Iran Update, March 5, 2023

March 5, 2023, 5:00 pm ET

The Iran Updates are produced by the Critical Threats Project (CTP) at the American Enterprise Institute with support from the Institute for the Study of War (ISW). To receive Iran Updates via email, please subscribe here.

CTP is publishing a special edition today in response to the dramatic escalation in poisonings of Iranian schoolgirls on March 4 and 5. CTP will resume regular updates on March 6.

The Iranian regime has permitted the country-wide, coordinated attacks on Iranian schoolgirls to escalate. Between March 4 and March 5 alone there were at least 300 attacks across 16 provinces, a significant increase from the 46 reported poisoning attacks on March 2 and the other sporadic attacks from November 30, 2022, onward.[i] The nature of these attacks, targeting primarily schoolgirls in urban areas who report similar symptoms, escalating over a period of four months, indicates that this is an organized and deliberate campaign, as CTP has previously assessed.[ii]

An organization able to conduct sustained attacks such as these likely has a number of distinctive characteristics.  First, it has members who are either widely dispersed throughout Iran or else able to move rapidly across the country. These capabilities are essential for a group conducting attacks on dozens of locations in more than half of Iran’s provinces each day for two consecutive days. Second, it must have a stock of whatever chemical agent it is using sufficient to conduct all these attacks. Third, it must be able to distribute that stock to the target locations. Fourth, its agents must be able to approach their targets undetected, deliver the agent by some means, and depart without being intercepted before, during, or after the attack. Fifth, its agents must either be unidentifiable, including by facial recognition, or protected in some way. Sixth, it must either be willing to risk having its agents identified, arrested, and unmasked (with the additional risk that the organization’s identity will be revealed) or else it must be confident that they will not be for some reason. Seventh, it must regard the advantage gained by poisoning schoolgirls without killing them to be sufficient compensation for the risks involved in the undertaking. 

This list of necessary attributes narrows the field of organizations that could possibly be conducting these attacks considerably.  It likely excludes groups such as ISIS or al Qaeda (which have never shown a proclivity for attacks of this variety in any event), as well as foreign intelligence services, Iranian officials’ accusations notwithstanding. The Iranian government has every incentive to identify, catch, and reveal foreign agents involved in attacks by such groups, and those agents have no reason to expect that they will be able to continue approaching schools and delivering poisons on target without being caught. Nor is it likely that a foreign intelligence organization that had agents with excellent cover so widely dispersed throughout Iran would risk losing them and being unmasked in order to poison schoolgirls. The available evidence does not support any firm conclusion about what organization might be conducting these attacks, however.

The regime’s response to these attacks continues to suggest that it is deliberately tolerating them. It has not changed its law enforcement posture despite the dramatic increase in the number and locations of attacks on March 4 and 5. The regime has still not deployed the security and surveillance capabilities it used to violently suppress the Mahsa Amini protests to protect schools. Reports indicate, on the contrary, that many of these capabilities have instead been either disabled or, if used, have been deployed to restrain schoolchildren and their families or to limit the spread of crucial information. Many of the affected schools have CCTV security cameras. One schoolgirl who experienced poisoning symptoms reported on February 28 that she was told that her school’s cameras had been “down for a week,” however.[iii] Another affected parent complained to school authorities on March 5 that cameras had been shut off at the Sizdah Aban Girls Elementary School in Tehran before the attack.[iv] Plainclothes officers have violently detained schoolgirls at some locations and either beaten or otherwise prevented concerned parents from trying to enter an impacted school.[v] It would make sense to keep parents out of schools thought to have suffered chemical attacks if the authorities were not then forcing school children either to stay in them or to return to them. In one instance plainclothes officers prevented students from leaving an impacted school while the students screamed “We don’t want to die!”[vi] At other times, students were told to come back to school immediately after an attack.[vii] Law Enforcement Command (LEC) officers have also discouraged people from coming to impacted areas and recording video, even confiscating phones on several occasions.[viii] Anti-regime outlet Iran International reported that security forces have prevented parents from obtaining medical test results that could contain information about the chemical agent used in the attack.[ix]

These regime reactions are extremely anomalous and support the assessment that elements of the regime are tolerating the attacks. A government facing a crisis such as this would normally focus on rapidly deploying law enforcement to schools to deter, stop, and detain the perpetrators.  A regime as heavily securitized as Iran’s would normally turn all its advanced security infrastructure on rapidly identifying the culprits.  When a school is attacked with a suspected chemical agent, the normal response would be to clear everyone out of the building, treat anyone with symptoms, offer counseling and solace to children and their parents, have specialist teams attempt to isolate samples of the agents, and then thoroughly clean the facility to ensure that no potentially toxic residues remained.  It is difficult to fathom any civilized country requiring children to go back into a building that has suffered a chemical attack on the very day of that attack—still less refusing to allow students to leave.  Such actions require either remarkable unconcern for the lives and health of young children or confidence that the agents used have either dispersed or were not that dangerous to begin with.  Considering that the regime has not offered any indication that it knows what agent(s) are being used, it is difficult to say why regime and local officials should be confident that it is safe to force children to return to their schools on the day of the attack.

Medical professionals from across Iran have reported students experiencing a common set of symptoms after being poisoned. Yasouj University of Medical Sciences Deputy for Medicine Mahmoud Shehamat, Parliamentary Health and Medical Committee Vice Chairman Morteza Khatami, and Shiraz University of Medical Sciences Deputy for Medicine Mehrdad Sharifi have all described similar symptoms experienced by victims of the poisonings: headaches, dizziness, shortness of breath, nausea, vomiting, and numbness.[x] It appears that most students who report poisoning symptoms and are brought to medical centers are discharged within a matter of hours or days.[xi] Apart from shortness of breath, CTP has not observed any reports of symptoms such as burning lungs, severe skin irritation, and watering eyes that would suggest that the attacks are the result of choking agents or blistering agents.[xii] 

The Iranian regime’s response to these attacks is anomalous and difficult to explain unless regime officials are complicit in at least allowing the attacks to continue. The most straightforward explanations require that at least some senior regime officials are knowingly allowing these attacks to occur for some reason, but there is only circumstantial evidence to support them. Other explanations require more elaborate schemes attributing motivations and capabilities to anti-regime actors, whether foreign or domestic, that are even harder to substantiate. The available evidence does not support attributing these attacks to any particular group but does appear to show that the regime has been willing to allow them to continue. CTP will continue to monitor the situation and update this assessment as more information becomes available.