Iris Hautaniemi Forsberg, Elena Alice Rossetti, Francesco Gallina, Victorie Tissine, WATCH/GSOC Team
Jennifer Loy, Chief Editor
Date: June 11, 2024
The Swedish Flag[1]
Introduction
In the first months of 2024, Iran carried out a series of attacks against the Israeli embassy in Stockholm, Sweden, according to the Israeli Institute for Intelligence and Special Operations (Mossad). Mossad accused Iran of using organized criminal gangs in Sweden as a proxy to target Israeli and Jewish establishments, particularly exploiting the gangs Foxtrot and Rumba.[2] This Iranian strategy exploits and develops the growing gang violence in Sweden, coupled with the increasing radicalization and engagement of minors in criminal activities. Beyond threatening public safety, these attacks undermine international stability and highlight the evolution of Iran’s state-sponsored terrorism tactics to leverage local criminal networks and avoid accountability. The transnational nature of the attacks and the crime-terrorism nexus require coordinated responses involving cross-sector collaboration between Swedish security forces, international actors, and local communities to prevent and respond to this evolving scenario.
Summary
On May 30, Mossad released a statement accusing the Iranian government of using organized crime gangs to attack Israeli and Jewish targets in Sweden.[3] A Swedish Security Service (SÄPO) conference confirmed these accusations, stating, “several concrete cases in Sweden in which planned attacks, linked to the Iranian security services, have been thwarted. Some of these attacks have used criminal networks as proxies.”[4] Mossad claims that Iran is linked to at least two attacks against the Israeli embassy in Stockholm in 2024. On January 31, a perpetrator threw a hand grenade over the fence to the Israeli embassy; while the incident did not cause any damage or injury, SÄPO took control of the case from the local police and started a terrorist crime investigation.[5] The second event happened on May 17, when gunshots were fired near the same Israeli embassy.[6] Despite Mossad directly linking the shooting to Iran, Swedish authorities did not perform any arrests in connection to this case and are conducting a serious weapons offense investigation, currently excluding a terrorist trail.[7] SÄPO is investigating two more incidents dealing with aggravated weapons offenses that occurred on May 16 for potential connections to the threats to the embassy. In both cases, the police arrested and then released underage suspects.[8] SÄPO previously mentioned Iran as one of the main threatening countries for Sweden, along with Russia and China.[9]
Violence from organized criminal gangs has affected Sweden in recent years, with approximately 62,000 individuals connected to these networks, according to the Swedish Police Authority. In 2023, 54 deadly shootings occurred, a slight decrease from 2022 (62 cases).[10] However, Justice Minister Gunnar Strömmer underlined that Sweden had nine times more deadly shootings than Norway, Denmark, and Finland together in 2023,[11] and the 2023 number of attacks using explosives was at the highest level ever.[12] Swedish gangs are recruiting underage individuals as young as 12 to carry out attacks while their leaders live abroad.[13] Mossad mentioned two particular gangs sponsored by Iran in their statement, Foxtrot and Rumba, although the Swedish police and SÄPO did not confirm.[14] Foxtrot’s leader Rawa Majid, also called the Kurdish Fox, appears on the International Criminal Police Organization (INTERPOL) Red Notices[15] and resides in Turkey, after becoming a Turkish citizen in 2018. Iranian officials arrested him on the Turkish/Iranian border in October 2023 and released him in the first months of 2024.[16] Mossad states he has started collaborating with Iran during his detention and that his group perpetrated the January 31 hand grenade attack on the Israeli embassy in Stockholm.[17] According to Mossad, Rumba and its leader Ismail Abdo are behind the shooting against the Israeli embassy on May 17.[18] Abdo, a Turkish citizen residing in Turkey, was previously Majid’s closest ally in Foxtrot, but an internal feud erupted between them in 2023 and the group split into two different entities. Turkey does not have an extradition agreement with Sweden and this limits Sweden’s ability to keep the gang leaders accountable.[19]
