Russia Sold Iran the Tech to Hunt Protesters

FindFace maps faces in crowds. Iran mapped dissidents to their deaths.

TL;DR:

  • Iran secretly bought Russia's FindFace facial recognition system in August 2019 through intermediary companies to dodge Western sanctions
  • The tech identifies faces in crowds from 500 million records in under a second, with 98% accuracy
  • Iranian Revolutionary Guard Corps (IRGC) distributed the system to security services nationwide
  • January 8-9, 2026: Over 30,000 protesters killed in 48 hours. Facial recognition helped identify and track targets
  • The company behind FindFace, NtechLab, was sanctioned by the EU in 2023 and the US in 2024. The technology still reached Iran.

The Investigation

On March 4, 2026, Forbidden Stories published what they'd found: contracts, documents, and technical specifications proving Iran bought Russia's most sophisticated facial recognition system [1].

The investigation involved Le Monde, Der Spiegel, ZDF, Paper Trail Media, and The Signals Network. They traced the paper trail from Moscow to Tehran.

The software is called FindFace. The company that makes it is NtechLab. And somehow, despite EU and US sanctions on both, the technology ended up in the hands of the Islamic Revolutionary Guard Corps.

What FindFace Can Do

FindFace isn't just another facial recognition system. It's built for mass surveillance at scale.

According to NtechLab's promotional materials reviewed by journalists, FindFace can:

  • Match a face against 500 million records in under one second
  • Achieve 98% accuracy in identification
  • Process live video feeds from CCTV networks in real-time
  • Build social graphs: mapping who knows whom based on who appears together in footage

That last capability is the killer feature. FindFace doesn't just identify individuals. It maps their networks. Show up at a protest with someone, and the system logs your connection. Attend enough events, and it builds a web of everyone you associate with [2].

For an authoritarian regime hunting dissidents, that's the perfect tool. You don't just identify one protester. You identify their friends, family, and fellow organizers.

How They Beat the Sanctions

The EU sanctioned NtechLab in July 2023 for "serious human rights violations in Russia." The US followed in December 2024, adding the company to the Treasury's blacklist [3].

None of that stopped the sale. It had already happened.

On August 19, 2019, NtechLab CEO Alexander Minin signed an authorization granting an Iranian startup called Rasad Intelligent Technologies (also known as Rasadco) the rights to use FindFace software [1].

About two years later, Rasadco was absorbed by a larger company called Kama. Kama's leadership includes a member of the IRGC, the same organization the EU designated as a terrorist group in January 2026 [2].

From Kama, the technology spread. The IRGC got it. The Ministry of Intelligence got it. The surveillance apparatus got their upgrade.

Rolling Out the System

Summer 2022: Iranian authorities announced facial recognition deployment in public spaces. The stated purpose? Monitoring women's attire after Mahsa Amini's death sparked the Woman, Life, Freedom protests [1].

December 2023: A journalist posted photos showing facial recognition screens inside Mashhad's metro system [1].

April 2024: Reports emerged that facial recognition was installed at Amirkabir University gates [1].

The infrastructure was in place. All that remained was to use it at scale.

January 2026: The Crackdown

December 2025: Protests over the cost of living began at Tehran's Grand Bazaar. They spread to over 100 cities. It became the largest uprising since the 1979 Islamic Revolution [4].

January 8-9, 2026: The regime responded.

Over two consecutive days, an estimated 30,000 people were killed. Protesters were shot in the streets. Others were identified, tracked, and detained [1].

Iranian cybersecurity researcher Nima Fatemi, interviewed by Forbidden Stories, said all evidence indicates FindFace was active during those 48 hours [2]. The system could process footage from street cameras, identify faces in crowds, and run them through government databases.

After internet access was partially restored, authorities detained people who were "believed to have attended protests" and subjected them to "hours of interrogation based on facial recognition and phone data" [4].

One Family's Story

The Forbidden Stories investigation includes the case of a father named Mansur and his 13-year-old daughter Hasti [1].

Hasti was identified through surveillance footage. She was arrested. When her family recovered her, she had neurological damage: injuries sustained during her detention.

She was thirteen years old.

Mansur's story is one of many. The regime used the technology to target protesters systematically. Age didn't matter. Being caught on camera did.

The Surveillance Pipeline

This is how surveillance technology flows from developer to authoritarian state to victims:

  1. Russia develops FindFace for law enforcement and commercial use
  2. NtechLab licenses it to Rasadco in August 2019
  3. Rasadco merges into Kama, an IRGC-linked company
  4. Kama distributes to IRGC and intelligence services
  5. Iran deploys in metro stations, universities, streets
  6. January 2026: 30,000 dead

The sanctions came years too late. By the time the EU and US acted, the technology was already deployed. Already integrated. Already killing.

Why This Matters Beyond Iran

During the France 24 coverage of the investigation, reporters asked whether this is just an Iran problem [5].

It's not.

NtechLab has sold FindFace to other governments. The same technology that mapped Iranian protesters could be deployed elsewhere. Russia uses it domestically. Other authoritarian states are customers.

And the sanctions? They're leaky. As the Iran case proves, shell companies and intermediaries can move technology across borders. By the time regulators catch up, the system is already installed.

Western democracies also use facial recognition, less lethally, but with the same underlying capability. The UK just announced it's expanding from 10 to 50 live facial recognition vans. The question isn't whether the technology exists. It's who controls it and for what purpose.

Where Things Stand

Supreme Leader Ali Khamenei was killed February 28, 2026, during Israeli-American bombing raids on Iran [1].

The protests didn't stop. The surveillance didn't stop either.

March 1, 2026: The IRGC sent threatening text messages to Iranian citizens. The surveillance infrastructure remains intact [1].

Nobel Peace Prize winner Narges Mohammadi was imprisoned for seven-and-a-half years in December 2025 for her activism [1]. She remains in detention.

The facial recognition system is still running. The databases are still full. And the next crackdown has all the same tools available.

Sources

Published: March 9, 2026