Iran and Hezbollah’s Pre-Operational Modus Operandi in the West – Part Two

By Mitch Silber

In January 2020, Mitchell D. Silber was named the executive director of the Community Security Initiative, a new position created as part of UJA and JCRC-NY’s $4 million plan to help secure local Jewish institutions in the New York region.  He previously served as Director of Intelligence Analysis at the New York City Police Department where he was the principal advisor to the Deputy Commissioner of Intelligence on counterterrorism policy and analysis.  He has represented the NYPD at the White House, National Security Council, CIA, FBI, and National Counter Terrorism Center and testified before the U.S. Senate and House of Representatives.

By Ioan Pop

Ioan Pop is an associate managing director in K2 Intelligence’s Financial Crimes Risk and Compliance practice in New York. He leads teams of compliance specialists and investigators in advising financial institutions on a range of Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) and Office of Foreign Assets Control (OFAC) sanctions compliance matters. Prior to joining K2 Intelligence, Ioan worked for 10 years as a senior intelligence analyst in the New York Police Department (NYPD) Intelligence Bureau, where he led various teams of intelligence analysts to support and direct NYPD counterterrorism investigations. Ioan worked alongside senior detectives on highly sensitive intelligence investigations, focusing mainly on counterterrorism and terrorist financing investigations relating to Hezbollah and Iran. Ioan has an M.A. in international affairs from Tufts University’s Fletcher School of Law and Diplomacy, and a B.S. in political science from Southern Connecticut State University.

In part one of Iran and Hezbollah’s Pre-Operational Modus Operandi in the West, authors Mitch Silber and Ioan Pop pulled from court documents and open source reporting to shed light on ways that Iran and its proxy groups have engaged in regional escalations after the killing of Iranian General Qassem Soleimani in January, and after the US withdrawal from the 2015 Iran nuclear deal.  In particular, part one dealt with intelligence gathering and surveillance activities.

Mitchell D. Silber, Former Director of Intelligence, NYPD

In January 2020, Mitchell D. Silber was named the executive director of the Community Security Initiative, a new position created as part of UJA and JCRC-NY’s $4 million plan to help secure local Jewish institutions in the New York region.  He previously served as Director of Intelligence Analysis at the New York City Police Department where he was the principal advisor to the Deputy Commissioner of Intelligence on counterterrorism policy and analysis.  He has represented the NYPD at the White House, National Security Council, CIA, FBI, and National Counter Terrorism Center and testified before the U.S. Senate and House of Representatives.

Ioan Pop, Former Senior Intelligence Analyst, NYPD

Ioan Pop is an associate managing director in K2 Intelligence’s Financial Crimes Risk and Compliance practice in New York. Prior to joining K2 Intelligence, Ioan worked for 10 years as a senior intelligence analyst in the New York Police Department (NYPD) Intelligence Bureau, where he led various teams of intelligence analysts to support and direct NYPD counterterrorism investigations. 

Modus Operandi 2: Plausible Diplomatic, Business, Cultural and Other Covers to Conceal Operational Activities

During a 2008 visit by an NYPD Intelligence Division team (including one of the authors) to Buenos Aires, Argentinian intelligence officials outlined how Hezbollah, in cooperation with various elements within the Iranian intelligence, was responsible for two separate terrorist attacks in Buenos Aires, the 1992 Israeli Embassy and the 1994 AMIA bombing. In both cases Iran leveraged a highly complex local intelligence network developed since the mid-1980s, which was run from Iranian Embassy in Buenos Aires and its Cultural Bureau. The local network for the 1994 AMIA attack, centered around a Shi’a Imam and Cultural Attaché to the Iranian Embassy and involved three front companies. While the authors were told by Argentine intelligence officials that the decision to attack Argentina in 1994 was made at the highest levels of Iran’s governmental structure, the Iranians used diplomatic cover, business cover and NGO/religious cover to mask their network on the ground in South America.

A report by the AMIA Special Prosecutor, Alberto Nisman, illustrated the three elements – diplomatic cover, business cover and NGO/religious cover – in Iran’s robust spy network in Argentina. Mohsen Rabbani, who was both the Imam at At-Tauhid Mosque in Buenos Aires and later given the position of Cultural Attaché to the Iranian Embassy in Buenos Aires benefited from both “religious cover” as an imam and later diplomatic cover. Nisman noted that both Rabbani and Ahmad Reza Asghari (Third Secretary of the Iranian Embassy in Buenos Aires) benefited from their diplomatic covers and “played key roles in the intelligence infrastructure that the Iranian government maintained in Buenos Aires at the time of the attack.”

