Iranian Response to Attacks on its Nuclear Program

by Scott Stewart

In the wake of several recent incidents that appear to have targeted Iranian missile and nuclear production facilities, the Iranian government likely will feel pressured to retaliate using terrorism. However, Tehran’s own terrorism capabilities are extremely limited, and current constraints on its proxies are likely to make them reluctant to conduct major attacks on Iran’s behalf.

A number of mysterious incidents have occurred in Iran over the past several weeks, among which were theJune 25 explosion at a ballistic missile production facility in Khojir and the July 2 explosion in a factory at Iran’s main nuclear production facility in Natanz that was reportedly producing a new generation of centrifuges. Due to the opaque nature of Iran, it is difficult to get a clear idea of exactly what is happening and whether these fires and explosions are linked. We don’t know for certain if these incidents are attacks or merely industrial accidents that outside forces are trying to claim as attacks to cause internal problems for Iran.

No matter the causes of these incidents, from the Iranian perspective there have simply been too many to treat them as accidents, and therefore it is only reasonable to assume that Tehran will respond as if they were attacks. Based on capability and past Iranian behavior, it is safe to assume the Islamic Republic will retaliate using terrorism. In response to these threats, Israeli and U.S. intelligence collection will redouble their monitoring of Iranian government and proxy group operations in an attempt to determine what approach Iran will take and thwart any attacks.

A shadowy, previously unknown group calling itself the “Cheetahs of the Homeland” claimed credit for the Natanz explosion in a series of videos and messages posted to social media. Some of these messages were sent to the BBC Persian monitoring service before the Natanz incident hit the news wires, raising the possibility that the authors of these messages had some advanced knowledge of the incident. However, many Iran watchers are skeptical that the Cheetahs of the Homeland is a real organization, raising suspicion that the claims were an attempt to obfuscate the actor behind them. Nevertheless, the claims have served to reinforce the belief by some inside Iran that the Natanz incident was intentional.

This theory is supported by a history of attacks on Iran’s nuclear program. Natanz itself was the target of the2010 Stuxnet cyberattack,  and between 2007 and 2012, five Iranian nuclear scientists were assassinated in a campaign that journalists Yossi Melman and Dan Raviv claim in their book “Spies Against Armageddon: Inside Israel’s Secret Wars” was conducted by Israeli Mossad. Given this history, then, it is not surprising that many suspect an Israeli hand in the incidents that appear to be targeting Iran’s nuclear program.

Iranian authorities have threatened to retaliate if they determine the incidents were sabotage attacks. Indeed, given the pressure on the Iranian government from internal hawks in light of recent events such as the Jan. 3, 2020, U.S. airstrike that killed Islamic Revolutionary Guards Corps (IRGC) commander Qassem Soleimani, it may feel the need to retaliate for internal political purposes even if it learns these were in fact accidents.

Possible Responses

The pressure on the Iranian government for a response makes it important to examine the tools it has should it decide to retaliate. The first option it has is conventional military forces, as seen when Iran retaliated against the Soleimani killing by launching a volley of ballistic missiles at a section of the Ain al-Asad airbase in western Iraq where U.S. personnel were stationed. Such forces also were used in September 2019 when, in response to sanctions against Iran’s oil industry, the IRGC attacked Saudi Arabia’s Abqaiq and Khurais oil processing facilities with cruise missiles and drones.

If the Iranians believe the United States was responsible for the recent incidents, additional attacks against U.S. military personnel and installations in Iraq, the Persian Gulf, or the Strait of Hormuz are possible. However, if Tehran blames Israel, it will be much more difficult to use conventional military force against Israeli targets due to geographic constraints. While Iran does have ballistic missiles that are capable of reaching Israel from Iran, it is difficult to imagine the Iranians using them in an attack against Israel — a ballistic missile attack against a nuclear armed country is very dangerous.

