Judgment;Abstract — ECLI:EU:T:2024:697
Date: 2024-10-16
Language of the case: French
Court formation: Sixth Chamber
Subject matter: External relations;Common foreign and security policy
Procedure: Action for annulment - unfounded

summary of reasons underpinning that decision, with the consequence that judicial review cannot be restricted to an assessment of the cogency in the abstract of the reasons relied on, but must concern whether those reasons, or, at the very least, one of those reasons, deemed sufficient in itself to support that decision, are substantiated (see, to that effect, judgments of 18 July 2013, Commission and Others v Kadi, C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518, paragraph 119; of 18 June 2015, Ipatau v Council, C‑535/14 P, EU:C:2015:407, paragraph 42; and of 18 February 2016, Council v Bank Mellat, C‑176/13 P, EU:C:2016:96, paragraph 109). 62 In that context, it is the task of the competent European Union authority, in the event of challenge, to establish that the reasons relied on against the person or entity concerned are well founded, and not the task of that person or entity to adduce evidence of the negative, that those reasons are not well founded (see, to that effect, judgment of 18 July 2013, Commission and Others v Kadi, C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518, paragraph 121). 63 However, contrary to what the applicant claims, it does not follow that the alleged lack of capacity of the Council to adduce the evidence that the reasons relied on to justify the applicant’s listing in Annex I to Regulation No 359/2011, if it were established, would undermine the applicant’s rights of defence. 64 As is apparent from the case-law recalled in paragraph 61 above, it is on the contrary because, in order to preserve the effectiveness of Article 47 of the Charter, the Courts of the European Union are obliged to verify, in the context of reviewing the legality of the restrictive measures, the merits of the reasons underlying those measures and, therefore, the evidential value of the documents produced, in the present case, by the Council. 65 Next, it is necessary to dismiss as irrelevant in the present case the considerations, relied on by the applicant, which are set out in the judgment of 8 December 2022, HYA and Others (Impossibility of questioning prosecution witnesses) (C‑348/21, EU:C:2022:965), in which the Court of Justice was asked about the interpretation of Article 6(1) and Article 8(1) of Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings (OJ 2016 L 65, p. 1) and the second paragraph of Article 47 of the Charter. 66 It must be recalled that the principle of the presumption of innocence, set out in Article 6(2) of the Convention for the Protection of Human Rights and Fundamental Freedoms and in Article 48(1) of the Charter, is a fundamental right which confers rights on individuals or entities managed by individuals which are enforced by the Courts of the European Union (see judgment of 18 May 2017, Makhlouf v Council, T‑410/16, not published, EU:T:2017:349, paragraph 122 and the case-law cited). 67 The principle of the presumption of innocence, which requires that any person charged with a criminal offence is presumed innocent until proved guilty according to law, does not preclude the adoption of precautionary measures for the freezing of funds, provided that they are not intended to commence criminal proceedings against the person or entity concerned. Such measures must however, in the light of their seriousness, be laid down by law, be adopted by a competent authority and be limited in time. It follows from paragraph 13 above that those first two criteria are satisfied. In addition, with regard to the time limitation, it must be observed that, in accordance with Article 12(3) and (4) of Regulation No 359/2011, Annex I to that regulation is to be reviewed at regular intervals and at least every 12 months, with the result that the listing of a person or an entity in that annex may be extended or amended where appropriate. The measures imposed on the applicant are indeed therefore limited in time (see, to that effect, judgment of 18 May 2017, Makhlouf v Council, T‑410/16, not published, EU:T:2017:349, paragraph 123 and the case-law cited). 68 In addition, it must be observed that the restrictive measures at issue do not entail the applicant’s assets being confiscated as the proceeds of crime but rather frozen as a precautionary measure. Those measures do not therefore constitute a criminal sanction and do not, moreover, imply any accusation of a criminal nature (see judgment of 18 May 2017, Makhlouf v Council, T‑410/16, not published, EU:T:2017:349, paragraph 124 and the case-law cited). 69 The contested regulation, in so far as it concerns the applicant, does not constitute a finding of fact that an offence has actually been committed, rather it was adopted in the context and for the purpose of an administrative procedure with a precautionary function which is solely intended to allow the Council to guarantee the protection of civilian populations (see, to that effect, judgment of 18 May 2017, Makhlouf v Council, T‑410/16, not published, EU:T:2017:349, paragraph 125 and the case-law cited). 