According to the report, Rabbani received his diplomatic cover (when he was named the Cultural Attaché to the Iranian Embassy in Buenos Aires) a few months before the attack. Nisman cited him as the “driving force” behind the Iranian intelligence collection efforts in Argentina and noted that he had received substantial amounts of money from Iran after the decision to carry out the attack was made. Nisman noted that once the decision to attack had been made, “the information flow between Iran and its Argentinean embassy substantially increased, via functionaries and diplomatic couriers.”

As part of the business cover for the Iranian spy network in Argentina, there were also three front companies, Government Trade Corporation (GTC), Imanco and South Beef SA, whose officials reportedly carried out various intelligence tasks. GTC was established in Argentina in March 1985 and by mid-1993 moved its office in the same building as Iranian Embassy’s Cultural Bureau. According to the Argentine intelligence officials, GTC “provided cover for Iranian intelligence operatives to enter Argentina,” as it was alleged that its executive in Argentina, Seyed Jamal Youssefi, was an Iranian intelligence official. According to Nisman’s report, documentation showed that GTC and Imanco had not conducted commercial activities for extended periods of time and it believed that their main purpose was to provide support and cover for the Iranian intelligence network in Argentina. Additionally, GTC interchanged personnel with Imanco and South Beef, all of which were in permanent contact with Mohsen Rabbani, the network’s ringleader.

Similar to the organizations hiding under different types of cover in Buenos Aires, in New York City, Iran’s presence included the Alavi Foundation, a nonprofit ostensibly devoted to charity works and promoting Persian and Islamic culture. In December 2009, Preet Bharara, U.S. Attorney for the Southern District of New York, described Alavi as having “effectively been a front for the government of Iran.” The complaint filed by the Southern District of New York led to the seizure of Alavi’s assets—including the Islamic Institute of New York, the largest Shi’a mosque in the city and closely affiliated with Iran’s UN mission. Although in August 2019, a federal appeals court which cited several errors by the trial judge, overturned the verdict that granted the seizure of Alavi assets, there is indisputable evidence of Alavi links to the Iranian government.

The investigation of Alavi, which had begun with the NYPD Intelligence Division and the District Attorney’s Office of New York, had been based on NYPD concerns that like in Argentina, Alavi could provide diplomatic and NGO cover to shield an Iranian spy network in New York City. As in the case the Iranian network in Argentina, several individuals with links with Alavi maintained close ties to Iranian government officials. They had traveled to Iran, had regular contact with Iranian government officials in New York City and participated as board members, executives or employees of Iranian governmental and nongovernmental entities in the U.S. such as the Iranian Mission to the UN, the Iranian Interest Section in Washington DC (located within the Pakistan’s Embassy), and various Shi’a Islamic Centers funded by the Alavi Foundation.

During the authors’ time at NYPD Intelligence Division, they investigated Iran activities related to pre-operational intelligence gathering and Iranian officials’ associations and funding of local institutions. They also investigated how, through a sophisticated web of financial transactions and shell companies, millions from the rental income of a Manhattan skyscraper owned by Alavi Foundation and Assa Corporation, a shell company controlled by Bank Melli (Iran), made its way to U.S. dollar-strapped Iran, in violations of U.S. sanctions.

Modus Operandi 3: Infiltration of Iranian Dissident Groups

Iranian security agencies use a range of tactics to safeguard the regime, including infiltrating opposition groups. These agencies have “identified and eradicated opponents and defectors inside and outside of the country”. In the 1990s, elements within the Iranian Intelligence focused on targeting the opposition outside Iran and are believed to have been responsible for assassinating various dissidents, including Shahpour Bakhtiar, the last prime minister under the Shah. In August 1991, Bakhtiar was stabbed and strangled to death at his home in France by three Iranian agents.

The Iranian government infiltrates and collects intelligence on the Iranian diaspora communities in various ways. For example, a Paris-based organization named “Supporting Iranian Refugees” is alleged to be used by Iranian intelligence to recruit Iranian asylum seekers in France, in order to spy on Iranian nationals residing there. A similar phenomenon of community monitoring was observed in NYC after the 2009 Iranian presidential election and the street demonstrations in support of the Green Movement in Iran.

