Session: The Messenger Regimes Fear Most

When Iran's government pulled the plug on the internet for 90 million people on January 8, 2026, they had a specific list of targets. VPNs. Tor. Encrypted messengers. And prominently: Session.

OONI network probes documented the Iranian regime deploying DNS spoofing specifically to block access to getsession.org, preventing citizens from downloading the encrypted messenger. This was targeted censorship of a tool the regime views as a direct threat to their control.

They're right to be afraid.

Session is built differently than mainstream messengers. There's no phone number required. No email. No central servers to pressure or seize. Messages route through a decentralized network of nodes that no single government can control or monitor. Even Session itself cannot read user messages or identify who is communicating with whom.

This architecture matters during protests. As Amnesty International researcher Rebecca White stated: "This blanket internet shutdown not only hides human rights violations but amounts to a serious human rights violation in itself. Access to the internet is a basic human right and indispensable in times of protest."

When the Iranian regime imposed a five-day internet blackout covering their crackdown on nationwide protests, they were following a playbook they've used before. During November 2019 protests, security forces killed hundreds while authorities imposed a near-total internet shutdown. During the Woman Life Freedom uprising of September-December 2022, the same pattern repeated: internet cuts providing cover for unlawful killings.

The numbers from the current blackout are staggering. According to CBS News sources, possibly 20,000 people were killed in what may be the largest massacre in modern Iranian history. HRANA independently verified 2,571+ deaths. Over 18,000 arrests. Protests in 614+ locations across 187 cities and all 31 provinces. The regime itself eventually admitted to 2,000+ casualties.

Whisper Security's forensic analysis documented how the shutdown worked: "A highly coordinated and centrally commanded shutdown that effectively removed the nation from the global internet." Their analysis showed 5.6 million BGP routing updates in 24 hours, a 368% spike, as every major network in Iran failed in unison at 03:00 UTC.

But the regime didn't just cut connectivity. They hunted workarounds. Whisper documented a sophisticated three-stage "Digital Kill Chain" specifically targeting privacy tools. DNS spoofing blocked Session. Middlebox interference disrupted Psiphon VPN. The regime even deleted IPv6, the modern internet protocol, reverting the entire country to legacy infrastructure they could more easily control.

This is why Session matters. Not just for Iranians, but for anyone living under authoritarian rule or facing potential crackdowns. Ugandan youth are downloading Bitchat ahead of their January 15 election after previous internet blackouts. Nepal saw freedom tech adoption surge during protests after social media bans. The pattern repeats: governments restrict communication, citizens migrate to tools governments cannot control.

Session has been built specifically to resist this pattern. The decentralized architecture means there's no central point of failure. No servers to raid. No company headquarters to pressure. No phone numbers to use for tracking protesters. Even Session's developers cannot decrypt messages or identify users.

The technology is straightforward: onion routing through a distributed network, end-to-end encryption, and metadata protection that prevents even Session from knowing who communicates with whom. Messages are routed through more than 2000+ nodes around the world.

This architecture protected communications during Iran's blackout for those who had Session installed before the shutdown. While the regime blocked downloads of new clients, existing users could still communicate through the decentralized network that no single entity controls.

The UN's Independent International Fact-Finding Mission on Iran urged authorities to "immediately restore internet access and halt the violent crackdown," noting that "Iranian women, men, and children deserve to live safely, with dignity, and with full respect for their rights, including the right to peacefully protest."

But appeals to human rights fall on deaf ears when regimes face existential threats. Which is why technological solutions matter. Session isn't asking permission from governments. It's building infrastructure that operates regardless of whether those governments approve.

Vitalik Buterin recently donated around $500,000 to Session, specifically citing the importance of metadata privacy and permissionless account creation.

The Iranian regime's specific targeting of Session proves the technology works. Authoritarian governments don't waste resources blocking tools that don't threaten them. They target the technologies that actually protect dissent, enable organization, and document atrocities they want hidden.

Session's role during the Iranian blackout demonstrates why censorship-resistant communication tools are essential human rights infrastructure. As governments increasingly weaponize internet access to hide violence and suppress dissent, technologies that operate outside their control become critical for documenting abuses and coordinating resistance.

The regime blocked getsession.org. They deployed sophisticated filtering to stop downloads. They hunted VPNs and encrypted messengers with a three-stage kill chain. But they couldn't stop Session from working for users who already had it installed. That's the point.

In an era where internet shutdowns have become normalized tools of authoritarian governance, Session represents something governments fundamentally cannot control: truly decentralized communication that exists independent of their infrastructure, their permission, and their censorship.

The Iranian regime was right to fear it.