Iran correctly perceived it was the target of a string of actions against its nuclear program and, by extension, the regime. In September 2010, Iranian computer networks linked to uranium enrichment at Natanz were infected with the Stuxnet virus, destroying some 1,000 centrifuges, reportedly part of an American-Israeli effort code-named Olympic Games.72 The next month an explosion at an IRGC missile base leveled most buildings and killed seventeen people, including Gen. Hassan Tehrani Moghaddam, a founder of Iran’s ballistic missile program.73
The Arbabsiar plot underscored Qods Force leaders’ willingness to work with criminal elements to further operational planning, perhaps as a means of countering enhanced law enforcement and intelligence efforts. It was a trend officials would note several more times, perhaps most tellingly in Baku. In October 2011, signals intelligence intercepted emails suggesting Azeri criminal elements with known ties to Iranian intelligence and militant groups were planning to transfer weapons and explosives into Azerbaijan from Iran. Over the next few weeks, weapons and operatives—including at least ten Iranian recruits—were smuggled into Azerbaijan, where they met up with other Azeri criminal recruits. The Azeris were strictly in it for the money, which they were paid up-front, and used their knowledge of the area to conduct surveillance of a Jewish school, an American-owned fast food restaurant, the office of an oil company, the US embassy, and specific American diplomats. “They were going after individuals,” a State Department official familiar with the investigation confirmed. “They had names [of employees]. And they were interested in family members, too.”74
Over several months, the operatives planned what one investigator described as a “jumble of overlapping plots,” including assassinating US diplomats and a local rabbi or striking other Jewish targets. One subplot involved snipers using rifles with silencers; in another, a car bomb would target US embassy employees or their families. One plot was planned for December 2011, another for February 2012. Together, these were intended to avenge the assassinations of Iranian scientists, the captured leader of the network would later tell investigators. Some two dozen accomplices were arrested in a series of raids in early 2012, most of whom were local criminal recruits. But US officials concluded the plots were overseen by the Qods Force, with possible support from Hezbollah, as part of a coordinated, thirteen-month campaign targeting foreign diplomats in at least seven countries.75 According to a US law enforcement official, Hezbollah paid criminal gang members $150,000 each to target the Jewish school in Baku.76
Meanwhile, Hezbollah operatives were busy planning operations to fulfill their end of the three-tiered plan: targeting Israeli tourists abroad. Around the same time that authorities foiled the January 2012 plot targeting Israeli vacationers in Bulgaria, another Hezbollah plot was disrupted in Greece.77 But it was halfway across the world, in Bangkok, where Israeli and local authorities broke up a far more ambitious Hezbollah bid to target Israeli tourists.
On January 12, 2012, acting on a tip from Israeli intelligence, Thai police arrested Hussein Atris—a Lebanese national who also carried a Swedish passport—at Bangkok’s Suvarnabhumi Airport as he attempted to flee the country. Originally from southern Lebanon, Atris moved to Sweden, where he married a Swede and ran a hair salon in Gothenburg before returning to Lebanon some ten years before his arrest in Thailand. His family was well known within Hezbollah circles: According to press reports, a relative—Muhammad Atris—was involved in the 1992 Mykonos assassinations (see chapter 3). Another suspect, whose police composite portrait strongly resembled Naim Haris, a Hezbollah recruiting agent whose photo Israeli officials publicized a year earlier, escaped. Within days police would issue an arrest warrant for Atris’s roommate, a Lebanese man who went by the name James Sammy Paolo.78
Israel first informed the Thai authorities on December 22 that three Hezbollah operatives were preparing to attack popular Bangkok tourist sites where they expected to find Israelis, and passed on more details of the plot as they became available. Long a popular destination for Israeli vacationers, and a country with a history of Hezbollah activity, Thailand likely featured on Israeli officials’ list of possible venues for Hezbollah attacks on Israeli tourists. The investigation led authorities to Mr. Atris, identified by Thai officials as a Hezbollah member.79
