Tehran Terror Attacks Underscore ISIS Depth in Iran

The horrific Tehran terror attacks revealed a surprising reality: there is a well-resourced and well-prepared ISIS cell and support structure in the Islamic Republic. The regime is trying to downplay the significance of the attack and redirect public attention and anger toward the U.S. and Saudi Arabia. That response is troublesome because it suggests that the Islamic Republic will respond to this tragedy by escalating the regional conflict.

The attack was complex and sophisticated. Its success was the more remarkable in that Iran is one of the most securitized states in the world. Multiple security services pervade Iran’s cities and towns, the Islamic Republic has established one of the most thorough regimes of internet and cellphone censorship and monitoring in the world, and the regime has demonstrated its willingness to subordinate civil liberties completely to the mission of preserving itself in power.

ISIS nevertheless managed to pull off a challenging operation. Two attacks began within 30 minutes of one another at locations about 10 miles apart. Four attackers, some dressed as women, armed with assault rifles, suicide vests, and hand grenades attacked the Iranian parliament. They penetrated security and engaged security forces in a four-hour standoff. One of the attackers reportedly left the scene for a time and ran around shooting before returning to the Parliament compound.  That fact indicates the security forces were remarkably slow and inefficient at establishing a cordon around a site one would have expected to be heavily protected. Two other attackers entered the Khomeini Mausoleum and engaged in a 90-minute stand-off with security forces there. Six attackers were killed (at least one detonated his suicide vest), and the attacks claimed a total of 17 victims and over 45 wounded. Perhaps the most remarkable fact of all is that the cell managed to get imagery of the attack through Iran’s censorship apparatus to an ISIS media facility that released aEditor's NoteAn earlier version of this piece incorrectly stated the length of the video ISIS released. The video is 24 seconds long, not 24-minutes long. 24-second video.

We must not allow the seeming simplicity of the weapons--AK-47s, suicide vests, and hand grenades--to obscure the difficulty of mounting an attack like this in Iran’s capital. As the Critical Threats Project and the Institute for the Study of War have described in earlier reports, an attack cell such as this one requires a large and complex support infrastructure inside the target country linking it to a base outside that country.

Iran’s Ministry of Intelligence and Security (MOIS) described the attackers as Iranians who were recruited by ISIS, left Iran to fight in Mosul and Raqqa, returned to Iran in August 2016 to attempt an attack that was disrupted, but managed to get back this week to conduct this attack successfully.

The attackers needed at a minimum the following resources and capabilities: weapons; training in how to use them as well as how to fight as a small team; coordination to conduct nearly-simultaneous attacks; sophisticated communications; staging areas near the sites of the attacks and safe-houses elsewhere in Iran. The attackers, in other words, were likely supported by others inside Iran--and they managed to plan and conduct this attack in a way that surprised Iran’s security forces. All of this suggests a much higher level of ISIS penetration of Iran than most people would have expected.

The external support zone of this attack was most likely in Iraq, probably in Diyala Province. ISIS announced the formation of a “Persian Brigade” in Diyala in late March. Iraq’s Popular Mobilization Units reported killing the founder of this force, Abu Qatibah, a close associate of ISIS leader Abu Bakr al Baghdadi, northwest of Baqubah, Diyala’s capital, in mid-May. The attack cell probably entered Iran through Kermanshah or Ilam Provinces, which border Diyala, and then transited several interior provinces before reaching Tehran. Iranian security forces have periodically reported finding, fighting, and disrupting ISIS cells in Kermanshah, but they clearly did not get all of them.

The timing of the attack was clever. It fits neatly into the global ISIS Ramadan campaign that has seen attacks throughout Europe, the Middle East, and even the Philippines.  It followed the Iranian election, moreover, likely exploiting the relaxation of security forces after a massive mobilization to ensure that the regime could handle any nascent protest movement that might occur. The period following such a security deployment frequently sees security force members going on leave, picking up menial tasks dropped during the mobilization itself, and generally losing focus as they relax from a time of great tension.

Iran’s reaction to this attack remains unclear. Leadership rhetoric has focused on trivializing the incident, on the one hand, and blaming the U.S. and Saudi Arabia for it on the other. IRGC statements have repeatedly promised to retaliate against the U.S. and the Saudis for this attack, suggesting that the regime will focus on escalating the regional war rather than pulling back from any of the activities in Syria and Iraq that have helped drive recruiting for ISIS and animus against Iran among Sunni Arabs.

The regime will nevertheless have to look hard at its internal security, which may divert some resources away from its interventions in Syria and Iraq. It had previously sent cadres of IRGC combat forces from Kermanshah, West Azerbaijan, and Khuzestan Provinces to fight in Syria; it may be less willing to pull forces away from those border areas in the future. It has also deployed forces from areas of central, northern, and eastern Iran to Syria, however, and the availability of those forces is unlikely to be affected by this attack unless the regime launches a country-wide security crackdown, which seems at the moment to be unlikely.

The attacks may also provide grist to the mill of the conservatives within Iran who have been attacking President Rouhani’s plans to expand internet freedoms and reduce censorship.  We will have to watch closely to see if Rouhani’s opponents attempt to turn any of the blame for the success of these attacks on him or if the regime attempts to unify and focus enmity on external actors such as Riyadh and Washington.

The tragic events of June 7 in Tehran are likely to prove an inflection point of some variety--either marking the start of active ISIS operations in Iran itself or triggering a increase in Iran’s internal security operations and regional efforts against ISIS, Saudi Arabia, the U.S., and their allies. Or, of course, both.

Editor’s note: An earlier version of this piece incorrectly stated the length of the video ISIS released. The video is 24 seconds long, not 24-minutes long.