SIM Report: Middle East and Central Asia, Issue 5

Iran: what recent internal dissent, geopolitical tensions and cyberwarfare mean for the region

A series of recent unexplained incidents involving fires and explosions have occurred in Iran since 26 June, prompting concern over the existence of various groups working to destabilise the country. The incidents have occurred in close proximity to each other and affected key infrastructure or sites linked to Iran’s nuclear programme, making them highly suspicious. There is little confirmed information about the source of the events, including whether they were accidents or covert attacks. Given the strategic significance of the sites affected and the low-likelihood for this many so-called ‘accidents’ to occur within such a short period of time, it is likely that at least some, especially two high profile incidents affecting the Natanz Centrifuge Production Plant on 2 July and the Khojir missile facility on 26 June, were premeditated attacks.

Geopolitical rivalries 

These incidents come amid a tense geopolitical climate with Tehran, which is increasingly isolated internationally. Relations between the US and Iran are particularly volatile and have worsened since May 2018 when the administration of US President Donald Trump withdrew from the 2015 nuclear agreement (JCPOA). Following the US’ withdrawal, Iran began the enrichment of weapons-grade uranium in open defiance of the nuclear deal. Growing animosity has also been recorded between Iran and Israel. Israel has been expanding a shadow war against Iranian proxies in the region, which includes striking pro-Iran interests in Iraq and Syria. This suggests an increased desire to hit Iran directly in the region, including possibly in Iranian territory.

Domestic insurgency

It is also worth looking at the various domestic militant insurgencies that Iran faces in light of the recent incidents.  While the potential for foreign involvement in some of these blasts and fires is high given the geopolitical climate, it is also plausible that some of them were conducted in coordination with or by domestic groups. The most well-known anti-regime group, and probably the most significant threat, is the People’s Mujahedeen of Iran (MEK), which is widely involved in international efforts at advocating for regime change. The presence of the Natanz nuclear facility, which was badly damaged by the blast on 2 July, was first revealed to Western intelligence agencies by the MEK in 2002. The MEK has said it was not responsible for the Natanz fire and also issued a statement attributing the other blasts and fires to ‘rebellious youths’ within the country. The statement appears to suggest a domestic angle to at least some of the more low-level incidents, perhaps with the aim of highlighting the increasing number of Iranians willing to risk retaliation and show dissent amid a resurging anti-government movement.

Meanwhile, a previously unknown group by the name of ‘Cheetahs of the Homeland’ claimed responsibility for the 2 July action at Natanz in a string of emails sent to various international media outlets hours before anyone knew about the explosion. The authenticity of the group has been widely debated. Going on the little information confirmed about the group, there is a realistic possibility that the group is the work of foreign agents posing as domestic dissidents to further undermine the regime. Cooperation between foreign and opposition elements inside Iran is also a possibility; both want to eliminate the nuclear programme and embarrass the regime, which has been achieved.

Likely culprit behind suspicious incidents

Amid the background of Iran’s current geopolitical rivalries and the growing threat from internal dissident groups, the identities of the threat actors largely, at least publicly, remain unknown. The most likely culprit, especially for the Natanz and Khojir blasts, is Israel. Destroying or damaging a centrifuge assembly facility, as the 2 July Natanz blast did, could greatly impact Iran’s ability to more quickly enrich greater amounts of uranium, and this would definitely be a goal for Israel. Iran admitted that the fire at Natanz had damaged precision and measuring instruments and set back its nuclear programme by several months. Outside experts have estimated a setback of one or two years. Additionally, Israel is generally considered the only one of Iran’s regional adversaries with the intelligence and covert operational capabilities to pull off such an attack. These points suggest likely Israeli involvement, either with the direct cooperation or implicit approval of the US.

Assuming at least the Natanz and Khojir blasts were acts of sabotage, it is also worth considering the manner in which the attacks were staged, especially amid an increasing climate of cyberwarfare. Initial speculation regarding the Natanz incident seemed to suggest cyberattack, although there has since been indication, including from an unidentified member of Iran’s Revolutionary Guards, that someone smuggled a bomb into the building. Current cyber capabilities suggest that a bomb is more likely; examples of cyberattacks causing actual physical damages such as an explosion are rare. Recent cyberattacks that have been linked to both Israel and Iran, including the Iran-linked attack on Israel’s water supply system in April and the Israel-linked attack on Iran’s port of Shahid Rajaei in May, have caused damage to the functioning of the systems rather than physical damage, suggesting this is currently the primary capacity for attacks. However, even if the Natanz and Khojir incidents were not in the cyber domain, Iranian revenge could come in the form of cyberattacks, especially as its conventional military capabilities are not on par with those of Israel and the US.

Impact and scenarios

There are a number of scenarios for Iran and the region that could develop amid the ongoing heightened tensions. One scenario is a devolution into open conflict involving Iran, Israel and/or the US, which would likely result in the event that Iran decides to retaliate militarily for the suspected attacks by staging a direct attack against Israeli or US interests. There is a realistic possibility that Iran will choose this path – a lack of response will make Tehran look weak internationally and could affect the government’s reputation domestically at a sensitive time of economic crisis, rising unemployment levels, and the COVID-19 pandemic. As the region becomes increasingly divided, especially following the Israel-UAE normalisation deal that suggests the Middle East is developing into two distinct coalitions, such a conflict would have widespread implications.

Maintaining the status quo is another, more likely scenario: Iran, the US and Israel have long been engaged in a cycle of retaliatory events that have included attacks by Iranian proxies, maritime threats, US and Israeli covert strikes, and hostile cyberoperations. Iran may view the most recent incidents at Natanx and Khojir as merely an escalation that is part of this ongoing pattern of incidents, rather than cause for an immediate forceful reaction such as a military response. Furthermore, Iran may wish to wait until the US presidential elections in November to determine how it will respond, banking on a new US president who is more willing to pursue de-escalation. In a status quo scenario, Iran would probably focus on its cyberwarfare efforts: following the 2010 Stuxnet attack, the Iranian military invested heavily into developing its cyberwarfare capabilities, which was one unintended blowback of that operation. Iran may also increasingly turn to assistance by non-state sponsored cyber threat groups, similar to what Russia has done. This would probably be a more concerning threat for the region as states ‘pay’ these groups but can also deny any official linkages.

A low-likelihood scenario could lead to regime change in Iran, a goal of Israel and the Trump administration’s ‘maximum pressure’ policy that has seen the ramping up of sanctions over the past 12 months. However, there are a number of issues with this scenario that make it unlikely. For one, the current and preceding regimes have been able to navigate around four decades of diplomatic pressure and multiple sanctions. Furthermore, the US ‘maximum pressure’ policy currently lacks global consensus as many countries seek another approach toward Iran. Another spoiler is the lack of credible alternatives to the current regime in Tehran. While the MEK group has positioned itself as an alternative political force and fosters a growing support base, it also faces staunch opposition within the country due to its support of Saddam Hussein in the Iran-Iraq war in the 1980s. It is also worth noting that regime change in the region has not had a history of success. In many cases, including in Iraq, Libya, Syria and Yemen, attempts at changing a regime from the outside has merely resulted in a failed state. Iranian hardliners are likely to re-establish themselves with a probable electoral victory in runoff parliamentary elections scheduled for 11 September; as such, the likelihood for dramatic political change is low at least in the short- to medium-terms.


Regional: Ramping up of nuclear programmes across the Arabian Peninsula to elevate geo-political tensions amid concerns of nuclear proliferation