Recruiting people with criminal records and duping teenagers into carrying out plots: has Iran stumbled on the perfect formula to unsettle European cities and absorb police resources across multiple countries?
A mysterious Iran-linked group connected to attacks in Europe is suspected of exploiting petty criminals with subterfuge including telling recruits hired on social media that they were part of a personal vendetta.
The French probe into a foiled attack last weekend against Bank of America's Paris headquarters has revealed methods used by the group, known online as the Islamic Movement of the Companions of the Right Hand.
It has launched attacks against American and Jewish interests in France, the Netherlands and Belgium, since the start of the Iran war. The attacks were all perpetrated by young men recruited on social media for a few hundred euros. The attacks did not cause any casualties and most took place in the middle of the night.
European judicial inquiries are being co-ordinated across Paris, The Hague and Brussels, the French National Anti-Terrorism Prosecutor's Office said on Wednesday. “An investigation was opened today on charges of criminal terrorist conspiracy,” its statement said.
The Islamic Movement of the Companions of the Right Hand was previously unknown to security services. It appears to be acting as a front for Iran.
In March, a Jewish school in Amsterdam and a synagogue in Rotterdam were targeted, as well as Jewish neighbourhoods in London and Antwerp. Iran's anti-Semitic government regularly conflates Israeli and Jewish interests.
On Thursday, it emerged that the Paris headquarters of the American bank Goldman Sachs in Paris had been placed under police surveillance overnight.
Goldman Sachs told its Paris staff they could work remotely amid the security alert. Citigroup staff in Paris and Frankfurt are also working remotely. A statement from Citigroup said the decision was a precautionary measure.
Last Saturday's attack was foiled after police were warned the group had published a video claiming that Bank of America was a target. Officers arrested a 17-year-old handling an incendiary device in front of the entrance to the headquarters. Another person escaped. The following day, an adult with a history of drug trafficking was arrested.
In total, four people have been arrested and charged with criminal terrorist conspiracy, making and transporting an explosive device, as well as attempted destruction in connection with a terrorist enterprise.
'Large fireball'
Belgium has responded to the attacks on its soil by deploying soldiers for the first time in years to protect Jewish sites over the Passover holidays. This weekend's Easter celebrations are also surrounded by heightened security.
Mohamed Fahmi, an expert in the propaganda of extremist groups at the Free University of Brussels, described the pattern of attacks in recent weeks in multiple locations as “co-ordinated and structured”.
“They recruit criminals for acts of political violence and terrorism, and they are able to control the intensity of the attacks,” Mr Fahmi told The National. “They're sending [Europeans] a message that they can easily strike.”
An examination following the arrest in Paris found that the explosive device consisted of a cardboard cylinder containing 650 grams of petrol and a fuse.
“The laboratory stated that this was the first pyrotechnic device of this power found in France to date, to its knowledge,” the prosecutor's office said. It “could have generated a large fireball several metres in diameter upon detonation”.
Investigations showed that three minors had been recruited on the night of March 26 to plant the device, ignite it and film the scene in exchange for a sum between €500 and €1,000.
The adult suspect told police he was an intermediary who had been contacted by a third party via social media asking him to plant the device as part of a personal vendetta. “The explosive device was allegedly delivered to his home by someone he did not know,” the prosecutor's office said.
It added that links to The Islamic Movement of the Companions of the Right Hand, also referred to by its Arabic acronym HAYI, have not been formally established.
Similar uncertainty has surrounded similar attacks in recent weeks, including the torching on March 23 of vehicles allegedly belonging to Jewish residents of Antwerp, which was claimed by HAYI.
Other incidents appear to have been organised by unconnected radicalised individuals, including a bomb attack outside the US embassy in Oslo. That led to the arrest of three Norwegian brothers of Iraqi heritage on March 11. Similar incidents have taken place in the US.
Amateur delivery
HAYI's amateurism has divided experts. They agree the group is linked to Iran but some have also highlighted possible links with Tehran-backed Iraqi Shiite militias because it has published statements and videos on social media channels linked to those groups. HAYI also made spelling mistakes in Arabic, inverting the letters of the word “temple” and used language not typically used by Iran-backed groups.
Historically, Iran carried out attacks against Jewish sites or the Iranian opposition in Europe with support from Lebanon's Hezbollah networks – another closely aligned Shiite group – on the continent. But in recent years it has moved towards simply paying unaffiliated local criminals gangs.
“lt doesn't take any preparation. All you need is money. It adds another layer of deniability,” said Hans-Jakob Schindler, senior director of the Counter Extremism Project, a non-profit organisation based in London, New York and Berlin.
On the recent attacks in Europe, Mr Schindler said it was “very clear the [Iranian] regime is saying it was us, without saying it was us”. He added: “There is no chance that it is actually a terror group, because a terror group doesn't post on other channels.”
In his first statement on March 12, Iran's new supreme leader Mojtaba Khamenei said Tehran would launch attacks on “other fronts where the enemy has minimal experience and where it would be highly vulnerable” if the war continued. The US and Israel jointly launched attacks on Iran on February 28, causing a regional conflict.
Mr Fahmi thinks the attacks were either organised directly by Iran or by supporters in Europe with links to Iraqi militias. Hdescribed their social media communications as “amateur”.
“The message has been understood. States are now on high alert. In that sense, the attacks were a success,” Mr Fahmi said.