70 Finally, it is also necessary to reject the applicant’s argument that, since the documents referred to in The Intercept article were not added to the file in the present case, that article should be rejected as inadmissible because, pursuant to the adversarial principle, a court can take into consideration only the procedural documents and evidence which have been made available to the parties and on which they have been able to comment. It is sufficient to observe in that regard that the applicant had the opportunity in its reply to set out its views on the evidence produced by the Council in Annex B.11, including that article, the evidential value of which it moreover contests. 71 Furthermore, it must be noted that the two user manuals for the SIAM software, the first written in Farsi and the second in English, could be consulted directly by following a hyperlink in The Intercept article at page 3 of file WK 307/2023 INIT produced by the Council in Annex B.11 to the defence. 72 The applicant’s arguments alleging infringement of Articles 47 and 48 of the Charter and breach of the adversarial principle must therefore be rejected. The evidential value of The Intercept article 73 The applicant alleges that The Intercept article is merely a news publication containing solely unverifiable allegations and, therefore, it has no evidential value 74 In that regard, it must be recalled that, in accordance with settled case-law, the activity of the Court of Justice and of the General Court is governed by the principle of unfettered assessment of the evidence, and it is only the reliability of the evidence before the EU Courts which is decisive when it comes to the assessment of its value. In addition, in order to assess the evidential value of a document, regard should be had to the credibility of the account it contains and, in particular, to the person from whom the document originates, the circumstances in which it came into being, the person to whom it was addressed and whether, on its face, the document appears to be sound and reliable (see judgment of 31 May 2018, Kaddour v Council, T‑461/16, EU:T:2018:316, paragraph 107 and the case-law cited). 75 In the absence of investigative powers in third countries, the assessment of the EU authorities must rely on publicly available sources of information, reports, articles in the press, intelligence reports or other similar sources of information (judgments of 14 March 2018, Kim and Others v Council and Commission, T‑533/15 and T‑264/16, EU:T:2018:138, paragraph 107, and of 1 June 2022, Prigozhin v Council, T‑723/20, not published, EU:T:2022:317, paragraph 59). 76 It would be excessive and disproportionate to require the Council itself to investigate on the ground the accuracy of the facts which are relayed by numerous media (judgment of 25 January 2017, Almaz-Antey Air and Space Defence v Council, T‑255/15, not published, EU:T:2017:25, paragraph 148). 77 Press articles may therefore be used in order to corroborate the existence of certain facts where they come from several different sources and they are sufficiently specific, precise and consistent as regards the facts there described (see judgment of 11 September 2019, Topor-Gilka and WO Technopromexport v Council, T‑721/17 and T‑722/17, not published, EU:T:2019:579, paragraph 137 and the case-law cited). 78 In the present case, the Council based the applicant’s listing in Annex I to Regulation No 359/2011 on four documents in file WK 307/2023 INIT, which are contained in Annex B.11 to the defence. 79 The first document is The Intercept article; the second, the article entitled ‘Hacker Leaks Manuals Showing How Iran Uses Mobile Networks to Track Protesters’, published on 31 October 2022 by the specialist website Commsrisk; the third, the article entitled ‘Iran: New tactics for digital repression as protests continue’, published on 17 November 2022 on the website of the association ARTICLE 19; and the fourth, the article entitled ‘Iran is using spyware to track citizens attending protests’, published by the online investigative newspaper The Tech Monitor on 3 November 2022. 80 The applicant claims that the Council bases the contested regulation, in so far as it concerns it, on the mere allegations contained in the article from The Intercept, which are themselves based on statements made by an anonymous individual. 81 It must be observed that The Intercept article reveals that, on the basis of internal documents of an Iranian mobile operator, in particular email exchanges involving the applicant’s management and two user manuals, one in English and the other in Farsi, for a software called SIAM, the authors of that article discovered how the Iranian authorities, through the applicant, had established a system working behind the scenes of Iranian mobile networks which allowed the Iranian Government to bypass the encryption of telephone calls, track the movements of a telephone user, identify all the telephones in a particular location, analyse all of a telephone user’s contacts and interrupt or slow down the user’s internet connection, and which had been used to repress and control the Iranian people following the death of Ms Amini in 2022. That article also explains that the English-language SIAM software user manual states that ‘based on [the applicant’s] rules and regulations all telecom operators must provide [the applicant] direct access to their system for query customer information and change their services via web service’ and contains, in addition, technical information about the most powerful commands used by the SIAM software to collect user data directly from Iranian mobile operators. 