The backstory behind the killing of Qods Force Col. Khodaei

It played out like a scene from the Netflix drama Tehran. On May 22, gunmen killed Islamic Revolutionary Guard Corps (IRGC) officer Col. Hassan Sayyad Khodaei, in broad daylight, outside his home in the Iranian capital. While this is not the first time Iranian officials have been killed in Iran, previous attacks typically targeted officials tied to Iran’s nuclear program. But the killing of Col. Khodaei, which press reports have attributed to Israel, was something different. Col. Khodaei was reportedly the deputy commander of the secretive Qods Force Unit 840, responsible for planning external Iranian operations such as kidnappings, abductions, and assassinations. And while Iranian external plots such as these are not a new phenomenon (Iran has carried out such operations for over four decades), they have become more frequent and aggressive in recent years. It appears Col. Khodaei was targeted because of his personal role in the sharp increase in such plots over the past decade. Based on a first-of-its-kind data set, we can track this upward trend in Iranian plots, effectively mapping out the backstory behind the otherwise puzzling killing of Col. Khodaei.

It was in response to one particularly prominent case—the July 2018 plot to bomb a National Council of Resistance of Iran (NCRI) rally in Paris—that I first started collecting data on Iran’s external assassination, surveillance, and abduction plots. My first area of interest focused on the IRGC’s use of Iranian diplomats to help execute attacks abroad.[1] Days after the NCRI plot was foiled, the U.S. State Department warned: “If Iran can plot bomb attacks in Paris, they can plot attacks anywhere in the world, and we urge all nations to be vigilant about Iran using embassies as diplomatic cover to plot terrorist attacks.”[2] Five months later, in January 2019, the European Union (EU) added the Directorate for Internal Security of the MOIS, along with two of its officials, to the EU’s terrorist list[3] after the Danish, Dutch, and French governments accused it of conducting assassination plots in Europe. At the time, the Danish foreign minister said the “EU just agreed to enact sanctions against an Iranian Intelligence Service for its assassination plots on European soil,”[4] pointing to the action as a “strong signal from the EU that we will not accept such behavior in Europe.”

But the plots kept coming, in Europe and elsewhere. Emirati, Israeli, and American interests were targeted in Ethiopia.[5] Israelis were targeted in Cyprus,[6] the U.S. Ambassador was a target in South Africa,[7] Jewish intellectual Bernard Henri-Levy was targeted in France,[8] Americans and Israelis were targeted in Colombia,[9] and an American-Iranian human rights activist was targeted in the United States.[10] Over the spring and summer of 2021, my research assistants and I started collecting and organizing data related to Iranian external operations—assassinations, surveillance, and abductions—around the world since the 1979 revolution in Iran. Ultimately, we produced an unclassified and open-source dataset of 98 cases of Iranian external operations from December 1979 through December 2021. Based on this data, which as an open-source project is admittedly not comprehensive of all attacks, I analyzed trends in Iranian external operations over the past 40-plus years, and then separately over the past decade. I took a close look at the who (targets and perpetrators), the what (types of attacks), the how (tactics), the where (location) and, where possible, the when and why (timing and motives) behind Iranian external operations. The results, published in the February 2022 volume of the Combatting Terrorism Center at West Point’s CTC Sentinel,[11] provide a stark backstory to the killing of Col. Khodaei.

Iran’s long history of external plots

Since the earliest days of the Iranian revolution, Iranian agents and their proxies have targeted dissidents and perceived enemies for assassination, surveillance, and abduction in plots around the world. One of the first cases took place in the United States in July 1980, when Iranian agents recruited American convert to Shi`a Islam, David Belfield (aka Dawud Salahuddin),[12] and instructed him to assassinate former Iranian diplomat Ali Akbar Tabatabai in Bethesda, Maryland. Ambassador Philip Wilcox later revealed in a 1997 U.S. State Department briefing that “since 1990, we estimate and indeed, we have solid information for, that Iran is responsible for over 50 murders of political dissidents and others overseas.”[13]

In the early years after the 1979 revolution, Iran instituted a major crackdown on dissidents and former officials, at home and abroad, in an effort to eliminate those who might pose threats to the nascent Islamic regime. In the past few years, Iran has escalated a similar campaign targeting dissidents, likely due to perceived regime instability or local threats and successful attacks or leaks of nuclear program intelligence by dissident groups. In the digital age, Iran has added cyber activities to its operational toolkit, utilizing cyber capabilities to spy on dissidents, surveil enemies,[14] and conduct disinformation campaigns.[15] Perhaps counterintuitively, Iran conducts external operations around the world, even in countries with advanced law enforcement, border security, and intelligence services that make operational security more difficult.

