The evidence in the public domain is not yet sufficient to establish that Iran directed the alleged RAF Fairford terrorist plot. But the strange and unclear circumstances surrounding this story raise vital questions about Tehran’s resolve to target western interests on western soil amid its ongoing war with the US and Israel.
Here is what we know so far: British counterterrorism police have stressed that they are pursuing multiple lines of inquiry. Seven people have been arrested, including a British-Iranian dual national, although the first six suspects have been released on bail. Iran has denied involvement.
Assassination plots, cases of espionage and cyber incidents are all part of the broader ecosystem of Iranian state threats. These hostile activities can involve intelligence and security services, diplomatic personnel and proxy organisations, but they can also involve criminal networks and, increasingly, local recruits. This model has evolved over time, with growing emphasis on deniability, compartmentalisation and the outsourcing of efforts to intermediaries.
As such, the person carrying out an operation may be several steps removed from the Iranian organisation ultimately responsible for directing or financing it. Criminal networks can provide local access and certain capabilities, while people recruited online may have little or no ideological connection to Iran. The further away from Iranian centres of powers, the harder it becomes for authorities to identify any connection to the Iranian state at the point of arrest.
Historically, Iranian activity abroad focused on regime opponents—intimidating dissidents, surveilling journalists, kidnapping or assassinating opposition figures and deterring criticism of the Islamic Republic. Meanwhile the Quds Force, the branch of the Islamic Revolutionary Guard Corps (IRGC) active overseas, has been associated more directly with operations against Israeli, Jewish and American targets. Fairford may well represent an evolution of the model.
The UK has already accused Iranian intelligence of directing surveillance and plots against journalists and activists, while British authorities have highlighted Tehran’s increasing use of criminals and proxy organisations to conduct hostile activity. In July, the UK designated the IRGC under the new National Security (State Threats) Act, after the government said the Quds Force had directed a proxy to carry out attacks across Europe. These new powers were intended to expose and disrupt foreign states, groups and individuals acting on the behalf of a foreign power in the UK.
Britain no longer views Iranian activity primarily through the lens of conventional espionage or isolated terrorism plots, but as part of that broader ecosystem, and this is significant for the Fairford case. There, the central question is not simply who happened to be near the base, but whether or not they were acting independently.
The ongoing war with the US and Israel is creating incentives for Tehran to pursue even more targets. Military facilities, intelligence assets, defence companies, logistics infrastructure and organisations associated with states supporting Iran’s adversaries could all be at risk. The objective might not necessarily be to inflict major physical damage. Surveillance, reconnaissance, attempted sabotage or even a limited attack could all demonstrate reach and deter further action while remaining below the threshold of conventional military confrontation.
Fairford does not seem an arbitrary location. The Gloucestershire base has been used by the US and has played a role in military operations connected to the conflict with Iran. Iran has publicly identified western military facilities involved in attacks against it as legitimate targets. The withdrawal of US B-1 bombers from Fairford following intelligence that pointed to a possible Iranian drone threat gives the episode additional significance, even though the precise intelligence behind that decision remains undisclosed.
There are important parallels with other cases in the UK, too, although they should not be conflated. On 2nd October, two Iranian men were charged over an alleged plot targeting the Jewish community in Manchester. Prosecutors allege that they were acting under the direction of another Iranian believed to be operating from Iran. Separately, on 6th October the trial started of three men in London over the alleged surveillance of Iranian journalists and an Israel-linked activist on behalf of Iranian intelligence.
These cases illustrate the breadth of the threat, from attacks against communities and targets connected to Israel, to surveillance and transnational repression. Tehran can use state personnel where direct control is important, and it can establish proxies where specialised capabilities or ideological commitment are required. It can turn to organised crime where local access and deniability are valuable, or local recruits where cheap and expendable capabilities will do.
The threat from Iran no longer neatly separates into categories of terrorism, espionage or organised crime. Such activities increasingly intersect. Cyber operations can facilitate physical targeting; criminal networks can provide logistics for intelligence operations; and intelligence personnel or intermediaries can provide direction, financing or operational support.
The ongoing conflict is likely to intensify all of these. Iran has strong incentives to impose costs on its adversaries, without necessarily triggering a direct confrontation that it cannot control. For Tehran, operations that are cheap, deniable and reversible, but still able to cause insecurity, are highly valuable.
Fairford may ultimately prove to have had no connection to Iran. That possibility should not prevent policymakers from examining what makes Iranian state-linked, hostile activity possible. The relevant question is not simply whether Tehran ordered this operation, but whether the capabilities, networks and methods that could enable such an operation are becoming more available to Tehran, and more of a priority as war continues.
Fairford may therefore be a warning. Not necessarily of an operation directed from Tehran, but of what Iran’s shadow war is becoming.