82 It must also be noted that the authors of The Intercept article ensured that they interviewed two individuals presented as experts. 83 In that regard, it must be pointed out that, contrary to what the applicant claims, the first person presented as an expert is not ‘someone who nobody knows and who seems to lack any particular legitimacy’. It is in fact apparent from the file that that first person is a researcher at Citizen Lab Canada, an interdisciplinary laboratory based at the University of Toronto (Canada) specialising in ‘research, development, and high-level strategic policy and legal engagement at the intersection of information and communication technologies, human rights, and global security’, and that he has previously been presented as such in an article published on 1 February 2022 by the prominent newspaper The Guardian. 84 Similarly, it is apparent from the file that the second person presented as an expert in The Intercept article describes himself and has been presented on a number of occasions by the international press agency Reuters as the Director of Digital Rights and Security at the MIAAN group, an organisation based in Texas (United States) which ‘defends human rights in Iran’. Contrary to what the applicant claims, the mere fact that it is ‘well known that [he] is a public figure who is openly and unreservedly engaged against the Iranian Government’ cannot necessarily render statements made by him irrelevant on the ground that he is not neutral and impartial. 85 In that regard, it must be observed that the experience of such an individual, a specialist in the defence of human rights, in particular digital rights, and who is described as an opponent of the Iranian regime by the applicant itself, is relevant to providing a valuable opinion as to how the Iranian authorities could use a system such as that described in The Intercept article to undermine those rights. 86 Furthermore, it must be observed that the article published on the website of The Intercept did not simply make allegations or even reproduce the opinion of experts, but rather substantiated its claims and views by providing access to the English-language SIAM software user manual, which could be consulted directly via a window embedded in the article, and to the second manual written in Farsi which bore the applicant’s logo. 87 In addition, with regard to the other articles contained in file WK 307/2023 INIT, it must be observed that the Commsrisk website, which describes itself as ‘a website that reports on the risks faced by electronic communications providers and their customers’, and The Tech Monitor, which explains that it seeks to provide ‘data-driven insight and authoritative analysis for business, digital, and policy leaders in a world disrupted and inspired by technology’, are specialist media in the field of telecommunications, and that the ARTICLE 19 association, based in London (United Kingdom), describes itself as ‘an international think-do organisation that propels the freedom of expression movement locally and globally to ensure all people realise the power of their voices’. They must therefore be regarded as relevant sources of information in connection with the use of information and communications technology in conjunction with the exercise of fundamental rights and, in particular, the right to freedom of expression. 88 While the Commsrisk, ARTICLE 19 and The Tech Monitor articles do all refer to The Intercept article, the Commsrisk article also reports on its author’s experience of meeting the representative of a technology company who was trying to sell Iran software with ‘disturbingly similar’ functions to those of the SIAM software and who had volunteered information about that sale. 89 In addition, it is apparent from the article by the ARTICLE 19 organisation that that organisation has monitored the extent of internet controls in Iran for several years, and that it outlined in a report entitled ‘Iran: Tightening the Net 2020’ how the internet infrastructure operated in that country and its governance by the authorities. In particular, it stated that there is a centralised system for shutting down internet access during protests in the course of which internet governance is treated as a national security matter. The ARTICLE 19 organisation claims to have discovered that the applicant, operating under the control of the Ministry of Communications, which is in actual fact controlled by Iran’s intelligence services, enforced the use of surveillance and censorship equipment at internet service provider (ISP) level and ordered shutdowns and other disruptions of internet access acting on behalf of the Supreme National Security Council. The article by the ARTICLE 19 organisation also reports on the Iranian authorities’ use of technology to block the use of tools which allow internet censorship to be circumvented, such as virtual private networks (VPNs), and of shutdowns or major disruptions of mobile internet connections as digital repression tactics. For instance, it states that shutdowns of mobile internet access have been a tactic increasingly in use since November 2019. Such shutdowns have been reportedly used particularly during regional protests from 2021 to the present day. The article states that mobile internet connections were disabled in a number of locations on most days following the protests in the wake of Ms Amini’s death. Those shutdowns affected the largest providers of mobile internet access across the country, which – in a country in which mobile internet service is people’s main source of internet access – had a detrimental impact on access to the internet. 