Tensions between the United States and Iran/Hezbollah have been on the rise since 2018 when the U.S. administration withdrew from the 2015 nuclear deal. These tensions spiked in January 2020 when U.S. strikes killed Qassem Soleimani the leader of Iran’s IRGC-Quds Force.
There is mounting evidence that in recent years, Iran and Hezbollah have sought to create a sleeper network in the U.S. and Western Europe, which could be activated to launch attacks as part of a retaliatory attack. This paper assesses Iran and Hezbollah pre-operational modus operandi in the West derived from court documents and open source reporting of recent arrest of Hezbollah and Iranian agents in the US and abroad. It sheds lights on the recruitment, training, and placement of these agents and the intricacies of their past operations. While it is impossible to predict when, where or how Iran/Hezbollah might retaliate as retribution for Soleimani’s killing, this article argues that there is growing number of indicators and warning signs for a possible attack in the U.S. or against U.S. interests abroad.
Tensions between the United States and Iran have been increasing since 2018 when the U.S. administration withdrew from the 2015 nuclear deal and re-imposed comprehensive sanctions on Iran. In response, Iran and its proxies have committed a series of calibrated asymmetric regional escalations designed to pressure the United States and its regional allies.
The January 3, 2020 U.S. strike that killed the IRGC-Quds Force leader, Iranian General Qassem Soleimani, has the potential to be a dramatic step up the escalation ladder by the United States, which catalyzes formidable Iranian retaliation against American interests. From the authors’ experience, as well as based on an assessment of the decade-long surge in Iran and Lebanese Hezbollah preoperational activities in both Western Europe and the United States, there is a high likelihood of a possible future attack on U.S. interests abroad and the possibility of an attack in the homeland. This article presents seven principles that underpin Iran and Hezbollah preoperational planning for a potential terrorist attack, ranging from surveillance, logistical planning, and front operations to disguise operatives to infiltration, recruitment, and target selection.
“They [U.S.] hit him [Soleimani] in a cowardly way, but with God’s grace and through endeavors of freedom-seekers around the world who want vengeance over his blood, we will hit his enemy in a manly fashion,” stated Esmail Qaani, the new leader of the IRGC-Quds Force following the death of his predecessor on January 3, 2020 in a U.S. drone strike at Baghdad international airport. Similarly, Iran’s Supreme Leader, Ayatollah Ali Khamenei, called for “forceful revenge” to avenge Soleimani’s death and; Hassan Nasrallah, the Secretary General of Hezbollah called on Hezbollah operatives globally to carry out “the appropriate punishment,” stating that this “will be the responsibility and task of all resistance fighters worldwide.”
During the authors’ time at the NYPD Intelligence Division (2005-2015), the threat from Iran and Hezbollah was always near and sometimes at the very top of the threat matrix for New York City based on Iran and Hezbollah’s global reach, sophistication and lethality as well as particular features that made the city a uniquely attractive target. Although the threat fluctuated depending on geopolitical tensions, given the killing of Qassem Soleimani, the commander of Iran’s IRGC – Quds Force, amid a background of rising tensions between Iran and the United States, the authors assess that the West is at an elevated risk for Iranian and, or Hezbollah retaliation. Therefore, it is important to analyze and assess Iran and Hezbollah’s preoperational modus operandi for committing terrorist attacks in the West.
Based on recent history, the authors assess that it is likely that Soleimani’s killing will trigger an Iranian/Hezbollah retaliatory response (or responses) similar to the reaction to the assassinations of Hezbollah leaders Abbas Musawi (1992) and Imad Mugniyah (2008). Like those, the vengeance will likely be calibrated, sufficient to send a message, but not so extreme as to threaten the survival of the Iranian regime. While widespread COVID-19 transmissions rates in Iran might delay Iranian plans for retaliation, based on past Iranian history, the regime is a patient actor and the IRGC is unlikely to be satisfied with anything less than a meaningful retaliatory response, delayed though it may be.
If the past is prolog, analysts might look at the 1992 Israeli Embassy bombing in Buenos Aires, which according to Argentine officials, was committed by Iran/Hezbollah partially in response to the Israeli assassination of Secretary General of Hezbollah, Abbas Musawi. Events that occurred in the wake of the February 2008 assassination of Hezbollah operations chief, Imad Mugniyah, by Israel and the United States may also be instructive. Following his death in Damascus, Syria, Hezbollah plotted several attacks to avenge his death in Azerbaijan, Bulgaria, Cyprus, India, Kuwait and Turkey. However, other than the 2012 suicide bombing attack on a bus carrying Israeli tourists in Burgas, Bulgaria, which killed six Israeli tourists and injured forty-two, all of the Hezbollah plots were thwarted.