While Iran often capitalizes on the less advanced security services in regions like Eastern Europe, Central Asia, and Africa, it nevertheless continues to plot attacks and engage in surveillance activities in areas where the operating environment is more difficult,[16] like western Europe and the United States. Oftentimes, these cases can be further classified by motive, such as revenge on governments supporting Iraq during the Iran-Iraq War or escalation of the shadow war between Iran and the West over the Iranian nuclear program in the period leading up to the JCPOA. Other times, identifying a specific motive is more difficult, especially with access to only open-source materials. However, through the careful examination of the perpetrators, targets, methods, locations, timings, and potential motivations of attacks such as these, Iran’s current operational environment becomes clearer and forecasting potential future plots becomes slightly less daunting. One item in particular that stands out is the apparent willingness of the Iranian regime to carry out such operations, usually in a fashion the regime believes will provide at least some deniability, regardless of the political climate.

Uptick in Iranian plots over past decade

Despite the arrests and media attention that followed the July 2018 Paris plot and a series of others around the same time in Albania, Denmark, Germany, the Netherlands, and elsewhere, Iranian assassination, surveillance, and abduction plots continued unabated. At least 26 well-documented plots have taken place in the three years following the Paris plot in places such as Colombia, Cyprus, Denmark, Ethiopia, France, Germany, Iraq, Israel, Kenya, the Netherlands, Scotland, Sweden, Tanzania, Turkey, the United Arab Emirates, the United Kingdom, and the United States.

Possibly the biggest takeaway to come from this study was the fact that Iran engages in international assassination, abduction, terror, and surveillance plots even in places and at times of heightened tension. Apart from a period of time directly after the 9/11 attacks, during which Iran tried to avoid being caught on the wrong side of the “war on terror,” Iranian operatives and proxies have pursued operations even when involved in key negotiations—including current negotiations over a return to the JCPOA.

Moreover, Iranian external operations were not limited to countries with less developed border security, intelligence, and law enforcement services. After a post-9/11 hiatus, plots in the United States increased (seven in the decade after 9/11, and seven more in the decade since 2011), while there were only two plots in Europe in the decade after 9/11. This dramatic drop in attacks in Europe reversed itself over the past decade, however, with 17 plots in Europe since 2011. Iran has not avoided surveillance or assassination plots in the United States or western Europe, where it must face additional obstacles; in fact, its presence in these areas is on the uptick.

This trend is even more stark when we take a global view. From 1990 to 2000, there were 17 cases of Iranian plots, and over the decade from 2001 to 2011, there were 16. Compare those 33 cases over two decades with the 52 cases recorded just between 2012-2021. While a certain amount of this disparity is likely due to better reporting and documentation, it also illustrates Iran’s broad escalation in its worldwide operations. Indeed, the number of documented Iranian assassination plots worldwide jumped since the start of the twenty-first century, from 4 cases in 2001-2011 to 15 cases in 2012-2021. Several of these recent assassination plots took place within the last year, such as the thwarted Iranian plot to kill a former Israeli intelligence officer in Colombia.[17] Meanwhile, Iranian surveillance operations targeting Western interests have similarly increased, from 3 cases in 1990-2000 to 7 cases in 2001-2011 and 10 cases in 2012-2021. And in terms of overall cases, Iran appears to have redoubled its efforts in Asia (9 of the 12 cases occurred in the last decade) and Africa (8 of the 10 cases occurred in the last decade). Thus, while Iran has not shied away from planning attacks in the U.S. and western Europe, it has also expanded its playing field and demonstrated a willingness to operate almost anywhere in the world.