90 It thus follows from the foregoing that the allegations set out in The Intercept article are corroborated by the other evidence contained in file WK 307/2023 INIT and that, therefore, contrary to what the applicant maintains, the Council did not rely solely on the allegations set out in that article. Accordingly, given the consistency of the various items of evidence and the circumstances described above in which they came into being, those allegations could legitimately be taken into account. The merits of including the applicant’s name 91 As a preliminary point, it must be observed that, while the applicant claims that the Council committed a ‘manifest error of assessment of the facts’ in the present case, the arguments put forward by it in that regard must be regarded as seeking to challenge the material accuracy of the facts of which it is accused. It is apparent from its line of argument developed in support of the present plea, as reproduced in paragraph 42 above, that the applicant does not contest that the facts of which it is accused may be covered by the listing criteria provided for in Article 3(1) and (2) of Regulation No 359/2011, but the reality of those facts. 92 In that regard, it follows from the case-law recalled in paragraph 62 above that the review by the Courts of the European Union entails a verification of the factual allegations in the summary of reasons underpinning the decision by which restrictive measures against an entity are adopted, and that such verification cannot be restricted to an assessment of the cogency in the abstract of the reasons relied on, but must concern whether those reasons, or, at the very least, one of those reasons, deemed sufficient in itself to support that decision, is substantiated. 93 The assessment of the merits of those reasons must be carried out by examining the evidence and information not in isolation but in their context. The Council discharges the burden of proof borne by it if it presents to the EU Courts a body of sufficiently specific, precise and consistent evidence to establish that there is a sufficient link between the person subject to a restrictive measure and the regime or, in general, the situations, being combated (see, to that effect, judgment of 20 July 2017, Badica and Kardiam v Council, T‑619/15, EU:T:2017:532, paragraph 99 and the case-law cited). 94 It is in the light of those considerations that it is necessary to determine whether the Council was right to take the view, in adopting the contested act, that restrictive measures could be imposed on the applicant. 95 In that regard, first, with regard to the provisions of Iranian law upon which the applicant relies to justify its claim that it is prevented by law from monitoring and controlling the communications of the users of Iranian mobile networks, it must be observed that, under Article 25 of the Constitution of the Islamic Republic of Iran, ‘the inspection of letters and the failure to deliver them, the recording and disclosure of telephone conversations, the disclosure of telegraphic and telex communications, censorship, … eavesdropping, and all forms of covert investigation are forbidden, except as provided by law’. 96 Article 582 of the Iranian Criminal Code provides: ‘A State official or civil servant who, in cases other than those permitted by law, opens, seizes, destroys, inspects, records or intercepts letters, telegraph or telephone communications of persons, or discloses their contents without their owners’ permission, shall be liable to a term of imprisonment of one to three years or a fine of 6 to 18 million rials’. 97 Article 104 of the Iranian Code of Criminal Procedure provides: ‘Control [interception] of individuals’ telecommunications shall be prohibited, save in cases in which it is connected with the internal or external security of the country or is deemed necessary for the investigation of the crimes listed in Article 302(a), (b), (c) and (d) of this Code. In such cases, the interception shall be first approved by the President of the Supreme Court of the province and the duration and frequency of the interception shall be specified. The interception of the telephone communications of the persons and civil servants listed in Article 307 of this Code shall be subject to the approval of the President of the Supreme Court, and that authority may not be delegated to others.’ 98 It is clear from those provisions that, while the interception of communications is prohibited in principle, it does however remain possible as a matter of law, in particular ‘in cases in which it is connected with the internal or external security of the country or is deemed necessary for [certain crimes]’ or where ‘the matter is related to national security’. In that regard, it must further be observed that the situations in which the interception of telecommunications is permitted by law are defined very broadly. 99 In addition, it must be noted that the applicant’s argument is also contradicted by the English-language SIAM software user manual, the authenticity of which the applicant does not contest, in which it is stated that ‘based on [the applicant’s] rules and regulations all telecom operators must provide [the applicant] direct access to their system for query customer information and change their services via web service’. 