Iran is Hezbollah’s closest ally and patron, providing money and weapons to the terrorist group often described as an “Iranian aircraft carrier parked north of Israel.” In addition to their ideological, political and military ties, Iran reportedly funds Hezbollah with an estimated $200-700 million yearly.
Hezbollah and Iran’s intelligence apparatus have a history of joint terrorist attacks globally, most notably, the attacks in 1992 and 1994 in Buenos Aires targeting the local Israeli Embassy and AMIA, a Jewish cultural center respectively. Moreover, their joint mission over the past decade to keep Assad in power in Syria has led to a significant augmentation of their cooperation. This makes it likely that any future external operations would entail joint operational planning and execution.
There is evidence Iran and Hezbollah have sought in recent years to create a sleeper network in the United States and Western Europe, which could be activated to launch attacks.
The failed 2011 Iran-directed plot to target the Saudi Ambassador in Washington illustrated an attack within the United States was not unthinkable. Hezbollah operative, Ali Mohamed Kourani, told the FBI during his 2016-2017 interviews that “in the event that the United States and Iran went to war, the U.S. sleeper cell would expect to be called upon to act.”
U.S. officials have made clear that Iran and Hezbollah continue to be a potential threat to the United States Homeland. In 2012, the then Director of National Intelligence (DNI), James Clapper stated that Iranian officials “are now more willing to conduct an attack in the United States in response to real or perceived U.S. actions that threaten the regime.” The director of the U.S. National Counterterrorism Center (NCTC), Nick Rasmussen, noted in October 2017, “It’s our assessment that Hezbollah is determined to give itself a potential homeland option as a critical component of its terrorism playbook.”
Although decision-makers in Tehran will likely still think very carefully before striking the U.S. homeland to avenge the death of Soleimani, it is important for the analyst/policymaker community to understand Iran and Hezbollah’s efforts to create an infrastructure for potential attacks in the West. In light of this and coupled with the recent history of Iran and Hezbollah terrorist activity outside the U.S., which this article will also outline, following the death of Soleimani, Iran may be less hesitant to authorize a retaliatory strike.
Based on the authors’ analysis of Iran and Hezbollah’s past operations, foiled plots, the recent U.S. arrests of Hezbollah operatives and their personal experience leading Iran and Hezbollah intelligence investigations for NYPD, seven principles underpin the preoperational modus operandi of Iran and Hezbollah:
– Intelligence gathering and surveillance activities;
– Plausible diplomatic, business, education and other covers to conceal operational activities;
– Infiltration of Iranian dissident groups;
– Logistical planning for possible future attacks;
– Preparing “human target packages” to enable assassinating dissidents and adversaries;
– Counter-intelligence tradecraft, and operational security
– Recruiting operatives with dual nationalities and Western passports from the Shia diaspora. Each of these are outlined in turn below.
Modus Operandi 1: Intelligence Gathering and Surveillance Activities
One of the distinguishing characteristics of Iran and Hezbollah’s modus operandi for operational planning in the West has been the sustained commitment to undertaking precise intelligence gathering and surveillance activities on targets that could support long term attack planning.
In some cases, Iranians have conducted intelligence gathering activities and in other cases it has been Lebanese expatriates acting on behalf of Hezbollah, who have burrowed into diaspora communities overseas to disguise their efforts.
New York City has witnessed intelligence gathering activities by both Iranians and Hezbollah operatives that demonstrate methodology and possible targets. In the case of Iran, between 2002 and 2010, the NYPD and federal authorities detected at least six events involving Iranian diplomatic personnel that these authors (who were then serving in the police department) struggled to categorize as anything other than hostile reconnaissance of New York City.
One of the most brazen incidents occurred at 2 a.m. on November 16, 2003 when uniformed NYPD officers riding a southbound 7 train observed two males filming the subway train tracks. The men, who initially claimed diplomatic immunity turned out to be guards at the Iranian Mission to the UN who had recently arrived in New York. “Despite two warnings from the State Department about this unacceptable behavior, in May 2004, two more Iranian Mission security guards were observed videotaping infrastructure, public transportation and New York City landmarks. One month later, the guards from the November 2003 subway incident were expelled by the United States for “engaging in activities that were not consistent with their duties” – in other words, spying.”.