There is also a possibility of using IRGC personnel stationed in Syria to conduct an attack targeting Israel using shorter-range missile systems and drones, but Israel has been conducting a persistent campaign ofairstrikes against IRGC personnel and weapons systems in Syria for the past several years, and with Israeli attention attuned so carefully to IRGC activity in Syria, it would be difficult to conduct a substantial attack using such systems without preparations being detected and pre-empted by Israeli airstrikes. The same set of circumstances applies to Iranian forces in Iraq; since July 2019, Israel has conducted a number ofairstrikes against IRGC and Iranian-backed Popular Mobilization Unit bases in Iraq, purportedly striking missile systems and arms depots.

Another possible avenue for Iranian retaliation is via cyberattacks. In response to the Stuxnet attack, Iranian advanced persistent threat groups became very active, beginning with the 2012 Shamoon attacks. Since that time these groups have been, well, persistent: They have not stopped attacking targets in the United States, Israel, and the Gulf and therefore don’t need a proximate cause to launch further attacks. In May, Israel’s National Cyber Directorate announced it had prevented a major Iranian cyberattack against Israel’s water system. A few days later, a disruptive cyberattack was launched against Shahid Rajaae, Iran’s largest port. While the attack was somewhat restrained, it appears to have been a message sent by Israel to Iran not to attempt to conduct similar attacks going forward.

While Iran is a rising cyber power, it remains outclassed by Israel and the United States. It is harder to defend against cyberattacks than it is to conduct them, meaning that Iran is vulnerable to retaliation should it attempt to significantly escalate cyberattacks against Israel. However, I do expect them to continue their longstanding campaign of lower-stakes cyberattacks against Israel and other rivals.

It is also possible that Iran will attempt to use its array of militant proxy groups to increase the tempo and scale of insurgent attacks against military targets as a means of retaliation. These groups include Hezbollah, the Popular Mobilization Units in Iraq, the al-Houthi fighters in Yemen, proxy groups in Afghanistan, and Hamas and the Palestinian Islamic Jihad in Gaza. U.S. troops on the ground in Syria, Iraq, Afghanistan, in the Persian Gulf, and elsewhere in the region would be vulnerable in more places for such attacks than Israeli forces or interests.

Israel would be most vulnerable to insurgent attacks by Iranian proxies such as Hezbollah in Lebanon and Syria or Gaza-based Palestinian groups such as Hamas and the Palestinian Islamic Jihad. But with Lebanon in the middle of a crisis due to social, economic and political unrest — not to mention the COVID-19 pandemic — and having suffered significant casualties while supporting the regime of Syrian President Bashar al-Assad, Hezbollah is not likely to have the appetite to provoke Israel into another full-on border war. Hezbollah does want to please its Iranian patrons, but the group has its own agency: It may choose to act on Iran’s orders, but only after first considering its own calculated interests and constraints. For a host of internal and external considerations, the timing doesn’t seem to be ideal for a war with Israel.

There is no doubt that the Iranians will continue to fund and arm Palestinian proxies such as Hamas and the Palestinian Islamic Jihad. However, their ability to smuggle arms into the Gaza strip has been hampered in recent years, especially larger weapons systems such as long-range artillery rockets. Furthermore, even more so than Hezbollah, these Sunni Muslim Palestinian proxies appreciate Iran’s largesse but will factor in their own calculations ahead of Iran’s wishes when deciding whether to conduct an attack. Because of this, the Palestinian groups will remain a persistent thorn in Israel’s side but are unlikely to conduct the type of attack the Iranians would desire as vengeance for the incidents in Iran.

Iranian Terrorism Capabilities

This brings us to the final tool in Iran’s retaliatory arsenal: terrorism. Iran’s clerical regime has used terrorism for decades to pursue an asymmetric warfare strategy against stronger adversaries, and it has conducted attacks using both government operatives and terrorist proxies. Based on this history, it is quite likely that Iran will use terrorism — such as bombings and armed assaults against noncombatants outside of conflict zones — to retaliate against whoever it believes is the author of the attacks against its nuclear program.

