Assessing Likelihood of Uprisings in Iran and Iranian Sleeper Cells in the United States

FullContextIntheBack:

Welp.

Of escalation options including: 1) continuing to attack Israel, 2) attack US bases in Iraq, 3) attack US forces in Qatar, and 4) close the Strait of Hormuz to oil shipments Iran has chosen 1-3 and is signaling #4.

To avoid burying the lede, #2-#3, the IRGC just issued a statement that they were conducting a missile attack against US forces in Iraq (which is nothing new) as well as US forces stationed in Qatar (which is very new). There have been reported flares and explosions in the airspace of Qatar, but no confirmed damage assessments and no reports of casualties. It’s quite possible Iran signaled the attack in advance, like a courtesy-knock before opening a bathroom, you don’t want to accidentally catch someone with their pants down. US and UK embassies advised citizens to shelter in place hours ago, and Qatar closed its airspace about an hour in advance of the attacks (one reason I was watching closely.) That would be a good thing, meaning they don’t want an incidental hit to kill dozens of Americans and provoke an escalation in return.

As for #1, missile attacks on Israel continued over the weekend, and as the relative munitions calculus between Israeli’s defensive and Iranian offensive capabilities continues to calculate, damages are increasing. Over $1.3B in property has been destroyed and there are dozens of wounded casualties, though not many fatalities, given Israeli’s sophisticated sheltering system.

As to #4, the Iranian parliament approved closing the Strait of Hormuz, but that still has to go through the Iranian National Security Council and get approved by the Supreme Leader Khamenei in his role as commander in chief.

There have also been initial signs of cyber hacktivist attacks on US and US political interests, Iranian-aligned hacktivists claiming to DDOS Truth Social over the weekend and Israel-backed hacktivists claiming to delete $90M in cryrpto currencies from Iranian state banks.

But before the OSINT Bros claim horrific damage and the start of WWIII, the reality is the Qatari-based US forces have the best anti-air and anti-missile defenses available, have not yet expended their supplies as Israel has in the ongoing campaign, and so are ‘fresh’ to counter Iranian ballistic, drone, and rocket attacks. Some might get through, but I’d be surprised at heavy damage. Still, the willingness to open fire at US forces stationed in Qatar directly is a significant step up the escalation chain as it invites a conventional response from those forces on anything even vaguely IRGC-shaped within a few hundred kilometers of Qatar.

Again, not getting into much of a military analysis (we don’t know enough) nor political analysis (others are covering that elsewhere). However, to address two anxieties that frequently arose from my previous list Saturday night: would this be ‘the moment’ Iranians took to the streets to overthrow the regime and/or the risk the Iranian regime might activate ‘sleeper cells’ in the United States to conduct terrorist attacks. These are likely exacerbated today. But both are low risks due to similar structural reasons – which is that a thing becomes really hard to do if the opponent has spent decades preparing for you to do it. And this goes to the Health Belief Model (HBM) of how people and institutions respond to perceive risk.

HBM comes from tons of research on compliance to public health policy but is a useful heuristic for dynamically assessing things like terror or sleeper cell risk. If you 1) know what the risk is, 2) fear it, 3 ) know how to counter it, and 4) have the means to counter it…counter-measures tend to be pretty good. The HBM risk level rises when you don’t know the risk, or worse, fail to fear it because it hasn’t happened in a long enough time. Think about compliance with anti-COVID measures…they all magically went up when lots of people started dying and started falling when people slowed in the death spin. For a look at how HBM can be modeled for counter-terrorism policies see the peer reviewed paper we wrote in the links in first comments.

So addressing the two risks:

1) Dirty bomb/sleeper cell attacks in the US. There must be memes going around because this is a very common refrain, that an Iranian sleeper cell is going to be activated and conduct a kinetic, or some form of a dirty bomb attack, inside the US. However, the US and Iran have been strategic adversaries for nearly five decades now. And Iran has routinely attempted to insert “sleeper cells” over that time period, most of which we catch and dismantle. It’s something we’ve gotten quite good at. Dirty bombs were the popularized boogeyman in the wake of 9/11, and for awhile there was a strategic gap in our ability to detect them. But if you want to know how advanced we’ve gotten since those early 00’s days, start driving around a vehicle emitting dangerously high levels of radiation in any major city and see how far you get. (On second thought, don’t, you don’t need the cancer, and I don’t need the fuzz coming down on me.) These days the greater risk than a ‘dirty bomb’ is probably a ‘dirty drone’, but just as our detection capabilities of the groundside threat have improved so have our aerial detection capabilities. (Check out larissian knots for an interesting mathematical approach of calculating optimal drone sweep patterns.)

