Moscow's Hand in Iran's Repressive Apparatus

Russian involvement in Iran's past protests

Russia has served as a critical enabler of the Islamic Republic’s ability to suppress domestic dissent. This role has gone far beyond rhetorical solidarity or episodic diplomatic cover. Over more than three decades, Moscow has helped Tehran build a layered, adaptive system of repression—one that combines riot-control hardware, surveillance and cyber tools, intelligence coordination, doctrinal learning, and diplomatic shielding. This partnership is not accidental. It is rooted in a shared threat perception: both regimes view popular uprisings not as expressions of social grievance, but as existential security threats emanating from malign external influence. Over time, Russia and Iran have converged around a common playbook for countering unrest, one that blends force with preemption, information control, and narrative warfare. This post traces the evolution of that cooperation. A subsequent post will focus specifically on the current protest wave in Iran and the concrete material support Russia has supplied.

Early Foundations: The 1990s

The foundations of Russia-Iran cooperation on internal security were laid in the aftermath of the Cold War. During the 1990s, Moscow largely avoided public criticism of Iran’s internal repression, framing unrest as an internal matter and signaling diplomatic tolerance for Tehran’s use of force. This posture mattered. At a time when Iran faced sporadic student and labor protests, Russia’s refusal to condemn crackdowns helped normalize the idea that internal repression was a sovereign prerogative. It also aligned with Iran’s silence over Chechnya, where Tehran avoided criticism of Russia’s brutal counterinsurgency campaign in the 1990s, reinforcing a mutual norm of non-interference that treated mass repression and civilian casualties as legitimate instruments of state sovereignty.

The July 1999 Tehran University protests, which saw Iranian security forces brutally suppress a major student uprising, marked an important moment. While there is no evidence of direct Russian material aid during that episode, Moscow’s sympathetic posture toward Tehran’s government signaled a willingness to look the other way. More importantly, the late 1990s marked the beginning of limited intelligence contacts between Russian and Iranian services. These exchanges were formally framed around counterterrorism, narcotics trafficking, and organized crime. In practice, they laid the conceptual foundation for future cooperation on what both regimes would increasingly define as “internal threats.” Protest movements, student activism, independent media, and diaspora networks gradually came to be folded into the same security category as terrorism and extremism.

These early interactions established three enduring patterns. First, Moscow would not challenge Tehran’s internal repression. Second, security cooperation could be justified through expansive threat definitions. Third, intelligence sharing, even when limited, would serve as the backbone of deeper collaboration later.

2009 Green Movement

The disputed presidential election of June 2009 and the massive Green Movement protests that followed marked a watershed in Russian-Iranian cooperation against internal dissent. As millions of Iranians poured into the streets alleging electoral fraud and demanding President Mahmoud Ahmadinejad’s resignation, Moscow moved swiftly and decisively to support the regime. The chants of “Death to Russia” that echoed among protesters reflected popular anger at Moscow’s role in supporting the regime’s repression.

Russia became the first government to recognize the disputed election results, a move that provided crucial international legitimacy to a vote that most democratic nations refused to validate. Days after the contested election, the Kremlin hosted Ahmadinejad at the Shanghai Cooperation Organization summit in Yekaterinburg, where Russian President Dmitry Medvedev and other leaders formally congratulated him on his “re-election” despite ongoing unrest in Iranian cities. The Russian government pointedly refused to criticize the ensuing violence in Iran, with officials declaring: “The Iranian elections are the internal affair of Iran… We welcome the fact that elections took place… and see it as symbolic that [Ahmadinejad] made his first visit to Russia.”

Behind the diplomatic facade, more troubling cooperation was taking shape. Russian and Iranian intelligence services were reportedly in closer contact than ever before. Several unconfirmed reports at the time suggested that Russian advisors provided advice to Iran’s Revolutionary Guard Corps (IRGC) and police on crowd control techniques, drawing on Russia’s own experience with dissent.

