Counterintelligence & Tradecraft — 2026-05-30

Western Intelligence Services Report Expanding Iranian Covert Operations as Arrests and Espionage Cases Multiply Across Europe

BLUFIran's expansion from dissident targeting to Western defense industry surveillance, combined with compressed proxy deployment timelines, will likely compel additional European criminal charges or diplomatic expulsions within 90 days.

British prosecutors on May 29 charged Ioannis Aidinidis, a 46-year-old Greek national residing in Munich, under the National Security Act with surveilling an Iran International journalist in London on behalf of a foreign intelligence service believed linked to Iran; prosecutors said he traveled to Britain twice in April and May, photographed addresses and vehicles, and installed a covert camera concealed in a sock in a tree capable of transmitting data to unknown recipients 12. Reuters reported evidence on Aidinidis's phone also indicated he conducted surveillance on an Italian defense firm between his UK trips 1. The DOJ this week sentenced a New York man to 10 years for an Iranian government-backed plot against journalist Masih Alinejad and indicted Mohammad Baqer Saad Dawood Al-Saadi on eight terrorism counts for coordinating European attacks through a Kataib Hezbollah front 2. Finn Borch Andersen, head of Denmark's PET, stated that the threat stems from Iranian intelligence services using criminal networks and recruited operatives across Europe 2.

Analysis
Aidinidis's surveillance of an Italian defense firm between his UK trips extends Iranian targeting from dissidents to Western defense industry, a qualitative shift. The Al-Saadi indictment exposes HAYI's organizational chain and IRGC command authority. HAYI's 15 claimed attacks since early March show Tehran has compressed the proxy-to-deployment timeline. The documented arrests may instead reflect IRGC resource compression from recent strikes, poor operative tradecraft suggesting a degraded network rather than deliberate expansion. At least one European government will likely announce charges or expulsions within 90 days as parallel investigations across the UK, Italy, Denmark, and Sweden enter judicial process, at moderate confidence grounded in convergence across independent investigative threads. Prosecutorial timing remains internal to each government; charges announced will force allied capitals to choose between coordinating expulsions and bilateral prosecution tracks.

3 sources