Iran’s Malign Intelligence Activities

Historical Background

The groundwork for today’s Iranian intelligence system was laid in pre-revolutionary Iran under the rule of the Shah of Iran, Mohamed Reza Pahlavi. In 1957, the U.S. provided the Shah with financial and technical assistance to create the National Security and Intelligence Organization (SAVAK). SAVAK’s primary functions were to monitor internal opposition and protect Iran’s government and armed forces against communist infiltration. SAVAK’s power within the Shah’s Iran grew to the extent that the organization was seemingly above the law, with the authority to arrest any individual suspected of anti-regime activism. Dissidents were sometimes tortured and detained indefinitely, most notably at SAVAK’s notorious Evin prison complex in Tehran, which is used similarly by the present regime. SAVAK became a feared instrument of repression with a reputation inside Iran for brutality, and eventually transformed Iran into a police state through its “vast informant networks, surveillance operations, and censorship.”

SAVAK’s heavy-handedness contributed to the anti-monarchical sentiment which eventually toppled the Shah and ushered in the 1979 Islamic Revolution, led by Ayatollah Ruhollah Khomeini, the founding father of the Islamic Republic and its first supreme leader. Khomeini’s revolutionary government immediately set about establishing a variety of intelligence services in order to identify and eliminate enemies within and outside Iran’s borders. At the local level, intelligence and security were handled by informal, neighborhood-based intelligence committees known as kumitehs which functioned as freelance militias that sought to uphold revolutionary ideology and adherence to Islamic mores.

At the national and international level, the Islamic Revolutionary Guard Corps (IRGC) was formed several months into the revolution on May 5, 1979 and immediately took over as the regime’s primary security force, equipped with a constitutionally-ordained mandate to “guard the Revolution and its achievements.” The IRGC was formed from a core of some 700 Khomeini loyalists who had received military training at Amal and Fatah training camps in Lebanon’s Bekaa valley while Khomeini was exiled in Najaf, Iraq. In effect, the IRGC was tasked with enforcing loyalty to velayat e-faqih and preserving the Iranian clerical regime, as well as exporting the Islamic Revolution.

During the IRGC’s formative years, it was focused predominantly on eliminating domestic threats to the nascent revolutionary order, serving as the country’s most active intelligence organization for the first five years after the revolution. The IRGC was involved in the suppression of violent, counterrevolutionary organizations such as the Mujahideen e-Khalq (MEK), Forghan (a militant anti-clerical Shi’a organization) and Communist Tudeh party. The MEK and Forghan were not merely political opposition movements, but terrorist groups that routinely carried out bombings and assassinations targeting Iranian officials.  

One of the IRGC’s first orders of business was to purge the Shah’s military and intelligence services in order to eliminate vestiges of monarchical support. The IRGC overran SAVAK’s headquarters in 1979, providing them access to a treasure trove of SAVAK’s internal security files. The Guards apprehended many former SAVAK agents and executed dozens of senior intelligence officers over the next few years.

Rather than completely dismantling SAVAK, however, Iran’s post-revolutionary regime sought to build upon its formidable foundation and maintain a robust surveillance apparatus. The regime established the National Intelligence and Security Agency (Sazman Ettela’at va Amniat Melli Iran, or SAVAMA) as the direct successor to SAVAK. SAVAMA focused primarily on collecting foreign intelligence, utilizing SAVAK’s intelligence infrastructure and capabilities and copying its methods. Iran granted many former SAVAK agents amnesty, seeking to capitalize on their skills and integrate them into service on behalf of the revolutionary regime. The expertise of former SAVAK agents was in acute demand due to intelligence needs stemming from the Iran-Iraq War, which began in 1980. In addition to the threat from Iraq, the clerical regime needed to gather intelligence on counterrevolutionaries and dissidents overseas plotting against the Islamic Republic. In 1984, the kumitehs and SAVAMA were merged and the Ministry of Intelligence of the Islamic Republic of Iran (MOI) was formed by parliamentary decree. The MOI is Iran’s premier civilian internal and external intelligence service, constitutionally-designated as the country’s highest intelligence authority.  

Structure

Iran’s system of governance has a complex structure, which is difficult for outsiders to grasp. Its intelligence apparatus is even more convoluted, exacerbated by organizations having unclear and often overlapping mandates, duplication of efforts, and frequently shifting responsibilities. Ultimately, the supreme leader, currently Ayatollah Ali Khamenei, is vested with authority to direct Iran’s foreign and domestic policy, serving as commander-in-chief of Iran’s conventional and IRGC forces, and as the overseer and chief customer of all of Iran’s intelligence agencies.

Iran has two major intelligence services—the MOI and the intelligence office of the IRGC—which compete for influence and primacy. Iran’s complex system of intelligence agencies was developed so that no organization would have a monopoly over intelligence gathering and operations, but at the same time, the MOI formally sits atop the intelligence hierarchy.  

Due to events both inside and outside Iran, the division of powers and responsibilities between the MOI and IRGC has evolved with each group taking on more specialized roles. Since 2003, the MOI has played no role whatsoever in external militia operations or significant assassinations overseas. The IRGC’s intelligence unit owns these operations in conjunction with the Quds Force, its foreign expeditionary arm. The MOI’s overseas role, meanwhile, has evolved in a more traditional, espionage-oriented direction. While there is occasional bureaucratic friction between the MOI and IRGC, both share the objective of preserving Iran’s revolutionary Islamist regime and upholding velayat e-faqih, and therefore do cooperate and share intelligence. In recent years, Supreme Leader Khamenei has moved to exert greater control over both the MOI and IRGC as they, in addition to the police and army, form his personal power base within the regime.

According to the Federal Research Division of the U.S. Library of Congress, “MOI is the most powerful and well-supported ministry among all Iranian (cabinet) ministries in terms of logistics, finances, and political support,” although its budget is kept secret. All government agencies, ministries, institutions, military, and police forces are expected to share information and intelligence with the MOI. This includes the IRGC and the Quds Force, which trains and directs terrorist proxies and militias.

The MOI is a cabinet-level agency whose head, the minister of intelligence, is appointed by Iran’s president, the second-ranking official in the Iranian system. This gives the president a degree of authority over the MOI which he lacks over IRGC intelligence. However, a special law dictates that the minister of intelligence must always be a cleric, giving the supreme leader, who sits atop Iran’s clerical hierarchy, additional influence over the ministry.

In 2014, the MOI revealed that the minister of intelligence directs a coordination council that oversees 16 different intelligence agencies. The MOI’s primary functions are the collection and analysis of intelligence; infiltrating and suppressing opposition and dissident organizations; thwarting threats to Iran’s revolutionary order and territorial integrity; and maintaining liaisons with Iranian proxies abroad in order to expand Iran’s ideological influence and abet terrorist and militant operations.

Iranian MOI officers are required to be adherents of the regime’s “Twelver Shia” theology and loyal to the doctrine of velayat e-faqih. Recruits go through intensive background checks to ensure their loyalty to the Islamic Republic before they undergo training at sites in northern Tehran and Qom. The MOI’s Foreign Directorate identifies potential agents outside of Iran sympathetic to the aims of the Islamic Revolution. Willing recruits are then brought to the MOI’s training facilities before being dispatched into their home countries, where they engage in espionage and disinformation campaigns on behalf of the Iranian regime. The MOI’s foreign recruiting pool is primarily drawn from Muslim countries having a strong Shi’a presence (Sunnis are sometimes recruited as well, mostly due to financial motivations), such as Iraq, Lebanon, and the Gulf States, particularly Saudi Arabia, Kuwait, and Bahrain, and extends as far afield as Latin America, which has a sizeable population of Lebanese expatriates.  

The other major power center in Iran’s intelligence apparatus is the IRGC’s intelligence office, which operates apart from the MOI, both domestically and externally through the Quds Force. Although the MOI is constitutionally above the IRGC in Iran’s intelligence hierarchy, in recent years the IRGC’s intelligence office has competed with MOI for power and influence.

Iran’s intelligence agencies are concerned first and foremost with preserving Iran’s internal stability, which they achieve primarily through repression and cultivating a climate of fear and intimidation. The Islamic Republic’s regime perceives the main threats to Iran’s revolutionary order as stemming from ethnic separatist movements and political dissident movements. Since the controversial 2009 election, which saw Khamenei and his principlist backers blame the MOI for failing to prevent and adequately crack down upon the Green Movement protests, the MOI has largely ceded responsibility for domestic security to the IRGC’s intelligence apparatus. While the IRGC has taken the lead, both organizations continue their efforts to surveil and harass ethnic and political opposition, to exert domination over the media landscape, and increasingly, to tighten the regime’s control over cyberspace. While it is not possible to fully prevent the proliferation of new technologies such as Telegram and other social media tools that Iran’s citizens use to circumvent censorship and mobilize against the regime, Iran has worked to ensure that the only social media applications that work properly are those that they can electronically infiltrate.

