Iran-backed network directed London attacks over FaceTime, US prosecutors say

The superseding indictment adds two defendants to a case against Mohammad al-Saadi, an alleged commander of the Iran-backed Iraqi militia Kataib Hezbollah who has been jailed in New York since May. The additional defendants are Mohsen Mohajeri, identified as an IRGC operative, and Mohammed Ali al-Hassani, an Iraqi who once lived in Britain. Both are at large and believed to be in Iran. All three face terrorism charges carrying potential life sentences.

Coordinated attacks

Prosecutors say the network targeted Jewish and American sites across Europe, including synagogues in Belgium, the Netherlands and London, and U.S. bank buildings in Amsterdam and Paris. The attacks also included a stabbing in London that left two Jewish men seriously injured. The group claimed about 18 attacks and attempted attacks across Europe between March and April, beginning days after the United States and Israel launched strikes on Iran.

Remote direction

During an arson attack on a Jewish charity's building in London in April, al-Hassani directed the attacker over FaceTime, with the attack streamed and projected onto a large screen with the militia's logo. Two days earlier, he allegedly directed another arson attack on Iran International, a London-based media organization. During another attack on a London synagogue, he urged the attacker to "light it up like a Christmas tree." The IRGC operative filmed the proceedings and the men directing it.

The network later plotted to attack RAF Fairford, a British air base used by U.S. bombers. During the alleged attempted attack, al-Hassani directed three vans toward the base by phone from Iran, while al-Saadi, already jailed in New York, relayed coded instructions through calls with relatives. At least two of the vans were turned back at a security roadblock.

Digital evidence

Much of the evidence comes from al-Saadi's iPhone, which FBI agents seized after he was detained in Turkey in May. It contained recordings of FaceTime calls, raw attack footage and messages. While FaceTime calls are end-to-end encrypted, investigators obtained recordings stored on the seized phone. The FBI linked his WhatsApp, Snapchat, Telegram and X accounts through a single phone number.

Prosecutors say al-Saadi received raw footage of a synagogue bombing in Belgium through Telegram and used the app to send footage of an arson attack in London. He also paid an undercover officer about $3,000 in cryptocurrency in April, related to a planned attack on a Manhattan synagogue that never occurred.

The indictment comes amid concerns over "hybrid warfare" and "state-sponsored terrorism," as well as disputes over law enforcement access to encrypted data. Apple is currently challenging a reported British demand for access to protected iCloud data, while the European Commission has outlined plans to explore technical options for lawful access to encrypted evidence.