In the wake of several recent incidents that appear to have targeted Iranian missile and nuclear production facilities, the Iranian government likely will feel pressured to retaliate using terrorism. However, Tehran’s own terrorism capabilities are extremely limited, and current constraints on its proxies are likely to make them reluctant to conduct major attacks on Iran’s behalf.
No matter the causes of these incidents, from the Iranian perspective there have simply been too many to treat them as accidents, and therefore it is only reasonable to assume that Tehran will respond as if they were attacks. Based on capability and past Iranian behavior, it is safe to assume the Islamic Republic will retaliate using terrorism. In response to these threats, Israeli and U.S. intelligence collection will redouble their monitoring of Iranian government and proxy group operations in an attempt to determine what approach Iran will take and thwart any attacks.
A shadowy, previously unknown group calling itself the “Cheetahs of the Homeland” claimed credit for the Natanz explosion in a series of videos and messages posted to social media. Some of these messages were sent to the BBC Persian monitoring service before the Natanz incident hit the news wires, raising the possibility that the authors of these messages had some advanced knowledge of the incident. However, many Iran watchers are skeptical that the Cheetahs of the Homeland is a real organization, raising suspicion that the claims were an attempt to obfuscate the actor behind them. Nevertheless, the claims have served to reinforce the belief by some inside Iran that the Natanz incident was intentional.
This theory is supported by a history of attacks on Iran’s nuclear program. Natanz itself was the target of the2010 Stuxnet cyberattack, and between 2007 and 2012, five Iranian nuclear scientists were assassinated in a campaign that journalists Yossi Melman and Dan Raviv claim in their book “Spies Against Armageddon: Inside Israel’s Secret Wars” was conducted by Israeli Mossad. Given this history, then, it is not surprising that many suspect an Israeli hand in the incidents that appear to be targeting Iran’s nuclear program.
If the Iranians believe the United States was responsible for the recent incidents, additional attacks against U.S. military personnel and installations in Iraq, the Persian Gulf, or the Strait of Hormuz are possible. However, if Tehran blames Israel, it will be much more difficult to use conventional military force against Israeli targets due to geographic constraints. While Iran does have ballistic missiles that are capable of reaching Israel from Iran, it is difficult to imagine the Iranians using them in an attack against Israel — a ballistic missile attack against a nuclear armed country is very dangerous.
There is also a possibility of using IRGC personnel stationed in Syria to conduct an attack targeting Israel using shorter-range missile systems and drones, but Israel has been conducting a persistent campaign ofairstrikes against IRGC personnel and weapons systems in Syria for the past several years, and with Israeli attention attuned so carefully to IRGC activity in Syria, it would be difficult to conduct a substantial attack using such systems without preparations being detected and pre-empted by Israeli airstrikes. The same set of circumstances applies to Iranian forces in Iraq; since July 2019, Israel has conducted a number ofairstrikes against IRGC and Iranian-backed Popular Mobilization Unit bases in Iraq, purportedly striking missile systems and arms depots.
Another possible avenue for Iranian retaliation is via cyberattacks. In response to the Stuxnet attack, Iranian advanced persistent threat groups became very active, beginning with the 2012 Shamoon attacks. Since that time these groups have been, well, persistent: They have not stopped attacking targets in the United States, Israel, and the Gulf and therefore don’t need a proximate cause to launch further attacks. In May, Israel’s National Cyber Directorate announced it had prevented a major Iranian cyberattack against Israel’s water system. A few days later, a disruptive cyberattack was launched against Shahid Rajaae, Iran’s largest port. While the attack was somewhat restrained, it appears to have been a message sent by Israel to Iran not to attempt to conduct similar attacks going forward.
While Iran is a rising cyber power, it remains outclassed by Israel and the United States. It is harder to defend against cyberattacks than it is to conduct them, meaning that Iran is vulnerable to retaliation should it attempt to significantly escalate cyberattacks against Israel. However, I do expect them to continue their longstanding campaign of lower-stakes cyberattacks against Israel and other rivals.
It is also possible that Iran will attempt to use its array of militant proxy groups to increase the tempo and scale of insurgent attacks against military targets as a means of retaliation. These groups include Hezbollah, the Popular Mobilization Units in Iraq, the al-Houthi fighters in Yemen, proxy groups in Afghanistan, and Hamas and the Palestinian Islamic Jihad in Gaza. U.S. troops on the ground in Syria, Iraq, Afghanistan, in the Persian Gulf, and elsewhere in the region would be vulnerable in more places for such attacks than Israeli forces or interests.