Combating Ethnic and Religious Dissent

One of the primary challenges facing Iran’s revolutionary regime is maintaining unity in a nation fractured along ethnic and sectarian lines. While Iran is commonly perceived as a Shi’a Muslim and Persian nation and its ruling regime governs on this basis, in actuality, only around 60% of Iran’s population are ethnically Persian. Roughly 8% of the population is Sunni. Iran’s ruling regime views the country’s ethnic diversity as a weakness and therefore seeks to enforce control by imposing its revolutionary religious ideology and ethnic nationalism on its variegated populace.

Iran is unique in that its 80 million people are largely concentrated in mountain regions, as its lowlands are largely uninhabitable. Iran’s mountainous terrain provides a natural buffer for the country’s large numbers of ethnic groups seeking to retain their distinctive cultures and characteristics and resist absorption and assimilation efforts by the centralized state.

Some of Iran’s non-Persian citizens regularly face political and economic discrimination and human rights abuses from Tehran. Minority communities on the country’s periphery, such as Iran’s Kurdish, Arab, and Baloch provinces are largely administered by outsiders, lag behind the industrialized core economically, suffer from uneven distribution of welfare and social services, and are subject to harsher applications of justice and a disproportionate number of executions. This state of affairs fuels anger against the central government, providing ideal conditions for subversion and ethnic separatist movements to flourish.

Despite the patina of rights provided by parliamentary representation, Iran treats demands for equality from its ethnic and religious minority populations as a threat to national security, and Iran’s typical response to outward expressions of discontent is repression. One of the core duties of MOI officers is to “surveil and infiltrate Iran's ethnic minorities, especially the Baluchs, Kurds, Azeris and Arabs, in search of dissident elements.”

Iran’s intelligence services play a role in upholding a state policy known as gozinesh, which forms the basis of state discrimination against ethnic and religious minorities, preventing them from full participation in Iranian civil life. Gozinesh is an ideological selection procedure that requires Iranian citizens to declare and demonstrate allegiance to Islam, the Islamic Republic, and velayat-e faqih as a prerequisite to becoming a state official or public sector employee. In many instances, the gozinesh process is also used to prevent minorities from opportunities in the private sector and from furthering their education. Intelligence officials from the MOI and IRGC are reportedly tasked with conducting ideological purity tests of minority citizens seeking things such as permits to open a business or a place in a public university, denying those who are determined to be insufficiently loyal.  

According to the U.S. Department of State’s 2017 Report on International Religious Freedom, Iran’s government “continued to harass, interrogate, and arrest Bahais, Christians (particularly converts), Sunni Muslims, and other religious minorities and regulated Christian religious practices closely.” The report indicates that Iran’s revolutionary regime views all religious expression that deviates from the official state-sanctioned Twelver Ja’afari Shi’a Islam as threatening its grip on power, and frequently uses the intelligence services for intimidation purposes. The regime is particularly harsh when it comes to allegations of proselytization by religious minorities.

Among the report’s findings, MOI harassment and intimidation of Sunni clerics in Kurdish provinces led the Council of Sunni Theologians of Iran to suspend its operations in July 2017. The state puts up barriers to the construction of Sunni mosques, driving Sunnis “underground” to ad-hoc prayer rooms and rented spaces. Intelligence and security officials regularly raid these unauthorized sites. Intel officials reportedly sealed one of the nine Sunni mosques operating in Tehran in June 2017, preventing its 1000 regular attendees from praying there.

Sufis have similarly been largely driven underground by Iran’s clerical regime. Numerous abuses at the hands of Iranian intelligence services have been documented, including arbitrary arrests and attacks on Sufi places of worship. MOI agents stand accused of keeping detained Sufis in solitary confinement for prolonged periods, harsh interrogations, and limiting bathroom usage and feedings to once a day. An August 2017 report by the UN Special Rapporteur on the situation of human rights in Iran further found that Sufi university students and professors were “reportedly victims of attacks carried out by security forces and subjected to threats by the intelligence unit of the Revolutionary Guards.”

Bahá’ís and Christians face similar persecution by the regime and its intelligence services. Considered the most persecuted of all of Iran’s religious minorities, the Bahá’í are routinely victimized because their beliefs are perceived as “deviant” and entirely contrary to Shi'a Islam as interpreted by the Iranian theocracy. Since 1979, Iranian authorities have killed more than 2,000 Bahá’í leaders, arrested and imprisoned thousands more, and dismissed more than 10,000 Bahá’í from government and university jobs. The Bahá’í are subject to arbitrary arrest, officially for “security reasons,” because government officials claim they are “an organized establishment linked to foreigners, the Zionists in particular.”

MOI and IRGC intelligence agents reportedly conducted frequent raids targeting Bahai homes and businesses. As of September 2017, 97 Bahá’ís were imprisoned by the Iranian clerical regime on the basis of their professed faith and at least 15 of the prisoners were transferred to a prison section “equipped with added security features, including surveillance cameras and microphones in toilets and showers.” MOI agents arrested a prominent Bahá’í singer upon returning to Iran from a concert tour in Europe for allegedly celebrating the life of Baha’u’llah, the founder of the Bahá’í religion. The singer was charged with “propaganda against the state,” “disturbing public opinion” and “membership in the illegal Bahai organization.” He was held in solitary confinement for a month in the MOI’s wing, Ward 209, in Tehran’s notorious Evin prison, and was interrogated 20 times for three to four hours at a time during his ordeal.

The regime is apprehensive over the growing—yet still less than one percent—number of Christians in Iran, which it fears may influence Muslims to convert (in Iran, a Muslim that converts away from Islam is an apostate that faces the death penalty). IRGC and MOI intelligence agents have arrested hundreds of Iranian Christians since the 1979 revolution. Christians in Iran have been driven largely underground by the regime’s harassment and persecution regime. Official reports and state media have characterized the networks of house churches that have arisen to serve Christian communities as “illegal networks” and “Zionist propaganda institutions.” Authorities have moved to close churches and restrict Farsi-language services, only nominally permitting worship in the Armenian and Assyrian languages.

The government is especially suspicious of Protestant and evangelical groups, which the state does not recognize as Christian. According to the U.S. Department of State, evangelicals, particularly converts from Islam, face “disproportionate levels of arrests and detention, and high levels of harassment and surveillance.” Both MOI agents and plainclothes IRGC intelligence officers have raided and arrested worshippers attending services at home churches in the past several years.

Combating Political Dissent

In addition to repression of religious minorities, one of the primary preoccupations of Iran’s civilian and IRGC intelligence services is stifling reformist/counterrevolutionary political dissent. In the immediate post-revolutionary period, the IRGC took the lead in cracking down on MEK, communist, and pro-monarchical violent counterrevolutionary elements. The regime ultimately purged thousands of prisoners, the majority of whom were MEK members, over a five month period in 1988. A four-man judicial panel was tasked with administering the executions, and the MOI’s representative at Evin prison, Mostafa Pourmohammadi, was one of the members of the so-called “death committee.” Pourmohammadi would go on to serve as former President Hassan Rouhani’s minister of justice during his first term in office. Current President Ebrahim Raisi, the main principlist presidential candidate in 2017 and a possible potential successor to Supreme Leader Khamenei, served on the panel as well.

“Chain Murders”

With the MEK, communist, and pro-monarchical threats minimized or driven outside Iran’s borders, the next challenge facing Iran’s intelligence apparatus was confronting calls for more political and cultural openness by the reformist camp. During the years 1988-1998, more than 80 prominent writers, dissidents, and intellectuals outspokenly critical of the velayat-e faqih regime were killed or died in suspicious circumstances. The deaths, spread out over the course of a decade, were carried out in a variety of ways and were designed to be seemingly unrelated.

The first apparent victim of the killings was Dr. Kazem Sami Kermani, an Islamic nationalist politician and physician who opposed the Shah, and later, the Islamic Republic. Sami served as health minister in the provisional post-revolutionary government of Prime Minister Mehdi Bazargan, resigning his post when Bazargan stepped down. He was then elected to the first majles (parliament), where he criticized the Islamic Republic and Khomeini’s policies. In 1982, Sami penned an open letter to Khomeini castigating him for not ending the Iran-Iraq War. Sami was murdered by an axe-wielding assailant posing as a patient in his medical clinic in November 1988.

In 1990, a religious intellectual critical of the regime’s ideological innovations to Shiism was summoned to the MOI for questioning and was not heard from again until his body was found on a rural road with a bullet in the head. In December 1994, a Christian apostate sentenced to death was released by Iran due to an international outcry, only to be found dead seven months later. A group of 134 writers published an open letter in 1994 calling for the abolition of censorship; many of the signatories subsequently died in mysterious circumstances. Other apparent victims died in suspicious car accidents, falls from high buildings, and heart attacks (which were later found to be brought on by injections of air or other toxins). One such heart attack victim was Ahmad Khomeini, the Ayatollah’s youngest son who went into cardiac arrest in March 1995 at the age of 49. Ahmad Khomeini’s death occurred a month after he gave a speech criticizing the regime’s principlist backers.