Iranian intelligence has a history of infiltrating opposition groups such as the MeK, which in 2002 disclosed publicly that Iran has two covert nuclear facilities located in Natanz and Arak. MeK also has had close ties to the U.S. intelligence agencies and it reportedly provided intelligence on Iran’s nuclear program to the U.S. Government. In 2018, two Iranians, Ahmadreza Mohammadi Doostdar and Majid Ghorbani, were indicted for reportedly spying on the MeK on behalf of the Iranian government. According to the Department of Justice, Doostdar and Ghorbani collected intelligence on “individuals considered by the government of Iran to be enemies of that regime, including Israeli and Jewish interests, and individuals associated with the MeK, a group that advocates the overthrow of the current Iranian government.” According to court documents, Doostdar was believed by U.S. investigators to be an Iranian agent who recruited Ghorbani to collect intelligence on MeK’s activities in the U.S.

According to the Department of Justice, in 2017 Majid Ghorbani attended a MeK rally in New York City, where he took photos of participants protesting against the Iranian government. Court documents indicate that in December 2017, upon his return from Iran, Doostdar contacted and met with Ghorbani. He reportedly paid Ghorbani roughly $2,000 for 28 photographs that Ghorbani took at the MeK rally, “many of which contained hand-written annotations identifying the individuals who appeared in the photos.”

In March 2018, Ghorbani traveled to Iran, reportedly for an “in-person briefing.” Upon his return to the U.S., a document was titled “About the Organization” was found on Ghorbani which appeared to include specific instructions on how to target the MeK:

“More influence in order to find out secret information, people in the network and organization’s decisions against Islamic Republic;”

“Attending the monthly gathering every last Sunday of the month at the church;”

“Evaluation of the workplace’s independency and the possibility of using it for the gathering of the important people of the organization;” and

“Introducing a second person who can be trained by uncle Sohrab and can act like uncle Sohrab inside the organization.”

Subsequently, in May 2018, he attended Iran Freedom Convention for Human Rights in Washington, DC, which featured speakers and attendees which were members or supporters of the MeK. While in attendance at this conference, Ghorbani took several photos of various attendees and speakers. According to U.S. Department of Justice, shortly after, he was allegedly called by Doostdar to “discuss clandestine methods Ghorbani should use in order to provide this information to Iran.”

Modus Operandi 4: Logistical Planning for Possible Future Attacks

Iran/Hezbollah’s modus operandi is often characterized by advanced logistical planning for potential future attacks. In some recent cases, this preparation has focused on the secret accumulation and storage of explosive material for potential forthcoming attacks. According to Israeli intelligence sources, as reported in the Israeli press, the effort by Hezbollah’s Unit 910 involves “long-term planning for immense, game-changing terror attacks.”

Hezbollah repeatedly and across different continents conducted this advanced logistical planning by establishing large stockpiles of harmless looking “First Aid” ice packs filled with ammonium nitrate. This characteristic Hezbollah tradecraft for prepositioning explosives around the world has been evidenced by discoveries in Thailand, Cyprus and the U.K.

The first time Hezbollah’s stockpiling of ammonium nitrate in First Aid ice packs was detected was in Thailand in 2012 and were linked to the efforts of previously mentioned Unit 910 member, Samer el Debek.

According to el Debek’s criminal complaint, in January 2012, Hussein Atris, a member of Unit 910 with dual Lebanese-Swedish citizenship was detained at a Bangkok airport, seeking to depart Thailand. He subsequently led Thai law enforcement to “a commercial building near Bangkok that housed a cache of 10,000 pounds of urea-based fertilizer and 10 gallons of ammonium nitrate which was stored in First Aid ice packs.”

Likely not unrelated, Samer el Debek, who had been trained in creating ammonium nitrate based explosives, went on his first mission for Hezbollah, years earlier, to Thailand in 2009 on behalf of Unit 910 and was tasked to dispose of the ammonium nitrate by moving it out of a house and pouring it down the drain because “they [Hezbollah] were under surveillance”.

In Cyprus, a strikingly similar example of Hezbollah’s advanced logistical planning was detected. A supply of First Aid ice packs consisting of more than eight metric tons of ammonium nitrate was found in the home of 26-year-old Hussein Bassam Abdallah, a dual Lebanese and Canadian national who admitted to being a member of Hezbollah. Abdullah “pleaded guilty and was given a six-year prison sentence in June 2015.”

