Iran’s Shadow War in Britain Is Hiding in Plain Sight

Britain is good at recognising spectacle. When a plot is disrupted, when arrests are made, when a name appears in court filings, the country knows how to react. The shock is registered, the statements are issued, the conversation runs its short cycle and then quiets. What Britain is less good at recognising is the system that produces the spectacle: the infrastructure of money, cover, influence, access and opportunity that has to exist before any plot becomes possible.

This gap matters most when it comes to Iran. MI5 and UK ministers have publicly referred to around twenty Iran-backed plots or threat investigations since 2022, some of them described by officials as potentially lethal. Each one invites a familiar pattern of headlines and reassurances. But the deeper picture, as set out in a recent London briefing on Iranian state-linked activity in the UK, is that these incidents should not be treated as isolated events. They are better understood as outputs of an operating system quietly assembling itself in plain view.

It is not suggested that all Iranian institutions, diplomats, businesses, expatriates or demonstrators are part of hostile activity. It concerns the publicly documented and officially alleged activity of the Iranian state, its security organs, sanctioned entities, proxies and networks operating in or through the UK. The distinction matters. Iranian communities in Britain are often themselves victims of the Islamic Republic’s intimidation and surveillance.

The argument running through a briefing I attended was disarmingly simple: if you only look at incidents, you will lose. If you look at the system, you stand a chance.

The first habit to break is treating “the Iranian threat” as a single thing. The regime in Tehran does not project power abroad through one organisation, one method or one tactic. It projects power through an ecosystem. Some of it operates noisily: the clumsy, public-facing plots that get detected, disrupted and discussed. Some operates quietly and patiently, in domains where most observers are not looking.

The most public part is the Islamic Revolutionary Guard Corps, the IRGC. Its operations tend to be visible — sometimes spectacularly so — because they are the ones that fail, or that succeed in ways that cannot be hidden. But there is another part, less well known in Britain, that the briefing emphasised: Iran’s Ministry of Intelligence, often referred to in English as MOIS and in Persian-linked abbreviation as VAJA. Its work is less theatrical. It is associated with influence, information operations, intelligence collection and the patient building of networks.

Alongside this, diplomatic and consular platforms can, in hostile-state activity generally, provide official cover for intelligence collection or facilitation. That does not mean every diplomat is an operative. It means that the boundary between diplomacy and state intelligence work can be deliberately exploited. A community focused only on the visible part of the threat is, by definition, blind to much of it.

The most useful conceptual tool on offer was the formula taught in counterintelligence work: a threat is the combination of intent, capability and opportunity.

Intent on its own does no harm. There is no shortage of regimes and movements that would happily damage British Jews, Israel and the West. But intent without capability is rhetoric. Capability — money, communications, safe houses, banking access, local intermediaries, secure transit, corporate structures, propaganda networks — is what turns rhetoric into operations. Opportunity — proximity to a target, access to a vulnerable seam, a moment of weak protection — is what turns operations into harm.

The strategic implication is uncomfortable but liberating. Britain cannot legislate away the intent of a foreign regime. But it can do a great deal about capability and opportunity. That is where the real fight is.

The briefing also pushed back on the instinct to define “threat” purely in terms of physical violence. There are four dimensions, not one: terrorism, espionage, sabotage and subversion. Terrorism targets people. Espionage targets individuals through covert collection. Sabotage targets organisations and infrastructure. Subversion targets society itself — its cohesion, its trust, its moral confidence, its sense of which side of a question it is on.

For the Jewish community in Britain, all four matter. A community that hardens against terrorism while ignoring espionage, sabotage and subversion has secured the front door and left every other entrance open.

The Golders Green ambulance attack served in the briefing as an illustration of how the first dimension can work — and how connected it is to the others. It was described as a low-level operation, indirectly planned and executed through individuals on UK soil, with claim-of-responsibility material later attributed to an organisation operating in the IRGC’s orbit. According to the briefing, an intermediary developed agents over messaging platforms, beginning with small tasks to assess responsiveness and willingness to escalate. Targets were developed and validated. Physical surveillance of the location was conducted, and reconnaissance video was generated.

The most important lesson from that example is not simply the identity of the location. It is the pattern: remote contact, small initial tasks, target validation, surveillance and possible escalation. The briefing argued that pre-attack surveillance is often the most practical point at which people outside the security services may notice something useful and report it. It is the moment when hostile operatives, however careful, have to step into public and observable space.

Alongside this sit more diffuse forms of public pressure — most visibly, the annual Quds Day demonstrations. The point is not that every participant in such demonstrations is paid, directed or knowingly serving a foreign agenda. That would be both unfair and analytically lazy. The narrower concern is that hostile state-linked actors can sometimes fund, amplify, steer or exploit public activity for strategic effect. They can manufacture the impression of a larger movement than actually exists. They can embolden sympathisers and intimidate opponents at the same time. They can create psychological facts on the British street.

