Iran Used Russian Facial Recognition to Hunt Protestors

Before the January 2026 crackdown that killed 30,000+ people, Iran deployed Russian-made FindFace across metro stations and universities.

TL;DR:

  • Iran secretly acquired Russia's FindFace facial recognition system in 2019, the same technology used to track Russian dissidents
  • The system can match a face against 500 million entries in under one second with claimed 98% accuracy
  • Iran deployed it across Tehran metro stations, Mashhad subway, and university entrances, ostensibly for "clothing law enforcement"
  • A joint investigation by Forbidden Stories, Le Monde, Der Spiegel, and others traced contracts through shell companies to the IRGC
  • Evidence suggests the system was used during the January 2026 crackdown that killed an estimated 30,000 people in 48 hours

The Technology Iran Bought

FindFace started as a dating app gimmick in Russia, snap a photo of someone on the subway, find their social media profile. Then NtechLab, the company behind it, pivoted to law enforcement [1].

The capabilities are straightforward and terrifying:

  • Speed: Matches a face against 500 million database entries in under a second
  • Accuracy claim: 98% identification probability
  • Integration: Links identified individuals to their social networks, friends, family, associates
  • Real-time tracking: Works across live camera feeds in public spaces

Russian authorities used it to identify protestors at opposition rallies. The EU sanctioned NtechLab in 2023 for "facilitating human rights violations." The U.S. followed with similar sanctions [2].

None of that stopped the sale to Iran.

How Iran Got It

In 2019, an Iranian company called Rasad Intelligent Technologies (Rasadco) signed a contract with NtechLab to become a "systems integration partner." That's corporate-speak for: we're reselling your surveillance tech [3].

By 2021, Rasadco had been absorbed into a larger company called Kama. The head of Kama? A member of the Islamic Revolutionary Guard Corps [1].

From there, the technology spread to:

  • Iran's Intelligence Ministry
  • The IRGC itself
  • Sharif University in Tehran
  • Mashhad city authorities

Contracts from 2020-2022, obtained by investigators, show the deals were structured through shell companies to obscure the IRGC connection [3]. Standard procedure for sanctions evasion.

Where It's Watching

The regime announced in 2022 they'd deploy facial recognition in public spaces. The official justification: enforcing hijab laws [1].

Confirmed deployment locations:

  • Tehran metro stations, Leaked video shows the system displaying identified individuals on control screens
  • Mashhad subway system, Installed in 2023
  • Amirkabir University of Technology entrances, One of Iran's top engineering schools

That's the public infrastructure. The system also pulls from surveillance cameras across the country, social media uploads, and government document photo databases [3].

January 2026: The Crackdown

Late December 2025, protests erupted over the cost of living. By January 2026, the movement had spread nationwide.

Then came the crackdown. Early estimates put the death toll at over 30,000 people killed in 48 hours [1].

An Iranian cybersecurity researcher told investigators that "all evidence suggests" authorities used FindFace during the crackdown to identify protest participants [1]. The images of masked protestors that emerged weren't fashion statements, they were survival tactics against a surveillance state.

The regime had spent years building this infrastructure. In January, they used it.

We Already Know It Works

This wasn't FindFace's first Iranian deployment. In 2022, surveillance footage helped authorities identify and arrest a 13-year-old girl. Her crime: her father had distributed pro-protest leaflets [2].

The technology doesn't just identify protestors. It identifies their families. It maps their social networks. One person at a demonstration can expose everyone they know.

That's the point.

Russia's Role

NtechLab was founded in 2015 with connections to Rostec, Russia's state defense corporation. The company built FindFace, watched it get used against Russian dissidents, then sold it to Iran [3].

Western sanctions came in 2023, years after the Iran deal was already done. The EU designated NtechLab for facilitating human rights violations. The damage was already spreading.

In January 2026, the EU designated the IRGC as a terrorist organization. The same month they used Russian facial recognition to hunt their own citizens [1].

What This Means

Authoritarian regimes share surveillance technology. Russia developed it, tested it on their own population, then exported it to Iran. China does the same with its surveillance systems across Africa and Asia.

Sanctions arrive too late. By the time Western governments respond, the technology is deployed, the databases are built, and the infrastructure is operational.

The 30,000 dead in January weren't killed by facial recognition. But the system helped identify who to target, whose families to threaten, whose networks to dismantle.

That's surveillance at scale. That's what it's for.

Sources

Published: March 5, 2026