Finally, in late 1998, a series of connected murders known as the “chain murders” took place which led to the exposure of the MOI’s role in the decade-long serial killing of intellectuals and dissidents. After Supreme Leader Khamenei ordered the closure of a reformist daily newspaper and the arrest of its employees as “enemies of God,” a group of journalists moved to form a writer’s association. The leaders of the effort were summoned to the Tehran public prosecutor for interrogation in October 1998 and over the next two months, five writers tied to the association were violently killed. Reformist President Mohammad Khatami formed a committee to investigate the murders and it was discovered that Saeed Emami, the deputy intelligence minister when the killings took place, led a team of intelligence agents who carried out the “chain murders” as well as most, if not all, of the roughly 80 suspicious deaths during the prior decade. Emami had carried out several of the murders himself, including that of Ahmad Khomeini, according to the military prosecutor who tried his case.

The MOI was forced to issue an unprecedented statement affirming its role in the targeted assassination campaign, but it sought to portray the killings as the actions of rogue elements. The MOI’s January 1999 acknowledgement pinned the blame on “a small number of irresponsible, misguided, headstrong and obstinate staff within the Ministry of Intelligence, who are no doubt under the influence of rogue undercover agents and acting towards the objectives of foreign and estranged sources when committing these criminal acts.”

The time period of the serial killings coincided with a concerted targeted assassination campaign against Iranian dissidents abroad, leading many to believe that the domestic and external killings were linked. Investigative reporting by Iranian journalists Akbar Ganji and Emad Baghi revealed that many prominent figures in the regime had knowledge of and backed the “chain murders,” including former President Rafsanjani and his intelligence minister, Ali Fallahian. Gholam-Hossein Mohseni Ejei, who would later serve as intelligence minister during Mahmoud Ahmadinejad’s first presidential term, was involved as well, according to Ganji.  

Emami and his subordinates in the assassination ring were imprisoned when their culpability came to light. In June 1999, Emami died by suicide while in regime custody, by ingesting a hair-removal cream, according to official reports. However, according to famed Iranian human rights attorney Shirin Ebadi, the lawyer for one of the families killed in the chain murders, the compound variant sold in Iran that Emami allegedly ingested would not have been lethal. The suspicious nature of Emami’s death has led to speculation that he was killed to cover up knowledge of the actual masterminds of the chain murders or knowledge of other MOI operations that could have implicated high-ranking regime officials.

The regime went on to target the journalists who played a part in exposing the systematic campaign of assassinations of regime critics and the involvement of higher-ranking officials. Emad Baghi served a three-year prison sentence for “propaganda against the Islamic Republic" and "divulging state secret information." Akbar Ganji served six years in Evin prison. He alleged during his trial that during his pre-trial detention, he had suffered torture and abuse by guards, was placed in solitary confinement for three months, and was denied visitation by his family and lawyers. Authorities banned three reformist newspapers—salam, Khordad, and Sobh-e Emrooz—for reporting details of the chain murders period. The editor of Khordad was jailed for three years and Saeed Hajjarian, the editor of Sobh-e Emrooz, survived an assassin’s bullet to the face in March 2000 that left him wheelchair-bound for life. The assassination attempt seemed to indicate that the remnants of the intelligence community behind the chain murders remained at-large.

Following the exposure of the intelligence community’s role in a decade-long assassination campaign inside and outside of Iran, President Khatami fired Fallahian’s successor as intelligence minister, Ghorban-Ali Dorri Najafabadi, whose appointment had effectively been imposed on him by Supreme Leader Khamenei. Najafabadi had carried on the assassination campaign inaugurated by Fallahian and was in charge of the MOI when it carried out the “chain murders” of 1998. The black eye suffered by the exposure of the targeted assassination campaign led Iran’s intelligence ministry to draw back from pursuing such prominent operations, but its general repression, harassment, and intimidation of dissent continued unabated.

1999 Student Protests

The exposure of the chain murders, the crackdown on reformist news outlets, and general dissatisfaction with President Khatami’s failure to deliver political and social reforms catalyzed an unprecedented protest movement in Iran centered on universities. On July 7, 1999, the regime shuttered the reformist daily Salam, triggering student demonstrations that grew to be the largest witnessed in Iran since the 1979 revolution.

The intelligence offices of both the IRGC and the MOI played a leading role in suppression of the 1999 student demonstrations. As the uprising crystallized, IRGC officers sent a letter to President Khatami signaling their intent to crack down on protestors, warning they would not tolerate "hypocrites and opponents...gathering in regiments in the name of 'students.'… "With complete respect and endearment toward His Excellency [Khatami], we declare that our patience has come to an end, and we will not permit ourselves any more tolerance in the face of your inaction."

The violence surrounding the 1999 student uprising began during the early morning hours of July 9, 1999. The previous day marked the start of the protests, with groups of Tehran University students peacefully demonstrating against the closure of Salam. Shortly after midnight, around 400 baton-wielding anti-riot police and plainclothes MOI operatives stormed a student housing complex of Tehran University and began wantonly attacking students and destroying property. At least five students were killed, some of whom were reportedly thrown off balconies, and 200 were arrested.

The dorm room attack catalyzed five days of student-led anti-regime protests which spread to 18 Iranian cities. The protests began losing steam by July 13, by which point the regime had begun conducting widespread arrests among the pro-democracy activists. President Khatami disowned the protests and called for them to end, issuing a statement that the demonstrations were an attack on the foundations of the regime and accusing its leaders of harboring “evil aims.” Despite Khatami’s disavowal, the protestors returned to the street where they were violently confronted by law enforcement, MOI anti-riot special units, and thousands of Ansar-e Hezbollah members. The following day, the regime mobilized tens of thousands of supporters—many who were reportedly government workers given the day off and bussed to Tehran—for a countervailing demonstration and show of force. The counter-protestors succeeded in taking back the streets, and many of the pro-reformist demonstrators who showed up were beaten and/or detained. Notably, then-Secretary of the Supreme National Security Council Hassan Rouhani, addressed the counter-protestors, vowing to punish the “rioters” and threatening them with the death penalty. 

The regime detained at least 1,200–1,400 students during the course of the protests. Some of those detained were beaten and tortured and forced to sign confessions. Several detainees were sentenced to Evin prison and at least one of them, Akbar Mohammadi, died there. Mohammadi was released from Evin in 2004 due to health complications that arose from torture, but was rearrested without warning in 2006. He underwent a hunger strike to protest his rearrest and died within a week. Several detained individuals remain missing.

2009 Green Movement Uprising

After the student protests were pacified, Khamenei and his conservative clerical allies were critical of the MOI for fostering an environment too lenient on dissent. Khatami’s chosen intelligence minister, Ali Yunesi, was despised in conservative circles for his perceived liberal views, and for seeking to rein in corruption within the MOI. According to a Stratfor analysis, the supreme leader curtailed the MOI’s influence and “gave the IRGC control of the former MOI intelligence officers and networks.” Following Mahmoud Ahmadinejad’s ascendance to the presidency, the MOI reestablished its independence under the leadership of intelligence minister Gholam Hossein Mohseni-Ejei, a figure suspected of backing the “chain murders” campaign. Ejei oversaw a crackdown on reformist dissent during his tenure.

Despite the ongoing repression of reformists, the 1999 mass student movement crystallized forces in Iran that were not fully purged but lay dormant for a decade. In 2009, the former student movement, in concert with elements of the reformist movement and disaffected middle-class Iranians coalesced in the form of the Green Movement, a massive protest movement that formed in response to Ahmadinejad’s victory over reformist candidate Mir-Hossein Mousavi in a highly irregular election.

The regime was caught off guard by the groundswell of opposition that emerged and was initially slow to react, taking two weeks to develop a strategy to quell the protests. The IRGC’s newly upgraded intelligence organization (see Section 1) was tasked with the leading role in suppressing the Green Movement protests. On the day of protests, the regime would exert the maximum amount of violence without killing protestors to scare people off the street.  The Basij Security Directorate, acting under the aegis of the IRGC intel organization, served as the primary authority arresting demonstrators, bringing many to temporary prisons and beating them up violently. The Basij would then release most of the detained protestors, who would go on to warn their family and friends of their mistreatment, slowly reducing the amount of people willing to take the risk. The Basij also shot protesters with live ammunition and rubber bullets, fired tear gas and pepper spray at them, and hit them with clubs, batons, and baseball bats. Over time, the IRGC intelligence organization identified the network nodes of the Green Movement, which was predominantly organized online. The IRGC arrested many of the movement’s leaders and sought to coerce their cooperation by threatening long prison sentences.