The Iranian infiltration into foreign crime organizations and gangs is not a recent or isolated phenomenon. Worldwide security agencies have recorded several terrorist threats and assassinations linked to the Middle Eastern state in recent years. In 2021, Swedish authorities discovered that Iran, through its Islamic Revolutionary Guard Corps (IRGC) organization, was behind an Iranian couple who planned to kill Jews in the country.[20] Other Iranian infiltration cases occurred in North America, where, in May 2013, law enforcement arrested and convicted a US-Iranian drug smuggler working for a Mexican cartel for planning the assassination of the Saudi ambassador to the USA. The US authorities proved the IRGC recruited the individual.[21] More recently, US and Canadian authorities found that Iranian intelligence hired members of the bikers’ outlaw group Hells Angels to kill Iranian dissidents in North America.[22] In Europe, Iran has been involved in conspiracies and attacks in the Netherlands, Belgium, France, Denmark, and Germany. In the Netherlands, two Iranian diplomats hired local gangs to murder two Iranian regime dissidents in 2015 and 2017.[23] In 2019, Iranian security forces attempted to assassinate members of the Iranian opposition in Denmark and France. In both cases, the national authorities thwarted the attack.[24] Germany has been the target of two recent plots aimed to attack synagogues and the resident Jewish community, in 2022 and 2023. In 2022, the Iranian authorities recruited through a Hells Angels member a German-Iranian national to launch a Molotov against a Jewish synagogue Bochum. The man ultimately aborted the attack.[25] In 2023, an Iranian member of the German Hells Angels shot at a synagogue in Essen. The German authorities linked the IRGC to this attack. In May 2024, in Brussels, Belgium, two grenades hit the Israeli embassy.[26]
Analysis
Iran’s use of criminal gangs and local networks with a global reach will almost certainly require Swedish security forces to adopt a multifaceted approach. They will very likely need to enhance collaboration and intelligence sharing between national agencies and international partners like Mossad. They will very likely increase oversight through the use of drones around Jewish and Israeli establishments and cyber surveillance to improve the detection and monitoring of suspicious activities. These security measures will almost certainly necessitate allocating additional resources and personnel to counter the evolving threat landscape effectively.
Local gangs and Iran’s terrorist network will very likely enhance their coordination through logistical cooperation, the exchange of resources and expertise, and financial support. The crime-terrorism nexus will very likely complicate the detection and monitoring of suspects, as crime groups and terrorist organizations will likely provide each other mutual protection. The use of Swedish gangs will likely offer Iran plausible deniability, operational benefits, and strategic flexibility as it will exploit their local expertise while avoiding accountability and high operational costs. This collaboration will almost certainly bolster the operational capabilities of both parties, increasing the overall threat level and posing significant challenges to law enforcement and intelligence agencies in Sweden and internationally.
Hostage diplomacy concerns will very likely limit Sweden’s response, as any aggressive measure will likely generate the risk of retaliation against Swedish nationals currently imprisoned in Iran. Their detention will very likely diminish Sweden’s leverage in diplomatic negotiations and policies against Iran. Iranian authorities’ knowledge about these Swedish constraints likely favored the choice of Swedish gangs compared to criminal groups based in different countries. There is a roughly even chance that the idea to use Swedish criminal gangs as a proxy against Israeli and Jewish targets started with the arrest of Majid in Iran. Majid likely planned the January 31 attack against the Israeli embassy from prison, under pressure from Iran’s Intelligence Ministry and the IRGC. Financial support rather than ideological foundations likely motivate these criminal gangs’ involvement, but there is a roughly even chance that Iran proposed a deal to Majid: his freedom in exchange for operations in Sweden.
Iran's links with local gangs very likely increase the gangs' competition and infighting, likely leading to direct clashes and retaliation. Rivals like Foxtrot and Rumba’s members will likely enhance their respective activities to gain Iran's trust and obtain funds or a bigger drug market share. They will likely exploit Iranian resources and expertise, likely enhancing the complexity of attacks and the level of violence. There is a roughly even chance that other local gangs will try to contact Iran or the IRGC directly, likely increasing the danger of hate crimes and attacks against Jewish people and Iranian dissidents. Local low-level criminals attracted by money and power will likely constitute a significant manpower repository, likely enabling Iran to implement plausible deniability, enlarging the potential perpetrators' base, and overloading surveillance systems.