100 Second, as regards the applicant’s alleged technical inability to monitor or control the users of Iranian mobile networks, it must be stated that that is not the case. 101 It should thus be observed that the applicant does not dispute that the SIAM software exists, nor the existence of the ‘Force2GNumber’, ‘LocationCustomerList’, ‘GetCDR’, ‘GetIPDR’ and ‘ApplySusplp’ commands or the ‘Legal Intercept’ (LI), ‘Control Illegal Devices’ (CID), ‘SHAHKAR’ and ‘SHAMSA’ systems. The applicant also does not deny that it uses the SIAM software and those systems. Furthermore, nor does the applicant contest the authenticity of the email exchanges between its management and the Iranian mobile operator referred to in The Intercept article or that of the SIAM software user manuals, the first written in English and the second in Farsi. 102 The applicant in fact simply claims that, first, the use of those commands either does not produce the effect described by the Council or serves a legitimate purpose and, second, the ‘Legal Intercept’ (LI), ‘Control Illegal Devices’ (CID), ‘SHAHKAR’ and ‘SHAMSA’ systems are in widespread use in most States. 103 In that regard, it must be recalled that the English-language SIAM software user manual states that ‘based on [the applicant’s] rules and regulations all telecom operators must provide [the applicant] direct access to their system for query customer information and change their services via web service’. 104 It must also be observed that, according to the French translation provided by the Council, the introduction to the SIAM software user manual in Farsi states that the purpose of that software is to ‘create a single, centralised and reunified system for submitting queries to different servers’ and to ‘allow users’ communications and actions to be managed and controlled’. 105 In addition, in the ‘Principles of Communications’ section of that manual, it is stated that ‘the input parameters are in the information sent by the SIAM software for each query method (function) to the operator and [that] the output parameters are the response data to the query (and the order of their classification), [and that the] operators must deliver to SIAM the response of each function specifically requested according to the order and composition described in the section concerned with the output parameters of that function’. 106 Moreover, that manual goes on to state that operators are required ‘to respond day and night (24x7) to queries from the SIAM software’ and to ensure that ‘all the necessary equipment in terms of hardware, software, network communications and security, such as data redundancy (Redundancy), load sharing (Road Balancing), firewalls (Firewall), is provided and that all other requirements are met’. 107 It follows from those findings that the SIAM software commands are addressed to all Iranian mobile operators and that those operators are required to respond to them in the manner prescribed at any time. 108 The applicant’s arguments related to the SIAM software commands and to the ‘Legal Intercept’ (LI), ‘Control Illegal Devices’ (CID), ‘SHAHKAR’ and ‘SHAMSA’ systems must be assessed in the light of those findings. 109 Thus, with regard to the ‘LocationCustomerList’ command, the applicant claims that that command does not enable a particular mobile network user to be tracked with any precision because it only allows users of a mobile network to be identified within a range of between 200 metres and 2 kilometres from a GSM relay antenna. However, it must be observed that the applicant does concede that that command allows all users of a mobile network in a particular geographic area – albeit an approximate one – to be identified. This is, moreover, made clear in the description of that command in the English-language SIAM software user manual, which states that ‘this function, which receives a location parameter, should provide a list of numbers which are in that location’. In addition, it must be observed that it is apparent from the manual written in Farsi that the ‘IdentitySearch’ command requires operators to send results in the form of a ‘table’ which, in the case of natural persons, states the person’s telephone number, first name, surname, father’s first name, birth certificate number, date of birth, postcode, nationality, passport number, postal address(es), payment type (prepaid/postpaid), line type (SIM card or other), registration date, IP address and the geographical longitude and latitude of the address. 110 As regards the ‘Force2GNumber’ command, the applicant submits that, contrary to what the Council argues, that command does not increase the risks of communications being hacked. However, as the Council rightly observes, the fact, assuming it were to be established, that that command does not increase the risk of hacking does not call into question the finding that such a command, the purpose of which is to force a mobile telephone to use the 2G network instead of the newer 3G and 4G networks, has the effect of making it impossible to view or share videos using that telephone. 111 As for the ‘GetCDR’ and ‘GetIPDR’ commands, the applicant submits that they are used, in the case of the former, to consult a telephone’s call history and, in the case of the latter, to obtain the IP address of the devices in which a particular SIM card has been activated. According to the applicant, those functions are used exclusively to comply with requests made in judicial investigations and are essential tools at the disposal of courts, as is shown by the judicial orders and police correspondence attached as annexes to the reply. However, first, it must be observed that the applicant does not produce any evidence to show that that command can be used only to respond to legitimate requests made by Iranian courts and police authorities. Second, as has already been pointed out in paragraph 98 above, the situations in which the interception of telecommunications is permitted by law are defined very broadly. 112 In the case of the ‘ApplySusp’ and ‘ApplySuspIP’ commands, the applicant submits that they allow SIM cards reported lost or stolen by users or belonging to persons who have been declared dead to be disabled. The applicant notes that that is an entirely standard capacity and is comparable to that relied on by the regulatory bodies of other States such as Germany. In that regard, it must be observed that it is apparent from the report entitled ‘Iran: Government surveillance capacity and control, including media censorship and surveillance of individual Internet activity’, published on 16 January 2015 by the Immigration and Refugee Board of Canada (Annex B.8), the report published by Amnesty International on 16 November 2020 on the November 2019 protests in Iran and the internet shutdowns (Annex B.10), the report published by the Human Rights Activists News Agency (HRANA) on 8 December 2022, which contains a statistical review, an analysis and a summary of the first 82 days of protests and states the estimated number of deaths and arrests (Annex B.3), and the 2022 report on freedom on the internet in Iran published by Freedom House (Annex B.6) that the situation in Iran is marked by regular challenges to the regime by the civilian population, challenges which are systematically repressed by the Iranian authorities using, inter alia, internet surveillance methods. In those circumstances, it cannot be ruled out, as the Council observes, that commands originally designed for ‘legal’ purposes, such as ‘ApplySusp’ and ‘ApplySuspIP’, may be misused and used by the Iranian authorities for law enforcement purposes. 113 With respect to the functional components of Iran’s system of intercepting communications, the applicant states that the ‘SHAHKAR’ system is simply a network used to verify the identity of the communications user when a SIM card is assigned to him or her in order to prevent fraud. According to the applicant, that system compiles information about the individual to whom each SIM card or fixed line belongs and creates a database which is used to combat fraud, harassment and other similar criminal activities. However, it must be observed that the applicant also explains that that system allows, inter alia, Iranian mobile operators to verify the identity of users of communication services. As found in paragraph 107 above, the SIAM software commands are addressed to all Iranian mobile operators and those operators are required to respond to those commands in the prescribed manner at any time and to provide the SIAM software with permanent access to the information they hold about users. It follows that the explanation provided by the applicant is not such as to reject the Council’s assertion that the ‘SHAHKAR’ system is a functional component of the system used by the Iranian authorities to intercept communications. 114 As for the ‘SHAMSA’ system, the applicant disputes that that system is an ‘interface for the collection of voice data and SMS in bulk (CDR) and IP data (IPDR)’, as the Council contends. According to the applicant, it is merely a ‘communication network or channel between [it] and the [mobile] operators, via which operators interact by entering codes and commands’. However, once again, in the light, first, of the finding made in paragraph 107 above that the SIAM software commands are addressed to all Iranian mobile operators and that those operators are required to respond to those commands in the prescribed manner at any time and, second, of the reference in the table of contents of the Farsi version of the SIAM software user manual – according to the French translation provided by the Council – to a command that SMS be transferred to a number, the explanation provided by the applicant is unconvincing. 115 With regard to the ‘CID’ system, the applicant claims that that system allows the device number, the mobile number and the SIM card number to be matched to one another. According to the applicant, the sole function of that system is to identify and monitor the legality of the importation into Iran of mobile telephones and electronic devices into which a SIM card can be inserted, in order subsequently to pass on that information to telecommunications operators. Once more, alongside the declared legitimate purpose of that system, it must be recalled that it has been found that Iranian mobile operators are required to grant the applicant, via the SIAM software, permanent access to the information which they hold on their users, so that the applicant can thus access the data compiled by the ‘CID’ system. 