Then, in September 2015, in the United Kingdom, multiple caches of tons of explosive materials were discovered as stockpiles on the outskirts of London, hidden at four properties in north-west London (three businesses and a home). The explosive ammonium nitrate was packaged in thousands of disposable First Aid ice packs which resembled those used for minor injuries. The clandestine hoard of what amounted to three metric tons of ammonium nitrate was discovered by MI5 and the Metropolitan Police in the autumn of 2015 and was believed to be directly linked to Hezbollah. This quantity exceeded the amount of ammonium nitrate that “was used in the [1995] Oklahoma City bombing that killed 168 people and damaged hundreds of buildings.”

Despite the seriousness of this discovery in the United Kingdom, a suspect in his 40s who was arrested “was eventually released without charge”. Reports suggest that the decision not to prosecute the suspect was done in order to protect sources and methods that derived from the covert intelligence. Not only would a court trial of the suspect risked exposing human intelligence operations, British authorities had political considerations as well to factor in, with this discovery coming at a time when the U.K. had just signed on to the October 2015 JCPOA nuclear deal with Iran.

In terms of targets, according to reports in the Israeli press, citing Israeli intelligence officials, police in Thailand, Cyprus and the U.K. determined that the stored explosives were to be directed against Israeli assets in those countries. Israeli newspaper Yedioth Ahronoth quoted an unnamed official, noting, “‘Hezbollah is preparing for a situation in which it will decide to seek revenge, whether for something taking place between Israel and Lebanon or for an attack on Iran’s nuclear sites, and has established a network of enormous caches of advanced explosive materials’ for that purpose.”

Hezbollah advanced logistical planning for future attacks in the West was not only about ammonium nitrate in first-aid ice packs. For example, Ali Mohammed Kourani was tasked by his Hezbollah handler to “cultivate contacts in the New York City area who could provide firearms for use in potential future IJO operations in the United States.”

However, what has not previously been disclosed and may be a new element in Hezbollah’s advanced logistical planning may be in the cyber realm. As part of the authors’ research into Alexi Saab via his social media footprint, it was discovered that not only did he work as an information technology specialist, but he had been employed as a subcontractor for Microsoft with access to New York City’s Domain Awareness System (DAS). The DAS is “one of the world’s largest networks of cameras, license plate readers, and radiological censors, designed to detect and prevent terrorist acts, but also of great value in criminal investigations.” This system, which is operated by the NYPD’s Counterterrorism Bureau, in coordination with the Intelligence Bureau, enables the department to track targets of surveillance and collect data on these targets in real time.

The system is connected to more than “18,000 CCTV cameras video cameras around New York City” and had access to data from more than “2[two] billion license plate readings, 100 million summonses, 54 million 911 calls, 15 million complaints, 12 million detective reports, 11 million arrests and [two] million warrants”. While there is no public information to suggest that Saab utilized any malware or inserted any logic bombs into the system, the coincidence of his work on this counter terrorism system is suspicious, bordering on alarming, in the view of the authors.

Modus Operandi 5: Preparing “Human Target Packages” to Enable Assassinating Dissidents and Adversaries

“Target packages” are a file of information that “enable an intelligence or military unit to find, fix, track and neutralize a threat. A human target package includes information collected about an individual, such as the official position of the individual; an analysis of personal vulnerabilities or other opportunities to exploit the individual and confirmation of the identity and location of the individual.” A target package could include “capture/kill operations”. There is strong evidence that assembling human target packages has been a consistent element of Iran/Hezbollah’s modus operandi in the West with examples in the Netherlands, France, Denmark, New York City and Washington DC.

For example, in Amsterdam, Iranian antiregime dissident, Ahmad Mola Nissi, was likely the victim of an Iran/Hezbollah liquidation operation in late 2017, when he was gunned down in front of his apartment. As the leader of the ASMLA, a movement that promotes the rights of the Ahwazi, an Arab people who feel oppressed in the oil-rich Iranian region of Khuzestan, he had sought refuge in the Netherlands since 2005. In the month leading up to his attack, Nissi had gone to the police expressing concerns about his safety. U.S. Secretary of State Pompeo appeared to refer to the alleged assassination in May 2018, when in a major statement he noted, “today, the Iranian Quds Force conducts covert assassination operations in the heart of Europe.”