The IRGC detained political prisoners in ward 2A of Evin Prison, which it controls and operates in extreme secrecy. According to a Wall Street Journal report, “Lawyers have said the ward is off-limits to prison guards, the judiciary and even the intelligence ministry. Journalists working in Iran during the election protests were warned by the information ministry that the Revolutionary Guard had taken over security. If arrested, reporters were told their contacts at the intelligence ministry wouldn't be able to locate them or help release them.”

The Iranian regime admitted to detaining 4,000 protesters during the 2009 demonstrations. The actual number of detentions remains unknown. Those detained included dissident politicians and clerics, journalists, bloggers, lawyers, students, and other activists. Iran’s chief of police admitted that detainees were tortured, with reports alleging rape, beatings, sleep deprivation, and other atrocities. Several detainees died in custody. With its brutal tactics, the regime effectively suffocated the Green Movement, preventing its reemergence to present day.

Under Hossein Taeb’s leadership, the IRGC intelligence organization’s power continued to grow since the Green Movement protests were suppressed. Capitalizing on fears of Western infiltration, the IRGC intel organization has broadened its interrogation and arrest powers, and subsequently abused its newfound powers to investigate and arrest thousands of Iranian citizens accused of ties to Western intelligence agencies.

Iran’s intelligence agencies moved to tighten their control over Iranians’ internet access in the wake of the Green Movement protests, which relied heavily on social media (a relatively new phenomenon at the time) for coordination. The IRGC severely curtailed access to mobile communications and the internet in the aftermath of the 2009 presidential election. Tehran first shut down internet access entirely and then restored it with diminished bandwidth. Iran also operated filters that blocked access to social media platforms like YouTube and Facebook, and blocked proxy servers that Iranians used to evade internet controls.

The IRGC’s role in surveillance and internet censorship has expanded since the 2009 protests. Iran privatized its internet sector in 2009 and the IRGC used a shell corporation, the Mobin Trust Corporation, to acquire a controlling stake in the Telecommunication Company of Iran, the nation’s primary service provider, giving the IRGC the ability to effectively monitor Iranians’ Internet communications. According to a report in the Journal of Strategic Security, “The IRGC has also launched its own official website, Gerdab, which it uses to track the activities of suspected dissenters and to post public denouncements of them. Moreover, the IRGC also controls the Center for the Surveillance of Organized Crime and the Working Group for Determining Criminal Content, powerful groups with broad powers to censor and track Internet users, through the IRGC Intelligence Organization’s Cyber Defense Command.”

2017-2018 Protests

In late December 2017, a new Iranian protest movement crystallized as demonstrations broke out in the city of Mashhad over rising inflation and unemployment and spread throughout the country. The demonstrations included elements of previous Iranian protest movements, but also, for the first time, featured many elements that did not previously protest and were assumed to be natural regime supporters, such as low-income families dependent on social welfare benefits. The MOI and IRGC intelligence organization both played a role in combatting the unrest. The IRGC sought to block access to the Instagram and Telegram social-media platforms, which Iranians were using to share information about the protests. MOI agents reportedly arrested more than 90 individuals during the protests, primarily university students.  

Some detainees were reported being held in solitary confinement and denied contact with lawyers, and there were also reports of sentences being handed down based on coerced confessions. A 23 year-old man, Sina Ghanbari, died in custody in Evin prison. Officials claim he hanged himself, but it is impossible to corroborate their version of events. Another protestor, 24 year-old Saro Ghahremani, was arrested at a demonstration in Iran’s Kurdish province. Eleven days later, his corpse was returned to his family showing signs of torture. His father was subsequently forced to issue a coerced confession on the Islamic Republic of Iran Broadcasting (IRIB) claiming that his son was part of an outlawed armed Kurdish faction, a charge which his family denies.

2019-2020 Protests

In November of 2019, many Iranians around the country took to the streets to protest the government’s steep increase in the price of gasoline, as well as rationing thereof. Facing protests in Iraq and Lebanon that were at least in part driven by opposition to Iranian meddling in those country’s affairs and with Iran’s economy deteriorating, Supreme Leader Khamenei immediately called upon the IRGC, basij, and Iranian intelligence organizations to rein in the demonstrations. Iran’s intelligence ministry released a statement early on that, “key perpetrators of the past two days’ riot have been identified and proper action is ongoing.” Iranian security and intelligence forces moved quickly to suppress the protests and, according to a report in Reuters, may have killed nearly 1500 protestors.

Security and intelligence forces conducted mass arrests during the protests and in the weeks that followed. The government announced that it had arrested over 1000 just in the first three days of the protests. According to Amnesty International, security and intelligence forces continued conducting raids targeting the homes and workplaces of suspected demonstrators, weeks after the protests died down. Amnesty further reported that many protestors were detained incommunicado and denied access to their families or lawyers, and alleged that many detainees were subject to ill treatment, torture, and beatings. Security and intelligence agents reportedly staked out hospitals, demanding the names of new admittees and arresting presumed protestors who came in with injuries, potentially preventing them from receiving needed care.

The November protests were also notable because of the Iranian government’s decision to restrict internet access in order to thwart efforts at organizing demonstrations and to prevent reports and images of the government’s brutality from being disseminated. According to NetBlocks, a group that monitors worldwide internet access, the Iranian internet disruption was “the most severe recorded in Iran since President Rouhani came to power, and the most severe disconnection tracked by NetBlocks in any country in terms of its technical complexity and breadth.”

In January 2020, protestors returned to the streets after the Iranian government attempted to cover up its role in the downing of a Ukrainian airliner. Iranian authorities reportedly fired on demonstrators with live ammunition and rubber bullets, deployed tear gas against them, and beat them. Amnesty International reported that scores of protestors were arrested around the country. They further reported that intelligence and security agents had established a heavy presence in hospitals, leading some hospitals to turn away patients lest they face retaliation for aiding the demonstrators. 

Preserving the Revolution

Even in the international arena, the primary focus of Iran’s intelligence agencies is the domestic imperative of preserving the revolutionary regime. Political and ethnic dissident groups of various stripes are active abroad, and the MOI plays the leading role in monitoring, infiltrating, and sabotaging these groups on foreign soil.

Following the Islamic Revolution, Ayatollah Khomeini’s newly installed Revolutionary Council immediately set about trying to eliminate potential nodes of opposition and as part of that effort, Iranian intelligence agents abroad undertook a campaign of targeted assassinations against exiled dissidents. According to the Iran Human Rights Documentation Center, Iranian intelligence agents have been linked to the assassination of at least “162 monarchist, nationalist, and democratic expatriate activists” in 19 different countries. A detailed accounting of the known victims of Iran’s international assassination campaign and its perpetrators can be found here.

The earliest targets of the assassination campaign were monarchists critical of the revolutionary regime. In December 1979, Prince Shahriar Shafiq, a 34-year-old nephew of the Shah, was shot to death in Paris, France, the first victim of extrajudicial assassination abroad. Shafiq was forced into exile due to his efforts to organize resistance to Khomeini’s revolutionary government, activities which he continued upon his arrival in France. On his way to visit his also-exiled mother’s apartment, a gunman concealing his identity with a motorcycle helmet shot him twice, killing him. Ayatollah Sadegh Khalkhali, a prominent regime official who served as the first religious magistrate of Iran’s revolutionary courts, published a statement in the hardline newspaper Kayhan claiming that members of the faction he led, fadaiyan-i Islam (Devotees of Islam), were behind the killing. Khalkhali further vowed that his guerilla fighters would continue to target former regime figures.

In July 1980, Khomeini’s agents struck in Bethesda, Maryland, a suburb of Washington, DC. Ali Akbar Tabatabai, a diplomat who served as the country’s press attaché in Iran’s US embassy under the Shah was shot and killed in his home by Daoud Salahuddin, an African-American Baptist convert to Islam sympathetic to Khomeini’s Islamic Revolution. Tabatabai became a prominent critic of Khomeini following the Islamic Revolution and founded the Iran Freedom Foundation, an organization that advocated for replacing Khomeini’s regime with a secular democracy. According to his assassin’s account, Salahuddin accepted several thousand dollars from a representative of Khomeini’s government to carry out the plot, which involved disguising himself as a postal worker. After executing the assassination, Salahuddin’s accomplices helped him escape to Iran via Canada and Switzerland. He has lived in Iran as a fugitive shielded from justice by the Iranian regime to present day. In 2007, Salahuddin was the last known person to have had contact with Robert Levinson, a former FBI agent who remains missing in Iran.      

