Iran's leadership unsurprisingly has issued broad threats of retaliation in response to the Jan. 3 killing of Qassem Soleimani, the head of Iran's Islamic Revolutionary Guard Corps' Quds Force, with Supreme Leader Ayatollah Ali Khamenei threatening to exact "severe revenge." One of the most influential individuals in Iran, Soleimani was seen as the key to Iran's aggressive military initiatives across the Middle East. There is little doubt that Iran will indeed seek revenge. The real question is when, where and how it will attempt to seek it. But while terrorist attacks by Iranian operatives or proxy groups working at the behest of Iran are a valid cause for concern, they are no reason to panic. Their activities can be detected and defended against through solid intelligence work and careful vigilance.

A Strike That Invited an Iranian Response

Soleimani died in a U.S. military drone strike against a motorcade that had just picked him up from Baghdad International Airport after he arrived from Lebanon. The strike also killed several others, including Abu Mahdi al-Muhandis, the founder of the Iranian-linked Kataib Hezbollah militia and the deputy commander of the Iranian-backed Shiite militias in Iraq known as the Popular Mobilization Units. 

The strike on Soleimani came in the wake of a violent demonstration outside the U.S. Embassy in Baghdad and a series of rocket attacks directed against U.S. forces on Iraqi military bases, the last of which resulted in the death of a U.S. military contractor and the wounding of four American troops. U.S. officials claim that Soleimani had arrived in Iraq to plot additional attacks against Americans, with one report suggesting he may have been planning to kidnap American citizens — an Iranian tactic dating back to the 1979 U.S. Embassy crisis in Tehran and the hostage crisis in Lebanon during the early 1980s. 

Over the past year, the Islamic Revolutionary Guard Corps (IRGC) has participated in a number of provocative attacks across the region. These have included limpet mine attacks against tankers in the Strait of Hormuz and the Gulf of Oman, harassment of U.S. military vessels, shooting down an American drone over international waters in June 2019 and seizures of tankers in the Strait of Hormuz. The IRGC also conducted drone and cruise missile attacks against critical Saudi oil infrastructure at Abqaiq and Khurais. As the commander of the IRGC's Quds Force, Soleimani was reportedly involved in the decisions to conduct these attacks. He was also involved in coordinating the activities of Iranian proxy militias in Iraq, Syria, Lebanon and Yemen. While some may question the wisdom of killing Soleimani, few can argue that the United States was not justified in doing so.

The Past as Guide to How Iran Might Respond

Stratfor thinks it unlikely the Iranians will launch a direct military attack that sparks a regional war. Tehran carefully watched the U.S. military dismantle the formidable Iraqi military in 1991 and 2003 and the Libyan war machine in 2011, and does not want to risk the same fate. Rather, we believe Iran will continue to employ the same type of asymmetrical tools it has long wielded against the United States and its allies, which could include continued operations by proxy forces in Iraq, Syria, Lebanon, Afghanistan and Yemen; global hacking attacks by Iranian "advanced persistent threats," a term used to describe the most prolific and long-lasting hacker groups; and violent protests. It could also once again attempt to carry out terrorist attacks.  

Many view Iran's terrorism capability with fear and awe. These sentiments are largely due to Iran and its proxies' early successes, such as the devastating truck bomb attacks against the U.S. Embassy in Beirut in 1983 and 1984, the 1983 barracks bombing targeting U.S. Marines and French paratroopers, and the 1983 truck bombings of the U.S. and French embassies and other targets in Kuwait City. Along with their masterful exploitation of the Lebanon hostage crisis, a global campaign to assassinate Iranian dissidents and support for a number of terrorist proxies, Iranian expertise at terrorism took on mythical proportions — a perception the Iranians have sought to reinforce during periods of increased tension with the United States and Israel. 

That said, Americans have a tendency to assign almost superhuman powers to their adversaries. We have seen terrorist figures such as Carlos the Jackal, Osama bin Laden and even Abu Musab al-Zarqawi all elevated to near-mythical status in the past; so to avoid exaggeration, the same should not be done with regard to IRGC operatives tasked with terrorist operations. They are mere mortals, and as such are constrained by the terrorist attack cycle like any other would-be attacker. Since they must follow the steps of the attack cycle to conduct an attack, their activities are detectable. My colleagues and I who helped the Argentine government investigate the March 1992 bombing of the Israeli Embassy in Buenos Aires found that in that case, the attack cycle was well defined and could easily have been detected. The attack succeeded only because nobody was looking for signs of such preparations in Argentina.