This isn’t to say sleeper cells can’t get inside the US and get close to becoming operational. There’s been several assassination teams that have gotten within varying distances of their targets over the last few years. Notably, last summer, one Iranian cell got close enough to targeting Trump’s campaign plane with a SAM that the Secret Service switched Trump off that and put him on one while his staff stayed on the original. (Which they were not thrilled to find out they were on the decoy.) But in some ways, that goes to my point.

In the HBM model, we 1) know that Iran is actively trying to insert sleeper cells, 2) we get enough regular reminders of attempts to be fearful of their success, 3) we have a good track record of countering them, and 4) we have the means to counter the kinetic attacks, whether of conventional terrorism or unconventional dirty bomb style.

Likelihood of Spontaneous Uprising

2) The same applies to the risk the Iranian people will rise up in revolution because we chucked some bombs and killed a few leaders. This is generally wishful thinking, which is stupendously stubborn – the belief that you can just conduct an air campaign and collapse a hostile regime. I know of no case where external bombing, absent an already in-motion local revolution, caused the collapse of a regime. Like…I can think of zero. I may be missing some. The closest is the Cambodian bombing campaigns during the Vietnam War, where there is some evidence that the communists used it to portray the state as weak, gain power, and then take out the regime. But it wasn’t that the bombing of eastern Cambodia targeted regime infrastructures that then allowed a revolution to spring up…rather, an existing local force took advantage. It’s a bit different when bombings coincide with an existing, organic, and local resistance effort. In *some* of these scenarios, you can collapse the regime. When President Obama ordered air strikes against Libyan state forces attacking Arab Spring rebels, he definitively tipped the scale against the regime and directly contributed to his collapse. But the rebels were already well organized, having captured several cities and regions, and in what amounted to a full scale civil war. The bombing didn’t *start* the uprising, though it did help end it. (And the aftermath of that decision was as bad regionally as anything Bush did, indeed Obama’s errors in Libya are almost exactly the same as Bush’s…not having a plan for the insurgencies that follow a seemingly ‘quick’ conventional victory.)

And so, just like the HBM model means its not likely Iranian sleeper cells will have much luck in the US, the HBM model also comes into the benefit of the Iranian regime in resisting uprisings and revolutions: 1) they know of the risk of internal uprisings, and have for decades it, 2) they fear it more than anything else, 3) they know how to counter those uprisings as they have for decades, and 4) they have the means to counter those uprisings. It’s not like Saturday was the first time the Iranian theocracy ever had to contend with the risk of a military encounter causing internal dissent.

But the mechanisms Iran uses to contain protests are multilayered consisting of both the IRGC -and- Basji paramilitary forces as tools of suppression, that align along a rural conservative vs. urban liberal divide. From the Green Revolution to the Veil Protests to the Hijab protests Iran has shown a willingness and capability to crack down, break apart, and suppress would-be-revolutionary movements. There are some long enduring terrorist networks at work, including Baloch aligned terror groups in the Bulchastan regions, and ISIS has struck inside Iran several times. But these are terror attacks, not widespread popular uprisings.

Taking out a few leaders of the regime is not going to change this calculus, without the revolutionaries having far more capabilities. In analogy, if you were to remove by injury the entire starting team of a professional US football team…they would probably still fare well against a middle-school or high-school team. Because the capabilities, experience, equipment, and training is just so vastly different.

3) left unasked but top of my mind (not the least of which because I’m working a project on it) are the cyber capabilities of Iranian backed state-proxies and Iranian aligned hacktvistists. These are pro, semi-pro, and amateur hackers who in different configurations attack cyber infrastructure in everything from DDOSing Truth Social off the web (which happened Saturday) to taking critical infrastructure like energy and water offline. Ironically, the very organizations of the government that are supposed to be government and commercial responses to the threats of these attacks: NSA, CYBERCOM and CISA are either leaderless at the top level (NSA) or DOGEd (CISA). I’ve been looking, and I’ve seen no FBI or CISA advisories of increased cybersecurity risk due to the Iran tensions…even though plenty of private sites are reporting those risks. I may be missing something, but it looks like the last threat on Iranian backed cyber activity from CISA was last year…a bit off the mark if you ask me.

To put these in context however, these cyber attacks, currently, could cause inconvenience (for a website outage) to significant localized impacts (for a grid or water attack). But are unlikely to cause major loss of life in the US. As their capabilities advance, they can probably do more, but right now the means, especially of amateur hacktivist groups I’m looking into are quite limited.

So at the end of this analysis – the attacks on Qatar (and likely soon to be Iraq) could signal a cycle of escalation if they do significant damage. If they don’t, maybe it amounts to a symbolic performative rites of agitation. But they may still incense Trump enough to do something, and if the damage is significant the 5th Fleet will probably be unleashed in the Persian Gulf, turning what is currently a missle/rocket/drone war that involves boats…into a naval encounter up and down the Persian Gulf and along both coastlines. Time will tell.