The Green Movement triggered a period of intense institutional learning within Iran’s security apparatus. Iranian officials later acknowledged that the protests exposed weaknesses in surveillance, intelligence coordination, and information control. In response, Tehran invested heavily in cyber monitoring, communications interception, and crowd-control capabilities. While China played a dominant role in providing internet filtering technologies, Russia’s relevance lay elsewhere. Russian experience with protest policing, intelligence penetration of opposition networks, and electronic warfare informed Iran’s post-2009 reforms. For example, Iran’s electronic jamming of dissident satellite broadcasts (like BBC Persian and VOA) intensified after 2009; while Iran largely developed jamming internally, its broader electronic warfare know-how was later enhanced through Russian collaboration. Crucially, Iran began conceptualizing protests not as spontaneous events but as networks that could be mapped, disrupted, and preempted.

Institutionalizing Repression

The early 2010s marked a decisive transition from informal cooperation to formalized repression infrastructure. The pivotal development was the 2013-2014 Law on Cooperation between Iran’s Ministry of Interior and Russia’s Ministry of Internal Affairs. On paper, the agreement resembles routine law enforcement cooperation. In practice, it created a durable legal framework for transferring the tools and doctrines of domestic repression.

Available via Internet Archive

The agreement’s significance lies in how it defines internal threats. It commits both parties to cooperation against crimes including “extremist activity,” “crimes related to information technology,” and threats to public order—categories that, in Iran’s legal system, directly encompass protest activity, online mobilization, and opposition organizing. The most revealing clause states plainly:

“The Parties shall also cooperate in the following areas: maintenance of public order and provision of public security.”

This language is not incidental. In Iran, “public order” and “public security” are the legal justifications most commonly used to suppress demonstrations, arrest activists, and deploy riot police. By explicitly anchoring cooperation in these domains, the agreement normalized repression as a technical policing matter rather than a political act.

The agreement further authorizes cooperation on “logistical support and assistance,” “development of information systems,” and “specialized equipment and technical means.” This phrasing enabled transfers of riot gear, surveillance platforms, communications interception tools, and command-and-control systems. It also allowed for joint development and training—embedding Russian methods within Iranian institutions.

Perhaps most consequentially, the agreement legitimizes preemptive repression. It authorizes information on the “exchange of information regarding crimes in the process of formation and development or already committed, and persons involved in these crimes,” not merely crimes already committed. This formulation aligns perfectly with anticipatory crackdowns: identifying organizers, monitoring networks, and disrupting protests before they materialize.

The agreement also anticipates mass unrest through its treatment of internal emergencies. It calls for the “exchange of information regarding the conduct of programs to maintain order and ensure public security during emergency situations (quarantines, widespread disturbances, and natural disasters).” Here, “widespread disturbances” functions as a catch-all category for large-scale protests, riots, and politically driven unrest. By explicitly incorporating “widespread disturbances” into the scope of cooperation, the agreement normalizes the treatment of protest activity as an emergency public-order problem.

The agreement further specifies that cooperation may be initiated either “on the basis of a request by the interested Party, or on the initiative of the Parties,” and that “in urgent cases, requests may be made orally,” with written confirmation to follow. These provisions for rapid coordination underscore the agreement’s operational focus on real-time crisis responses, exactly the kind of agility needed to suppress emerging protests.

Throughout the 2010s, this institutional framework enabled sustained transfers of equipment and expertise. Russia expanded its role as a supplier of anti-riot and electronic warfare systems to Iran, including crowd-control vehicles, body armor, shields, batons, tear gas, stun grenades, electronic jamming devices, and communications interception tools. In parallel, training programs brought Iranian internal security forces into contact with Russian counterparts from the National Guard and the FSB, with a focus on crowd-control, urban protest management, and counter-mobilization tactics. In practice, the agreement functioned as a conduit through which hardware, operational concepts, and professional networks were systematically transferred and adapted for use against domestic dissent.

2017-2018 Protests

When protests erupted across Iran in late December 2017—initially triggered by economic grievances in Mashhad before spreading rapidly to dozens of cities—Russia moved quickly to shield Tehran diplomatically and legitimize its coercive response. As young Iranians mobilized around unemployment, inflation, and inequality, Iranian officials reverted to a well-established narrative that framed the unrest as foreign-instigated, accusing the United States and Israel of engineering the protests. Russian officials publicly reinforced this framing. Deputy Foreign Minister Sergei Ryabkov issued a pointed warning to Washington, cautioning it “against attempts to interfere in the internal affairs of the Islamic Republic of Iran.”