Questioned over the weekend of January 13, 2012, Atris led police to a three-story building on the outskirts of Bangkok where he and his housemate had stockpiled some 8,800 pounds of chemicals used to make explosives. The materials were already distilled into crystal form, a key step in building bombs.80 Information on international shipping found at the scene indicated at least some of the explosives—which were stored in bags marked as cat litter—were intended to be shipped abroad. Intelligence officials surmised that Hezbollah had been using Thailand as an explosives hub—Atris rented the space a year earlier—and decided to use its on-hand operatives and material to target Israeli tourists. The conclusion should not have surprised: US officials already determined that Hezbollah was known to use Bangkok as a logistics and transportation hub, describing the city as “a center for a [Hezbollah] cocaine and money-laundering network.”81
Seeking to contain the damage to their tourist industry, Thai officials maintained that the shipping information indicated Thailand was merely a transit site, not a target itself. But Israeli officials insisted Thailand was the target of a “high—concrete threat.” The US embassy in Bangkok posted an alert of its own informing citizens of terrorist threats targeting Bangkok tourist areas. According to an embassy spokesman, the warning was based on “specific, credible, not-counterable threats.”82
Kooky Terrorists and Sticky Bombs
The American ambassador to Baku may have breathed a sigh of relief when the Qods Force plot targeting him and his staff was disrupted in February 2012, but that was only a small portion of what the Qods Force had planned. Five attacks targeting Western diplomats were scheduled to be carried out as close to the February 12 anniversary of Mughniyeh’s assassination as possible. The plot in Baku was foiled; another in Turkey was delayed; others would play out in India, Georgia, and Thailand.
On February 13, twin bombings targeted personnel from the Israeli embassies in New Delhi, India, and Tbilisi, Georgia. In both cases Qods Force operatives encountered more sophisticated security arrangements than anticipated and so they settled for modest strikes. In India, an assailant on a motorcycle attached a magnetized “sticky bomb” to a car taking the Israeli defense attaché’s wife to pick up her children at school. She was injured, along with her driver and two others. About three hours later in Georgia, a similar sticky bomb attack targeted a local citizen employed by the embassy but was discovered and defused before doing any harm.83 Just a month earlier, the deputy director of Iran’s uranium enrichment facility at Natanz, Mostafa Ahmadi Roshan, was killed in a nearly identical attack, also using a sticky bomb. Roshan was the fifth Iranian scientist to be assassinated, and the use of sticky bombs to target Israeli diplomats was a not-so-subtle message of retaliation from Iran.84
The next day in central Bangkok, police rushed to the scene of an explosion in the early afternoon at a home rented by a group of Iranians. Two barefoot men fled the house, but a third was injured and tried to hail a taxi to escape. When the taxi refused to stop, the injured man threw a bomb at the car, destroying half the vehicle and injuring the driver and four bystanders. Police soon cornered the injured suspect, who tried to throw another explosive at them but was too weak; the resulting explosion blew off both his legs. The other two men were soon caught—one was detained at the airport as he tried to catch a flight to Malaysia; the other managed to escape to Malaysia, where he was arrested boarding a flight to Iran. A fourth suspect, an Iranian woman who rented the house, was believed to have fled to Iran.85
Unlike the Hezbollah plot foiled just weeks earlier in Thailand, in this plot Qods Force operatives were targeting Israeli diplomats, Thai investigators determined. At the scene of the explosion, authorities found several
undetonated devices, all homemade magnetic sticky bombs of the same type used in India and Georgia.86 In time, investigators would tie the three attacks together not only based on the explosives used but through phone records, travel documents, and money transfers. About a dozen Qods Force operatives coordinated their preparations for the attacks, which began ten months earlier in April 2011—not long after press reports tied the Stuxnet virus to Israel and the United States and the sticky bomb assassination of Iranian nuclear scientist Majid Shahriari to Israel. That month, Iranian operatives traveled to India and Thailand to scope out targets, followed by more trips in the summer and fall of 2011 to rent apartments, hire local help, arrange finances, and conduct surveillance. During his 2011 reconnaissance visits to India, Houshang Afshar Irani, identified by Indian police as the assailant who attached the bomb to the Israeli diplomatic vehicle in New Delhi, used a cell phone number that was also used in June 2011 in Tbilisi, Georgia.87 According to Israeli officials, cell phone calls and text messages among operatives in Thailand, India, and Baku also link the attacks.88 Based on these findings and more, US counterterrorism officials concluded that Iran was tied to the terrorist plots in Azerbaijan, Georgia, India and Thailand.89
