The arrest of five men near RAF Fairford, the British air base used by American bombers in operations against Iran, has sharpened scrutiny of Tehran’s capacity to project asymmetric power deep inside Europe. But it has also demonstrated how quickly suspicion can run ahead of evidence. British authorities have not established any Iranian connection to the arrested individuals, all of whom have since been bailed, and Defence Secretary Wes Streeting has warned that it would be “very unwise” to speculate about the suspects’ motives while the investigation continues. Iran has categorically rejected suggestions that it was involved, condemning what its embassy in London described as “unfounded and malicious speculations” intended to fuel anti-Iran sentiment. The real significance of the Fairford plot lies within a broader question that European intelligence agencies have been grappling with for years: How far has Iran developed the ability to conduct surveillance, intimidation, sabotage and violence inside Western countries without deploying conventional Iranian operatives? Iran’s overseas operational model has become increasingly diverse, Clara Broekaert, research analyst at The Soufan Center, told Arab News, involving everyone from organized criminals to petty offenders and profit-driven teenagers recruited online. But while the resulting operations can appear chaotic or even amateurish, she said, the system behind them is often far more structured. “Iran’s operational model in Europe has become incredibly multifaceted,” Broekaert explained. The basic architecture frequently begins with Iranian state actors — including the Islamic Revolutionary Guard Corps’ Quds Force or the Ministry of Intelligence and Security — tasking an operation. A second layer of handlers or criminal networks then turns that instruction into an operational plan, before disposable recruits in Europe carry it out. Those “foot soldiers,” Broekaert said, can be petty criminals or teenagers motivated primarily by money and with “little or no ideological affinity” for the Iranian government. “Typically, these ‘foot soldiers’ are recruited digitally, while the handler layer is still in the Middle East,” she said. The distinction is important because it challenges the assumption that apparently crude attacks cannot have been centrally directed. “A misconception about these operations is that they aren’t carefully orchestrated top-down because they can appear amateurish at times,” Broekaert said. That emerging architecture looks very different from the proxy system Iran developed across the Middle East. Hezbollah in Lebanon and allied armed groups in Iraq were built over years or decades through political, ideological and military relationships with Tehran. Europe, however, requires something more flexible. An assassin in London, an arsonist in Scandinavia or somebody conducting surveillance outside a Jewish institution does not necessarily need to believe in the Islamic Republic’s ideology. They may simply need to accept payment. A recent New Yorker investigation highlighted that evolution through the stabbing of Iranian dissident journalist Pouria Zeraati outside his London home in 2024 and examined a wider pattern involving foreign criminals allegedly recruited to attack Tehran’s opponents. The reporting described a model built around layers of intermediaries — effectively cutouts of cutouts — designed to distance those ordering an operation from those carrying it out. Broekaert said Iran has increasingly exploited criminal networks in countries including Sweden and Germany. But she cautioned against describing the model as genuinely “plausibly deniable,” instead, calling it “implausibly deniable.” Tehran may not necessarily expect Western governments to believe it had nothing to do with a particular operation. Rather, the layers of criminal intermediaries can prevent the kind of immediate, incontrovertible attribution that might force a direct response. Broekaert contrasted that approach with the 2018 plot to bomb a gathering of the National Council of Resistance of Iran outside Paris. That operation involved an Iranian diplomat based in Vienna, Assadollah Assadi, who was later convicted in Belgium for his role. “I don’t think they’d repeat the 2018 operation,” Broekaert said. The contemporary model, she argued, has gone “all in on implausible deniability. “We know these operations are linked to Iran, and they are orchestrated to signal that even the embattled regime can still reach mainland Europe and wreak havoc under the threshold of immediate escalation.” An attack conclusively traced to an IRGC officer or Iranian diplomat could produce sanctions, expulsions or potentially a more severe response. A teenager recruited through an encrypted app to set fire to a building, or a local criminal paid through multiple intermediaries to conduct surveillance, creates a much murkier problem. Swedish authorities have publicly accused Iran of using criminal networks to carry out violence, including against Israeli and Jewish targets. The