Revolutionary paramilitary organizations such as fadaiyan-i Islam formed the basis of Iran’s early intelligence community, and they pursued regime opponents abroad on an ad hoc basis. Upon the creation of the MOI, the assassination campaign became a “coordinated government action in which Iranian intelligence officers and soldiers of the Revolutionary Guards’ elite Quds Force provided the tip of a spear wielded against the opposition by the Special Affairs Committee, an extraparliamentary body comprised of some of the most powerful executive political figures in the country.”

The MOI-led assassination campaign would continue until 1999. The international campaign increased in scope and intensity during the period concurrent with the “chain murders” in Iran, from 1988-1998. The increasing reliance on assassinations was largely the handiwork of President Rafsanjani’s intelligence minister Ali Fallahian, who was also the chief architect of the domestic assassination campaign against regime opponents. After the MOI was purged of many of its most hardline staffers in the wake of the discovery of the chain murders, the international assassinations tapered off as well.

One of the more sensational assassinations during this period took place in Switzerland in April 1990 and targeted Kazem Rajavi, the brother of MEK leader Massoud Rajavi. Two cars ran Rajavi’s vehicle off the road, after which armed gunmen exited one of the cars and executed Rajavi. Swiss investigators issued a report naming 13 suspects believed to be Iranian intelligence officers. According to the report, “all 13 came to Switzerland on brand-new government service passports, many issued in Tehran on the same date. Most listed the same personal address, Karim-Khan 40, which turns out to be an intelligence ministry building.”

In August 1991, Iranian operatives stabbed to death one of the most prominent exiled opposition figures, Dr. Shapour Bakhtiar, and his secretary in his Paris apartment. Bakhtiar was a political opponent of the Shah who the Shah appointed as his final prime minister in a last-ditch effort to prop up his crumbling government at the end of 1978. During his short-lived tenure, Bakhtiar sought to rapidly implement political reforms in an effort to pacify Khomeini’s revolutionary forces. Khomeini, insisting on nothing less than the overthrow of the monarchy, rejected Bakhtiar’s government and denounced him for collaborating with the Shah. Bakhtiar fled Iran shortly after the Islamic Revolution in April 1979.

Bakhtiar was one of the former regime figures marked for assassination by Ayatollah Khalkhali, the first magistrate of Iran’s revolutionary courts immediately following the revolution. Upon his emergence in Paris, Bakhtiar founded and led the National Movement of the Iranian Resistance. This organization connected Bakhtiar to Ali Akbar Tabatabai, who served as Bakhtiar’s primary spokesman in the US In July 1980, Khomeini thwarted a coup plot led by Iranian military officers at the Nojeh air base which Bakhtiar was accused of backing. Shortly thereafter, Bakhtiar survived the first assassination attempt on his life by Khomeini’s agents. One of the would-be assassins later implicated the Iranian regime in the plot, stating in a 1991 interview, “I had no personal feelings against Bakhtiar … It was purely political. He had been sentenced to death by the Iranian Revolutionary Tribunal. They sent five of us to execute him.” In 1991, three Iranian operatives were dispatched for another assassination attempt on Bakhtiar, this one successful. Two of the assassins escaped to Iran while the third was apprehended in Switzerland and extradited to France. The assassin received a life sentence, but was paroled in 2010 and subsequently repatriated to Iran.  

Perhaps the most “daring and public“ incident during this time period was the elaborately planned assassination of four Kurdish democracy activists at the Mykonos Restaurant in Berlin, Germany on September 17, 1992. The Mykonos plot was carried out by a Hezbollah cell acting under the orders of the Iranian government and with direct participation by MOI operatives. An Iranian defector with ties to the security establishment alleged that the decision to carry out the attack was made by Iran’s Special Affairs Committee, which included President Rafsanjani, Intelligence Minister Fallahian, former Foreign Minister Ali Akbar Velayati, and Supreme Leader Khamenei himself. In the run up to the attack, Fallahian gave a series of interviews in which he boasted that Iran surveilled dissidents abroad and had already eliminated some top regime opponents.

An MOI operative trained in Lebanon led the “attack group” behind the Mykonos assassination and served as one of the two gunmen. The other gunman, and many of the co-conspirators in the attack were Hezbollah members based in Germany. The MOI was instrumental in the logistics of the attack, conducting surveillance of the targets and securing the weapons and silencers used. Following Germany’s investigation into the attack, the federal prosecutor issued an arrest warrant for Ali Fallahian for ordering the attack. Khamenei, Rafsanjani, and Velayati would also be charged for their roles in the plot in November 1996.

The revelation of the MOI’s role in the chain murders, along with rising international condemnation and pressure from countries where Iranian intelligence operatives had carried out assassinations, led the Islamic Republic to abandon the practice by 1999. Since that time, Iran’s external intelligence apparatus has shifted its focus to harassment, intimidation, and delegitimization of dissidents abroad.

Embedded Iranian intelligence agents “have been known to monitor dissidents by infiltrating and observing their meetings and speeches, and MOI officers often want dissidents to know they are being watched so that they will be intimidated.” Iranian intelligence frequently engages in disinformation campaigns to tarnish the reputation of dissident groups abroad and to sour their relations with host countries, a tactic it learned from the Soviet KGB. In 2013, for instance, at the Obama administration’s urging, Albania offered asylum to up to 2000 Iranian MEK dissidents. In response to their presence, Iranian media outlets began publishing articles in Albanian meant to discredit the MEK. In May 2017, the Islamic Republic of Iran Broadcasting (IRIB) announced the launch of a 24-hour Balkan Network featuring Bosnian and Albanian language programming meant both to propagate the Iranian regime’s religious and geopolitical worldview, and to influence public opinion against the MEK.

Iran has also launched complex operations in recent years to lure dissidents into third countries, which offer Iranian intelligence a permissive environment, and to kidnap them while there. Recent cases include the late dissident journalist Ruhollah Zam, the son of a former regime official, who ran a popular Telegram channel called Amad News. Beginning in 2011, Zam had lived in exile in France under police protection. In 2019, he was lured to Iraq with false promises of funding for a media project, and abducted there by the IRGC. Zam was later executed in December 2020 for the crime of “corruption on earth.”

The regime also kidnapped Jamshid Sharmahd, a California-based operative of the Kingdom Assembly of Iran’s Tondar opposition group, in Dubai. After, based on cell phone data, Iranian operatives took him to Oman and then to Iran. The regime accused Sharmahd, a German citizen, of complicity in a 2008 attack on a mosque, but Sharmahd’s family denies the allegation, saying he was merely a spokesman for the group. A similar modus operandi was employed in Iran’s abduction of Habib Chaab in Turkey. Chaab, a founder of the Arab Struggle Movement for the Liberation of Ahvaz (ASMLA) and a Swedish citizen, was lured to Istanbul using an MOI “honey trap.” This entailed the use of a female Iranian spy who enticed Chaab to travel to Turkey under the pretext of a romantic meeting. He was then kidnapped and smuggled across the border into Iran. There, he appeared on state television, with an alleged coerced confession to engaging in terrorism. Thus, the IRGC and MOI have both been using this tactic.

Iran made the decision to spread its revolutionary ideology through terrorism and subversion in the early years following the Islamic Revolution. At a 1982 conference in Tehran, former IRGC commander Javad Mansouri proclaimed, “Our revolution can only be exported with grenades and explosives.” In the same speech, Mansouri called upon Iran to transform every Iranian embassy into an intelligence center and a base to export the revolution.

The regime adopted Mansouri’s strategy, and as a result, Iran seeks to embed undercover intelligence agents and IRGC operatives in its foreign embassies, which are often heavily scrutinized by host countries. According to Stratfor, “Iran includes large intelligence sections in its embassies and missions, and official cover often includes positions in the Foreign Ministry abroad. … The MOI also employs non-official cover for its officers, including those of student, professor, journalist and employee of state-owned or state-connected companies (e.g., IranAir and Iranian banks).”

In communities where Iran has an embassy or consulate, it typically also operates an interconnected web of mosques, cultural centers, educational institutions, charities, and media organs. Many of these organizations double as fronts for the MOI and IRGC-IO to embed agents. Within these institutions, Iranian intel operatives fulfill a number of foreign policy objectives on behalf of the Iranian regime.

Among their primary duties, Iranian agents seek out and establish ties to potential recruits from local communities sympathetic to Iran’s Islamic Revolution for training and indoctrination oriented toward radicalization. Recruitment often occurs at business conferences and religious or cultural events. These recruits in turn provide the Iranian regime a support base in host countries, and Iran’s intelligence services pay for the most ideologically committed individuals to travel to Iran for specialized religious and paramilitary training. Iran’s recruits can then use the cover of the Iranian-funded and directed religious, cultural, and educational institutions to establish networks and exchange lessons learned. Iran is able to plug some recruits into existing Hezbollah networks, where they assist the global terrorist organization in its criminal and violent exploits.   