In the case of the Thailand plot, senior Qods Force commander Majid Alavi reportedly arrived on-scene on January 19, 2012, traveling through Malaysia on a diplomatic passport bearing a fictitious name. Responsible for Qods Force Unit 400, Alavi previously tracked Iranian dissidents in places as varied as London and Los Angeles. It was Alavi who ordered the attacks on Israeli diplomats to occur as close to the anniversary of Mughniyeh’s death as possible.90
Yet despite the hands-on oversight of senior Qods Force officers, the attacks not only failed but demonstrated sloppy tradecraft and operational security—the very strengths for which the Qods Force is usually known. Aside from reusing phone numbers and SIM cards across multiple operations, operatives traveled on Iranian passports, checked into hotels as Iranians, carried Iranian currency in their wallets, and in at least one instance took out time from their surveillance to party with prostitutes. A group photo on one of the women’s cell phones helped identify accomplices who fled the country.91 In the words of one flabbergasted analyst, “It’s as if there’s a systematic policy of Iran recruiting low-rent, downright kooky terrorists.”92
Instead of restoring Iran’s damaged prestige, the attacks only further underscored Iran’s operational limitations. Following the Green Revolution in Iran, the Qods Force gained prominence at the expense of the Ministry of Intelligence and Security over the latter’s perceived soft-handed approach to suppressing political protests in Iran. Within the Qods Force, quick promotions of mediocre managers diluted the group’s professional capabilities at the management level.93 The problem was compounded when, desperate to quickly implement its new attack strategy and exact revenge for covert attacks against its nuclear program, the Qods Force traded speed for tradecraft, cut corners, and reaped what it sowed. Qods Force planners were stretched thin by the rapid tempo of their new attack plan and were forced to throw together random teams of operatives who had not trained together.94
Worse, despite Iran’s preference for signature attacks targeting embassies, diplomats, or other official targets—and despite concerns by US intelligence that Iran was developing contingency plans for such attacks targeting the United States and its allies—Iranian planners found their chosen targets too well protected and settled for less-hardened targets.95 In the end, not one of the five planned attacks could be considered an operational success. Ever since, Israeli officials say, the frustrated Iranian operatives have been “trying harder than ever” to execute successful attacks.96
The operational tempo continued apace. In March 2012, the Israeli National Security Council’s Counterterrorism Bureau warned of terrorist threats against Jewish and Israeli targets in Turkey. According to the Turkish press, the warning came less than a week after Israeli intelligence tipped off Turkish authorities about a Qods Force plot to be carried out by at least four individuals who crossed the border from Iran armed with weapons and materials.97 The plot, again targeting Israeli diplomats, had originally been timed to coincide with the other plots in February but was postponed.98 In May, yet another Hezbollah attack targeting Israeli tourists was thwarted, this time at the Johannesburg airport in South Africa.99
Also in March, forty-year-old Hamid Kashkouli, an Iranian PhD student at the University of Pune in India, was deported for spying on Israeli nationals, a Jewish center, and a synagogue. According to Indian police, Kashkouli, who worked as a paid undercover agent of the Iranian government, traveled regularly to the Iranian consulate in Mumbai, where Iranian government officials reportedly met him, according to his driver. Intercepted emails revealed he was providing Iranian officials with pictures of Jewish people in the area and reporting on their business dealings.100
In June 2012, authorities in Nairobi, Kenya, arrested two Iranian nationals, both of them purportedly Qods Force operatives.101 Prior to the two men’s arrest, Kenyan police reported, they had scouted out the Israeli embassy, the British High Commission, and other sites, leading authorities to conclude the pair was planning attacks targeting Israeli, American, British, or Saudi Arabian interests in Kenya or elsewhere in Africa.102 The day after their arrest, one of the two operatives led authorities to thirty-three pounds of RDX explosives hidden under a bush at the Mombasa Golf Club, overlooking the Indian Ocean.103 Seemingly to deflect attention from Iran, the Iranian operatives apparently partnered with al-Shabab, the al-Qaeda-affiliated terrorist group in Somalia. This tie underscored how desperate Tehran was to see successful attacks carried out. That interest has only grown more acute, as efforts to disrupt Iran’s nuclear program—from sanctions to assassinations to covert sabotage of equipment—continue to gain momentum.
