When an Online Lifeline Becomes Evidence: How Iran Polices LGBTQ+ Digital Life

Safety and Exposure

For an LGBTQ+ person without a safe place to meet others publicly, a phone can become a community. A dating application can provide intimacy and connection. A Telegram group can provide information and mutual support. An Instagram account can make another person's life visible enough to remind someone living in isolation that they are not alone.

But every connection also produces information.

A photograph can connect a face to an account. A conversation can reveal a relationship. A group can expose a network of people who communicate with one another. A contact abroad can acquire a political interpretation that was never intended by the people involved. None of these things establishes criminal wrongdoing. Yet in an environment where sexuality, gender expression and certain forms of association are vulnerable to criminalization and surveillance, ordinary digital information can acquire a dangerous second meaning.

ARTICLE 19's 2018 research involving Egypt, Lebanon and Iran documented the use of digital platforms by state authorities and hostile private actors to identify, threaten and entrap LGBTQ+ users. Reported methods included fake profiles, infiltration of conversations and searches of devices. The findings were regional and should not be transformed into a claim that every technique occurred with the same frequency in Iran. What they demonstrate, however, is the vulnerability created when a community relies on digital spaces for communication while those same spaces can be used to identify its members.

The same technology that allows a community to exist can expose the people inside it.

Iran's Online Space and the Cost of Visibility

ARTICLE 19 addressed the Iranian context more directly in 2022 while analyzing the proposed Protection Bill. The organization reported receiving testimony that security forces had infiltrated dating applications and queer online spaces. It warned that restrictions on anonymity and secure communications would increase risks for LGBTQ+ users who were already exposed to criminalization and surveillance.

The bill was a legislative proposal at that point, and proposed provisions should not automatically be treated as though they became enforceable law. But the vulnerability described by ARTICLE 19 does not depend on a single piece of legislation.

An online account contains social information. Investigators do not need to intercept every message in the country for that information to become useful. A phone can be confiscated after an unrelated arrest. A hostile person can enter a private group. Someone already detained can be pressured to identify contacts. An unlocked device can expose years of conversations within minutes.

Surveillance is therefore not only a question of sophisticated technology. It is also a question of access. The moment authorities gain access to a device, an account or another participant in a conversation, a private network can become visible.

FATA and the Architecture of Online Enforcement

Iran's Cyber Police are commonly known as FATA. They belong to the law-enforcement structure and should not automatically be confused with cyber units linked to the Revolutionary Guards or the Ministry of Intelligence. Different institutions may monitor overlapping spaces, but that does not make them a single organization.

In October 2022, the US Treasury identified Vahid Mohammad Naser Majid as head of Iran's Cyber Police and sanctioned him in connection with monitoring, filtering and blocking activity. The same Treasury announcement named then-communications minister Eisa Zarepour in connection with restrictions on internet access during the protest crackdown and then-interior minister Ahmad Vahidi in relation to oversight of law-enforcement forces.

These were official US administrative sanctions findings. They do not establish that any named official personally monitored a particular LGBTQ+ account. Their significance lies instead in showing the layers through which digital repression can operate.

A ministry can influence access to networks. Cyber police can investigate users. Law-enforcement leadership can exercise supervision. Prosecutors can choose charges. Courts can determine consequences. For a person whose phone has been seized, these different layers can feel like a single system because the consequences ultimately converge on the individual. For accountability purposes, however, those institutions must remain distinct.

When "Immoral" Content Becomes a Police Matter

Online morality enforcement has also been publicly announced. In May 2024, IranWire, citing ISNA, reported that the FATA chief had announced action against online material authorities characterized as immoral, including livestreams. The report said authorities claimed to have acted against ten pages.

An enforcement announcement does not establish what every account owner actually did. But the language matters because it places online expression inside the same morality framework used to regulate physical behavior.

An account does not have to coordinate a protest to attract official attention. Expression itself can become the stated reason for intervention. That is particularly significant for LGBTQ+ users whose ordinary visibility may already contradict official definitions of acceptable gender or sexuality.

A photograph, a conversation or a public statement may be ordinary forms of self-expression to the person creating them. Within a system that treats certain forms of identity and expression as morally or legally suspect, the same material can acquire a completely different meaning once it enters an investigative file.

The Security Institutions Are Not Interchangeable

Cyber enforcement in Iran extends beyond FATA. A 2012 US Treasury factsheet identified the IRGC's Center for Inspecting Organized Crimes and its Gerdab website, describing activities involving the monitoring and targeting of online activists. It also alleged cooperation between Datak Telecom and state surveillance.

These historical records concern broader digital repression. They are not evidence that every IRGC cyber operation targeted LGBTQ+ people. Precision matters because "surveillance" can easily become an explanation for everything.

A blocked platform demonstrates restriction of access. It does not prove that authorities read every private conversation. Possession of someone's messages does not establish whether they were obtained through interception, a seized device, another participant or compelled disclosure.

A credible investigation has to preserve those distinctions. Otherwise, uncertainty about the technical mechanism becomes an excuse for unsupported certainty about responsibility.

How a Phone Becomes a Case File

The path from a digital relationship to a criminal accusation can be remarkably simple. Someone joins a conversation. Someone saves an image. Someone is arrested. A device is opened. Contacts appear. The investigation expands.

ARTICLE 19's later regional research gathered accounts from more than 5,000 LGBTQ+ people across eight countries during work conducted between 2019 and 2024. It documented device searches, monitoring, entrapment and accounts of officers using encounters to demand money or sexual acts. Iran was among the countries included.

Regional findings cannot be converted into Iranian national prevalence rates, and an account of extortion somewhere in the research cannot be used to accuse a named Iranian official without specific evidence. But the broader vulnerability is clear: digital information can create leverage.