Israel would be most vulnerable to insurgent attacks by Iranian proxies such as Hezbollah in Lebanon and Syria or Gaza-based Palestinian groups such as Hamas and the Palestinian Islamic Jihad. But with Lebanon in the middle of a crisis due to social, economic and political unrest — not to mention the COVID-19 pandemic — and having suffered significant casualties while supporting the regime of Syrian President Bashar al-Assad, Hezbollah is not likely to have the appetite to provoke Israel into another full-on border war. Hezbollah does want to please its Iranian patrons, but the group has its own agency: It may choose to act on Iran’s orders, but only after first considering its own calculated interests and constraints. For a host of internal and external considerations, the timing doesn’t seem to be ideal for a war with Israel.
There is no doubt that the Iranians will continue to fund and arm Palestinian proxies such as Hamas and the Palestinian Islamic Jihad. However, their ability to smuggle arms into the Gaza strip has been hampered in recent years, especially larger weapons systems such as long-range artillery rockets. Furthermore, even more so than Hezbollah, these Sunni Muslim Palestinian proxies appreciate Iran’s largesse but will factor in their own calculations ahead of Iran’s wishes when deciding whether to conduct an attack. Because of this, the Palestinian groups will remain a persistent thorn in Israel’s side but are unlikely to conduct the type of attack the Iranians would desire as vengeance for the incidents in Iran.
Iranian Terrorism Capabilities
This brings us to the final tool in Iran’s retaliatory arsenal: terrorism. Iran’s clerical regime has used terrorism for decades to pursue an asymmetric warfare strategy against stronger adversaries, and it has conducted attacks using both government operatives and terrorist proxies. Based on this history, it is quite likely that Iran will use terrorism — such as bombings and armed assaults against noncombatants outside of conflict zones — to retaliate against whoever it believes is the author of the attacks against its nuclear program.
In terms of an indigenous terrorism capability, that role has been assumed in recent decades by members of the IRGC’s Quds Force. However, while Quds Force has experienced a great deal of success in paramilitary operations on battlefields close to its core territory in places such as in Iraq, Yemen, and Lebanon, it has clearly struggled to project its terrorist capability over distance and in more hostile operational environments. In the wake of the assassination campaign against Iranian nuclear scientists, we saw the IRGC attempt to conduct attacks in several places to include Tbilisi, Bangkok, New Delhi, Istanbul, Baku and Nicosia. Those attacks were either thwarted, aborted, or botched and did not result in any Israeli deaths.
The reason for this lack of success is that conducting terrorist operations in a hostile capital city requires a different skill set than training and leading paramilitary forces to conduct guerrilla warfare. The tradecraft skills required to clandestinely conduct terrorist operations are more akin to the skills required of an intelligence officer than those of a commando. A terrorist operative must be skilled in things such as clandestine travel, covert communications, and conducting the attack cycle, especially during steps where the operative is most vulnerable to detection such as weapons acquisition and surveillance, while practicing exceptional operational security to prevent being detected by the host country’s security.
Hezbollah has had more success than Quds Force. In July 2012, a Hezbollah member launched a suicide bombing attack against a group of Israeli tourists at the airport in Burgas, Bulgaria, that killed five tourists and a Bulgarian bus driver and injured another 32 victims. But Hezbollah also has ample reason to refrain from becoming too active on the terrorist front at this time. Past attacks in places such as Buenos Aires and failed attempts in places like Bangkok have resulted in significant disruption to Hezbollah’s finance and logistics networks in those regions. Also, Hezbollah has been hard at work to keep European countries from declaring them terrorists because of the impact that would have on the group’s finance and logistics network.
Clearly, the security posture of most countries has changed dramatically in the post-Sept. 11 and post-Islamic State “caliphate” world. It has become much more challenging to conduct terrorist attacks than it was in the heyday of Iranian terrorism in the 1980s. This poses a huge challenge for Iran and its terrorist proxies. Given the string of incidents in Iran, and Iranian threats of retaliation, the United States, Israel, and other intelligence agencies are undoubtedly redoubling their efforts to monitor the activity of suspected Iranian operatives and proxies, making for an even more challenging environment.
However, despite these challenges and a history of setbacks, Iran is highly likely to continue to attempt to exercise its terrorism capability, and we can expect to see more attempted attacks by the Quds Force and perhaps proxies such as Hezbollah in the months ahead. This likelihood will become even higher if the incidents in Iran were in fact attacks and if more attacks occur.
Scott Stewart is Vice-President of TorchStone Global, an international risk mitigation and security firm. Previously, Mr. Stewart was VP of Tactical Analysis at Stratfor (2004-20). Prior to that Stewart was the protective intelligence coordinator at Dell where he served as a member of Michael Dell’s executive protection team. He also spent 10 years as a special agent with the U.S. Department of State’s Diplomatic Security Service (DSS), where he was involved in several high-profile terrorism investigations. Follow him on Twitter at @stick631.
The views expressed herein are the author’s and do not necessarily reflect those of CGP.