A month after the Kenya plot was exposed, a Hezbollah operative targeting Israeli tourists in Cyprus was arrested. In October 2012, the Cypriot secret service foiled another attempt against Israeli tourists on cruise ships arriving at the Limassol port.104 Tragically, Israeli tourists in Burgas, Bulgaria, were less fortunate. In the months that followed, more threats arose, prompting travel advisories from Cyprus and Greece to Thailand, Bulgaria, and Ukraine.105 All told, more than twenty terror attacks by Hezbollah or Qods Force operatives were thwarted over the fifteen-month period between May 2011 and July 2012; by another count, nine plots were uncovered over the first nine months of 2012.106 The key to all these attacks, however, whether carried out by Hezbollah or the Qods Force, was deniability. Both Hezbollah and Tehran wanted attacks carried out, but neither wanted to invite a full-fledged military response targeting them back in Lebanon or Iran. Ever since the July 2006 war, Nasrallah has reportedly refused to approve any attacks along the Israeli-Lebanese border for fear of sparking another full-scale war with Israel.107
Contrary to conventional wisdom, however, while Hezbollah and the Qods Force have worked together on some plots—Baku in 2008 and Istanbul in 2009, among others—in other cases they failed to deconflict their operational activities and found themselves engaged in completely disparate operations in the same place. When Hezbollah operatives laid the groundwork for a bombing in late 2011–early 2012 in Bangkok, they were apparently unaware that the Qods Force was also preparing an attack there. Whether the Qods Force was, in turn, ignorant of Hezbollah’s activities there is unclear, but the Iranians appear not to have known Hezbollah was using Bangkok as an explosives distribution hub. And even once Hezbollah operative Hussein Atris was arrested in January 2012, the Qods Force operation there was not suspended. Similarly, within days after the explosion in Burgas, Bulgaria—while the investigation into the bombing and the search for accomplices was at its height—Bulgarian authorities reportedly caught a Qods Force operative scoping out a synagogue in the country’s capital, Sofia.108
Meanwhile, even as Hezbollah remains committed to exacting revenge for Mughniyeh’s death, IJO leaders grudgingly began to a
ppreciate the difficulty of hitting a high-level Israeli target abroad. Such targets are typically well protected, so while Hezbollah operational planners continued to search for viable targets abroad, they initiated parallel plans for attacks targeting Israeli officials inside Israel.109 Leveraging networks of criminal associates who typically trade intelligence for drugs, and sometimes recruiting Israeli-Arabs through ideological appeals to spy for the group, Hezbollah pursued at least two plots targeting Israeli officials within the country within a three-month period in 2012, both of which were thwarted.
In June 2012, Israeli authorities arrested eleven men caught smuggling twenty kilograms of C4 explosives into Israel from Lebanon. According to authorities, the explosives crossed the border with the help of an Israeli-Arab resident from Ghajar, a small town that straddles the Blue Line demarcating Israel’s northern border with Lebanon. The facilitator, who was known to authorities as a drug smuggler with ties to Hezbollah, hid the bag of explosives in a field he owned before passing it along in a series of exchanges among drug smugglers who believed, according to Israeli security officials, they were smuggling drugs, not explosives. Abed Zoabi, a drug smuggler from Nazareth who received the explosives, reportedly helped smuggle Israeli cell phone SIM cards through Jordan to Hezbollah operatives in Lebanon so that he and George Nimer, a Lebanese drug dealer with ties to Hezbollah, could communicate directly with greater security.110 According to Israeli officials, the explosives were intended to be used in one or more attacks targeting Israeli officials within the country.111
Hezbollah Page 62