Another function of embedded Iranian intelligence agents is to provide logistical and operational support for Hezbollah terrorist attacks in conjunction with the IRGC-Quds Force. The 1992 and 1994 bombings in Buenos Aires of the Israeli embassy and AMIA Jewish Community Center provide a case study for the modus operandi of Iran’s intelligence services in facilitating terrorist attacks.

In the mid-1980s, Iran dispatched a committed revolutionary, Mohsen Rabbani, to Latin America to build out “an intelligence system that would report to the Iranian Embassy in Buenos Aires and then up to Tehran.” Serving as the imam of a major Iranian-directed mosque, Rabbani propagandized on behalf of Iran’s revolutionary government, cultivating and training disciples willing to conduct espionage and subversive activities to further Iranian objectives. The intelligence network formed by Rabbani and his disciples provided logistical and operational support to the embedded Hezbollah network that carried out the 1992 and 1994 bombings targeting Buenos Aires’s Jewish/Israeli community. Rabbani’s team surveilled locations, provided documentation and communications support to the bombers, and in the case of the AMIA attack, handled all details pertaining to the purchase, hiding, and arming of the van to be used in the bombing.

A subsequent investigation of the bombings by Argentinean prosecutor Alberto Nisman fingered Rabbani, who had built a network of “local clandestine intelligence stations designed to sponsor, foster and execute terrorist attacks,” as the mastermind behind the attacks. Immediately preceding the AMIA bombing, Iran moved to suddenly designate Rabbani as the Cultural Attaché to the Iranian Embassy in Buenos Aires, accordingly granting him a diplomatic passport. This hasty appointment enabled Rabbani to use the cover of the Iranian embassy “to go about providing material support for the operation with relative ease, while at the same time guaranteeing him diplomatic immunity following the attack.”

Nisman’s report further concluded that “the decision to carry out the AMIA attack was made, and the attack was orchestrated, by the highest officials of the Islamic Republic of Iran at the time, and that these officials instructed Lebanese Hezbollah—a group that has historically been subordinated to the economic and political interests of the Tehran regime—to carry out the attack.” An FBI investigation into the attack found that Rabbani used his perch in the office of the Cultural Attaché to stay in frequent contact, under the radar, with the Hezbollah operatives carrying out the attack.

The Iranian officials behind the attacks were the Special Affairs Committee, the same officials who had orchestrated the Iranian campaign of dissident assassinations abroad in venues like Mykonos. Nisman’s findings precipitated the issuance by an Argentinean court of international arrest warrants for nine high-ranking Iranian and Hezbollah officials, including former Iranian President Ali Akbar Hashemi Rafsanjani, former Iranian Intelligence Minister Ali Fallahian, former Foreign Minister Ali Akbar Velayati, and Mohsen Rabbani.

Since the bombings in Argentina, Iran has sought to embed operatives and intelligence contacts throughout Latin America, Europe, and Africa. These agents have helped Iran spread its revolutionary ideology around the world and facilitated terror attacks at the regime’s behest. Between 2011 and 2013, the IRGC-QF and Hezbollah attempted more than 30 attacks on foreign soil, often with assistance from the MOI. Among the targets were American, Saudi, and Israeli interests in the U.S., Thailand, India, Nigeria, Kenya, Bulgaria, and Cyprus. Iranian intelligence operatives or foreign recruits under their command were involved in the scouting of targets and material provision of funds and weaponry/explosives to facilitate the attacks, many of which were thwarted by local authorities.

In October 2011, U.S. agents disrupted an assassination plot allegedly directed by the Iranian government targeting Saudi Arabia’s then-ambassador to Washington, Adel al-Jubeir. The FBI’s investigation into the plot (code named Operation Red Coalition) discovered that Mansoor Arbabsiar, a dual U.S.-Iranian citizen, and Gholam Shakuri, an IRGC-QF commander, were planning to kill al-Jubeir with a bomb at a restaurant. They also planned to subsequently bomb both the Saudi and Israeli embassies in Washington D.C. and were also considering carrying out attacks in Buenos Aires. Arbabsiar was arrested on September 29, 2011 at JFK International Airport, confessing to the plot and receiving a 25-year prison sentence, while Shakuri remains uncaptured.

Similar plots continue to this day. Iran is increasingly engaged in espionage activities on German individuals, for instance. In March 2017, it was reported that the Quds Force intelligence agents in Germany hired a Pakistani student known as Syed Mustafa H. to gather information on pro-Israeli individuals and institutions. The student was asked to surveil former MP Reinhold Robbe, who previously headed the German-Israeli parliamentary group and served as President of the German-Israeli Society. Security authorities suspect that information was gathered for potential retaliatory measures against Israel-friendly individuals in case Israel launched air strikes on Iranian nuclear facilities. Following this incident, police conducted a series of raids linked to 10 other Iranian spy suspects, but no arrests were made.

In early July, 2018, authorities in France, Belgium, and Germany thwarted a planned Iranian terror attack targeting the Paris convention of the National Council of Resistance in Iran, the political wing of the MEK. Two Iranian suspects were intercepted in Belgium carrying 500 grams of explosives to the convention. An Iranian diplomat, Assadollah Assadi—believed to be the MOI station chief in Vienna—was arrested in Germany on suspicion of having contacts with the would-be bombers. The foiled plot bore many of the hallmarks of previous Iran-backed terror plots, including an intelligence official using the diplomatic cover of an Iranian embassy to coordinate the attack. In February 2021, Assadi and his co-conspirators were convicted in a Belgian court for their roles in the plot and given sentences ranging from 15-20 years. The convicted terrorist returned to Iran in late May 2023 in exchange for Iran’s release of various European prisoners, who had been taken hostage on trumped-up charges.

In August 2018, U.S. federal authorities arrested two individuals, Ahmadreza Mohammadi Doostdar and Majid Ghorbani, for acting as agents of the Government of Iran, violating U.S. sanctions, and conspiracy.  According to the arrest affidavit, Doostdar, a dual U.S.-Iranian national, and Ghorbani, an Iranian national with permanent U.S. residency, acted on behalf of the Iranian government “in order to conduct covert surveillance on and to collect information from and about the Mohahedin-e Khalq (MEK) and Israeli/Jewish groups, and to provide this information back to the Government of Iran for the purpose of enabling the Government of Iran to target these groups.” The affidavit detailed the intelligence tradecraft methods employed by the alleged Iranian agents to conceal their activities and detect countersurveillance. Prosecutors allege that Doostdar paid Ghorbani $2000 for photographs he took at pro-MEK demonstrations in 2017.

In October 2018, Denmark’s intelligence service Politiets Efterretningstjeneste (PET) accused an “Iranian intelligence agency” of plotting to assassinate an exiled leader of an Iranian-Arab separatist group on Danish soil in the previous month. The plot was apparently intended as retaliation for a September 22 attack on an Iranian military parade in southwest Iran. The target, however, has denied his group’s involvement in that attack and a different Arab separatist movement has claimed credit. According to Danish and Swedish police, a Norwegian man of Iranian descent was seen in late September taking photographs of the Arab dissident’s residence with the intent of passing on “the information to an Iranian intelligence service with a view to the information forming part of the plans to assassinate the leader.” The Iranian agent was arrested in Sweden on October 21.

In November 2019, an Iranian dissident, Masoud Molavi Vardanjani, was shot dead in Istanbul, Turkey. According to Turkish authorities, Vardanjani had previously worked in cyber security for the Iranian Defense Ministry, but while living in Turkey had launched a campaign to expose financial and moral corruption of senior regime officials. In March 2020, Turkish officials alleged—based on the testimonies of the suspected gunman and other Turks and Iranians detained in connection to the plot—that the killing was carried out at the direction of two Iranian intelligence officers with diplomatic passports at the Iranian consulate in Istanbul. A senior U.S. official concurred with Turkey’s findings, telling Reuters, “Given Iran’s history of targeted assassinations of Iranian dissidents and the methods used in Turkey, the United States government believes that Iran’s Ministry of Intelligence and Security (MOIS) was directly involved in Vardanjani’s killing.”

In March 2020, Afghanistan reportedly expelled two Iranian diplomats for their suspected involvement in intelligence activities on behalf of the Iranian government. One of the diplomats served as the cultural attaché at the Iranian embassy in Kabul and the other was allegedly an influential member of the IRGC Quds Force. 

In June 2020, a former Iranian judge, Gholamreza Mansouri, who was awaiting extradition back to Iran, was found dead at a hotel in Romania. Mansouri, who was notorious for the jailing of journalists, had been implicated in a corruption case in Iran. While investigations are ongoing, indications of foul play have emerged in Tehran. Former Secretary of Iran’s Expediency Council Mohsen Rezaei dubbed his death a “murder” and the editor-in-chief of Mashregh News, which is close to the IRGC, proclaimed “As of today, Romania is a point of strategic depth [for Iran].” A day later, there was an attempted assassination on a Kurdish Iranian dissident, Sadegh Zarza, in the Netherlands. The Dutch government in the past has accused Iran of hiring criminal gangs to target dissidents inside the country.