Despite this official reprimand, suspicious activities by Iranian diplomatic personnel continued. “In May 2005, tips led the NYPD to six people on a sight-seeing cruise who were taking pictures and movies of city landmarks like the Brooklyn Bridge. In September 2008, police interviewed three people taking pictures of railroad tracks. And in September 2010, federal air marshals saw four people taking pictures and videos at a New York heliport.” During interviews by law enforcement, the four individuals disclosed that they were associated with the Iranian government. However, they were ultimately released and never charged.
Iranian intelligence gathering and surveillance activities have extended beyond New York City. In November 2019, two men—Ahmadreza Mohammadi-Doostdar, a dual U.S.-Iranian citizen and Majid Ghorbani, an Iranian citizen residing in California—pleaded guilty to acting as illegal agents of the government of Iran on charges stemming from monitoring two Jewish facilities in Chicago and as well as American members of an exiled Iranian opposition group, Mujahideen-e-Khalq (MeK), an Iranian dissident group that seeks regime change in Iran.
According to the criminal complaint, both men were accused of “acting on behalf of the Iranian government to gather information that could be used to identify and locate individuals and facilities.” Not only did they conduct physical surveillance on and collect information about Americans involved with MeK, but in July 2017, they also conducted hostile reconnaissance on the University of Chicago Hillel Center and a Rohr Chabad Center. “Doostdar was seen photographing the front and back of the Rohr Chabad Center, as well as the wrought iron fence surrounding the building. Doostdar also turned around to look at the building multiple times as he walked away.”
More recently, aggressive Iranian intelligence collection activities against Jewish targets have been detected in Europe. According to reporting from Israeli newspapers, German security forces raided various locations across Germany pursuing alleged members of Iran’s Islamic Revolutionary Guard Corps – Quds Force for spying on Jewish and Israeli locations. Raids were carried out in the German states of Baden-Württemberg, North Rhine-Westphalia, Bavaria and Berlin, but no arrests were made. Among the IRGC reconnaissance targets were Jewish kindergartens and the Israeli embassy in Berlin, Germany.
Some of these activities were discussed in greater detail by the intelligence agency of the German state of North Rhine-Westphalia. In a report issued during the summer of 2019, it found that “a main focus [of Iran’s regime] is spying on Israeli and pro-Israeli institutions, as well as citizens of the State of Israel living here [Germany] and persons of the Jewish faith.”
While more than twenty investigations related to Iranian espionage in Germany have been conducted, the one arrest and conviction in Germany linked to Iran dates back to 2017, when a Berlin court convicted Pakistani citizen, Haidar Syed-Naqfi, for being paid by the Qods Force to target Jewish and Israeli individuals and institutions. German prosecutors argued that Naqfi was told to identify, surveil and conduct reconnaissance on “Israeli and Jewish institutions and Israel advocates in Germany, France and other unnamed Western European countries for possible attacks.”
In recent years, more incidents of preoperational intelligence gathering, and surveillance activities have been detected, conducted by members of Hezbollah’s Islamic Jihad Organization (IJO) also known as Unit 910 than by Iranians. While New York City has figured prominently in these intelligence gathering efforts, Chicago, Washington DC and Boston have also registered as potential targets.
Exhibit a for this concern was an Investigation by the NYPD and the FBI that led to the May 31, 2017 arrests of two naturalized Americans from Lebanon who were recruited and trained by Hezbollah’s unit 910 to conduct intelligence collection missions in the United States. While these two lebanese expatriates, Ali Mohammed Kourani 32, and Samer El Debek, 37, at the time of their arrest, gave the outward appearance of leading ordinary lives in the U.S., in reality, they were conducting intelligence gathering missions for their beirut based handlers. In fact, Kourani went as far to describe himself to the FBI as “an IJO ‘sleeper’ operative working undercover in the United States.” On December 3, 2019, Ali Kourani was sentenced to 40 years in prison for “covert terrorist activities on behalf of Hezbollah’s Islamic Jihad Organization.” Samer El Debek’s case is still pending in courts.
In the wake of the arrest of these two IJO operatives, former New York City Police Department Commissioner James P. O’Neill noted, “preoperational surveillance is one of the hallmarks of [Hezbollah] in planning for future attacks.” The surveillance performed in New York City was done “in support of anticipated IJO terrorist attacks.”
