There is growing number of indicators and warning signs that Iran and Hezbollah have sought to create a sleeper network in the US and Western Europe, which could be activated to launch attacks as part of a retaliatory attack.
Those indicators were revealed in a research published by Ioan Pop and Mitchell Silber in an article entitled “Iran and Hezbollah’s Pre-Operational Modus Operandi in the West.”
The two writers said tensions between the United States and Iran/Hezbollah spiked in January 2020 when US strikes killed Qassem Soleimani the leader of Iran’s IRGC-Quds Force.
“There is mounting evidence that in recent years, Iran and Hezbollah have sought to create a sleeper network in the US and Western Europe, which could be activated to launch attacks as part of a retaliatory attack,” the article said.
Their paper assesses Iran and Hezbollah pre-operational modus operandi in the West derived from court documents and open source reporting of the recent arrest of Hezbollah and Iranian agents in the US and abroad. It also sheds light on the recruitment, training, and placement of these agents and the intricacies of their past operations.
The authors’ analysis is based on Iran and Hezbollah’s past operations, foiled plots, the recent US arrests of Hezbollah operatives, and their personal experience leading Iran and Hezbollah intelligence investigations for NYPD.
They have conducted seven principles that underpin the preoperational modus operandi of Iran and Hezbollah: The intelligence gathering and surveillance activities, the plausible diplomatic, business, education and other covers to conceal operational activities, the infiltration of Iranian dissident groups, the logistical planning for possible future attacks, the preparing “human target packages” to enable assassinating dissidents and adversaries, the counter-intelligence tradecraft and operational security, and the recruiting operatives with dual nationalities and Western passports from the Shiite diaspora.
Modus Operandi 1: Intelligence Gathering and Surveillance Activities
One of the distinguishing characteristics of Iran and Hezbollah’s modus operandi for operational planning in the West has been the sustained commitment to undertaking precise intelligence gathering and surveillance activities on targets that could support long term attack planning.
In some cases, Iranians have conducted intelligence-gathering activities and in other cases it has been Lebanese expatriates acting on behalf of Hezbollah, who have burrowed into diaspora communities overseas to disguise their efforts.
New York City has witnessed intelligence-gathering activities by both Iranians and Hezbollah operatives that demonstrate methodology and possible targets. In the case of Iran, between 2002 and 2010, the NYPD and federal authorities detected at least six events involving Iranian diplomatic personnel that these authors (who were then serving in the police department) struggled to categorize as anything other than hostile reconnaissance of New York City.
Iranian intelligence gathering and surveillance activities have extended beyond New York City. In November 2019, two men—Ahmadreza Mohammadi-Doostdar, a dual US-Iranian citizen and Majid Ghorbani, an Iranian citizen residing in California—pleaded guilty to acting as illegal agents of the government of Iran on charges stemming from monitoring two Jewish facilities in Chicago and as well as American members of an exiled Iranian opposition group, Mujahideen-e-Khalq (MeK), an Iranian dissident group that seeks regime change in Iran.
According to the criminal complaint, both men were accused of “acting on behalf of the Iranian government to gather information that could be used to identify and locate individuals and facilities.”
On December 3, 2019, Ali Kourani was sentenced to 40 years in prison for “covert terrorist activities on behalf of Hezbollah’s Islamic Jihad Organization.” Samer El Debek’s case is still pending in courts.
Modus Operandi 2: Plausible Diplomatic, Business, Cultural and Other Covers to Conceal Operational Activities
During a 2008 visit by an NYPD Intelligence Division team (including one of the authors) to Buenos Aires, Argentinian intelligence officials outlined how Hezbollah, in cooperation with various elements within the Iranian intelligence, was responsible for two separate terrorist attacks in Buenos Aires, the 1992 Israeli Embassy and the 1994 AMIA bombing. In both cases Iran leveraged a highly complex local intelligence network developed since the mid-1980s, which was run from Iranian Embassy in Buenos Aires and its Cultural Bureau. While the authors were told by Argentine intelligence officials that the decision to attack Argentina in 1994 was made at the highest levels of Iran’s governmental structure, the Iranians used diplomatic cover, business cover and NGO/religious cover to mask their network on the ground in South America.
Similar to the organizations hiding under different types of cover in Buenos Aires, in New York City, Iran’s presence included the Alavi Foundation, a nonprofit ostensibly devoted to charity works and promoting Persian and Islamic culture. In December 2009, Preet Bharara, US Attorney for the Southern District of New York, described Alavi as having “effectively been a front for the government of Iran.
Modus Operandi 3: Infiltration of Iranian Dissident Groups
Iranian security agencies use a range of tactics to safeguard the regime, including infiltrating opposition groups. These agencies have “identified and eradicated opponents and defectors inside and outside of the country”. In the 1990s, elements within the Iranian Intelligence focused on targeting the opposition outside Iran and are believed to have been responsible for assassinating various dissidents, including Shahpour Bakhtiar, the last prime minister under the Shah. In August 1991, Bakhtiar was stabbed and strangled to death at his home in France by three Iranian agents.
