The Paris plot appears especially audacious in its scope. The perpetrators intended to detonate an indiscriminate explosive device instead of carrying out a targeted assassination; Assadi smuggled TATP and a detonator onto a flight from Iran to Austria; the plot line included touch points in at least five European countries; and several prominent current and former government officials from the United States and other countries were present at the annual convention of the National Council of Resistance of Iran (NCRI).3
As it happens, the foiled Paris plot was just one in a string of Iranian operations carried out by Iranian operatives or their proxies. In June 2018, the Netherlands expelled two Iranian diplomats based at the Iranian embassy in Amsterdam following an investigation by Dutch intelligence.5 This move came just months after an Iranian Arab activist was gunned down in Amsterdam.6 In March 2018, Albanian authorities charged two Iranian operatives with terrorism after they surveilled a venue where Iranian Nowruz (New Year) celebrations were set to begin. In January 2018, German authorities raided several homes after weeks of surveillance confirmed they were tied to Iranian agents. These operatives were reportedly scoping out potential Israeli and Jewish targets in Germany, including the Israeli embassy and a Jewish kindergarten. Ten of the Iranian agents were issued arrest warrants, but none were apprehended.7
Weeks earlier, a German court convicted an Iranian agent for spying after he scouted targets in Germany in 2016, including the head of the German-Israeli Association. The German government subsequently issued an official protest to the Iranian ambassador.8
Over the past several decades, Iranian external operations of the kinds described above fall into several functioning subgroups: the targeting of dissidents, the active execution of religious edicts (fatwas) against entities perceived as insulting the Islamic faith, the targeting of perceived enemies, and the targeting of Jews. Several of these categories overlap, such as the targeting of Jews and Israeli citizens or diplomats.
Targets of Iranian External Operations
Of the 98 cases in the dataset, 42 involved the targeting of dissidents, 21 of whom were dual nationals or legal foreign residents. An additional 31 of the 98 cases targeted Jews or Israelis, 24 targeted diplomats, 24 targeted Western interests, seven targeted Gulf state interests, five involved the fatwa against Salman Rushdie, and two appear to be incidental to the primary target. (For example, in Baku, Azerbaijan, the Israeli embassy was located in the same building as the Japanese embassy.)
Limiting the analysis to the past decade, the numbers remain alarming. Out of 55 cases over the past decade, 22 operations targeted Iranian dissidents, 25 cases targeted Jews or Israelis, 19 targeted diplomats, 12 targeted specifically Western interests, and six targeted Gulf state interests.
Iranian operations frequently targeted Israeli interests, including 27 incidents in the overall dataset and at least 23 cases over the past decade. Still more disturbing, however, is the prevalence of Iranian external operations apparently targeting Jews, not Israelis. (In several incidents, the operatives were targeting both.) Iranian operatives and their proxies carried out surveillance or operations specifically targeting Jews in places such as Azerbaijan, Bulgaria, Cyprus, Germany, India, Nepal, Nigeria, and the United States, including surveillance of Jewish cultural centers, synagogues, and tourists.
Overall, 24 Iranian assassination or attack plots targeted foreign diplomats or diplomatic compounds, including 19 incidents over the past decade. The targeted diplomats represented Israel, Saudi Arabia, United Arab Emirates, the United Kingdom, and the United States. These plots primarily took place in countries with weaker security services, with the notable exceptions of surveillance operations in Israel and the 2011 Arbabsiar plot targeting the Saudi Ambassador to the United States (discussed below). One of the most disturbing of these plots, from an American perspective, was the 2011-2012 plot targeting specific U.S. diplomats and their families in Baku, Azerbaijan, among other targets.27
In an effort to carry out attacks with relative deniability, Iran has also deployed operatives who are dual nationals (typically citizens of Iran and another country, but sometimes of two countries other than Iran). Dual national operatives appear in 21 cases, including 15 just in the past decade, marking a significant shift toward this trend. Over the years, these have included citizens of Afghanistan, Belgium, Canada, Colombia, Germany, Iraq, Lebanon, Norway, Spain, Sweden, Tunisia, Turkey, and the United States.