Local groups will likely exploit Iranian contacts and expertise to expand their criminal activities, such as drug dealing, over the border. Iran will likely provide economic support and contacts with international extremist networks like Hezbollah. Hezbollah's international links, for example in the Tri-Border Area (Argentina, Brazil, and Paraguay) in South America, will likely deepen the interdependency between European and international drug dealers. There is a roughly even chance that other local gangs from northern European countries will try to replicate the Swedish scenario, likely contacting Iranian-linked figures to offer their manpower and a local presence in exchange for economic resources or involvement with drug trafficking. Iran's links with European criminal networks very likely enlarge these criminals' power and outreach, likely challenging domestic policies to deter and defect these groups and requiring a multilateral approach.
The gangs' contacts with extremist groups like IRGC or Hezbollah will likely boost their ideological stance, likely spreading Islamist radicalization and antisemitism risks. There is a roughly even chance that young gang members will be more prone to extremist propaganda, likely increasing the risk of making them progress from criminal conduct to terrorist activities. Iran will likely exploit the ongoing Hamas/Israel conflict to instill resentment against Israel and its Western allies, especially among young people of Arab or Palestinian origin. There is a roughly even chance that newly radicalized individuals will commit attacks as lone wolves, likely assaulting not only Jewish communities and Iranian dissidents but also Swedish and Western figures. These radicalized individuals will likely spread extremist ideologies among common criminals, should they serve a prison term.
There is a roughly even chance that these extremist groups or gang criminals, especially the most organized ones, challenge or elude Iranian control. Key criminals have a roughly even chance of using Iranian-linked expertise, financial resources, and contacts for their own interests, hitting targets not aligned with Iranian strategy, such as internal rivals or local police forces. These activities will likely attract unwanted police forces' attention, with a roughly even chance of exposing more direct links between the IRGC and local crime. The loyalties of these actors will likely challenge Iranian strategy in the long term, likely prompting Iran to implement more effective oversight and checks.
Swedish gangs’ multifaceted recruitment strategies, such as encrypted applications and gig jobs, almost certainly require local authorities to implement new protocols and develop a 360-degree approach. Swedish law enforcement will likely devise specific programs to monitor online and in-person recruitment networks and increase cooperation between the Swedish Security Service, the Police Authority, and the National Defence Radio Establishment. Prisons will very likely remain a recruitment area, likely prompting penitentiary police to limit and oversee possible contact points between recruiters and sympathizers. Encrypted applications very likely require up-to-date online resources and trained security forces officials for monitoring, likely eroding police forces' budgets. There is a roughly even chance that police forces’ focusing on these surveillance activities diverts personnel availability from checking different terrorist threats, likely posing a dilemma for Swedish law enforcement.
The recruitment of underage gang members almost certainly restricts Sweden’s ability to tackle the issue as security forces, legal authorities, and Preventing Violent Extremism (PVE) professionals will very likely face operational and evidence challenges. The legal status of minors will likely require security forces to resort to careful and less aggressive engagement strategies. The difference in legal standards for underage individuals will likely complicate their prosecution process, as justice systems often prioritize rehabilitation over the prison sentences of minors. Legal authorities will likely struggle to find evidence as juvenile justice protocols likely hinder and prolong the gathering of admissible information. PVE professionals will likely face identification and monitoring challenges, and the online radicalization of minors will likely be difficult to track, as privacy rights and juvenile legal standards will likely complicate the process.
Recommendations
The recent Iranian activities in collaboration with Swedish criminal gangs indicate an increasing effort to target Israeli and Jewish establishments abroad, following the increasing tensions between Iran and Israel after the October 7 Hamas attack and the ongoing conflict in Gaza. This collaboration will very likely boost operational capabilities for Iran in terms of local knowledge and manpower in Sweden, and for the criminal gangs in terms of financial and material support. The evolving nature of these actors and their operational strategies will very likely increase the overall pressure on the Swedish Police Authority and SÄPO.