More than four decades ago, Iran instituted a major crackdown on dissidents and former officials, at home and abroad, in the early years after the 1979 revolution. But in the past few years, Qods Force Unit 840 has intensified a similar campaign targeting dissidents. In fact, 22 of the 42 cases of Iran targeting dissidents in this dataset occurred within the past decade. This includes the plot exposed in July 2021 to kidnap New York-based journalist and human rights activist Masih Alinejad – a U.S.-Iranian dual citizen – and forcibly take her to Iran where “the victim’s fate would have been uncertain at best,” in the words of U.S. Attorney Audrey Strauss.[18]

Alinejad’s case shocked much of the public who were surprised by Iran’s actions toward a dual national, much less a U.S.-Iranian dual national. But the data shows that this is not uncommon. On the contrary, of the 42 cases of Iran targeting dissidents in the overall data set, 21 (12 in the past decade) targeted dissidents who were dual nationals or legal residents of foreign countries, including U.S. citizens and legal residents. Some of these occurred in the dissident's country of residence, while others occurred in third countries where the individual was traveling. For example, a dissident living in Sweden was targeted in Turkey,[19] a dissident in the United States was targeted in the UAE,[20] and a dissident in France was targeted in Iraq.[21] Iran also targeted Israeli targets (distinct from Jewish targets) primarily in third countries.

Dual nationals also feature in another interesting trend. In an effort to carry out attacks with relative deniability, Qods Force Unit 840 has deployed operatives who are dual nationals (usually citizens of Iran and another country, but sometimes of two countries other than Iran). Dual national operatives feature in 21 cases, including 15 just in the past decade, thus indicating a major shift toward this trend. Over the years, Iran’s dual national operatives have included citizens of Afghanistan, Belgium, Canada, Colombia, Germany, Iraq, Lebanon, Norway, Spain, Sweden, Tunisia, Turkey, and the United States.

Similarly, non-Iranian citizens carried out operations in 38 of the 98 cases in the dataset, 24 of which were in the last decade. And in a few cases, Iran enlisted criminal organizations to help with operational activities or carry out plots. Six of the seven cases in which Iran contracted criminals to carry out surveillance or execute plots took place in the past decade. As could have been expected, working with criminals sometimes took a toll on operational security.

Iran expects its dual national and non-Iranian operatives to travel and operate using their non-Iranian travel documents, marking an increasingly common Iranian modus operandi. Meanwhile, an examination of the travel patterns of Iran’s external operations points to several cases where operatives used false passports (six in the past decade). Iranian agents have even been caught using false Israeli passports (a practice not unheard of when studying Iranians traveling as economic migrants).

When it comes to tactics employed in Iranian external operations, the most significant recent development has been the use of cyber tools for surveillance and targeting. For example, in 2012, Monica Witt, a former U.S. Air Force intelligence specialist, allegedly attended a conference in Iran hosted in cooperation with the IRGC-Qods Force. Witt was recruited by Iranian intelligence, and she was ultimately indicted by the U.S. Department of Justice in 2019. Witt apparently researched U.S. Intelligence Community (USIC) personnel she had known and worked with and assembled “target packages”[22] on these individuals. In 2019, the U.S. Treasury targeted the organization that hosts these conferences, asserting that they serve as recruitment and intelligence collection venues. Witt remains a wanted fugitive and appears on the FBI’s Most Wanted list.[23]

The significant uptick in the operational tempo of Iranian external operations clearly predates the January 2020 targeted killing of Qods Force chief Gen. Qassem Soleimani. But the killing of Soleimani, along with Iraqi Shi`a militia leader and designated terrorist Abu Mahdi al-Muhandis, clearly increased the risk of Iranian retaliation or escalation. To date, Iran has largely responded to Soleimani’s assassination by targeting U.S. forces in Iraq. But shortly after the strike, U.S. intelligence and law enforcement agencies stressed in a joint intelligence bulletin the need “to remain vigilant in the event of a potential [Government of Iran] GOI-directed or violent extremist GOI supporter threat to US-based individuals, facilities, and [computer] networks.”[24]

Since then, 16 of the 98 cases in the dataset occurred in the period following Soleimani’s death. Notably, 5 of these 16 cases plotted indiscriminate attacks that would target groups of people, such as a foreign military or embassy. This means that nearly one-quarter of the total indiscriminate attack plots included in this dataset (5 of the 21) occurred in the barely two years following Soleimani’s death. Of these five cases, four targeted Israeli interests, one targeted Emirati interests, and two targeted U.S. interests (one, a failed attack plot in Ethiopia,[25] involved the targeting of the UAE embassy in Addis Ababa and the surveillance of both the U.S. and Israeli embassies, while another, a failed assassination plot in Colombia, targeted Israeli and U.S. officials, thus explaining the overlap in cases). One important example took place in January 2021 when the National Security Agency intercepted IRGC Qods Force communications discussing a plan in which Iranian agents would surveil, infiltrate, and attack Fort McNair in Washington, D.C. and assassinate Gen. Joseph M. Martin.[26] Two intelligence officials confirmed that the plot stemmed from Iranian efforts to avenge Soleimani’s assassination.[27]