In terms of an indigenous terrorism capability, that role has been assumed in recent decades by members of the IRGC’s Quds Force. However, while Quds Force has experienced a great deal of success in paramilitary operations on battlefields close to its core territory in places such as in Iraq, Yemen, and Lebanon, it has clearly struggled to project its terrorist capability over distance and in more hostile operational environments. In the wake of the assassination campaign against Iranian nuclear scientists, we saw the IRGC attempt to conduct attacks in several places to include Tbilisi, Bangkok, New Delhi, Istanbul, Baku and Nicosia. Those attacks were either thwarted, aborted, or botched and did not result in any Israeli deaths.

The reason for this lack of success is that conducting terrorist operations in a hostile capital city requires a different skill set than training and leading paramilitary forces to conduct guerrilla warfare. The tradecraft skills required to clandestinely conduct terrorist operations are more akin to the skills required of an intelligence officer than those of a commando. A terrorist operative must be skilled in things such as clandestine travel, covert communications, and conducting the attack cycle, especially during steps where the operative is most vulnerable to detection such as weapons acquisition and surveillance, while practicing exceptional operational security to prevent being detected by the host country’s security.

Quds Force has historically struggled to project its terrorist capability due to poor tradecraft, and judging from more recent operations, there is little sign it is improving in this area. In June 2018, Belgian authorities arrested an Iranian-Belgian couple for plotting an attack against a rally being held by an Iranian dissident group in Paris. The pair was found to be transporting a small bomb in their vehicle when they were arrested. The arrest was timed to coincide with the arrests of an Iranian diplomat in Vienna and other suspects in France and Germany, indicating that the group’s poor tradecraft and operational security had allowed the entire network to be identified and monitored by security forces. In October 2019, Albanian police reported that they foiled a plot by Quds Force operatives to attack Iranian dissidents in that country. And in early July 2020, a Mossad spokesman told Israel’s Channel 12 news that his service had helped uncover and thwart an Iranian plot to attack Israeli embassies in a number of unidentified countries in Europe and elsewhere.

Hezbollah has had more success than Quds Force. In July 2012, a Hezbollah member launched a suicide bombing attack against a group of Israeli tourists at the airport in Burgas, Bulgaria, that killed five tourists and a Bulgarian bus driver and injured another 32 victims. But Hezbollah also has ample reason to refrain from becoming too active on the terrorist front at this time. Past attacks in places such as Buenos Aires and failed attempts in places like Bangkok have resulted in significant disruption to Hezbollah’s finance and logistics networks in those regions. Also, Hezbollah has been hard at work to keep European countries from declaring them terrorists because of the impact that would have on the group’s finance and logistics network.

Clearly, the security posture of most countries has changed dramatically in the post-Sept. 11 and post-Islamic State “caliphate” world. It has become much more challenging to conduct terrorist attacks than it was in the heyday of Iranian terrorism in the 1980s. This poses a huge challenge for Iran and its terrorist proxies. Given the string of incidents in Iran, and Iranian threats of retaliation, the United States, Israel, and other intelligence agencies are undoubtedly redoubling their efforts to monitor the activity of suspected Iranian operatives and proxies, making for an even more challenging environment.

However, despite these challenges and a history of setbacks, Iran is highly likely to continue to attempt to exercise its terrorism capability, and we can expect to see more attempted attacks by the Quds Force and perhaps proxies such as Hezbollah in the months ahead. This likelihood will become even higher if the incidents in Iran were in fact attacks and if more attacks occur.

Scott Stewart is Vice-President of TorchStone Global, an international risk mitigation and security firm. Previously, Mr. Stewart was VP of Tactical Analysis at Stratfor (2004-20). Prior to that Stewart was the protective intelligence coordinator at Dell where he served as a member of Michael Dell’s executive protection team. He also spent 10 years as a special agent with the U.S. Department of State’s Diplomatic Security Service (DSS), where he was involved in several high-profile terrorism investigations. Follow him on Twitter at @stick631.

The views expressed herein are the author’s and do not necessarily reflect those of CGP.