about necessity and proportionality: Did these sanctions represent a fair and proportionate response to Abr Arvan? Were they a sufficient deterrent for other private companies that might consider becoming involved in Iran’s system of repression?
Early on, some digital rights advocates argued for the removal of Abr Arvan’s sanctions. They contended that the sanctions prevented VPN hosting on the company’s servers, which are not blocked by the regime. Hosting VPN providers is a crucial element of fighting government internet censorship, and accessing the right tools can be difficult for providers because of cost or sanctions overcompliance by international firms.
But Abr Arvan’s hypothetical potential to help some Iranians shouldn’t be an excuse to give the firm a pass. Several technologists in Iran’s cloud industry told me that Abr Arvan’s servers are a bit player in this ecosystem. Most developers running VPNs find ways to use other providers, such as DigitalOcean, because of their distrust of Abr Arvan, as well as the superior services found on other platforms. Another technologist, who is living in exile after spending years working in Iran’s cloud industry, told me that the sanctions have another important effect: they make it extremely difficult for the company to hire talent. “No one wants that association,” the technologist said. “The less talent in organizations that work for the regime, the better.”
Moreover, the contract between the Iranian government and Abr Arvan shows that the company agreed to use techniques that violate international human rights standards. The contract states that the company would facilitate the legal interception of communications and “disconnect” or create limitations for its users. Arvan agreed to provide these services at any time or place specified by the government.
Jadi, the technology blogger, likened Abr Arvan’s offerings to an everyday item that’s also deadly. “You cannot work in a kitchen without a knife,” Jadi explained in a 2021 video analyzing the Abr Iran contract. “But we know there are several types of people we don’t give a knife to. We don’t hand knives to children, the mentally ill, and certainly we don’t hand knives over to people who want to kill us.”
Abr Arvan is by no means unique in the Iranian internet space. There are likely hundreds of other companies complicit in these systems of abuse that have yet to pay a price for their actions. And despite the EU’s reversal on Abr Arvan, other companies are still facing international accountability: last year, for example, the U.S. Treasury sanctioned technology firm Yaftar for its role in building systems of censorship for the regime.
The purpose of sanctions is not only to impose costs on complicit actors but also to serve as a deterrent—to cause other companies to think twice before partnering with authoritarian regimes directly or indirectly on human rights abuses. Despite Abr Arvan’s close cooperation with Iranian authorities and statements from its leaders about their willingness to work with the regime, the EU has reversed course. By removing penalties against Abr Arvan, the EU has sent a troubling message about its willingness to hold the Iranian state and those who support it to account for their repressive actions.
Carnegie’s Digital Democracy Network is a global group of leading researchers and experts examining the relationship between technology, politics, democracy, and civil society. The network is dedicated to generating original analysis and enabling cross-regional knowledge-sharing to fill critical research and policy gaps.
.jpg)
