Contending with IRGC Plots

This week, the U.S. Department of Justice charged an Iranian national based in Tehran, Shahram Poursafi, with plotting to kill former U.S. National Security Adviser John Bolton. A member of Iran’s Islamic Revolutionary Guard Corps (IRGC), Poursafi reportedly agreed to pay $300,000 to have Bolton murdered, and offered $1 million for another murder-for-hire plot—this one apparently targeting former Secretary of State and CIA Director Mike Pompeo. (The individual “hired” to kill Bolton was a cooperating human source for the FBI.) The FBI described Poursafi as a “uniformed member” of the IRGC, adding that he was “assessed to allegedly be working on behalf of” the IRGC’s Qods Force when he hired individuals in the U.S. to carry out these murders.

The affidavit underpinning the criminal complaint reads like an espionage novel. For many, the idea that Iranian operatives have recruited agents here in the United States to assassinate former U.S. government officials near their suburban Maryland homes or their D.C. offices is a bit hard to digest. It seems too fantastic to be true. But in fact, Iran has a long track record of carrying out assassinations, abductions, and surveillance operations targeting American and other Western interests around the world, including here in the United States. I maintain a database of Iranian foreign operations, which, while incomplete, currently includes 105 cases spanning the 43 years since the Iranian revolution in 1979. Limiting the analysis to the past decade, the numbers remain alarming. Out of 62 cases I have tracked over the past decade, 23 operations targeted Iranian dissidents, 28 cases targeted Jews or Israelis, 20 targeted diplomats, 14 targeted specifically Western interests, and six targeted Persian Gulf State interests. These took place all over the world, including 18 plots in the United States.

Notably, the first external assassination plot carried out by agents of the Islamic Republic of Iran took place in Bethesda, Maryland, just outside Washington, D.C.—the same general area where Poursafi plotted to kill Bolton over the past few months. In July 1980, Iranian agents recruited David Belfield (aka Dawud Salahuddin), an American convert to Shiite Islam, to assassinate former Iranian diplomat Ali Akbar Tabatabai in Bethesda, Maryland. Such plots increased in the 1990s, with a senior U.S. counterterrorism official stating in 1997 that the U.S. government had “solid information” to underscore its assessment that Iran had been responsible for an estimated “50 murders of political dissidents and others overseas” since 1990.

Iran continues to target Iranian dissidents, with a focus on the activities of the National Council of Resistance of Iran (NCRI), also known as the Mujahideen e-Khalq. Just last month, the group canceled a planned summit in Albania, where the group is now based, after receiving warnings from authorities about a possible Iranian threat. Iranian operatives have conducted surveillance of NCRI activities in the United States, as well. 

In November 2019, two Iranian agents—one a dual Iranian American citizen and the other an Iranian living in California—pleaded guilty to carrying out surveillance of U.S. nationals who are NCRI members. The Iranian agents attended NCRI rallies in New York City and Washington, D.C. During the course of their investigation, FBI agents had one of the operatives under surveillance in Chicago as he took photographs of the Hillel Center and Rohr Chabad Center, two Jewish institutions at the University of Chicago. Then, as in the Bolton plot, the Iranian agents were in regular contact with their IRGC handlers back in Iran, underscoring that these are not rogue operations but plots directed by Iranian officials.

More recently, Iran dispatched agents twice over the past year to target Iranian American human rights activist Masih Alinejad, who lives in New York. In July 2021, the Justice Department indicted four Iranian intelligence officials, along with a co-conspirator and California resident, for conspiring to kidnap Alinejad in New York and forcibly abduct her to Iran. According to U.S. authorities, the Iranian intelligence official who led this plot also directs a network of Iranian operatives that has targeted other victims in Canada, the United Kingdom, and the United Arab Emirates. 

Remarkably, the public exposure of this plot and the significant media attention it drew did not deter Iran from pursuing a still more brazen plot targeting Alinejad. Earlier this month, Alinejad’s door camera captured footage of a man standing on her front porch taking photos or video with his phone. Responding to his suspicious behavior, police arrested him when he failed to stop at a stop sign and was found to be driving without a license. When they searched his car, police found a suitcase with a loaded AK-47-style assault rifle with the serial number removed and $1,100 in cash.

My study of Iranian external operations plotting identifies several key trends about the nature of these activities. It also reveals that such activities are on the rise—especially those targeting Western interests and/or carried out in Western countries.

First, Iran sees external operations targeting its perceived enemies—be they, among others, political dissidents; regime critics; Jews; American, Israeli, European, or Gulf officials involved in activities countering Iran’s malign behaviors—as a cost-effective means of protecting the revolutionary regime in Tehran. At a time when the regime feels it is under increased pressure at home, an empowered IRGC is likely to defend the revolution aggressively. In the eyes of Iranian leaders, such plots are a proportionate and reasonable response to support for Iranian dissident groups or actions like the January 2020 targeted killing of Iranian Qods Force Gen. Qasem Soleimani. Indeed, the Bolton and Pompeo plots appear to have been intended as retaliation for the Soleimani hit.

