Iran’s real spy threat is widening the security state’s reach over dissent

The analytical problem begins with a genuine security breach. Israeli intelligence has claimed extensive access inside Iran, while targeted wartime killings and sabotage demonstrated that hostile services possessed actionable information about protected people and facilities. Former Mossad director David Barnea said agents entered Iran before the June 2025 war and claimed Israel deliberately publicised operations to prompt Iranian authorities into arresting large numbers of uninvolved people, thereby obscuring genuine assets. His account is self-interested and cannot by itself establish the operation’s full scale, but it describes a plausible counterintelligence challenge: Tehran must find trained operatives within a much larger population of citizens who communicate, report events or oppose the government. (aljazeera.com)

That challenge becomes politically consequential when the government defines foreign operations as a comprehensive “hybrid war”. Under that concept, espionage and sabotage sit alongside hostile media, economic pressure, protests and ethnic or sectarian tensions. The framework allows security institutions to treat activities with very different levels of operational significance as components of one campaign.

The result is a widening enforcement perimeter. Traditional espionage involves obtaining protected information or supporting a foreign service. Iran’s reported cases also encompass images sent to overseas media, Starlink use, online statements, contact with organisations designated hostile and criticism interpreted as aiding an enemy. These actions might sometimes expose military positions or support intelligence collection, particularly during active conflict. But the category alone does not demonstrate intent, recruitment or an operational relationship.

This distinction matters because the judicial process offers few public tools for testing it. The judiciary’s figure of 1,895 defendants shows the scale of the caseload, not the strength of the evidence against each person. The 94 media workers within that total are a particularly important test: reporting can reveal sensitive information, but treating professional contact or publication as presumptive collaboration collapses the difference between intelligence activity and newsgathering.

Tehran’s strongest counterargument is that conventional peacetime distinctions are inadequate when foreign services exploit civilian technology, social networks and open-source imagery. A photograph, location report or communications terminal can have tactical value even when supplied by someone without formal intelligence training. Subsequent official announcements of alleged spy-cell arrests reinforce the point that penetration attempts did not end with the earlier wars. (presstv.co.uk)

Yet that argument supports careful investigation rather than undifferentiated repression. Broad arrests can overwhelm investigators with false positives, encourage unreliable denunciations and drive legitimate communications underground. They can also help genuine agents blend into an enormous pool of loosely defined suspects. Iran’s current model therefore contains a strategic contradiction: measures intended to demonstrate control may reduce the state’s ability to separate capable foreign assets from critics, reporters and frightened civilians.