The Counterterrorism Group (CTG) recommends the Swedish Police Authority and SÄPO increase cooperation and monitoring activities with neighboring countries, European counterparts, and international partners, such as the European Union Agency for Law Enforcement Cooperation (EUROPOL) and the INTERPOL, to assess the gangs' outreach and devise shared countering policies. They should develop specific information sharing and best practices to limit contacts between local groups and Iran or Iranian proxies, such as Hezbollah.
Local Swedish forces should promote coordination between the police, financial task forces, and antiterrorism units to cut the crime-terrorism network and prevent future antisemitic or terrorist actions. They should implement financial controls and tracking systems to identify and interrupt the movement of funds between Iran and criminal networks in Sweden. The Swedish Police Authority, SÄPO, and Mossad should share gang-related information and investigation findings. Their cooperation should help agencies identify potential extremist members within organized crimes in Sweden and stop antisemitic attacks. They should cooperate to identify criminal gangs at risk of being approached and recruited by Iran, and increase measures to prevent Iran from financially supporting criminal gangs in Sweden.
To tackle criminal gangs’ recruitment at a societal level, CTG recommends the Swedish authorities, in collaboration with local administrations and social organizations, create and enact action plans tailored to address the issue of criminalization in the younger population, for example, crime prevention projects such as Communities that Care (CTC) and Group Violence Intervention (GVI). They should implement a system of positive monitoring and education, ensuring that those growing in challenging conditions receive proper education and mentoring. These plans should allow Swedish law enforcement to receive notice of dangerous tendencies arising in individuals or groups of individuals, and be reactive in their deterrence, mitigation, and elimination.
Sweden should promote cross-sector collaboration to address the challenges linked to underage gang members’ status and radicalization. PVE professionals should establish and strengthen existing preventive measures to address the recruitment of minors through early intervention strategies. They should engage with schools and community centers to educate on the risks of radicalization and provide support for de-radicalization. They should collaborate with local communities and social services by training them on detecting early signs of radicalization. They should establish or reinforce existing protocols for safe information sharing to encourage community leaders, educators, and parents to report suspicious behaviors and activities.
CTG recommends the Swedish Police Authority and SÄPO increase physical security around Israeli and Jewish establishments, such as the Israeli Embassy in Stockholm, synagogues, and Israeli companies around the country. They should engage with Israeli officials and prominent Jewish individuals to establish security routines and directions for all citizens and members within Sweden and enhance physical security for individuals at risk of targeted attacks from Iran. They should also contact Iranian dissidents residing in Sweden who might be at risk of assassination attempts and consider relocating these to safe locations with security procedures in place, such as security details and the ongoing monitoring of potential threats.
Western countries, that Iran might consider enemies, should analyze the Swedish comprehend Iranian strategy and infiltration techniques and assess their vulnerability. They should compare their criminal and extremist landscape with Sweden to see which local groups are more prone to become Iranian’s targets. They should monitor antisemitism, considering anti-Semitic hate crimes are rising in Europe after the 7 October Hamas attack, and check if some outlaw groups sympathize with antisemitic or Islamist ideologies. Counter-terrorism professionals and local forces should study the development of gangs/Iran links to adapt their local preventing and countering extremism and terrorism activities.