In March, more than a year after the end of the Trump administration, the State Department confirmed that it is paying more than $2 million per month to provide 24-hour security to former Secretary of State Mike Pompeo and former top aide Brian Hook due to “serious and credible” threats from Iran.[28] With the revolutionary leadership solidifying control over key elements of power in Iran, and with an eye toward protecting the revolution at a time when the revolutionary leadership sees increasing threat coming from elements both foreign and domestic, threats like these are likely to increase.

And they have. Most recently, Israel warned citizens against travel to Turkey where, according to Israel’s National Security Council (NSC), Iranian agents have been trying to target Israelis. In a statement, the Israeli NSC warned: “For several weeks now, and even more so since Iran blamed Israel for the death of the Revolutionary Guards officer last week, there has been growing concern in the defense establishment about Iranian attempts to harm Israeli targets around the world.”[29]

For Iran, there is an element of psychological warfare to this campaign, which it no longer denies. Iran’s Fars News Agency recently published a list of Israeli businesspersons purportedly “living in hiding” because they have been surveillance targets of Iranian agents or their proxies.[30]

Oddly enough, comparisons between these real-life cases and those depicted on Netflix’s Tehran are not just theoretical. In a case of ‘life mimicking art mimicking life’, it appears that leaders of Qods Force Unit 840 were not only aware of the Netflix show Tehran, but also sought to infiltrate the show. According to the show’s creator, Iranian agents were on the show’s set in Athens during the filming of the first season.[31] Though it was only revealed later, at the time of the filming, an Iranian agent recruited a group of Israeli women of Iranian decent; one took photos of the American Embassy, while another was instructed to have her son join an Israeli military intelligence unit.[32] As it turns out, one of the women was instructed to audition for a part in Tehran (she didn’t get the part).

So long as Iran continues to pursue external operations such as assassinations and kidnappings, the countries targeted by such operations will act to thwart them. And as long as the revolutionary regime in Iran feels threatened by internal dissent and external powers, it will likely continue to carry out such plots. All of which is to say that the backstory to the assassination of Col. Khodaei—a sharp rise in Iranian external operation plots—is also the forecast for the near to medium future.

References

[1] Matthew Levitt, “Iran’s Deadly Diplomats,” The Washington Institute for Near East Policy, August 8, 2018, https://bit.ly/3Nkn4Ww.

[2] U.S. Department of State, “Background Briefing on Meeting with Saudi Officials,” July 10, 2018, https://bit.ly/3amD2AX.

[3] European Council, “Fight against Terrorism: Council Renews the Designation on the EU Terrorist List and Adds Two Iranian Individuals and One Iranian Entity in Response to Recent Foiled Attacks on European Soil,” January 9, 2019, https://bit.ly/3x3GgCi.

[4] Jacob Gronholt-Pedersen, Robin Emmott and Anthony Deutsch, “In shift, EU Sanctions Iran over Planned Europe Attacks,” Reuters, January 8, 2019, https://reut.rs/3NKa8t0.

[5] Declan Walsh, Eric Schmitt, Simon Marks and Ronen Bergman, “In a Dangerous Game of Cat and Mouse, Iran Eyes New Targets in Africa,” The New York Times, February 15, 2021, https://nyti.ms/3zbjmdV.

[6] Dan Williams and Michele Kambas, “Israel Accuses Iran of Cyprus Attack Plot after Suspect Arrested,” Reuters, October 4, 2021, https://reut.rs/3z8TiQs.

[7] Nahal Toosi and Natasha Bertrand, “Officials: Iran Weighing Plot to Kill U.S. Ambassador to South Africa,” Politico, September 13, 2020, https://politi.co/38UG3Za.

[8] “IRGC Colonel Reportedly Plotted to Assassinate French Jewish Philosopher,” Times of Israel, May 26, 2022, https://bit.ly/3t87Fkf.

[9] Florencia Montaruli, “Colombian Defense Minister Reveals Iran-backed Assassination Plot,” Iranwire, November 16, 2021, https://bit.ly/3amFtn5.