Dual national and non-Iranian operatives would be expected to travel and operate using their non-Iranian travel documents, though in some cases they exhibited poor operational tradecraft and traveled on Iranian documents, used their true Iranian names, carried Iranian currency, used the same SIM card for operations in different countries, or allowed their pictures to be taken with local prostitutes, as discussed below. In some cases, they may have used Iranian travel documents to enter countries, like Malaysia, that do not require a visa for Iranian passport holders.
Iran relied on established proxy groups, like Hezbollah, to assist with some aspect of external operations in 20 cases, nine of which occurred since 2011. Prior to 2011, seven plots were carried out by Iran with assistance from proxies, while four were executed by proxies alone. Over the past decade, proxies carried out two plots on their own and played support roles alongside Iranian operatives in another seven.
The dataset includes 42 assassination plots, not all of which were successful. Of these, 18 occurred within the last decade. The assassination plots that occurred prior to 2011 were typically carried out by Iranian operatives (21 out of 24), but an analysis of the 18 cases executed over the past decade shows that over this more recent time period, Iran has been just as likely to dispatch locals or non-Iranians, dual nationals, or criminals as actual Iranian operatives.
This dataset includes 10 abduction plots, seven of which occurred since 2011. Iranian operatives were involved in all these plots, though three also used local, non-Iranian operatives. One recent plot, which targeted Iranian-American human rights activist Masih Alinejad in the New York area and was revealed in July 2021,30 displayed a combination of effective and outlandish tactics.
This dataset did not aim to include every indiscriminate attack tied to Iran and its proxies over the past several decades, but it included 21 key events (plots and attacks) with clear open-source evidence of Iranian involvement. While such attacks have been carried out at a steady pace over the past four decades, over the past decade Iran appears more willing to carry out assassination plots using more indiscriminate tactics such as bombings (consider the 2018 Paris plot targeting MEK and the 2011 Washington, D.C., plot targeting the Saudi Ambassador). In such plots, Iran typically deploys a combination of its own operatives and proxies to execute the attacks.
Each of these operation types typically involves some pre-operational surveillance, so it should not surprise that 54 cases in the dataset are listed or cross-listed as surveillance cases. Of these, 36 occurred in the past decade. Iranian operatives were typically involved in surveillance operations, often working together with proxies. Since 2011, surveillance operations appear to also include locals or non-Iranian operatives more frequently.
A review of travel patterns in Iranian external operations reveals several cases in which operatives used false passports, including six in the past decade. Interestingly, Iranian agents have been caught using forged Israeli passports (as have Iranians who appear to have been economic migrants). The use of dual nationals traveling on their non-Iranian passports is an important and current modus operandi.
The dataset includes a wide variety of financial activities, including money laundering to pay a private investigator for work related to an abduction plot in the United States.43 In other cases, agents carried a few thousand dollars in cash on their person to pay local agents,44 an Iranian intelligence agent with diplomatic cover was found with 30,000 euros in Europe,45 Iranian students were paid to study abroad to collect intelligence,46 and dual citizens living abroad were promised as much as $1 million to carry out surveillance missions.47 In one case, an Iranian was paid $300,000 to abduct an Iranian dissident,48 and a Shi`a imam in Africa was paid around $24,000 to carry out surveillance in Nigeria.49 In Baku, Azerbaijan, members of a crime gang were reportedly paid $150,000 each to target a Jewish school there,50 and Arbabsiar sent tens of thousands of dollars in two wire transfers from an overseas bank account to hire someone he believed to be an assassin.51
According to a report produced by the Federal Research Division of the Library of Congress, the MOIS has overall responsibility for covert Iranian operations, but since its founding in 1990, the Quds Force has typically carried out extraterritorial operations like assassinations:
In the post-9/11 world, overall border security enhancements in countries around the world likely led terrorist groups and rogue actors of all kinds to either curtail operations for a period of time and/or operate in nations with comparatively lax security rather than more vigilant Western nations. The dataset suggests there was a gap in Iranian external operational activity for about 23 months after 9/11, and the operations that commenced after that time in the West were all surveillance operations, which may not have been tied to near-term plots but rather were contingency planning for future off-the-shelf operational planning.
b37509886e