Beyond rhetorical alignment, Iranian protest suppression in 2017-18 increasingly reflected Russian-style approaches to information control and crowd management. Iranian authorities imposed rolling restrictions on Telegram and mobile networks, an approach that closely paralleled Russia’s contemporaneous efforts to regulate Telegram and assert state authority over the digital space. By this period, Iran’s internal security apparatus had been strengthened through the expansion of its cyber police (FATA, established in 2011) and through upgraded filtering and surveillance systems—organizationally and doctrinally similar to Russian cyber-policing models. During the broader 2017-2019 protest cycle, Iranian forces deployed truck-mounted water cannons, armored tactical vehicles, and increasingly sophisticated radio jammers, reflecting tactics long used by Russian riot-control units.

Iran’s internet censorship regime also evolved in ways that echoed Russian practice. During the 2017-18 protests, authorities blocked millions of websites, deepened filtering to counter VPN circumvention, and critically implemented targeted, localized internet shutdowns rather than an immediate nationwide blackout. This calibrated approach closely resembled Russia’s emphasis on selective disruption, allowing the state to suppress mobilization while avoiding the escalation risks associated with total information blackouts. While much of the underlying infrastructure was developed domestically or with Chinese assistance, Russian influence was evident in Tehran’s adoption of “information sovereignty” rhetoric and its push to localize internet traffic—directly mirroring Russia’s own legal and regulatory framework for sovereign internet control. Notably, these partial shutdowns foreshadowed (but did not yet replicate) the nationwide blackout imposed in 2019.

Russian state media reinforced this alignment at the narrative level. RT and Sputnik advanced claims that British intelligence services had fomented the unrest, citing remarks by a convicted hacker who accused GCHQ of infiltrating activist networks to conduct disinformation operations. This strategy closely followed Moscow’s standard playbook for delegitimizing protests—casting them as externally orchestrated “color revolution” efforts rather than expressions of domestic grievance. Iranian officials and state media echoed these narratives almost verbatim, blaming foreign “instigators” and CIA plots, reinforcing a storyline that Russian officials actively promoted.

High-level security coordination underscored that this convergence was not coincidental. Russia’s former Security Council Secretary Nikolai Patrushev and former head of Iran’s Supreme National Security Council Ali Shamkhani held frequent consultations during periods of unrest. Patrushev, in particular, developed a clear pattern of engaging Iranian counterparts amid protest waves. In subsequent meetings, the two sides explicitly discussed “measures to combat Western interference in [their] internal affairs.”

2019 Protests

The November 2019 protests, triggered by a sudden fuel price hike, marked one of the deadliest episodes of repression in Iran’s modern history. Over the course of several days, Iranian security forces killed at least several hundred protesters, with some estimates exceeding 1,500. Russia’s role during this crisis was less visible but more consequential, spanning infrastructure control, riot-control capability, and intelligence coordination.

Within 24 hours of the unrest, Iran imposed a near-total nationwide internet blackout that lasted roughly ten days. This unprecedented move closely resembled Russian and post-Soviet “kill-switch” models for suppressing mass mobilization by severing horizontal communication among protesters while preventing external scrutiny. Iran’s ability to execute a nationwide shutdown while preserving limited domestic connectivity pointed to major advances in centralized control, capabilities likely informed by Russian and Chinese technical expertise. Although Tehran had tested elements of its “national intranet” before 2019, the fuel protests demonstrated a new level of operational maturity consistent with Russian-style sovereign internet concepts.

Reports also persisted of Russian-origin riot-control equipment and vehicles being deployed. By 2019, Iran’s riot police had acquired armored vehicles such as Rateq platforms and other crowd-control trucks. While Iran produces some domestic systems, it has also imported or jointly produced equipment with close partners.

Most critically, intelligence coordination deepened. As protests unfolded, Iran’s security services likely benefited from Russian intelligence inputs, including monitoring of diaspora activists and Persian-language networks abroad—an area where Russian intelligence has extensive experience. Reporting from this period suggests that Moscow and Tehran intensified intelligence sharing related specifically to countering domestic unrest. A later disclosure by Iranian Major General Mostafa Izadi was particularly revealing: he stated that Russian intelligence had provided advance warnings of impending protests, enabling Iranian forces to pre-position units and prepare repression measures before unrest fully materialized.