While Dutch authorities did not officially charge anyone in connection with this crime, they did arrest and then release two Iranian embassy staff in the wake of the killing. The Nissi assassination was likely not the first conducted on Dutch soil by Iranian/Hezbollah hit squads as, “the AIVD [Dutch General Intelligence and Security Service] has strong indications that Iran has been involved in the liquidation of two Dutch people of Iranian origin (in Almere in 2015 and in The Hague in 2017), both known as opponents of the Iranian regime.”

Meanwhile, another liquidation attempt in 2018 was very clearly Iran-related and involved a sophisticated “human target package” as well as TATP explosives in France. The target was a conference in Paris for the political arm of the MeK, called the National Council of Resistance of Iran (NCRI), with 25,000 visitors expected, including more than thirty former U.S. officials, among them, former House speaker Newt Gingrich and former New York City Mayor Rudy Giuliani. However, coordinated intelligence operations in Europe thwarted the plot. In late June 2018 in Belgium, special police units stopped a Mercedes driven by an Iranian-Belgian couple on their way to Paris bringing with them a bag with 500 grams of TATP explosive and an ignition mechanism. The bomb was fully functional.

Simultaneously, “an Iranian diplomat stationed in Vienna is arrested in a parking lot in Germany. According to the German authorities, the man works for the Iranian security service MOIS. During a meeting in Luxembourg, he [allegedly] handed over the explosives to the Belgian couple. The French government now says it is certain that Iran is behind the foiled bomb attack and announces targeted sanctions, including against a deputy minister who is seen as the mastermind behind the action.”

Similar to the Netherlands, but with a different outcome, in October 2018, Denmark announced it had foiled an operation to kill an Iranian dissident on its territory. Danish authorities arrested a Norwegian citizen of Iranian descent for allegedly planning the assassination of a Denmark based leader of ASMA – the same ethnic Arab separatist group that Nissi in Amsterdam had been a member of – according to Denmark’s Security and Intelligence Service (PET). Danish Prime Minister, Lars Lokke Rasmussen pointed the finger at Iran noting, “It is totally unacceptable that Iran is planning liquidations on Danish soil.”

In yet additional pre-operational Iran-linked espionage activity in Western Europe, Syed-Naqfi, a Pakistani national working as an operative for the Qods Force, collected intelligence for his targeting package on two known individuals. One was French-Israeli businessman and professor, “David Rouach, who teaches at the elite Ecole Supérieure de Commerce de Paris and served as head of the French-Israeli Chamber of Commerce.” In Germany, Naqfi also monitored Reinhold Robbe, the former head of the German-Israel Friendship Society. According to German authorities, Naqfi actions were “a clear indication of an assassination attempt.”

Meanwhile during his time in New York City, Ali Mohammed Kourani was also tasked to complete human target packages, or as the criminal complaint notes, “to identify and collect intelligence regarding individuals in the United States affiliated with the IDF [Israeli Defense Forces]”. Kourani told U.S. Law Enforcement officials that he believed that the IJO [Unit 910] “gave him this tasking to facilitate, among other things, assassinations of IDF personnel [living in the U.S.] in retaliation for the 2008 assassination of Imad Mugniyah, the former leader of the IJO.”

Similarly, the two Iranian-linked individuals, Doostdar and Ghorbani, operating in Chicago, New York and Washington, D.C., focused on human targeting packages that could be used to identify and locate individuals related to the MeK and their supporters—even if they were members of Congress. For example, Ghorbani traveled to New York City in September 2017 where he attended a MeK/NCRI rally that denounced the Iranian regime. “During this rally, Ghorbani conducted physical surveillance and photographed individuals participating in the rally.”

In the wake of the rally, “during a court-authorized physical search of Ghorbani’s apartment, the FBI found several hand-written notes in Farsi regarding members of the MeK, including names, positions, and relations to other MeK members,” according to the Justice Department. “The FBI also found in a locked suitcase a manila envelope containing information, including biographical data and phone numbers, about several U.S. Congressmen who have overt ties to the MeK.”

Modus Operandi 6: Counter-Intelligence Tradecraft and Operational Security

Another hallmark of Iranian/Hezbollah tradecraft is the employing counter-surveillance tradecraft and sophisticated operational security. A variety of modalities of this tradecraft has been utilized and observed in the United States.

