Viber Company Refutes Tapping Claims by Iranian Officials

International Campaign for Human Rights in Iran

Following statements by Iran’s Cyber Police Chief about his force’s ability to monitor messages on Viber, the instant messaging service for cellphones, a Viber Company representative told the International Campaign for Human Rights in Iran that the application’s communications are encrypted and as such it is not possible for third parties to monitor messages.

“All text messages sent through Viber on its supported platforms are encrypted. Media messages, such as photos and videos, are encrypted on Viber for iOS, Viber for Android, Viber for Windows 8 and Viber for Windows Phone 8,” a member of the Viber Company support team wrote in response to a query by the Campaign.

Reacting to a wave of jokes targeting Ayatollah Khomeini, the founder of the Islamic Republic of Iran, Commander Seyed Kamal Hadianfar told reporters last week that “You should know from the cases the Iranian Cyber Police has pursued and concluded that personal messages on Viber, WhatsApp, etc. can be controlled by the Cyber Police.”

Iran Newspaper wrote on September 17, 2014 that under certain circumstances, Viber conversations could be monitored by Iranian government agencies. In the piece entitled, “Are Viber and WhatsApp really monitored easily?” the paper quoted a “computer expert” named Mani Haghshenas who stated, “It is possible for users to use Internet networks that shut down certain security protocols and disallow Viber to encrypt messages, and, ultimately, a network such as Viber would prefer to switch to a normal message transmission mode, in order to avoid permanent nonoperation of its application for some of its users. The country’s filtering systems may sometimes block and disable the security and communication protection capabilities of an application, and in order to continue its operation, such applications may automatically have to provide their services to their users without encryption, and such circumstances would assist the governments to control and tap communications.”

This statement essentially argues that if the government blocks the SSL protocol, it can tap Viber communications. In January 2014, the Fars News Agency announced that the Communication Infrastructure Organization, which is under the authority of the Communications Ministry and is responsible for the technical aspects of Internet blocking, has provided the technical capabilities for restricting and blocking security protocols such as SSL whenever needed.

However, the Viber Company clearly refuted such a possibility. “We have no reason to believe that the SSL process is being blocked. Viber runs based on a process in which, if SSL was blocked, we would be aware. Viber uses a proprietary encryption method. This means that even if SSL was blocked, the messages that are sent via Viber would still be protected and encrypted,” wrote a member of the company’s support team.

The issue of restricting and blocking users’ access to Viber has been repeatedly discussed by judicial officials. In a letter addressed to the Ministry of Communications and Information Technology, the Iranian Judiciary demanded blocking of Viber, WhatsApp, and Tango. All three cell phone applications have become increasingly popular among Iranian users for phone conversations and communications inside and outside the country.

Iranian authorities have also reported efforts to create an application similar to Viber inside Iran. Daneshjoo News Agency quoted Mohsen Torabi, Project Manager for Iran’s localized chat software, Zoobi, who said that the software will be ready for utilization in a month. This is part of a larger effort to develop all information technology infrastructure domestically, so that the Iranian authorities will be able to control Internet access and monitor content as well.

Earlier, Abdolsamad Khorramabadi, Secretariat for the Work Group to Determine Instances of Criminal Content on the Internet, had announced on April 4, 2014 that the government’s decision to block Viber and similar applications has been postponed until replacement local applications are developed and utilized.