[1] Sweden, generated by a third party database
[2] Mossad: Iran-backed criminal networks behind attacks on Israeli embassies in Europe, The Times of Israel, May 2024, https://www.timesofisrael.com/mossad-iran-backed-criminal-networks-behind-attacks-on-israeli-embassies-in-europe/
[3] Ibid
[4] Iran is using criminal networks in Sweden, Säkerhetspolisen, May 2024, https://www.sakerhetspolisen.se/ovriga-sidor/other-languages/english-engelska/press-room/news/news/2024-05-30-iran-is-using-criminal-networks-in-sweden.html
[5] Swedish security agency is investigating an object found at the Israeli Embassy as an act of terror, AP, February 2024, https://apnews.com/article/sweden-israeli-embassy-object-investigation-terrorism-250f2bfcd8736608534b6fbc97eb1978
[6] Mossad: Iran-backed criminal networks behind attacks on Israeli embassies in Europe, The Times of Israel, May 2024, https://www.timesofisrael.com/mossad-iran-backed-criminal-networks-behind-attacks-on-israeli-embassies-in-europe/
[7]Fler attacker kopplade till Israels ambassad utreds, Dagens Nyheter, May 2024, https://www.dn.se/sverige/fler-attacker-kopplade-till-israels-ambassad-utreds/ (Translated by Iris Hautaniemi Forsberg)
[8] Ibid
[9] Ryssland, Kina och Iran, Säkerhetspolisen, 2023, https://sakerhetspolisen.se/om-sakerhetspolisen/publikationer/sakerhetspolisens-arsberattelse/sakerhetspolisen-2023-2024/allvarligt-lage/ryssland-kina-och-iran.html (Translated by Iris Hautaniemi Forsberg)
[10] Skjutningar i Sverige år för år, SVT Nyheter, June 2024, https://www.svt.se/datajournalistik/skjutningar-i-sverige-ar-for-ar/ (Translated by Iris Hautaniemi Forsberg)
[11] Sweden has around 62,000 persons linked to criminal gangs, police say, Reuters, February 2024, https://www.reuters.com/world/europe/sweden-has-around-62000-persons-linked-criminal-gangs-police-say-2024-02-23/
[12] Gängen lejer barnsoldater – ”situationen liknar Liberia”, Dagens Nyheter, October 2023, https://www.dn.se/sverige/gangen-lejer-barnsoldater-situationen-liknar-liberia/ (Translated by Iris Hautaniemi Forsberg)
[13] Ibid
[14] Mossad: Iran-backed criminal networks behind attacks on Israeli embassies in Europe, The Times of Israel, May 2024, https://www.timesofisrael.com/mossad-iran-backed-criminal-networks-behind-attacks-on-israeli-embassies-in-europe/
[15] Interpol Red Notices - MAJID, RAWA, Interpol, https://www.interpol.int/en/How-we-work/Notices/Red-Notices/View-Red-Notices#2020-55671
[16] Kurdiska rävens pappa: Rawa Majid satt fängslad i Iran, SVT Nyheter, May 2024, https://www.svt.se/nyheter/inrikes/kurdiska-ravens-pappa-rawa-majid-satt-fangslad-i-iran (Translated by Iris Hautaniemi Forsberg)
[17] Mossad: Iran-backed criminal networks behind attacks on Israeli embassies in Europe, The Times of Israel, May 2024, https://www.timesofisrael.com/mossad-iran-backed-criminal-networks-behind-attacks-on-israeli-embassies-in-europe/
[18] Ibid
[19] Gängledaren Ismail Abdo gripen, SVT Nyheter, May 2024, https://www.svt.se/nyheter/utrikes/gangledaren-ismail-abdo-gripen (Translated by Iris Hautaniemi Forsberg)
[20]Iran tros ha planerat mord på judar i Sverige – par greps misstänkta för terror, SVT Nyheter, February 2024, https://www.svt.se/nyheter/inrikes/iran-planerade-mord-pa-judar-i-sverige-par-greps-misstankta-for-terror (Translated by Iris Hautaniemi Forsberg)
[21] Iran använder sig av kriminella gäng i fler länder, Dagens Nyheter, June 2024, https://www.dn.se/sverige/iran-anvander-sig-av-kriminella-gang-i-fler-lander/ (Translated by Iris Hautaniemi Forsberg)
[22] Ibid
[23] Ibid
[24] Ibid
[25] Berlin Summons Iran Ambassador Over 2022 Synagogue Plot, Voice of America, March 2024,https://www.voanews.com/a/berlin-summons-iran-ambassador-over-2022-synagogue-plot/7535941.html
[26] Mossad says Iran behind attacks on Israeli targets in Sweden, Belgium, Al-Monitor, May 2024,