Foxtrot network, one of Sweden’s most notorious criminal organizations, has been sanctioned by Britain and the US over allegations it carried out attacks on Tehran’s behalf. Dutch intelligence has also accused Iran of drawing on European criminal networks in assassination plots targeting regime opponents, while Britain appears to be the most recent to face such a problem. Farsi-language broadcaster Iran International and its journalists have faced repeated alleged plots, while UK authorities have strengthened sanctions and legislation aimed at countering Iranian state threats. Across the Atlantic, US prosecutors have accused Iranian figures of attempting to recruit organized criminals for murder-for-hire operations targeting dissidents, including Iranian-American journalist Masih Alinejad. What makes the threat especially difficult to counter, Broekaert said, is that many of the recruits do not fit any conventional intelligence profile. “What makes it hard is the recruitment of teenagers who have no clear ideological affinity, so no reason to be a target for intelligence collection in the first place,” she said. Iran, she added, has learned to exploit the seams between organized crime, terrorism and opportunistic young recruits. Money does not flow directly from an Iranian intelligence-linked account to a teenage recruit. Layers of intermediaries and obfuscated payment methods can separate the executor from the ultimate sponsor. It is a model that Broekaert said increasingly resembles Russia’s approach to hybrid warfare in Europe. “Iran is clearly learning from Russia’s hybrid playbook,” she said. Even small or unsuccessful operations can serve a strategic purpose, she argued, because the publicity they generate helps Tehran demonstrate that it can reach adversaries far beyond the Middle East. The operation does not always have to succeed spectacularly. The suggestion that Tehran can reach an opponent in London, Stockholm or Berlin can itself impose costs by forcing governments, journalists and dissidents to spend resources on security and live with persistent uncertainty. Broekaert said pressure on Iran’s traditional “Axis of Resistance” had not simply driven Tehran toward more operations in Europe. Instead, some of its allied organizations appear to have adopted similar methods themselves. She cited Harakat Ashab Al-Yamin Al-Islamia, or HAYI, which has claimed operations in Europe and which US prosecutors have linked to Iraq’s Kata’ib Hezbollah, as well as alleged Hamas plots across the continent. “This does not mean Tehran always approved this,” she cautioned. But it demonstrated how allied groups continued to seek ways to signal reach and “bring the war home” to societies geographically removed from the battlefield. In that sense, she said, the logic resembles Iran’s use of pressure on the Strait of Hormuz: creating consequences that ordinary citizens abroad eventually feel themselves. The strategy is particularly relevant as Iran’s conventional and regional military options come under pressure. Writing in The Atlantic earlier this year, terrorism analyst Colin P. Clarke argued that weakening Tehran’s missile forces or traditional proxies would not necessarily eliminate its ability to retaliate. Instead, it could make lower-cost and less attributable operations overseas more attractive, thus creating a paradox for Western governments. Weakening Iran’s capacity to respond conventionally may simultaneously increase incentives to operate in the gray zone. But Broekaert cautioned that attribution itself has to be handled carefully. Iran benefits when every suspicious incident is immediately interpreted as evidence of its global reach. So attribution, she argued, should therefore be precise and calibrated. “When things are unclear, which they always are in this ‘gray zone’ where every operation requires peeling back many layers, I think it is fair to distinguish when Iranian responsibility is ‘a line of inquiry,’ when it is ‘consistent with Iranian tactics,’ and when it is clear that it can be attributed to the Islamic Regime.” That framework is particularly relevant to RAF Fairford. The base has hosted US aircraft involved in operations against Iran, making the arrests inevitably sensitive. However, no evidence currently establishes that Tehran directed the five British nationals who were arrested as suspects, and Iran has explicitly denied any involvement. Previous Iranian-linked operations in Europe have also largely focused on dissidents, diaspora journalists, Jewish and Israeli targets and other perceived opponents. An operation against a British military facility used by US forces would represent a significant escalation into direct sabotage against Western defense infrastructure. Still, the speed with which an Iranian hypothesis entered the discussion says something about how Western security agencies now view the threat. The concern is no longer simply that IRGC officers or Iranian intelligence agents could enter Europe to organize an attack. It is that Tehran may not need them to.