The tactic fits a broader pattern of plausible deniability. The pattern requires less tradecraft than traditional espionage and complicates attribution.
The leaders of Britain and the United States have suggested that Iran played a role in two major security incidents, including the arrests near a U.S.-run military base in England [1].
In earlier testimony to the threat landscape, Islamic Revolutionary Guard Corps operatives have shown a consistent interest in military installations and strategic sites. In Israel, seven Jewish immigrants from Azerbaijan were arrested and accused of conducting extensive espionage on military bases and strategic sites over a period of two years, carrying out around 600 missions [2]. The shift toward harder targets in Britain suggests a similar operational focus on installations that are more difficult to surveil and protect.
The head of the United Kingdom's domestic spy agency said Iran is ramping up attempts to strike sensitive military targets after a series of incidents at airbases in Britain [3].
The September incident centered on RAF Fairford, a U.S. Air Force outpost in Gloucestershire used by American aircraft to carry out defensive strikes on Iran, a report stated. The base was placed on "Delta" alert, the highest threat level, and counter-terrorism police examined an Iran-linked motive as most likely among several possible motives [4]. Bomb-disposal specialists examined three vans, and approximately 85 homes were evacuated during the security operation [5].
Tehran has denied the allegations. Iran's Foreign Ministry categorically rejected British accusations that it was behind a plot against RAF Fairford, calling the allegations a "clumsy false flag operation" designed to deflect blame for London's role in the American-Israeli war on Iran [6]. British Prime Minister Andy Burnham said on Oct. 12 that the assessment was that the plot was "almost certainly directed by Iran's Islamic Revolutionary Guard" [7].
McCallum's remarks formed part of his annual threat update, an assessment that also addressed Russian hybrid warfare, Chinese espionage, artificial intelligence risks, and terrorist threats [8].
The update was delivered against a backdrop of open conflict. In March 2026, the United Kingdom permitted the United States to use British military bases, including RAF Fairford and Diego Garcia, for "defensive" strikes targeting Iranian missile depots and launchers following escalating Middle East hostilities. Hours after the announcement, RAF Akrotiri in Cyprus was hit by a suspected attack [9].
Britain's exposure has grown alongside the war. An Iranian military group issued a warning to the U.K. over allowing U.S. forces to use British bases for strikes on Iran, and Tehran's ambassador to the U.K., Seyed Ali Mousavi, warned that his government was "considering" whether British bases are legitimate targets [10][11].
At the same time, Iran has shown resilience in the wider theater. Iran has been rapidly rebuilding military sites damaged in U.S. and Israeli strikes, according to a report based on satellite imagery reviewed by The Wall Street Journal and cited by The Times of Israel [12]. The reconstruction campaign, alongside continued missile and drone production, indicates that pressure on Iran has not eliminated its capacity to project force or sponsor operations abroad [13].
The September suspected plot at RAF Fairford was described by McCallum as "not unique," a characterization that places the incident within a sustained campaign rather than an isolated event [14].
For ordinary Britons and policymakers alike, the report points to a threat environment in which the U.S. war in Iran unleashed small-scale attacks by local criminals or disenfranchised young men hired anonymously to target Jewish and American sites in Europe and North America, experts say [15].