In August 2020, the domestic intelligence service for the German state of Saarland alleged that Iran had undertaken illicit procurement efforts for weapons of mass destruction and their delivery systems, presumably referring to ballistic missiles, in Germany during the previous year. The agency’s report detailed how countries like Iran embed intelligence staff within Germany through official (embassies and consulates) and semi-official (news agencies, airline offices) channels. According to the report, “The intelligence staff there, supposedly working as diplomats or journalists, conduct open or covert information gathering themselves or provide support in intelligence operations that are carried out directly by the headquarters of the intelligence services in their home countries. … The focus of their respective procurement activities is based on current political requirements or economic priorities.”

The Saarland report followed a June 2020 report from the domestic intelligence agency for the German state of Baden-Württemberg that also alleged Iran was undertaking illicit weapon of mass destruction procurement activities in Germany. The report from the heavily industrialized state noted that German companies should be wary of Iranian front companies seeking to circumvent export controls by obtaining dual use materials and bringing them to bypass countries, such as the United Arab Emirates, Turkey, and China, with the ultimate destination being Iran.

In September 2020, U.S. intelligence reports alleged that Iran is plotting to assassinate the American ambassador to South Africa in retaliation for the January U.S. drone strike that killed IRGC Quds Force commander Qassem Soleimani in Iraq. According to a U.S. government official, Iran’s embassy in Pretoria is involved in the plot which first came to light in the spring. More recently, intelligence about the threat to the ambassador has reportedly become more specific.

Iran has reportedly cultivated an extensive network of spies in South Africa in recent years, embedding agents through Iran’s diplomatic channels in the country as well as covers including Iran Air, the Islamic Republic of Iran Broadcasting and the Islamic Republic of Iran Shipping Lines. Iran’s intelligence activities in the country have included seeking workarounds for international sanctions targeting Tehran, illicit procurement attempts to acquire proscribed missile components through the use of front companies, and establishing confirmed links to terrorist and extremist organizations. According to an assessment by South Africa’s State Security Agency, Iran’s general modus operandi is to use the cover of diplomacy to send and store arms in Iranian embassies and diplomatic missions, recruit among local populations to establish Hezbollah or terrorist cells, and then train these cells to carry out terrorist plots or assassinations, giving Iran a degree of plausible deniability as to its involvement.   

In November 2020, Israel was behind the assassination of Iran’s leading nuclear scientist, Mohsen Fakhrizadeh, according to a U.S. official. The operation represented a monumental intelligence failure for Iran, and has led to the MOI and IRGC-IO casting blame on each other for the lapse. In the time since, Iran’s intelligence services have sought to retaliate through a number of plots targeting Israeli tourists, diplomats, and businessmen abroad.

In January 2021, Indian authorities alleged that the IRGC-Quds Force helped a local Shi’a terror cell carry out a bombing outside the Israeli embassy in New Delhi. The cell, calling itself “Indian Hezbollah,” left a handwritten note near the scene vowing to avenge the killings of Qassem Soleimani and Mohsen Fakhrizadeh.

In September 2021, Cypriot authorities thwarted a plot, which Israel alleges was orchestrated by Iran, involving an Azerbaijani hitman. The hitman had repeatedly staked out an office complex where many Israelis worked, and was captured with a gun and silencer on him immediately before he was about to carry out his killings.

There has also been an uptick in Iran threat reporting in Colombia. In November 2021, Colombian media reported that Israel had evacuated a former intelligence official and diplomat who had recently opened a surveillance technology company in Bogota from the country because he was being surveilled by Hezbollah operatives. According to the Mossad, Hezbollah was seeking to assassinate the former Israeli intelligence official, as well as U.S. diplomats stationed in Bogota. Colombia’s defense minister additionally revealed that Colombia expelled two Hezbollah operatives two months prior who were planning a “criminal act” in the country. The increased Hezbollah activity in Colombia has raised concerns about the group using neighboring Venezuela as a haven to plot terrorist attacks and establish connections to other terrorist and criminal networks. There were additional reports in June 2021 that Colombia’s intelligence agency issued a security alert that two Israeli businessmen were targets of an assassination attempt by a senior Quds Force operative Rahmat Asadi. It remains unclear if there was overlap between the Hezbollah and the Quds Force plots.

Also, in November 2021, an Israeli television network reported that local intelligence authorities in unspecified African countries arrested five individuals who were reportedly planning to attack Israeli targets in Africa. The five suspects reportedly were recruited by the IRGC-Quds Force and given training and unspecified materials in Lebanon before being dispatched to Africa, where they were instructed to pose as religious students and find Israeli interests to attack. The suspects reportedly had traveled to Ghana, Senegal, and Tanzania before their capture. This followed reports earlier in 2021 of Ethiopian authorities thwarting an Iranian intelligence cell that was plotting attacks on Emirati diplomatic facilities in Addis Ababa and Sudan. Likewise, in February 2022, Turkish authorities implicated Iran in a plot to assassinate Yair Geller, an Israeli and Turkish citizen, and businessman, in retaliation for killing Iran’s former Deputy Defense Minister Mohsen Fakhrizadeh.

Separately, Iran continues to eye assassination operations on the U.S. homeland to avenge the death of Soleimani. In March 2022, U.S. media reports suggested that former U.S. Secretary of State Mike Pompeo, former U.S. National Security Advisor John Bolton, and former U.S. Special Representative for Iran Brian Hook have all received federal protection because of “serious and credible threats” to their lives from Iran. According to CBS News, Pompeo’s security detail “rivals one that is typical for a current cabinet member” and that on at least three occasions, a specific threat required security for Hook, most recently in November 2021. Such threat assessments are consistent with the U.S. intelligence community's finding from the Worldwide Threat Assessment of 2022 that Iran remains interested in developing networks inside the United States—an objective that it has pursued for more than a decade.

On August 10, 2022, the U.S. Department of Justice charged an Iranian national and member of the Islamic Revolutionary Guard Corps (IRGC) for plotting to assassinate former U.S. National Security Advisor John Bolton on behalf of the IRGC’s Quds Force. More specifically, he was charged “with use of interstate commerce facilities in the commission of murder-for-hire, and with providing and attempting to provide material support to a transnational murder plot.” Shahram Poursafi, currently at large abroad, attempted to pay individuals in the U.S. $300,000 via a cryptocurrency to murder John Bolton, likely in retaliation for the January 2020 death of Qassem Soleimani, the U.S. Justice Department said. Poursafi allegedly told his recruit that the order to carry out the assassination was sent down through a chain of command, suggesting that he was not a rogue operative within the Quds Force. Poursafi assigned his source with a separate assassination job in March, but the Justice Department has not revealed the target of the second plot. If captured and convicted on both counts, Poursafi faces up to 25 years in prison, and $500,000 in fines.

On June 1, 2023, the U.S. Department of the Treasury announced the designation of several individuals under counterterrorism authority E.O 13224. Mohammad Reza Ansari, an IRGC Quds Force operative, was designated for his involvement in a plot to assassinate two former U.S. government officials, alongside the previously mentioned Poursafi. Additionally, Hossein Hafez Amini, an IRGC affiliate in Turkey, was designated for providing material assistance to Quds Force operations in Turkey through his connections in the airline industry. Furthermore, two senior officials within the IRGC Intelligence Organization were also designated. Rouhallah Bazghandi, the IRGC-IO Counterespionage Department Chief, was designated for his role in planning and overseeing operations in Iraq and Syria, as well as targeting Israeli nationals. Reza Seraj, the IRGC-IO Foreign Intelligence Chief, was designated for his involvement in failed intelligence operations in Asia, along with targeting U.S. and Israeli nationals.

Iran has also stepped up its targeting of Israelis in the aftermath of a string of mysterious deaths inside Iran in May and June 2022, including the deputy commander of the Quds Force’s Unit 840 Hassan Sayyad Khodaei. Khodaei reportedly was responsible for terrorist plots against Israelis in New Delhi and Thailand in 2012, and more recent incidents directed at Israeli diplomats in Turkey, an American general in Germany, and a French intellectual. As Iran has experienced multiple attacks at home, Turkey has emerged as a central launchpad for its attempted attacks and kidnappings of Israelis to restore deterrence. Iran has not only been aiming to strike at diplomats and businessmen in Turkey, but also at tourists. In June 2022, Israel’s Foreign Ministry took the unusual step of asking Israelis to cancel flights to Turkey and return home immediately due to an imminent threat. As Israel’s foreign minister warned, “these terrorists are aimed at vacationing Israelis. They are selecting, in a random but deliberate manner, Israeli citizens with a view to kidnapping or murdering them.”