116 Last, so far as concerns the ‘LI’ system, the applicant acknowledges that it is a security system which allows a network operator to be asked to collect and provide to law enforcement authorities intercepted communications of individuals or organisations. The applicant states that that system is subject to strict limitations imposed by the applicable provisions of Iranian law. However, as held in paragraph 98 above, it is apparent from the provisions of Iranian law upon which the applicant itself relies that the situations in which interceptions of telecommunications are permitted by law are defined very broadly. 117 In the light of the considerations set out in paragraphs 95 to 115 above, it must be found that the Council has produced before the Court a body of sufficiently specific, precise and consistent evidence to establish that there is a sufficient link between the applicant and the situation being combated in the present case, namely the repression by the Iranian authorities of peaceful demonstrators, journalists, human rights defenders, students and others speaking up in defence of their legitimate rights. 118 The applicant’s complaints based on the material inaccuracy of the facts must therefore be rejected. 119 It follows that the third plea must be dismissed as unfounded in its entirety. The fourth plea, alleging breach of the principle of proportionality 120 The applicant claims that the restrictive measures to which it is subject because of its listing in Annex I to Regulation No 359/2011 are contrary to the principle of proportionality. 121 In that regard, first, it argues that the ‘international sanctions’ adopted in the past against Iran had given rise to tools being withheld which are of particular use to it, one of which is used to prevent Iranian frequencies from overlapping with those of neighbouring states and the other, the Location Based System, for the accurate location of connected devices. Moreover, the sanctions currently imposed on Iran prevent the applicant from performing its role as the regulator of frequencies and from ensuring that the national telecommunications network operates effectively. 122 Second, the applicant argues that the ‘sanctions’ prevent it from joining the Global System for Mobile Communications Association (GSMA) and that it cannot therefore use the GSMA register to prevent counterfeit or illegal devices from being repaired. This has a number of harmful consequences, including, in particular, Iran’s inability to combat fraud effectively, the creation of a parallel market in stolen telephones and the impossibility of returning stolen telephones to their owners. 123 The Council disputes the applicant’s line of argument. 124 It must be recalled that, by virtue of the principle of proportionality, which is one of the general principles of European Union law, the lawfulness of the prohibition of an economic activity is subject to the condition that the prohibitory measures should be appropriate and necessary in order to achieve the objectives legitimately pursued by the legislation in question; when there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see judgment of 6 September 2013, Bank Melli Iran v Council, T‑35/10 and T‑7/11, EU:T:2013:397, paragraph 179 and the case-law cited). 125 In addition, whilst respect for fundamental rights is a condition for the legality of acts of the Union, it is settled case-law that those fundamental rights do not enjoy, under European Union law, absolute protection, but must be viewed in relation to their function in society. Consequently, the exercise of those rights may be restricted, provided that those restrictions correspond to objectives of public interest pursued by the European Union and do not constitute, in relation to the aim pursued, a disproportionate and intolerable interference, impairing the very substance of the rights thus guaranteed (see judgment of 13 September 2013, Makhlouf v Council, T‑383/11, EU:T:2013:431, paragraph 97 and the case-law cited; judgment of 16 January 2019, Haswani v Council, T‑477/17, not published, EU:T:2019:7, paragraph 74). 126 In the present case, it must be observed that the applicant does not raise any argument to demonstrate that the restrictive measures provided for in Regulation No 359/2011 and to which it is subject as a result of the adoption of the contested regulation do not pursue a legitimate objective or are not necessary or appropriate to achieve that objective. It simply claims, in essence, that the international sanctions to which Iran has been subject in the past have had a negative impact on its ability to perform its role, without establishing the necessary link to the measures provided for in Regulation No 359/2011. 127 In any event, it must be observed that one of the objectives pursued by Regulation No 359/2011, as is made clear, in essence, in recitals 1 and 2 thereof, consists in exerting pressure, by freezing their funds and economic resources, on certain persons and entities responsible for directing or implementing grave human rights violations in Iran in the repression of peaceful demonstrators, journalists, human rights defenders, students or other persons who speak up in defence of their legitimate rights, including freedom of expression. 128 It must be observed that such an objective is a legitimate objective of common foreign and security policy (CFSP), namely to consolidate and support democracy, the rule of law, human rights and the principles of international law, as set out in Article 21(2)(b) TEU. 129 Furthermore, the restrictive measures provided for in Regulation No 359/2011 cannot be regarded as inappropriate in view of the key role played by the applicant in the enforcement of the Iranian Government’s requirements to filter internet content through the SIAM spyware, as is apparent from the examination of the third plea. 130 Moreover, those measures must be regarded as necessary since, as the Council rightly observes, it has not been shown that alternative and less onerous measures such as a pre-authorisation system or an obligation to provide justification a posteriori for the use of the funds disbursed would enable the objective pursued to be achieved as effectively. 131 The fourth plea must therefore be dismissed as unfounded. The first plea, alleging, in essence, misuse of powers 132 The applicant claims that, although the competence of the Council to adopt the contested regulation is not contested, that regulation is vitiated by a misuse of powers by the Council in so far as the applicant is concerned. In the applicant’s view, that misuse of powers stems from the fact that the real reason which led the Council to include its name in Annex I to Regulation No 359/2011 was to target the Iranian State. 133 Thus, in its opinion, the Council did not sanction the applicant because of its activity, as is falsely stated in the contested regulation, but solely because of its governmental status, which is the result of its affiliation with the Ministry of Communications, as in any other country. By making the applicant subject to the restrictive measures provided for in Regulation No 359/2011, the Council seeks to penalise that affiliation and, in so doing, to paralyse the Iranian authorities. 134 The applicant is of the view that, in accordance with case-law, while the legal status of a person covered by restrictive measures or its legal or economic ties to the government of a country may be an indication that might raise suspicions in the eyes of the Council, it cannot, on its own, justify the adoption of such measures. 135 The identity of the other persons listed in Annex I to Regulation No 359/2011 also demonstrates that the applicant’s listing in that annex is excessive. 136 Moreover, the applicant notes that the restrictive measures adopted by the Council mirror the sanctions adopted by the Office of Foreign Assets Control, which is evidence of the political hostility towards the Islamic Republic of Iran. 137 The Council disputes the applicant’s line of argument. 138 It must be recalled that, according to the case-law of the Court of Justice, a measure is only vitiated by misuse of powers if it appears, on the basis of objective, relevant and consistent evidence, to have been taken with the exclusive or main purpose of achieving an end other than that stated or of evading a procedure specifically prescribed by the Treaty for dealing with the circumstances of the case (see judgment of 31 January 2019, Islamic Republic of Iran Shipping Lines and Others v Council, C‑225/17 P, EU:C:2019:82, paragraph 115 and the case-law cited). 139 In the present case, the applicant claims that the Council included its name in Annex I to Regulation No 359/2011 solely because of its governmental status stemming from its affiliation with the Ministry of Communications and not because of its own activities. 140 However, it is apparent from the examination of the second plea (see paragraphs 25 to 34 above) that the inclusion of the applicant’s name in Annex I to Regulation No 359/2011 by the contested regulation was not solely based on its affiliation with the Ministry of Communications, but essentially on its enforcement of the Iranian Government’s requirements to filter internet content through the SIAM spyware and, in particular, the use of its control of internet access and mobile phones to track protesters and create a detailed picture of dissidents’ and protesters’ activities for the authorities to use at their will during the 2022 protests which followed the death of Ms Amini. 141 In addition, it is apparent from the examination of the third plea that the reasons relied on by the Council to justify the inclusion of the applicant’s name in Annex I to Regulation No 359/2011 by the contested regulation had a sufficiently solid factual basis. 142 Furthermore, the applicant fails to substantiate how the fact that the names of other persons in Annex I to Regulation No 359/2011, upon which it itself explains that it does not wish to comment, or the fact the authorities of the United States of America also decided to adopt restrictive measures in its regard is relevant to demonstrating that, in the present case, the Council misused its powers within the meaning of the case-law recalled in paragraph 138 above. 143 The first plea must therefore be rejected as unfounded and, consequently, the action must be dismissed in its entirety. Costs 144 Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. In the present case, as the applicant has been unsuccessful, it must be ordered to bear its own costs and to pay those incurred by the Council, in accordance with the form of order sought by the latter. On those grounds, THE GENERAL COURT (Sixth Chamber) hereby: 1. Dismisses the action; 2. Orders the Communications Regulatory Authority (CRA) to pay the costs. Costeira Kancheva Öberg Delivered in open court in Luxembourg on 16 October 2024. [Signatures] * Language of the case: French.