[10] Rachel Pannett, “Masih Alinejad: Iranian Intelligence Agents Plotted Brazen Abduction of Brooklyn Dissident Journalists, U.S. Prosecutors Say,” The Washington Post, July 14, 2021, https://wapo.st/3NNXbye.

[11] Matthew Levitt, “CTC Sentinel: Trends in Iranian External Assassination, Surveillance and Abduction Plots,” Combating Terrorism Center 15, no. 2 (February 2022), https://bit.ly/3taDF7r.

[12] Ira Silverman, “An American Terrorist,” The New Yorker, July 28, 2002, https://bit.ly/3M7I9SE.

[13] U.S. Department of State, “Briefing by Ambassador Philip Wilcox on Release of Report Patterns of Global Terrorism 1996,” April 30, 1997, https://bit.ly/3NJxIWT.

[14] Benjamin Weinthal, “Iran Uses Server in Netherlands for Spying on Dissidents – Report,” The Jerusalem Post, February 20, 2021, https://bit.ly/3PY1Y2i.

[15] U.S. Department of Justice, “Two Iranian Nationals Charged for Cyber-Enabled Disinformation and Threat Campaign Designed to Influence the 2020 U.S. Presidential Election,” November 18, 2021, https://bit.ly/3aAdkcs.

[16] Nathan Sales, “Tehran’s International Targets: Assessing Iranian Terror Sponsorship,” The Washington Institute for Near East Policy, November 13, 2018, https://bit.ly/3NLx7Ur.

^[17] “El plan era atacar a dos miembros de la comunidad judía. Agencias buscan a Rahmat Asadi,” El Tiempo, August 29, 2021, https://bit.ly/3m2JIH3.

[18] U.S. Department of Justice, “Iranian Intelligence Officials Indicted on Kidnapping Conspiracy Charges,” July 13, 2021, https://bit.ly/3t3NdB5.

[19] Kareem Fahim and Erin Cunningham, “Turkey Says Iranian Intelligence Was Behind Elaborate Plot to Kidnap Opponent in Istanbul,” The Washington Post, December 13, 2020, https://wapo.st/3Q6BbRt.

[20] “Family Tells AP: Iran Abducted California Man while in Dubai,” VOA News, August 4, 2020, https://bit.ly/3Nbhzte.

[21] “Iran: Transnational Repression Origin Country Case Study,” Freedom House, Special Report 2021, https://bit.ly/3M6GzAJ.

^[22] U.S. Department of Justice, “Former U.S. Counterintelligence Agent Charged with Espionage on Behalf of Iran; Four Iranians Charged with a Cyber Campaign Targeting Her Former Colleagues,” February 13, 2019, https://bit.ly/3wZcvBl.

[23] FBI, “Most Wanted: Monica Elfriede Witt,” https://bit.ly/3x2Ip00.

[24] “Escalating Tensions between the United States and Iran Pose Potential Threat to the Homeland,” Public Intelligence, January 20, 2020, https://bit.ly/3aAAFL5.

[25] Declan Walsh, Eric Schmitt, Simon Marks and Ronen Bergman, “In a Dangerous Game of Cat and Mouse, Iran Eyes New Targets in Africa,” The New York Times, February 15, 2021, https://nyti.ms/3zbjmdV.

[26] James Laporta, “AP Sources: Iran Threatens US Army Post and Top General,” AP News, March 21, 2021, https://bit.ly/3Nf3DyI.

[27] Ibid.

[28] Matthew Lee, “US Pays $2M a Month to Protect Pompeo, Aide from Iran Threat,” PBS News, March 12, 2022, https://to.pbs.org/3GGSDaU.

[29] Emanuel Fabian, “Israel Warns against Travel to Turkey amid ‘Real Threat’ of Iranian Revenge Attack,” Times of Israel, May 30, 2022, https://bit.ly/3lZ7QdP.

[30] Tzvi Joffre, “Iranian Media Threatens Israelis, Lists Those It Claims ‘Live in Hiding’,” The Jerusalem Post, May 30, 2022, https://bit.ly/3M6ioSW.

[31] Jessica Steinberg, “Spy Drama Meets Real-Life Espionage on the Set of TV Hit ‘Tehran’,” Times of Israel, May 30, 2022, https://bit.ly/3zbI5ie.

[32] “Israel Says It Broke Up Iranian Spy Network That Recruited Women,” BBC News, January 13, 2022, https://bbc.in/3NDuZOG.