Second, Iranian assassination, surveillance, and abduction plots continue unabated despite the negative publicity that accompanies the arrest of Iranian operatives. This was true in the case of Masih Alinejad here in the United States, but elsewhere as well. After an Iranian diplomat and several other operatives were arrested across Europe for a plot to bomb a July 2018 NCRI rally in Paris, Belgian prosecutors explicitly tied the plot to Iran’s Ministry of Intelligence and Security, whose tasks “primarily include the intensive observation and combatting of opposition groups inside and outside Iran.” The Iranian diplomat was convicted and sentenced to 20 years in prison for his role in the plot, yet over the next three years Iranian agents pursued some 26 plots across multiple continents.

Most significantly, the data suggests that Iran aggressively pursues international assassination, abduction, terror, and surveillance plots, even at times and in places that are particularly sensitive. With the exception of a 23-month period following the 9/11 attacks, when Iran actively sought to avoid getting caught up in the “war on terror,” Iranian operatives and proxies have carried out operations even during periods of key negotiations. As illustrated by these recent plots, this includes pursuing operations—including operations here in the United States—even in the midst of negotiations over a possible return to the Joint Comprehensive Plan of Action (JCPOA). This was also the case during and just after the original negotiations over the original JCPOA under the Obama administration.

The uptick in Iranian external operations predates the targeted killing of Soleimani, but that event seems to have significantly increased the risk of Iranian retaliation. U.S. authorities anticipated this, as evidenced by the Joint Intelligence Bulletin issued just days after the Soleimani strike, warning that “escalating tensions between the United States and Iran pose potential threats to the Homeland.” The bulletin stressed the need “to remain vigilant in the event of a potential GOI [Government of Iran]-directed or violent extremist GOI supporter threat to US-based individuals, facilities, and [computer] networks.”

According to my database (which, although not comprehensive, is representative of the number of Iranian foreign operations over the past several decades), 23 of the 105 total Iranian foreign plots I have tracked since 1980 have occurred since Soleimani’s killing in January 2020—representing an extraordinary increase in the number of incidents. Further, six of these 23 (26.1 percent) incidents took place in the U.S., compared to 12 out of 82 (14.6 percent) of the incidents prior to Soleimani’s death. 

Earlier this year, the State Department confirmed it was paying more than $2 million per month to provide security to former officials Mike Pompeo and Brian Hook due to “serious and credible” threats from Iran. That explains why Poursafi told his recruit—who was working with the FBI—that targeting Pompeo was dangerous because of the security detail around him, but that his “time would come.” Indeed, Poursafi told the source to focus on this first job (murdering Bolton) but that “then there would be other jobs” and the two “had years of work to do together.”

Iran typically seeks to carry out its operations with some measure of deniability. To that end, it often employs dual-nationals, proxies, and criminals to carry out key tasks. But recent events underscore how Iran also still deploys its own nationals to carry out or oversee operations. In the plot to murder Bolton, Poursafi told his operative that he did not want any money getting traced back to either of them, and the two engaged in various types of operational security when communicating. But when the source asked Poursafi what would happen if the murder were attributed to Iran, Poursafi seemed unfazed and said not to worry because his group (the IRGC) would take of it. In response to Poursafi’s indictment, an Iranian foreign ministry spokesperson already issued a warning against “any action against Iranian citizens under the pretext of these ridiculous and baseless accusations.”

All of which begs the question, why does Iran engage in such aggressive activities, even at times of sensitive negotiations, and even if it will be exposed as the culprit? The answer is that Iranian officials believe they can do so at little to no cost. 

Iran perceives the potential benefits of such operations to be high, while the costs of getting caught are low and typically temporary. While sanctions are often imposed, they are also often later lifted. And jailed perpetrators are somewhat regularly released in prisoner exchanges. The one thing that could really impact Iran’s decision-making calculus—diplomatic isolation—has been nearly impossible to achieve given parallel efforts to negotiate a nuclear deal and concerns that Iran could retaliate with even more bellicose militant activities in the region and beyond. 

The one time the international community did circle the wagons and impose coordinated diplomatic costs on Iran was after a German court found Iran responsible for the 1992 attack at the Mykonos restaurant in Berlin—in which Sadegh Sharafkandi, the head of an Iranian Kurdish opposition group, was murdered. Following this incident, several European countries briefly withdrew their ambassadors from Tehran, but they soon returned. And while a few of the attackers were arrested and convicted, the Iranian leaders implicated in the attack were never held to account. And some, like Ali Akbar Velayati, went on to hold still higher positions and play roles in additional terrorist plots.

Law enforcement actions such as this latest one are important, even when there is little chance of apprehending the accused, who in this case remains in Iran. But indictments and financial designations are insufficient responses to such activities—especially when planned on American soil. At a minimum, the response of America and its allies should include diplomatic isolation, travel bans preventing family members of Iranian leaders from studying abroad or going on Western shopping sprees, and other actions that incur tangible costs on Iranian decision-makers.

Matthew Levitt is the Fromer-Wexler Fellow and director of the Reinhard Program on Counterterrorism and Intelligence at The Washington Institute. This article was originally published on the Lawfare website.