The facts of the case, as laid out by the U.S. government, are worth recounting in detail. According to the Department of Justice “[f]rom at least in or about 2009, up to and including in or about September 2015, Kourani conducted surveillance of U.S. military and intelligence outposts in New York City, as well as airports in New York City and another country, in support of anticipated terrorist attacks by Hizballah’s Islamic Jihad Organization.” “Principally responsible for conducting IJO intelligence-gathering and surveillance activities, Kourani received taskings in Lebanon and executed his missions covertly.”
According to the Department of Justice, from Lebanon, Kourani was directed and “conducted physical surveillance of the following targets: FBI offices in Manhattan, New York; a U.S. Army National Guard facility in Manhattan, a U.S. Secret Service facility in Brooklyn, and a U.S. Army armory facility in Manhattan. Kourani used his phone to videotape activity around at least one of these surveillance targets, transferred the video footage to a memory card, and brought the memory card to his Lebanese-based handler and other IJO personnel in Lebanon.
When it came to airports, Kourani’s intelligence collection, surveillance and reconnaissance were not limited to the United States and John F. Kennedy Airport in New York. The scholar Matthew Levitt, whose research has focused on Hezbollah, has written that Kourani was tasked to also focus on Toronto’s Pearson International Airport, visiting Pearson seven times.
According to Levitt, during his debriefings with the FBI, Kourani explained that “he provided Hezbollah with details about security procedures, the uniforms worn by security officers, and whether the officers were armed.” Kourani’s surveillance “focused on exit points, security checkpoints, camera locations, baggage claim procedures, and what questions airport screeners asked passengers.”
Moreover, as Levitt notes, “aside from carrying out surveillance himself, Kourani also plied [Pearson] airport employees for information, some of whom understood they were providing information for Hezbollah while others were unwitting, in one case even smoking a hookah together with an airport employee who would “casually answer Kourani’s questions about the locations of cameras and magnetometers. Kourani said he could ask the man to carry a bag onto an airplane for him, and he would do it. “According to a U.S. Prosecutor’s statement during the trial, Hezbollah was ‘thinking about how to get terrorists, and weapons, and contraband through airports, from Lebanon into Canada, from Lebanon into the United States.’”
Similarly, while prosecutors accused Samer El Debek of surveilling “potential targets in America, including military and law enforcement facilities in New York”, much of his intelligence collection activity occurred in Latin America. In Panama, he allegedly was tasked to locate the U.S. and Israeli embassies, “case and identify security procedures at the Canal and Israeli Embassy” and “to locate places where items such as acetone and battery acid, which are explosive precursors, could be purchased.”
Kourani and El Debek were not the only IJO/Unit 910 members conducting intelligence, surveillance and reconnaissance actives in the Americas. More recently, another Lebanese-born, Hezbollah trained IJO/Unit 910 member, Alexei Saab (AKA: “Ali Hassan Saab”) 42, was arrested in September 2019, accused of providing Hezbollah with “intelligence and photographs concerning several locations Saab had surveilled in the New York City area, including the Port Authority Bus Terminal, Grand Central Terminal, the New York Stock Exchange, [NYC FBI Headquarters at] 26 Federal Plaza, and local airports.” Saab had been recruited into Hezbollah as a student in Beirut in 1996, according to the Department of Justice, which is also the source of the allegations against Saab outlined in the paragraphs below.
For his surveillance training, besides classroom and field work in Beirut, Saab was allegedly taught sophisticated tradecraft to “start by recording an unrelated subject before panning the camera to the object of his surveillance” and “took videos from a high altitude and different zoom ranges to show perspective relevant to Hezbollah”. For still photography, “Saab would also often pose people in front of the intended objects of his surveillance, to provide perspective and shield his true purpose from law enforcement.”
As part of his “intelligence collection” efforts, “Saab explained that IJO had trained Saab so that his mindset was that he should always be gathering intelligence and he was on ‘autopilot’ to collect intelligence at any opportunity, including while he was in New York City.” Admitting the purpose of his intelligence collection activities, “Saab understood that the information he provided to the IJO would be used to calculate the size of a bomb needed to target a particular structure and the ideal location in which to place explosive devices to maximize damage,” so “Saab focused on structural weaknesses of the location he surveilled to determine how a future attack could cause the most destruction.” Saab’s information was allegedly prepared for the IJO in a seven-to-ten-page report on New York City.
New York City was allegedly not Saab’s only target. According to court documents, he also admitted that as part of his reconnaissance and intelligence collection, he took photographs in Boston including Quincy Market, Fenway Park and the Prudential Center and in Washington DC including the Capitol Building and the White House. His case is still pending in the courts.
Source » thecipherbrief