Iranian intelligence has a history of infiltrating opposition groups such as the MeK, which in 2002 disclosed publicly that Iran has two covert nuclear facilities located in Natanz and Arak.
Modus Operandi 4: Logistical Planning for Possible Future Attacks
Iran/Hezbollah’s modus operandi is often characterized by advanced logistical planning for potential future attacks. In some recent cases, this preparation has focused on the secret accumulation and storage of explosive material for potential forthcoming attacks. According to Israeli intelligence sources, as reported in the Israeli press, the effort by Hezbollah’s Unit 91099 involves “long-term planning for immense, game-changing terror attacks."
Hezbollah repeatedly and across different continents conducted this advanced logistical planning by establishing large stockpiles of harmless-looking “First Aid” ice packs filled with ammonium nitrate. This characteristic Hezbollah tradecraft for prepositioning explosives around the world has been evidenced by discoveries in Thailand, Cyprus, and the UK.
The first time Hezbollah’s stockpiling of ammonium nitrate in First Aid ice packs was detected was in Thailand in 2012 and were linked to the efforts of previously mentioned Unit 910 member, Samer el Debek.
Modus Operandi 5: Preparing “Human Target Packages” to Enable Assassinating Dissidents and Adversaries
“Target packages” are a file of information that “enable an intelligence or military unit to find, fix, track and neutralize a threat. A human target package includes information collected about an individual, such as the official position of the individual; an analysis of personal vulnerabilities or other opportunities to exploit the individual and confirmation of the identity and location of the individual.” A target package could include “capture/kill operations”. There is strong evidence that assembling human target packages has been a consistent element of Iran/Hezbollah’s modus operandi in the West with examples in the Netherlands, France, Denmark, New York City, and Washington DC.
For example, in Amsterdam, Iranian anti-regime dissident, Ahmad Mola Nissi, was likely the victim of an Iran/Hezbollah liquidation operation in late 2017, when he was gunned down in front of his apartment. As the leader of the ASMLA, a movement that promotes the rights of the Ahwazi, an Arab people who feel oppressed in the oil-rich Iranian region of Khuzestan, he had sought refuge in the Netherlands since 2005. In the month leading up to his attack, Nissi had gone to the police expressing concerns about his safety. US Secretary of State Pompeo appeared to refer to the alleged assassination in May 2018, when in a major statement he noted, “today, the Iranian Quds Force conducts covert assassination operations in the heart of Europe.”
Modus Operandi 6: Counter-Intelligence Tradecraft and Operational Security
Another hallmark of Iranian/Hezbollah tradecraft is employing counter-surveillance tradecraft and sophisticated operational security. A variety of modalities of this tradecraft has been utilized and observed in the United States.
One example was the Doostdar case. The information outlined in the paragraphs below comes from details publicly released by the Justice Department. “From approximately July 25 through July 30, 2017, Doostdar was in Costa Mesa, California, where he met several times with Ghorbani. Doostdar employed intelligence tradecraft and ran surveillance detection routes before, during, and after his meetings with Ghorbani.”Doostdar also utilized tradecraft like “changing clothes before each meeting, visiting meeting locations prior to the actual meeting, and arriving and departing from each meeting in a circuitous manner.” FBI surveillance teams also noted that “Doostdar walked slowly and was constantly looking around his surroundings” and looked at “the reflection of store windows as he passed by, consistent with checking for surveillance.” Consequently, the FBI assessed that Doostdar engaged in “intelligence tradecraft and counter-surveillance measures” that were “consistent with having received training from an Iranian intelligence service.”
Modus Operandi 7: Recruiting Operatives with Dual Nationalities and Western Passports
Iran and Hezbollah have a history of recruiting operatives globally from within Shiite diasporas, preferably those who have Western passports. A representative example of this is Mansour Arbabsiar, a naturalized US citizen of Iranian descent, who is October 2011 was arrested and charged with plotting to kill Adel al-Jubeir, the Saudi Ambassador to the United States. According to the court documents, Arbabsiar claimed he had been recruited by a cousin in Iran who was a high-ranking member of IRGC’s Quds Force.
Similarly, the recent arrests of the reported Hezbollah Unit 910 operatives, Ali Kourani, Samer el-Debek, and Alexei Saab in the US, reinforce the idea that Hezbollah focuses its external recruitment on individuals residing in the West, with dual nationalities and access to Western passports.
For example, according to court documents, Kourani was recruited mainly because his residence in the United States. Similarly, Samer el-Debek, arrested for his links to Hezbollah, claims he was recruited because as a US naturalized citizen, he was in possession of a US passport.
Although Alexei Saab was recruited in Lebanon before he spent time in the US, within five years of his lawful entrance, he applied for naturalized citizenship in the US. Subsequently, according to court documents, Saab entered into a fraudulent marriage in order to gain US citizenship.