One example was the Doostdar case. The information outlined in the paragraphs below comes from details publicly released by the Justice Department. “From approximately July 25 through July 30, 2017, Doostdar was in Costa Mesa, California, where he met several times with Ghorbani. Doostdar employed intelligence tradecraft and ran surveillance detection routes before, during, and after his meetings with Ghorbani.” Doostdar also utilized tradecraft like “changing clothes before each meeting, visiting meeting locations prior to the actual meeting, and arriving and departing from each meeting in a circuitous manner.” FBI surveillance teams also noted that “Doostdar walked slowly and was constantly looking around his surroundings” and looked at “the reflection of store windows as he passed by, consistent with checking for surveillance.” Consequently, the FBI assessed that Doostdar engaged in “intelligence tradecraft and counter- surveillance measures” that were “consistent with having received training from an Iranian intelligence service.”

The Iranians also observed secure communications protocols. Not only did they avoid speaking on open lines, but when Ghorbani asked if he could call Doostdar back on the same phone that he had been called from, Doostdar replied, “no, I call you from public phone…from Macy’s public phone.” Furthermore, Doostdar advised Ghorbani that despite turning their cell phones off, “they should wait until they got out of the car to talk, since phones could record even if they are turned off- it is possible.” After this particular call they then met at a Starbucks coffee shop for approximately forty-five minutes sitting in a more private area.

When communicating back to Lebanon from the U.S., Unit 910 members also observed strict communications protocols. Ali Mohammed Kourani and his handler, Fadi, used a marriage-related code, such as “bride,” to signal to Kourani that he should return to Lebanon, according to the Justice Department. After Kourani got married in real life, “Fadi communicated similar recall messages using coded references to a job or employment prospect in Lebanon.” Similarly, for Alexi Saab, “if Hezbollah ever needed him to return to Lebanon, Saab would receive an email to his personal email account that would appear to be spam. There would be a coded signal concealed in either or the subject or the body of the message that would alert Saab of the need to return to Lebanon.”

For regular communications back to Lebanon, “Kourani provided Fadi with the name of a particular childhood friend of Kourani, and Fadi established one or more email accounts using that name for purposes of operational communications.” Also, “Kourani deleted electronic communications from Fadi immediately after reviewing them.” Interestingly, “in approximately 2011 or 2012, Fadi instructed Kourani not to use existing operational email accounts or the IJO [Unit 910] Pager, as the IJO assessed that these communications selectors had been compromised. Kourani and Fadi did not use email to communicate regarding IJO operations after approximately 2012.”

However, coded email was also the means that both Samer el Debek and Alexi Saab used to communicate with Hezbollah members from overseas. El Debek said “[Hezbollah] gave him an email account to contact when he was away, and coded language to use in his emails to Hezbollah. He also said he was permitted to use any email account he wished to use to communicate with [Hezbollah] by email.”

Unit 910 members, like Ali Mohammed Kourani, observed elaborate communications protocols even when returning to Lebanon. He was advised that upon arrival in Beirut, he was to “call a telephone number associated with a pager (the “IJO Pager”) and provide a code that he understood was specific to him. After Kourani called the IJO pager, Fadi [his handler] would contact Kourani to set up an in-person meeting by calling a phone belonging to one of Kourani’s relatives.”

Meanwhile for Alexi Saab, when he returned to Lebanon, his handler utilized both a phone number and numeric code to inform his handler that he had returned to Lebanon, according to the Justice Department. After his handler received the code from Saab, he “would contact Saab on his personal cellphone or at his family home in Yaroun, Lebanon.”

As far as the means to provide the collected intelligence back to his Hezbollah handlers, “Kourani was instructed by IJO personnel abroad to use digital storage media, such as USB drives and memory cards, to transport pictures and data back to Lebanon relating to his external operations,” according to the Justice Department. Similarly, the Justice Department stated the Iranian, Doostdar also transported his information on two flash/USB drives, “one of which was concealed in a toy on a key chain.”

Modus Operandi 7: Recruiting Operatives with Dual Nationalities and Western Passports

Iran and Hezbollah have a history of recruiting operatives globally from within Shi’a diasporas, preferably those who have Western passports. A representative example of this is Mansour Arbabsiar, a naturalized U.S. citizen of Iranian descent, who is October 2011 was arrested and charged with plotting to kill Adel al-Jubeir, the Saudi Ambassador to the United States. According to the court documents, Arbabsiar claimed he had been recruited by a cousin in Iran who was a high-ranking member of IRGC’s Quds Force.

