Iranian attack planning against dissident activists in Denmark

Executive Summary

  • The head of Denmark’s security service (Politiets Efterretningstjeneste) PET said on 30 October 2018 that he suspected an Iranian intelligence service had attempted to carry out an attack on an individual in Denmark.
  • The purported intelligence resulted in the mobilisation of specialist law enforcement units in a likely attempt to isolate the suspected attackers within the Sjælland region by restricting movement along the Great Belt (Storebælt) and Øresund Bridge. Officers had arrested a Norwegian citizen with Iranian background on 21 October.
  • Although the involvement of the Iranian Ministry of Intelligence and Security cannot be ruled out, it is likely that the incident was linked to the Islamic Revolutionary Guard Corps – Qods Force (IRGC-QF); Iran’s elite intelligence and special operations arm.


On 22 September 2018, a military parade was attacked by armed gunmen in the southwestern Iranian city of Ahvaz. The shooters killed 25 people, including Islamic Revolutionary Guard Corps (IRGC) personnel and civilian bystanders. The attack was the deadliest of its kind to take place in Iran since the Chabahar suicide bombing in December 2010. Anti-government Arab group, Ahvaz National Resistance — the umbrella group for all Ahvaz resistance groups — claimed the attack. Additionally, the so-called Islamic State (IS) claimed responsibility the attack, though the likelihood of both groups conducting the attack in concert is assessed as highly unlikely. Iran subsequently accused Denmark, the Netherlands and the UK of harboring Ahvaz resistance group members, especially those from the Arab Struggle Movement for the Liberation of al-Ahwaz (ASMLA).

The head of Denmark’s security service (Politiets Efterretningstjeneste) PET announced on 30 October 2018 that he suspected an Iranian intelligence service had attempted to carry out an attack against three ASMLA activists in the town of Ringsted, located in the Sjælland region on 28 September. Acting on likely Israeli intelligence reports, Danish security forces consisting of PET and police personnel, including the Politiets Aktionsstyrketactical unit were mobilized to seal off Sjælland region and establish checkpoints at ferry ports, rail stations, and the entrances to the Great Belt (Storebælt) and Øresund Bridges. Additional reports further suggested that Danish authorities were hunting for a Swedish-registered black Volvo.

In the days leading up to the events on 28 September, undercover agents reportedly observed a Norwegian citizen of Iranian origin taking photos of the home belonging to an ASMLA branch leader. PET agents further reported that a Swedish-registered black Volvo starting moving “suspiciously” outside the house, when they attempted to approach the car, it sped off. However, Danish authorities later apprehended the vehicle and later determined that the car had nothing to do with the case.

The Likely Perpetrators

So far, PET has only cited “Iranian Intelligence” to be the likely perpetrators of the intended attack. However, we are aware that offensive operations by the Iranian Ministry of Intelligence and Security (MOIS) were curtailed following the ‘Mykanos Incident’ in Berlin in September 1992 which led to German authorities issuing an arrest warrant for Ali Fallahian, the former Iranian minister of intelligence and security, because of his order to assassinate Iranian Kurdish dissidents. By order of Ayatollah Khamenei, overarching responsibility for offensive overseas operations were transferred to the Qods Force.

The Qods Force is led by Major General Qasem Soleimani, a veteran of the Iran-Iraq War. With a popular standing in Iran, Soleimani has risen through the ranks to be entrusted with the responsibility of Iran’s external operations. Recently, he has gained increased notoriety for personally commanding the Shi’a militia groups to oust Islamic State from Iraq. Despite being subjected to a US-enforced travel-ban, Soleimani met with Russian President Vladimir Putin and Foreign Minister Sergei Lavrov in October 2016. Intelligence source indicates that the meeting paved the way for the deployment of Russian forces to Syria to enable the Qods Force to deploy all available assets Iraq, ahead of a major advance by Shi’a groups in Salahuddin and al-Anbar provinces. As a testament to his capability, Soleimani is considered to have been the architect behind the formation of a number of pro-Iranian proxy groups throughout the Middle East.

Following his appointment as the commander of the Qods Force, Soleimani re-structured and created a Special External Operations branch that is now referred to as ‘Department 400’. In addition, Solemani oversaw the incorporation of MOIS special operations into the Qods Force that resulted in the creation of a second Special External Operations branch that is referred to as ‘Department 900.’ Both departments are commanded by Hamed Abdallahi, whilst sub-command of Department 900 is assigned to Majid Alavi, a former deputy intelligence minister.

Qods Force Networks in Europe

Traditionally, operations in Europe are coordinated through the Qods Force regional department for Europe referred to as Department 10,000. However, the activities of Department 10,000 activities are largely assessed to be attributed to the funding of pro-Shi’a movements and the provision of aid to Muslim refugees fleeing the Middle East and North Africa. In Europe, the Qods Force are known to have a presence in nearly every country that hosts an Iranian diplomatic presence. The only exception is the United Kingdom, where Qods Force operations were disrupted following the expulsion of Iranian diplomats in the early 2000’s. In Scandinavia, the Qods Force are known to base the majority of their regional operations from Sweden.

Additionally, the Iranian-sponsored Hezbollah group maintains an active presence in Europe and recent reports indicate a continued focus on the group to target prominent Israeli nationals and Jewish figures. The most prominent attacked occurred in 2013 when a member of Hezbollah’s External Security Organisation (ESO) attacked a bus carrying Israeli tourists in Burgas, Bulgaria. Hezbollah attempted and successful attacks in Europe indicate a continued intent to conduct violent operations in concert with raising funds through a variety of criminal enterprises dotted throughout Europe.


As an organisation, the Qods Force employ the same methods employed by the US CIA and the British SAS. They are a unique organisation due to the fact that their activities include intelligence gathering and covert military operations. They are known to have been responsible for a number of previous attacks targeting Israeli and Jewish personalities; additionally, they have also been responsible for targeting Iranian dissidents located outside of Iran’s borders. Whilst there is a possibility that the recent events in Denmark may be linked to the Iranian Ministry of Intelligence and Security, it should be noted that their responsibility for external overseas operations was curtailed by Ayatollah Khamenei and subsequently transferred to the Qods Force in 1997. Therefore, there is a reasonable probability that the Qods Force ‘Department 900’ may have been the group responsible for the planned attack in Denmark.

Share this Post