Formalizing Digital Repression

By the early 2020s, Russia-Iran cooperation on internal security had moved beyond informal coordination and episodic assistance. The information security agreement signed in Moscow on January 26, 2021, and later approved by Iran’s parliament in 2023, marked a shift toward codifying shared practices for controlling the digital domain. Publicly framed as a cybersecurity framework, the agreement instead reflects a convergence around a common understanding of information space as an arena of internal security and regime protection.

The language of the agreement is explicit in how it conceptualizes dissent. It identifies concern over the use of digital technologies “to destabilize the internal political and socio-economic situation,” placing protest mobilization, political organizing, and online opposition in the same threat category as foreign interference. This framing closely mirrors Russian information-security doctrine, which treats internal dissent not as a political phenomenon but as a vector of subversion.

Rather than narrowly defining threats, the agreement adopts an expansive conception of harmful activity in the information space. It characterizes the use of information and communication technologies “to interfere in the internal affairs of states,” “violate public order,” or “destabilize the internal political and socio-economic situation and interfere in public administration” as security threats. It further identifies as threatening the dissemination of information that causes harm to the “socio-political and socio-economic systems” or to the “spiritual, moral, and cultural environment.” The effect of this language is to collapse protected political expression and genuine security risks into a single category, granting both states broad discretion to criminalize online activism, protest coordination, and sustained criticism of government policy.

The agreement also establishes mechanisms for operational cooperation. It commits both sides to “exchange information and cooperate in the law enforcement sphere to prevent, detect, suppress, and investigate crimes involving the use of information and communication technologies.” Given the breadth of the threat definitions, this effectively authorizes intelligence sharing on political dissidents, joint monitoring of online spaces, and coordination in prosecutions related to digital activism and protest organization. The agreement further commits the parties to “providing assistance…in the transfer of information technologies and knowledge, capacity building and professional training”—language consistent with the diffusion of surveillance tools, monitoring techniques, and institutional practices for policing the information environment.

Taken together, the agreement does not introduce a new direction in Russia-Iran relations so much as formalize an existing trajectory. It embeds into law a shared conception of digital repression that had already been tested during earlier protest waves, and it positions information control as a core pillar of counter-unrest strategy. In doing so, it laid the institutional groundwork for the more explicit and operational cooperation that would emerge during the nationwide protests that followed.

Mahsa Amini Protests

The nationwide protests that erupted in September 2022 following the death of 22-year-old Mahsa Amini in morality police custody constituted the most serious challenge to the Islamic Republic in decades. Demonstrations spread rapidly across all provinces and persisted for months, with protesters openly calling for the end of the regime. Tehran’s response was comprehensive and violent. Russia’s role during this period was correspondingly more explicit and operational than in previous protest cycles, reflecting the maturation of a security partnership between two increasingly isolated authoritarian states.

U.S. intelligence publicly revealed in the fall of 2022 that Russia was actively advising Iran on how to suppress the demonstrations. White House Press Secretary Karine Jean-Pierre stated that “Russia may be advising Tehran on how to manage the protests,” while National Security Council spokesman John Kirby emphasized that this was “not an allegation but a fact.” Moscow, he noted, was drawing on its “extensive experience” suppressing dissent to advise Tehran on “optimal methods” of crackdown. Subsequent disclosures indicated that this support went beyond general consultation.

Leaked Iranian government documents obtained and released by the hacker group Black Reward showed that Tehran had explicitly requested Russian assistance as the protests intensified. According to these files, Iranian authorities asked Moscow to dispatch security advisors and provide anti-riot equipment and training in preparation for a “long-term confrontation” with protesters. The documents also described Russian signals intelligence activity targeting Western communications, intended to provide Tehran with insight into the protest movement’s organization, leadership, and relative strength.

In response, Russia reportedly began supplying Iran with additional anti-riot equipment in late 2022. Iran International reported that Tehran specifically requested “anti-riot equipment and training” from Moscow as it faced shortages during the prolonged unrest. This assistance likely included helmets, shields, tear gas canisters, stun grenades, and possibly additional armored crowd-control vehicles. Observers noted that Iranian riot police appeared with newer gear as the crackdown continued, consistent with replenishment during the protest period.