Similarly, the recent arrests of the reported Hezbollah Unit 910 operatives, Ali Kourani, Samer el-Debek and Alexei Saab in the U.S., reinforce the idea that Hezbollah focuses its external recruitment on individuals residing in the West, with dual nationalities and access to Western passports.

For example, according to court documents, Kourani was recruited mainly because his residence in the United States and “in connection with efforts by the IJO to develop “sleepers” who maintained ostensibly normal lives but could be activated and tasked with conducting IJO operations.” Moreover, one of his handler’s “first instructions to Kourani, who was a lawful permanent resident at the time, was to obtain United States citizenship and a U.S. passport as soon as possible” and “to acquire a U.S. passport card “that could be used to reenter the United States if his U.S. passport was seized outside the U.S.” Similarly, Samer el-Debek, arrested for his links to Hezbollah, claims he was recruited because as a U.S. naturalized citizen, he was in possession of a U.S. passport.

Although Alexei Saab was recruited in Lebanon before he spent time in the U.S., within five years of his lawful entrance, he applied for naturalized citizenship in the U.S. Subsequently, according to court documents, Saab entered into a fraudulent marriage in order to gain U.S. citizenship.

Many of the other Hezbollah Unit 910 operatives discussed earlier in this article similarly utilized dual citizenships to travel the world and operate on behalf of the unit. Hussein Atris, arrested in Thailand in January 2012 based on his links to the cache of thousands of pounds of urea-based fertilizer and gallons of ammonium nitrate, was a dual Lebanese – Swedish citizen. Similarly, Mauhamad Hassan Mouhamad El Husseini, the Hezbollah suicide bomber who detonated explosives on a tourist bus carrying Israeli tourists in Burgas, Bulgaria, killing six in July 2012, had dual Lebanese – French citizenship. Also, Hussien Bassam Abdallah, the Hezbollah operative arrested in Cyprus with 8.2 tons of ammonium nitrate in his residence had Lebanese – Canadian citizenship.

In New York, ownership of a Western passport was a key factor in Hezbollah’s recruitment criteria for members of the Shi’a Lebanese diaspora as well based on the authors’ experience investigating the group. From our observations, Hezbollah members in the city often traveled abroad to Lebanon, Latin America, Europe, China and Canada, using both, their U.S. and Lebanese passports.

The Ongoing Threat vs. the United States

Since the early 2000s New York City has been an active test bed for various pre-operational activities conducted by both Iranian and Hezbollah agents. Although the city has not had, by any means, a monopoly on this pre-operational activity, it has served as a unique observation post from which we could examine Iran and Hezbollah’s hostile tradecraft, up close, virtually identical to what has been similarly observed in Western Europe, Latin America and even some other American cities.

Elements of this tradecraft have included: undertaking intelligence gathering and surveillance activities on possible targets; advanced logistical planning for future attacks; using sophisticated and plausible diplomatic, business, cultural and other covers to conceal operational activities; infiltrating Iranian dissident groups; preparing “human target packages” to enable assassinating dissidents and adversaries; employing counter-surveillance tradecraft, sophisticated operational security, including observing communications security; and recruiting operatives, especially those with dual nationalities and Western passports from the Shia diaspora. They are all part of the Iran and Hezbollah’s playbook, or pre-operational modus operandi in the West.

Even in the wake of Iran’s ballistic missile attack on Al Asad Air Base in western Iraq in early January 2020, which injured more than fifty American soldiers and seemed like retaliation, President Hassan Rouhani of Iran told reporters on March 18, “Americans assassinated our great general, and we did not and will not leave this without a response,” suggesting that there was more to come.

While it is impossible to predict when, where or how Iran/Hezbollah might retaliate for the strike that killed IRGC General Qassem Soleimani, this article has made clear there is growing knowledge of the indicators and warning signs.

The authors’ hope is that by illuminating these tactics, techniques, and procedures, allied law enforcement and intelligence agencies around the world might improve their odds in thwarting future Iranian/Hezbollah terrorist attacks in the future.

A fully foot-noted version of this article is available at Taylor & Francis Online.

Read more expert-driven national security insights, analysis and opinion in The Cipher Brief


Related Articles

Search

Close