Global Intelligence Summary

In a recently disclosed report that was presented to US state and ​local law enforcement on 20 March, the Federal Bureau of Investigation (FBI) and National Counterterrorism Center (NCTC) warned that Iran poses a persistent threat to targets within the US. The report specifically warned about the threat to government personnel, military sites, Jewish and Israeli institutions, and Iranian dissidents in the US homeland. However, while the report warned of an elevated nationwide threat, the threat is targeted, and there is reportedly no current intelligence indicating a broader threat environment to the general public.

Solace Global Assessment: 

Despite official warnings from several domestic intelligence agencies, the White House has consistently downplayed the Iranian threat on US soil, and several media outlets have reported that the Trump administration has blocked the release of similar intelligence reports. While no major attacks or confirmed examples of Iranian-sponsored hybrid warfare have been recorded in the US, there are likely multiple attack vectors Iran could pursue, including tactics leveraged by Tehran in the past. These include targeted plots, surveillance, cyber operations, and attempts to lure individuals abroad for kidnapping or assassination.

The immediate threat of Iranian asymmetric attacks in the US has highly likely decreased following the recent agreement of a ceasefire and progress towards a diplomatic solution. However, there is a high likelihood that the negotiation process will collapse, with all parties demanding maximalist concessions that are likely to be unacceptable to their counterparts, such as the suspension of all sanctions imposed on Iran or the complete withdrawal of US combat power from the region.

The collapse of negotiations and resumption of hostilities would highly likely increase the short-term risk of Iranian asymmetric activity targeting the US homeland, a threat that will likely gradually increase should the conflict persist or escalate. Iranian-linked operations in Europe are likely reflective of Tehran’s ability to leverage disenfranchised or criminal networks, as well as opportunistic individuals, to conduct deniable attacks outside of its primary sphere of influence.

Many of the attacks were claimed by previously unknown groups, likely front organisations, with dissemination patterns and digital footprints closely linked to pro-Iranian networks and the Islamic Revolutionary Guard Corps (IRGC). While attribution to Iran is often inconclusive, the operational characteristics, targeting patterns and other elements are highly indicative of established Iranian hybrid warfare tactics that have been reported publicly on by European intelligence services and security agencies.

It is highly likely that such tactics could migrate to the US, with a lack of previous attacks potentially reflective of a deliberate strategy to avoid triggering a disproportionate response or direct escalation on US soil, rather than a lack of reach or capability. Domestic polling indicates that approximately two-thirds of Americans oppose the war, and the joint FBI-NCTC report explicitly warns of violent extremists with a variety of ideological backgrounds, including those who oppose the US or Israel, who may also see exploit the conflict as a justification for violence.

This likely provides Tehran with a pool of potential actors who could be exploited, inspired, or paid to conduct highly deniable, low-level attacks on US soil, likely partially modelled on Russia’s campaign in Europe, which has emphasised the recruitment of local individuals, including criminal elements, to conduct acts of sabotage, arson, and intimidation, as opposed to high-profile or mass-casualty attacks to limit escalation. However, the political polarisation and ease of access to weapons in the US could increase the risk that such activity results in more lethal outcomes, whether intentional or incidental, should Tehran seek to employ these tactics on US soil.