by Matthew Levitt,  Sarah Boches

The International Centre for Counter-Terrorism

In his latest update on national security threats against the United Kingdom, MI5 Director General Ken McCallum revealed that since January 2022, authorities contended with twenty Iranian-backed plots targeting UK citizens and residents. In these plots, he added, “Iranian state actors make extensive use of criminals as proxies – from international drug traffickers to low-level crooks.” In fact, this is a trend seen across Europe.

In September, investigators in Germany and France recently revealed Iranian agents - who were acting through European drug traffickers living in Iran - hired European criminals to carry out surveillance of Jews and Jewish businesses in Paris, Munich, and Berlin over the past few months. Once arrested, one French criminal conceded that he was paid one thousand euros to take photographs of a target’s home in Munich in April. According to the French domestic intelligence service DGSI, “The Iranian services have adapted their modus operandi and now more systematically prefer to use people from criminal circles” to carry out their attacks abroad.

Drawing on a dataset developed by one of the authors (Levitt), trend analysis clearly demonstrates that in the wake of a foiled 2018 Iranian bomb plot outside of Paris, which led to the arrest and conviction of an Iranian diplomat for his role in the plot, Iranian operational leaders, specifically IRGC and MOIS, have increasingly leveraged criminal networks as proxies to carry out attacks abroad to provide distance between Tehran and the operations abroad. The Washington Institute has produced an interactive map drawing on this dataset which depicts Iranian external operations – assassinations, abductions, intimidation and surveillance plots – around the world and shows a marked increase in Iranian operational activity in Europe, with many of these plots involving criminal recruits.

Background: Recent Iranian Operations in Europe Using Criminals

Shortly after the 1979 Islamic Revolution in Iran, the revolutionary leadership of Iran embarked on a campaign to assassinate Iranian dissidents and former Iranian officials who served under the Shah’s regime. Over the past forty-five years, Iranian agents have continued to engage in assassination, abduction, intimidation, and surveillance plots targeting regime opponents around the world. Many of these plots occurred in Europe, from the December 1979 assassination of the Shah’s nephew, Shahriar Shafiq, in Paris, to the March 2024 stabbing of Iranian journalist Pouria Zeraati in London.

Drawing on the author’s dataset of Iranian external operations, which are depicted in the Iranian External Operations interactive map and timeline, of the 218 plots in the overall dataset covering 1979 to today, 102 plots occurred in Europe. The pace of Iranian operational activity in Europe has spiked, with over half of these plots (54 cases) occurring between 2021 and 2024. These operations have focused on targeting Iranian dissidents (34 cases), including journalists broadcasting news in Farsi that Tehran would rather not see the light of day, Israeli citizens and diplomats (10 cases), and Jews (7 cases). Furthermore, of these 54 plots, sixteen involved the use of criminal perpetrators to carry out the attacks. Six of these cases targeted Iranian dissidents or journalists, seven targeted Israeli diplomats or embassies, and four targeted Jews or Jewish institutions.

Consider the disrupted plot, nicknamed “the Wedding” by Iranian intelligence, to assassinate two Iran International news anchors in London. Iran’s Revolutionary Guard Corps (IRGC) hired a people smuggler (referred to in the subsequent investigation as ‘Ismail’ for his own safety) to assassinate Fardad Farahzad (the ‘groom’) and former presenter Sima Sabet (‘the bride’), who were labelled as targets by the IRGC’s Unit 840 in November 2022. Ismail began working with Iranian intelligence in 2016 and was recruited for his role as a transnational criminal based in Europe.

How Criminals are used in Europe

Iranian government officials are increasingly using drug traffickers and other criminals in Iran as middlemen to recruit criminals to carry out attacks abroad. Consider the case of Umit B., a drug trafficker from the Lyon region in France with Turkish roots who now reportedly operates out of Iran. “According to Western intelligence,” Der Spiegel reports, “he is allowed to hide in the country from the reach of European investigators, in return for which he helps the regime plan attacks against Jews and Israelis.” This parallels the case of Naji Ibrahim Zindashti, described by the US Treasury Department as an “Iran-based narco-trafficker,” whose criminal network “has carried out numerous acts of transnational repression including assassinations and kidnappings across multiple jurisdictions in an attempt to silence the Iranian regime’s perceived critics.” In return, the US Treasury notes, “Iranian security forces protect Zindashti and his criminal empire, enabling Zindashti to thrive in the country’s drug market and live a life of luxury while his network exports the regime’s repression, carrying out heinous operations on the government’s behalf.” The data shows that Iran increasingly leverages criminal networks such as these for its international operations. Not only does Iran use individuals with a criminal past, but organised crime groups as well.