The micro-tasking pattern fits within this wider picture. Investigations and briefings have described a pattern in which individuals are approached online to perform small symbolic acts for modest payments, including through cryptocurrency. These may include burning printed photographs, recording short videos, sharing particular messages or carrying out low-level intimidation tasks. The point of such tasks is rarely the act itself. It is to test compliance, reliability and appetite for risk. Small tasks are how serious tasking can begin.

If there is one place where intent gets converted into capability, it is money.

The briefing devoted considerable time to the financial infrastructure the Iranian regime has built, exploited or attempted to access in Britain. The most striking element was not exotic. Iranian state-linked banking and commercial structures have, at different points, intersected with the UK financial system, company registers and regulatory architecture. Where specific entities or individuals are discussed, the point is not to allege unproven criminal conduct, but to identify publicly reported sanctions, ownership and regulatory-risk issues that deserve scrutiny.

The foundations for financial and sanctions-risk exposure have often been visible in public records: company filings, ownership structures, sanctions designations and regulatory histories. That does not prove criminality in any individual case. But it does show why public registers matter, and why the connective tissue of hostile capability is often not hidden in some cinematic underworld. It can sit in ordinary filings, ordinary authorisations, ordinary corporate structures and ordinary property transactions.

Layered on top of this is the use of jurisdictional arbitrage. The briefing described the use of cross-jurisdictional corporate structures — including entities incorporated outside the UK — to create distance between beneficial control, regulatory visibility and operational activity. This is not unique to Iran. It is a recurring feature of sanctions evasion, illicit finance and hostile-state enablement globally. But in the Iranian case, it matters because financial opacity can become a strategic asset.

Similar concerns have historically arisen around maritime-linked corporate structures, where ship-by-ship entities can make ownership, control and enforcement harder to follow. One company can be moved, replaced, dissolved or reconstituted without necessarily disturbing the wider network. The result is a system designed to absorb pressure.

Recent reporting and policy discussion have also raised concerns about high-value London property acquisitions by individuals later sanctioned, investigated or alleged by authorities to be linked to hostile Iranian state activity. Those individuals may deny wrongdoing or challenge sanctions, and the existence of a property holding does not itself prove operational use. But the broader policy concern remains: beneficial-ownership opacity and weak due diligence can create strategic vulnerabilities.

This is why finance is the single highest-leverage point for mitigation. Disrupt the money, and you generate friction across all four dimensions at once. Safe houses, salaries, surveillance kit, real estate fronts, travel, communications, cut-outs and propaganda networks do not run for free.

None of this is a counsel of panic. It is a counsel of seriousness.

For the Jewish community, the practical implications are coherent and proportionate. Surveillance-awareness training, oriented around the recognition and reporting of pre-attack reconnaissance, deserves to be a normal part of communal life around sensitive sites. Reporting channels into CST, the police and local authorities can always be tighter. Communal institutions handling significant funds or property can do more financial due diligence with their eyes open to the specific risk picture.

Communal leadership can also press regulators, parliamentarians and policymakers to take beneficial-ownership transparency, sanctions screening and the FCA’s licensing perimeter seriously — and keep pressing when the news cycle moves on. The question should not only be whether the next plot is stopped. It should be whether the enabling environment is being made harder to use.

Information operations deserve their own line of effort. Recognising that hostile actors will try to manipulate the British conversation about Israel, Jews and Iran is not paranoia. It is literacy. The right response is not counter-shouting, but calm, accurate, persistent communication that does not concede the terms of the argument. The aim should be to expose method, not merely denounce message.

Throughout, the line that must be held with discipline is the line between the Iranian regime and Iranian people. The threat described here is a regime-linked threat, run through specific institutions and specific networks. It is not a threat from Iranian communities in Britain, who are themselves frequently among the regime’s victims, and whose dissidents and exiles have for decades carried much of the moral weight in this argument. Conflating the two is precisely the kind of subversive effect a hostile actor would happily encourage.

The shadow war in Britain is hiding in plain sight because too many people are looking only for the explosion, not for the system that makes the explosion possible. The banks are listed. The corporate structures are filed. The property purchases are recorded. The demonstrations are public. The micro-tasking is documented. The framework for understanding it all — intent, capability and opportunity, mapped across terrorism, espionage, sabotage and subversion — has existed in counterintelligence training for decades.

What is missing is not information. What is missing is the willingness to treat the system as the threat, and to act before the next visible incident forces the conversation.

Britain need not wait for that incident. The shadow war is already legible to anyone willing to read it.