Russian support extended into the digital domain. During the protests, the Wall Street Journal reported that Moscow was directly assisting Iran through the provision of surveillance tools, hacking software, and exploitation techniques targeting common consumer technologies. Specific transfers later came to light involving software from the Russian firm PROTEI, which maintains close ties to the Russian Defense Ministry. PROTEI supplied censorship and interception software to Iranian mobile service providers such as Ariantel. According to the University of Toronto’s Citizen Lab, these tools enabled Iranian authorities to “directly monitor, intercept, redirect, degrade, or deny all Iranians’ mobile communications, including those who are presently challenging the regime.”

At the diplomatic level, Moscow continued to provide protective cover. When Western governments pushed a resolution at the UN Human Rights Council in late 2022 to establish a fact-finding mission into Iran’s protest-related abuses, Russia voted against it. When Iran was expelled from the UN Commission on the Status of Women in December 2022 over its repression of women and girls during the protests, Russia was one of only eight countries to oppose the move.

The depth of Russian support was underscored in November 2022, at the height of the crackdown, when Nikolai Patrushev made another high-profile visit to Tehran. Patrushev met with both President Ebrahim Raisi and Supreme National Security Council Secretary Ali Shamkhani for talks explicitly focused on “cooperation in the field of law enforcement, including public security and the fight against terrorism and extremism.” His trip was preceded by a Russian interdepartmental delegation led by his deputy, Oleg Khramov, which focused specifically on cooperation in information security and digital technologies—the very capabilities being deployed against Iranian protesters.

Codifying the Strategic Partnership

The cumulative result of three decades of cooperation was formalized on January 17, 2025, when Russia and Iran signed a comprehensive 20-year strategic partnership treaty in Moscow. The agreement codified the security collaboration that had long underpinned Iran’s ability to suppress domestic dissent, embedding it within a binding international framework and signaling its durability.

The treaty explicitly formalizes intelligence cooperation against internal threats. It commits the intelligence and security services of both states to “exchange information and experience” and to “increase the level of their cooperation” in order to strengthen national security and counter common threats. This language institutionalizes the intelligence sharing on protest movements, opposition networks, and perceived internal destabilization that had already proven central to Iran’s repression strategies.

The treaty further commits both sides to cooperation in “maintaining interaction on issues of protection of public order and ensuring public security, protection of important state facilities,” alongside counterterrorism and extremism. As in earlier agreements, “public order” and “public security” serve as legal catch-all categories that encompass protest suppression and crowd control, providing ongoing justification for coordinated repression.

Information security cooperation is elevated to the treaty level. The agreement commits both parties to political and practical cooperation in international information security in line with the 2021 information security agreement, including expanded cooperation in countering the use of information and communication technologies for criminal purposes and facilitating “strengthening national sovereignty in the international information space.” It further commits both states to regulate international technology companies, exchange experience in managing national segments of the internet, and develop information and communication infrastructure—an explicit endorsement of shared internet control, filtering, and surveillance practices.

Media cooperation is similarly codified. The treaty commits the parties to “jointly countering disinformation and negative propaganda” and to countering the dissemination of “unreliable socially significant information” deemed to threaten national security. In practice, this language targets independent media, diaspora outlets, and investigative reporting on protests and human rights abuses, recasting such coverage as a security threat.

Forward to the Present

Over more than three decades, Russia has played a central role in enabling the Islamic Republic to withstand repeated waves of domestic unrest. This support has extended well beyond episodic diplomatic cover or symbolic political alignment. Instead, it has taken the form of sustained, multi-layered cooperation: the provision of riot-control hardware and crowd-management equipment; the transfer of surveillance technologies and cyber capabilities; training and advisory support for internal security forces; intelligence sharing focused on protest movements and opposition networks; and consistent diplomatic shielding that limits international accountability.

Iran now confronts a new phase of internal instability, marked by deeper societal polarization, greater organizational sophistication among protesters, and heightened international scrutiny. The question is no longer whether Russia will support Tehran, but how that support is evolving. The next post examines Russia’s role in the current protest wave, with particular attention to the specific technologies, advisory mechanisms, and operational practices that are being deployed as Iran’s internal security apparatus adapts to its most serious challenge yet.