The person holding the device does not need access to a national surveillance system if the information required is already stored in their hand. The vulnerability can begin with the confiscation of a single phone.

Digital Evidence Is Not Self-Explanatory

A screenshot can look definitive. It is not necessarily so.

A private conversation may be incomplete. An account may continue operating after its owner has been detained. A message may have been written by another participant. A relationship described by investigators as exploitation may have involved mutual assistance. A foreign contact may be a friend rather than an intelligence connection.

Digital material acquires meaning through interpretation, which makes context part of the evidence. Timestamps matter. Full conversations matter. Device custody matters. Authentication matters. The circumstances in which a confession or password was obtained matter.

Without those questions, the apparent precision of digital evidence can conceal uncertainty. A screenshot may show that something existed, but it does not necessarily establish who created it, why it was created, what came before or after it, or under what circumstances investigators obtained it.

For human-rights investigations, those distinctions are essential. Digital evidence can expose abuse, but digital evidence can also be selectively interpreted to construct a case against a person whose private life has suddenly become an object of state scrutiny.

When LGBTQ+ Visibility Acquires Capital Consequences

The prosecution of Zahra Sedighi-Hamadani and Elham Choubdar demonstrates how online LGBTQ+ visibility can become connected to an extraordinarily serious criminal case. Freedom House's 2023 assessment linked their capital prosecution to advocacy carried out through Telegram and Instagram. Their death sentences were later overturned.

The significance is not that every LGBTQ+ social-media account in Iran faces the same outcome. It is that community expression could be inserted into an accusation involving "corruption on earth" and an alleged cross-border network.

Once that framing occurs, messages that once represented support can acquire a radically different meaning inside a prosecution. Communication that was intended to help another person may be presented as evidence of organization. Contacts can become evidence of association. Advocacy can become part of a security narrative.

The public record does not establish that FATA conducted every stage of the Sedighi-Hamadani case. Reporting instead places the IRGC Intelligence Organization at the center of her arrest and the security allegations surrounding the prosecution. A phone appearing in a case does not automatically make the case a FATA operation.

Institutional accuracy is therefore part of accountability. Identifying the correct institution is not a technical detail. It determines which records need to be examined, which officials had authority and where responsibility may ultimately lie.

Digital Policing Can Become Physical Coercion

Cyber policing does not remain online when the institution controlling an investigation can arrest the person behind an account.

The death of blogger Sattar Beheshti provides a stark historical example. US Treasury records state that Iran's Cyber Police arrested Beheshti on 30 October 2012 over online activity. He subsequently died in custody.

Beheshti was not identified as an LGBTQ+ victim, and his case should not be transformed into one. Its relevance lies elsewhere. It demonstrates the potential bridge between digital investigation and physical detention.

A removed post is one form of repression. A person in state custody is another. When institutions have the ability to move from identifying online activity to physically detaining the person behind that activity, digital rights cannot be separated from physical safety.

The institutions capable of making that transition deserve scrutiny not only for what they block online, but for what happens after identification.

The Ministry of Intelligence and the Problem of Attribution

Iran's Ministry of Intelligence represents another institution involved in surveillance and repression. A September 2022 US Treasury announcement named Esmail Khatib as intelligence minister and described alleged targeting of human-rights defenders and their families by the ministry.

That establishes an institutional role and an official allegation from the US government. It does not establish that Khatib personally monitored a particular LGBTQ+ person.

The same discipline must be applied to reports of threats against LGBTQ+ Iranians abroad. In 2025, 6Rang published research based on testimony from 25 LGBTQ+ Iranians who had left the country. Some participants described continuing threats and harassment.

A selected group of 25 people cannot establish that every LGBTQ+ Iranian abroad is monitored. Departure should not automatically be treated as safety, but neither should it automatically be treated as proof of surveillance. Risk has to be established person by person.

For an individual who has already experienced persecution, however, leaving the country does not necessarily erase the vulnerabilities created by the information collected while they were there. Digital accounts, family contacts, photographs and previous communications can continue to exist after a person crosses a border.

Censorship Can Harm Without Producing an Arrest

Not every digital restriction ends in detention. Censorship can nevertheless impose a significant cost.

For someone isolated because of sexuality or gender identity, an online community may be the only environment in which those parts of life can be discussed safely. Blocking information can make it harder to understand the law. It can limit access to health information. It can prevent someone from finding supportive peers. It can leave a person more dependent on information supplied by relatives or officials who may themselves be hostile.

Freedom House has documented extensive filtering in Iran, including restrictions affecting LGBTQ+ content and online expression. That does not mean every person attempting to access prohibited material is individually identified. It means access itself is constrained.

For an already isolated community, losing access can deepen dependence on the very offline structures from which a person may be seeking protection. Digital freedom is therefore not simply a question of convenience or political expression. For some people, it is part of the infrastructure through which they find community, information and a sense of safety.

Privacy Tools Cannot Solve Criminalization

Technology companies can reduce some risks. They can minimize unnecessary data collection, improve account recovery, limit location exposure and design protections for users whose devices are seized.

But encryption cannot repeal a criminal law. A disappearing message cannot guarantee safety once a person has been detained. A privacy setting cannot prevent authorities from pressuring another participant to reveal a conversation.

The deeper problem appears when the information that allows people to find one another becomes grounds for punishment.

The public record supports concern about FATA, broader cyber-enforcement structures, censorship and prosecutions involving online activity. It does not support the idea that every account is continuously watched or every private message is intercepted.

The danger is more concrete than omnipotent surveillance. Authorities do not need to see everything. They need enough information to identify a person.

What happens after identification is the real measure of protection.