The Cyber Threat

In 2010, over 15 Iranian nuclear facilities were targeted by the Stuxnet computer virus, a worm jointly developed by the U.S. and Israel that destroyed nearly 1000 centrifuges. The attack exposed the weakness of Iran’s cyber defenses, leading Iran to rapidly seek the advancement of offensive and defensive cyber capabilities. By 2011, Iran created a “cyber command” to combat threats and conduct retaliatory operations. Since that time, Iran has “become increasingly adept at conducting cyber espionage and disruptive attacks against opponents at home and abroad,” according to a Carnegie Endowment report on the Iranian cyber threat. The 2018 Worldwide Threat Assessment of the U.S. Intelligence Community concluded that Iran “will continue working to penetrate U.S. and Allied networks for espionage and to position itself for potential future cyber attacks.”

Iran has carried out cyber attacks against the U.S. on several occasions. In May 2016, the U.S. Department of Justice announced indictments against seven Iranian cyber specialists linked to the Iranian government and Islamic Revolutionary Guard Corps (IRGC) for cyber attacks against U.S. banks and a New York dam. The men were accused of carrying out distributed denial of service attacks in which they hacked into bank servers and clogged it with data, preventing legitimate traffic, against 46 U.S. financial institutions, and attempting to hack into the control system of a New York dam between 2011 and 2013. In 2014, Iranian “hacktivists” carried out a data deletion attack against the network of a Las Vegas casino owned by Sheldon Adelson, an outspoken opponent of Iran’s nuclear program. The scope and sophistication of the attack indicated knowledge by the Iranian government, given the regime’s strict controls over internet usage. In March 2018, federal prosecutors unsealed indictments against nine Iranians accused of carrying out cyber attacks on behalf of the IRGC who stole data for financial gain from “144 American universities, 36 American companies and five American government agencies.”

In August 2018, Facebook and Twitter purged hundreds of Iran-based groups and accounts that appeared to be part of a coordinated, inauthentic effort linked to Iranian state media to spread political content on four different continents, including in the U.S. The unusual activity was detected by a private cybersecurity firm called FireEye, which alerted the social media companies. In a statement, FireEye said, “This operation is leveraging a network of inauthentic news sites and clusters of associated accounts across multiple social media platforms to promote political narratives in line with Iranian interests.” The inauthentic pages sought to back Iranian foreign policy imperatives, and featured content that was pro-Iranian and pro-Palestinian, or anti-American, anti-Israeli, and anti-Saudi. Many pages reportedly promoted Quds Day, the Iranian regime-sponsored global day of protest against Israel.

In 2019, Iran engaged in a campaign of stepped-up malign activities around the region as the Trump administration’s “maximum pressure” campaign increasingly took effect, harming Iran’s economy. As part of its campaign, Iran also stepped up its malign cyber activities. In June 2019, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) warned, “CISA is aware of a recent rise in malicious cyber activity directed at United States industries and government agencies by Iranian regime actors and proxies. … Iranian regime actors and proxies are increasingly using destructive ‘wiper’ attacks, looking to do much more than just steal data and money. These efforts are often enabled through common tactics like spear phishing, password spraying, and credential stuffing.”

In July 2019, U.S. Cyber Command tweeted that they discovered active misuse of a bug in Microsoft Outlook. FireEye traced the activity to a threat group called APT33, which is allegedly working at the behest of the Iranian government as part of a coordinated campaign against “U.S. federal government agencies and financial, retail, media, and education sectors.” Following the January 2020 drone strike that killed IRGC Quds Force commander Qassem Soleimani, Iran-based attempts to hack U.S. federal, state and local government websites jumped 50% and nearly tripled worldwide.

Iran has turned its cyber capabilities against U.S. allies as well. In 2012 and then again in late 2016 and early 2017, Iranian-origin malware called Shamoon targeted the Saudi Arabian government and private sector. The 2012 attack damaged or destroyed nearly 30,000 computers belonging to the Saudi state oil company, Aramco, and the latest attacks deleted data on dozens of public and private computer networks. In July 2018, Germany’s domestic intelligence service found that Iranian cyber attacks targeting “the German government, dissidents, human rights organizations, research centers and the aerospace, defense and petrochemical industries” have been growing since 2014. The efficacy of the Iranian cyber attacks on Germany led the report’s authors to conclude that the operations are initiated and guided by intelligence agencies.

In March 2020, Reuters revealed hackers linked to Iran’s government had attempted to infiltrate the personal email accounts of staff members of the World Health Organization during the coronavirus pandemic. The same report indicated that such operations in the past have been characterized by experts as intelligence-gathering exercises.

In July 2021, cyber-security firm Proofpoint reported that the IRGC-linked hacking collective, Charming Kitten, had conducted a sophisticated spear phishing campaign that involved spoofing the website and impersonating staff of a British university in order to trick U.S. and U.K. based Middle East scholars and experts into registering for fake academic conferences, collecting personal information, including e-mail addresses and passwords, in the process. Google also warned of such cyberattacks by Charming Kitten in a threat alert issued in October 2021. UANI itself has been targeted as a part of this activity. In November 2021, the FBI warned that Iranian hackers had visited cybercriminal websites for sensitive data stolen from American and foreign organizations for future operations.

In 2022, the director of the FBI revealed that in June 2021, during the negotiations to revive the nuclear deal, Iran attempted to launch a cyberattack on Boston Children’s Hospital. He called it the most “despicable” attacks he had ever seen.

While Iran’s cyber capabilities do not rival those of the U.S., China, Russia, or even Israel, the asymmetric nature of the cyber domain has enabled Iran to carry out some of “the most sophisticated, costly, and consequential attacks in the history of the internet.” Cyberwarfare enables Iran to mask the source of attacks, but U.S. indictments against Iranians engaged in cyber sabotage and espionage revealed operations that “required costly infrastructure, including dedicated servers and dozens of domain names, in addition to personnel time,” indicating the involvement of Iran’s intelligence services.

Iran’s primary intelligence agencies, the MOI and IRGC-IO, have participated in assassinations and terror attacks, both domestically and internationally, and facilitated repression of religious and political dissenters.  Nevertheless, given the slate of Iranian officials who have died in recent years in Iran proper and the strikes inside the country targeting nuclear, drone, and missile bases, the intelligence services still suffer from counterintelligence and security difficulties, and are not omnipotent.

The U.S. Treasury Department sanctioned the MOI in 2012 for its role in domestic human rights abuses, material support for terrorist groups, and for advising Syria’s Assad regime on technical aspects of suppressing the Syrian opposition. The previous intelligence minister, Mahmoud Alavi, was designated by OFAC in November 2020 for his role in Iran’s human rights abuses and suppression of the November 2019 protest movement. The current intelligence minister, Esmail Khatib, has not yet been sanctioned although the MOI’s malign conduct has continued unabated throughout his tenure. The Treasury Department sanctioned the IRGC in its entirety in October 2017, and designated IRGC-IO head Hossein Taeb in 2010 for human rights abuses. Iran’s supreme leader’s deputy chief of staff in charge of intelligence and security Asghar Mir-Hejazi has also been sanctioned.

Although the MOI and IRGC have been targeted by sanctions for years, the scale and scope of their continued malign conduct indicate that sanctions have thus far been insufficient to compel changes in Iran’s behavior. Sanctions should be ratcheted up to a degree that compels debate within the regime over whether it can risk further destabilization by carrying on in the same vein. If sanctions alone are insufficient, the US should pursue law enforcement, intelligence, and policy coordination with allies to disrupt Iran’s malign intelligence activities.

In May 2019, IRGC commander Hossein Salami praised Iran’s intelligence organizations, declaring, “Today, we are engaged in a serious, global round-the-clock intelligence war with enemies. He likened the MOI and IRGC-IO to “the two sharp eyes” of the Islamic Revolution which “complement each other on the battlefield.”

Salami’s comments were an attempt to paper over the complex interplay between Iran’s two main intelligence branches, one of the key bureaucratic and political power struggles in Iran today. Both agencies serve the domestic and foreign policy imperatives of the supreme leader and the revolutionary regime, but the IRGC-IO’s greater portfolio and authority in recent years are indicative of the weakened position of Iran’s president and elected government relative to unelected security, clerical, and economic leaders connected through patronage to Supreme Leader Khamenei. With the ascension of Ebrahim Raisi to the presidency, Khamenei’s hardline ideological allies are positioned for a complete takeover of Iran’s elected and unelected power centers, cementing the IRGC as the dominant force in Iran for years to come. Iran is therefore likely to accelerate its repressive, confrontational trajectory, and its intelligence apparatus shows no signs of curtailing its malign domestic, regional, and international conduct in furtherance of preserving and expanding the Islamic Revolution at home and abroad.