Trends in Iranian External Assassination, Surveillance, and Abduction Plots.

AuthorLevitt, Matthew

In February 2021, a Belgian court convicted Assadollah Assadi, an Iranian diplomat based in Vienna, of organizing a July 2018 plot to bomb the annual convention of the National Council of Resistance of Iran--the political wing of the Mujahedeen-Khlaq, MEK--near Paris. Three accomplices, all Iranian-Belgian dual citizens living in Brussels, were also sentenced for their roles in the plot. ( (1)) According to German and Belgian prosecutors, Assadi was no run-of-the-mill diplomat but rather an Iranian intelligence officer operating under diplomatic cover. In a statement, prosecutors tied Assadi to Iran's Ministry of Intelligence and Security (MOIS), whose tasks "primarily include the intensive observation and combatting of opposition groups inside and outside Iran." (2)

The Paris plot appears especially audacious in its scope. The perpetrators intended to detonate an indiscriminate explosive device instead of carrying out a targeted assassination; Assadi smuggled TATP and a detonator onto a flight from Iran to Austria; the plot line included touch points in at least five European countries; and several prominent current and former government officials from the United States and other countries were present at the annual convention of the National Council of Resistance of Iran (NCRI). (3)

Pointing to this case, the United States sought to mobilize its partners to counter Iran's support for terrorism around the world. A senior State Department official summarized Washington's concerns in a briefing for the press:

The most recent example is the plot that the Belgians foiled, and we had an Iranian diplomat out of the Austrian embassy as part of the plot to bomb a meeting of Iranian opposition leaders in Paris. And the United States is urging all nations to carefully examine diplomats in Iranian embassies to ensure their countries' own security. If Iran can plot bomb attacks in Paris, they can plot attacks anywhere in the world, and we urge all nations to be vigilant about Iran using embassies as diplomatic cover to plot terrorist attacks. (4) As it happens, the foiled Paris plot was just one in a string of Iranian operations carried out by Iranian operatives or their proxies. In June 2018, the Netherlands expelled two Iranian diplomats based at the Iranian embassy in Amsterdam following an investigation by Dutch intelligence.(5) This move came just months after an Iranian Arab activist was gunned down in Amsterdam.(6) In March 2018, Albanian authorities charged two Iranian operatives with terrorism after they surveilled a venue where Iranian Nowruz (New Year) celebrations were set to begin. In January 2018, German authorities raided several homes after weeks of surveillance confirmed they were tied to Iranian agents. These operatives were reportedly scoping out potential Israeli and Jewish targets in Germany, including the Israeli embassy and a Jewish kindergarten. Ten of the Iranian agents were issued arrest warrants, but none were apprehended. (7)

Weeks earlier, a German court convicted an Iranian agent for spying after he scouted targets in Germany in 2016, including the head of the German-Israeli Association. The German government subsequently issued an official protest to the Iranian ambassador. (8)

Perhaps most disturbing, however, is the fact that Iranian assassination, surveillance, and abduction plots continued unabated despite the negative publicity that accompanied the arrest of Assadi and his accomplices. At least 26 well-documented such plots have occurred in the three years since the Paris plot in places as far afield as Colombia, Cyprus, Denmark, Dubai, Ethiopia, France, Germany, Iraq, Israel, Kenya, the Netherlands, Scotland, Sweden, Turkey, the United Kingdom, and the United States, according to a dataset maintained by the author. This includes the plot exposed in July 2021 to kidnap New York-based journalist and human rights activist Masih Alinejad, a U.S.-Iranian dual citizen, and forcibly take her to Iran where "the victim's fate would have been uncertain at best," in the words of U.S. Attorney Audrey Strauss. (9) Since then, authorities have identified Iranian plots in Colombia (September 2021), (10) Cyprus (October 2021), (11)_ Kenya (November 2021) (12) Tanzania (November 202l), (13) and Turkey (September 2021, February 2022). (14)

Iranian agents and their proxies have targeted dissidents and perceived enemies for assassination, surveillance, and abduction in plots around the world since the earliest days of the Iranian revolution. The first such case in the United States took place in July 1980 when Iranian agents recruited David Belfied (aka Dawud Salahuddin), an American convert to Shi'a Islam, to assassinate former Iranian diplomat Ali Akbar Tabatabai in Bethesda, Maryland.(15) Later, in a 1997 U.S. State Department briefing, Ambassador Philip Wilcox stated that, "since .1990, we estimate and indeed, we have solid information for, that Iran is responsible for over 50 murders of political dissidents and others overseas." (16)