In recent decades, and particularly in the post-9/11 era, the Quds Force has experienced a great deal of success in paramilitary operations conducted in permissive environments close to its core territory, such as in Iraq, Yemen and Lebanon. This has included programs to train and equip Iraqi Shiite militias to attack U.S. troops in Iraq post-2003, and efforts with the Houthis in Yemen. It clearly has struggled, however, to project its terrorist capability in more hostile operational environments, where a greater degree of clandestine tradecraft is required.

Iran's Recent Struggles

The IRGC's struggles to carry out terrorism abroad were vividly on display in a series of poorly planned and executed attacks in 2011 and 2012, such as the February 2012 sticky bomb attack in New Delhi. They were also on display in attacks that were detected and thwarted, such as a February 2012 bomb plot in Bangkok. 

While the 2011 plot to murder the Saudi ambassador in Washington was quite bold, it was also amateurish and ill-conceived. In this way, it resembled the 2009 activities of Mohammad Reza Sadeghnia, an IRGC operative arrested on solicitation of murder charges in California in 2009 who admitted to conducting preoperational surveillance on an Iranian opposition group broadcaster in Los Angeles and a Voice of America employee in London. 

Little indicates that the IRGC has improved its ability to operate in hostile environments since then. In June 2018, Belgian authorities arrested an Iranian-Belgian couple for plotting an attack against an Iranian dissident group rally in Paris. The couple was found to be carrying a small explosive device in their car. The timing of the arrest, along with the concurrent arrests of an Iranian diplomat in Vienna and other suspects in France and Germany, indicates that the group practiced poor tradecraft and operational security. The bomb in question also consisted of only 500 grams (1.1 pounds) of TATP, a far cry from the multiton truck bombs used in the Beirut bombings. In October 2018, Denmark asked Sweden to arrest and extradite an Iranian-born Norwegian citizen who it charged had conducted surveillance on a dissident in the Danish capital of Copenhagen who Iran planned to assassinate.

These shortcomings reflect how dramatically the world has changed since Iran's terrorism heyday of the 1980s. In the post-9/11 and post-Islamic State "caliphate" world, it is simply far harder to conduct terrorist attacks than it was in the decades before. Because of those early attacks, the security at the U.S. Embassy in Baghdad is a far cry from the old U.S. Embassy and Embassy annex in Beirut in 1983 and 1984. The force posture of, and protective measures taken by, coalition troops in Iraq today is far different from that of the U.S. Marines and French paratroopers in Lebanon in 1983. And law enforcement and security services across the world are far more vigilant in the face of the terrorist threat than they were in the 1980s, as is the general public.

This shift and recent IRGC terrorist operations suggest that should Iran choose to conduct this type of terrorist operation outside its core areas, its operatives are likely to struggle with tradecraft like surveillance and covert communications — although using Iranian diplomatic pouches to move explosives and other weapons may help it during the weapons-acquisition phase of the attack cycle. It will remain vulnerable to detection as it progresses through the attack cycle, and so is likely to gravitate toward softer and less aware targets — and to places where the security forces are less proficient than in Western Europe or the United States. Should the Iranians again decide to conduct terrorist operations outside the Middle East, I believe we will see similar operations against similar targets in similar locations to the 2011-2012 campaign. 

This is not to say that the terrorist operations of the IRGC and its proxies can't be deadly. In July 2012, a Hezbollah suicide bomber detonated his vest among a group of Israeli tourists in Burgas, Bulgaria, killing six and wounding many others. And in September 2019, the U.S. government charged a U.S. citizen born in Lebanon with having received terrorist training from Hezbollah. The detailed criminal complaint in the case afforded a great inside look at the terrorist tradecraft training Hezbollah provides to its operatives. The suspect was stopped and questioned by Turkish authorities in 2005 after conducting surveillance against targets in Istanbul; Hezbollah apparently cut ties with him after his cover was blown. The case highlights Hezbollah's efforts to recruit American citizens to conduct terrorist operations.