But while the Islamic Republic of Iran has a long history of engaging in operations such as these, it appears to have picked up the pace over the past decade (20.11-2021) and exhibited multiple patterns worth drawing out. Several milestone events in recent years underscore the need to better understand trends in Iranian assassination, surveillance, and abduction operations. Most significantly, the January 2020 targeted assassination of General Qassem Soleimani, the head of the Islamic Revolutionary Guard Corps' Quds Force (IRGC-QF), along with Iraqi Shi'a militia leader and designated terrorist Abu Mahdi al-Muhandis, clearly increased the risk of Iranian retaliation or escalation. To date, Iran has primarily responded to this incident through efforts targeting U.S. forces in Iraq, But days after the Soleimani strike, U.S. intelligence and law enforcement agencies released a joint intelligence bulletin warning of the need "to remain vigilant in the event of a potential [Government of Iran] GOI-directed or violent extremist GOI supporter threat to US-based individuals, facilities, and [computer] networks." (17) Other milestone events making this issue all the more timely include matters such as negotiations over the possible reentry of the United States into a renegotiated nuclear deal with Iran (an updated Joint Comprehensive Plan of Action, JCPOA); the potential for Iran to lash out over the economic consequences of international sanctions; Iran's aggressive regional posture in places such as Syria, Iraq, Yemen, and the Strait of Hormuz and Persian Gulf; domestic, political, economic, and environmental tensions within Iran; and the looming prospect of selecting a new Supreme Leader as Ali Khamenei ages.

This study draws on an unclassified and open-source dataset of 98 cases of Iranian external operations from December 1979 through December 2021. The dataset draws on court documents, reports, press releases, and news articles, and is therefore, by definition, limited to what information is publicly available. Some of that information may be misleading or wrong; much of it is likely to be incomplete--such is the nature of compiling open-source datasets--and th is is in no way a comprehensive listing of all such Iranian external operations. Additionally, there is significant overlap between different analytical categories in this dataset For example, a plot may have involved surveillance and abduction, or may have been carried out by a combination of Iranian and non-Iranian operatives.

In an effort to capture abroad array of Iranian foreign operational trends, the dataset includes assassination plots targeting specific persons, indiscriminate attacks targeting groups of people such as dissidents or a foreign embassy, abduction plots aimed at bringing an individual to Iran against their will, and surveillance operations aimed at supporting such activities or collecting intelligence for future potential operations. The dataset includes cases involving both Iranian operatives and proxies, but. it. does not include every case in which an Iranian proxy group--such as Lebanese Hezbollah--carried out an attack unless the attack was carried out jointly with Iran or there is convincing evidence that the proxy specifically carried out the attack at Iran's behest. It also does not include militant attacks such as Hezbollah rocket salvos fired at Israeli civilian communities.

This study looks back at Iranian external operations since the Iranian revolution, but in an effort to provide timely analysis, it then focuses more closely on Iranian external operations over the past decade (2011-2021). The study examines in turn the who (targets and perpetrators), the what (types of attacks), the how (tactics), the where (location) and, in more general terms explained later, the when and why (timing and motives) behind Iranian external operations. The study then forecasts potential future trends in Iranian external operations worthy of consideration. The observations that follow are all drawn from analysis of the author's dataset.

Over the past several decades, Iranian external operations of the kinds described above fall into several functioning subgroups: the targeting of dissidents, the active execution of religious edicts (fatwas) against entities perceived as insulting the Islamic faith, the targeting of perceived enemies, and the targeting of Jews. Several of these categories overlap, such as the targeting of Jews and Israeli citizens or diplomats.

Iran has employed a range of actors in its operations, including its own agents, proxies, criminal recruits, and a combination of the above. On occasion, Iran has successfully inspired loyalists from around the world to act. on its behalf such as the attacks following Ayatollah Khomeini's fatwa calling for the assassination of Salman Rushdie, predating today's general trend toward lone-offender attacks. (18) Over the decades...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT