A lie was told. A story was heard. From a wave of false claims and real attacks, the lie multiplied fear in the Jewish community — fear not of just another antisemitic attack on the streets of Britain, but of a new and coordinated wave of Iranian-linked Islamist antisemitic terror sweeping Europe. The story heightened distrust of the British Muslim community, many of whom were themselves horrified by the attacks on their Jewish neighbours. And it created a second wave of fear in those Muslim communities as counter-Islam propaganda took hold in the absence of any clear answer from the British government.
We waited. The silence my first article The Silence After the Lie diagnosed did not stay silent. It filled with the Counter-Islam industry doing what it was built to do — accusation, suspicion, and the steady transfer of a manufactured fear poisoning the public bloodstream. It filled with the propaganda outlets and pundits who make their careers from exactly this. It did not fill with clear corrections from the government officials, the Met, the BBC, or the mainstream outlets that ran the original framing.
Nearly two months in, the Metropolitan Police have arrested twenty-six people. Eight have been charged with arson-related offences. One has been convicted of arson. One man was arrested on 26 April on suspicion of preparing terrorist acts — the first terrorism-related arrest in the entire investigation.¹ The investigation that began under the lens of an Iranian-directed Islamic terror campaign has now been reframed by the Met itself as a paid-proxy criminal operation — “violence as a service,” in the words of the senior counter-terrorism coordinator.² But the Iran attribution has not been retracted. The framing has only shifted from Iranian-linked terrorism to Iranian-linked criminality — the same misinformation, the same dubious sources, the same pipeline, with the noun changed and the modifier preserved. The British government has not retracted the Iran link. The BBC has not retracted the framing — it has only softened it, now describing HAYI as a group with possible or suspected links to Iran rather than as a confirmed Iranian-backed group. The legislation Parliament wrote for foreign-state-directed hostile activity is not being used. The original framing has been left in place to do its work.
This article is about the evidence that has accumulated to date — not only in the three weeks since The Silence After the Lie was published, but from the moment HAYI first appeared on the ninth of March 2026. The first article established the pipeline through which the Iran-linked narrative was laundered and reached the British public: the Foundation for Defense of Democracies, the Israeli Ministry of Diaspora Affairs, the International Centre for Counter-Terrorism in The Hague, the BBC. That pipeline is established. This article is about the operational fingerprint of the people who built the HAYI brand. The technical impossibility of the Iranian-handler thesis. The Met’s quiet retreat from terrorism to criminality without any retreat from the Iran attribution itself. And the question the original article could not yet ask — not just who built this, but why, nearly two months in and twenty-six arrests later, no foreign sponsor has been named when the Met’s own most recent comparable case named one within months.³
Both communities are owed clarity. Jewish families in Golders Green were told they were under siege from Iranian-directed Islamic terror. They were not. Muslim families across Britain have been carrying the weight of an attack their communities had no part in and condemn without qualification. The Met, the British government, and the media that ran the original framing owe both communities the same correction, with the same prominence as the original story. They have not yet given it. The investigation was wrong from the beginning. The work of this article is to show what putting it right would actually require. Until it is put right, both communities cannot heal and the public cannot see the true problem.
No Muslim Hands
HAYI claims to be a Shia Islamic militant group. That is the identity the brand asserts in its founding statement. The 9 March announcement, circulated through Iraqi pro-Iranian Telegram channels, declared the start of HAYI’s “military operations against US and Israeli interests around the world.” ⁴ The communiqués that followed framed the campaign as jihad — a sacred religious act in the framework of Islamic militancy — in retaliation for the US-Israeli war on Iran, conducted by a movement aligned with the Axis of Resistance. That is the identity the founding statement asserts. That is the identity the Israeli Ministry of Diaspora Affairs formalised in its 16 March report.⁵ That is the identity the International Centre for Counter-Terrorism amplified on 23 March.⁶ That is the identity the public received.
The evidence disqualifies that identity at every level the operation can be examined — language, theology, vocabulary, source material, soundtrack, and behaviour. None of it requires specialist analysis. Most of it is documented by the institutions whose own reports gave the original framing its credibility. The case is not that the framing was hard to verify. The case is that the framing was contradicted by the materials HAYI itself published, and the institutions that ran with it did not look.
Start with the strongest single point: the founding statement HAYI issued for the Golders Green attack — the document the Israeli Ministry of Diaspora Affairs republished on its own website — opens with a quotation from the Qur’an, Surah At-Tawbah verse 41. The text has been altered.⁷
The Quranic verse reads wa-jāhidū — “and strive” — the imperative form of the verb. HAYI’s version reads wa-jāhadū — past tense, “and they strove.” The vocalisation mark on the letter hāʼ has been moved from below the letter (kasra, short i) to above it (fatḥa, short a). One vowel. The vowel changes the tense, changes the grammatical function, and changes the meaning of the verse.
This is not a hard error to identify. The Arabic text of Surah 9:41 is available on Quran.com, in every printed Qur’an in the world, and in every Islamic-language corpus a translator might consult. Copy-paste produces the correct text. The error appears only when someone composes the line themselves — or asks an AI to compose it — without checking against the received text.
For Muslims, this matters in a way that cannot be overstated and is difficult to convey to a reader who does not share the formation. The Qur’an is considered divinely preserved — God’s words, transmitted through fourteen centuries with the precise vocalisation intact. Altering the text, even in a quotation, even by a single diacritical mark, is theologically unthinkable. It is taught from the moment a child first picks up a Qur’an. A Muslim militant group — any school, any sect, any tradition — does not alter Quranic text in the document that announces its existence. There is no internal religious framework in which the alteration would be permitted, and no operational framework in which it would be allowed to pass.
Whoever composed HAYI’s founding statement did not know this. The implication is binary: either the person had no Muslim religious formation at all, or the statement was generated by AI and published without anyone checking it against the Qur’an. Both possibilities preclude the identity HAYI asserts. A Shia Islamic militant group does not produce its founding statement with the Qur’an misquoted in Arabic on the first line.
And the misquotation is not on a hand-drawn logo or a low-resolution graphic where a letter might be miscopied. It is the body text of a written communiqué, reproduced as an image in the Israeli Ministry of Diaspora Affairs’ own report on the group. The Israeli Ministry of Diaspora Affairs has been republishing the error. They do not note that it has been altered.
The vocabulary the operators chose for the rest of the statement points the same way.
The Golders Green communiqué describes the Machzike Hadath Synagogue as significant because of its connection to “Rabbi Abraham Isaac HaCohen Kook, the first Chief Rabbi of Israel and one of the most influential thinkers of Religious Zionism, who served at this synagogue before immigrating to the Land of Israel.” ⁸ The phrase to mark is “the Land of Israel” — Eretz Yisrael. It is the formulation of Religious Zionism: the theological-political movement founded by Rabbi Kook that frames the modern state of Israel as the realisation of biblical promise. It is the vocabulary of Israeli nationalism and of the settler movement. It is not the vocabulary of any Iranian proxy. It is not the vocabulary of any Shia militant tradition. It is not the vocabulary of any Sunni jihadi movement. Real Islamist groups have a vocabulary for talking about Israel — the Zionist entity, the Occupation, the usurper entity, the Zionist regime. They use it because their ideological framework requires them to deny the legitimacy of the Israeli state in the act of naming it. The Land of Israel concedes the legitimacy in the act of naming. It is the formulation of the side that affirms the state, not the side that opposes it.
The same paragraph contains a second tell. The communiqué describes Machzike Hadath as “one of the important centers of Orthodox Judaism.” The construction is unremarkable to a Western reader who has grown up around Anglo-American Jewish denominational vocabulary — Reform, Conservative, Modern Orthodox, Hasidic, Haredi, the categories that organise diaspora Jewish religious life. To a Muslim militant, this construction is unwritable. The framework that motivates a real Islamist attack on a synagogue does not distinguish denominations. The framework is al-yahud — Jews — or Zionists. A Shia militant communiqué does not specify Orthodox versus Reform any more than anti-shariah propaganda would specify Sunni versus Shia when calling for violence against Muslims. Denomination is theologically irrelevant to the framework. Specifying it is the move of someone inside Jewish religious-political life, fluent in its internal categories — not someone hating Jews from outside it.
The two phrases together are the operators’ fluency, on display in the document that introduced HAYI to the world. “The Land of Israel” is Religious Zionist vocabulary. “Orthodox Judaism” is the language of someone who knows Jewish denominational categories. Neither is something a Muslim militant would write. Both are something a person fluent in Anglo-American Jewish religious-political life would write without thinking. The operators wrote a Muslim extremist communiqué in the wrong vocabulary — vocabulary they evidently knew well enough to use without noticing.
The same paragraph contains a smaller tell that compounds the others. The Machzike Hadath Synagogue is described as “one of the important centers of Orthodox Judaism” — American spelling, not the British centres. The communiqué is announcing an attack on a London target. The American spelling does not, on its own, prove who is sitting at the keyboard. It proves the device the document was composed on. A uniformly American communiqué is not the output of an unconscious bilingual habit slip — that produces a mixed document, with British spellings appearing alongside the American ones. Neither is it the output of a writer working on a British-defaulted machine, whose American keystrokes would be corrected back. And the analysts who have examined HAYI’s materials agree that the Arabic text shows the signatures of machine translation, with the ICCT specifically identifying the second Telegram channel name as “likely resulting from an incorrect English translation.” ⁹ The English text is the input, not the output. Uniform American spelling in the English source requires American-defaulted hardware. The device default does not, on its own, disqualify any operator — Muslim militants working in or near American-defaulted contexts exist. What it does is add another small fact to the picture HAYI’s own materials have already built: a Quranic verse altered in a way no Muslim composes, vocabulary describing Israel and Jews that no Muslim militant uses, and a communiqué for a London target composed on an American-defaulted device. Each of these alone is small. Together they describe an operation built somewhere other than where HAYI says it was built.
The strongest direct test of HAYI’s claimed identity came on the day after the Golders Green attack. CBS News reached the administrator of HAYI’s surviving Telegram channel and exchanged a series of messages with him. The administrator, who referred to himself as Asad-Allah, did three things in the exchange that revealed more than any of HAYI’s published materials. He revealed his working language. He revealed the conceptual framework he reasoned from. And he revealed what he would not answer.¹⁰
The administrator wrote to CBS in American English. Not the English of an Arabic-speaker translating into a second language, with the syntactic markers that betray a non-native speaker. American English. The language of someone for whom American English is the default working language, written without strain and without translation artefacts. CBS noted this directly in their reporting.
The conceptual framework was sharper still. CBS observed that posts on the account had repeatedly referenced Christian and Jewish philosophy to justify the group’s actions, with no mention of Islamic principles or teachings. A Shia Islamic militant group does not justify its attacks through Christian and Jewish philosophy. A Shia Islamic militant group justifies its attacks through the Qur’an, the hadith, the example of the Imams, the Karbala framework, the Khomeinist tradition, the rulings of senior Shia jurists. These are not interchangeable with Christian and Jewish philosophy. They are not equivalent intellectual traditions one might substitute for the other depending on audience. A Shia operative defending an attack reasons from sources internal to the Shia tradition, because that is the framework that makes the attack intelligible to the audience the operative cares about. The administrator of HAYI’s Telegram channel did not. He reasoned from sources outside the tradition the group claims as its own.
The pattern surfaced again, on the record, seven weeks later. On 29 April 2026, HAYI claimed responsibility for a stabbing attack on two Jewish men in Golders Green, in a video circulated through the same Iraqi Shia militia Telegram channels that had carried the founding statement. The video runs forty-one seconds. It contains no attack footage and no imagery from the perpetrator — only static text overlays on the HAYI logo, in English on the left and Arabic on the right. The operative phrase reads: "Historically, the Jews are the killers of Jesus Christ, and today the Zionists are the killers of innocent women and children."⁴⁵ This is deicide — the Christian theological accusation that the Jews collectively killed Christ, formally repudiated by the Catholic Church in Nostra Aetate in 1965. It is not an Islamic doctrine. The Qur'an explicitly denies that Jesus was crucified at all. Surah An-Nisa 4:157 reads: "And they did not kill him, nor did they crucify him; but [another] was made to resemble him to them." The classical Islamic position, held across Sunni and Shia traditions for fourteen hundred years, is that Jesus was raised by God and another was substituted on the cross. No Muslim militant group invoking jihad against Jews could coherently use the deicide accusation, because doing so requires the speaker to affirm a crucifixion their own scripture denies. The video then compounds the incoherence. It praises "the followers of Jesus Christ (peace be upon him)" — Christians — for "participating in the operation." A supposedly Shia Islamic militant group is praising Christians, invoking deicide against Jews, as theological warrant for jihad. That position does not exist inside any actual Islamic militant tradition. It retroactively claims an alleged American attempted-assassin of US President Trump, named in the video as Cole Thomas Allen, as one of HAYI's own — and calls on "all free people" to kill Trump as well. What CBS observed in the administrator's private messages on 24 March — reasoning from Christian and Jewish philosophy rather than Islamic sources — has now appeared in HAYI's own published claim communiqué on 29 April, expanded into a fully Christian-framed call to action. The operators are not improvising one-off rhetorical errors. They are operating from inside Christian and Jewish theological frameworks, reaching for the most familiar piece of historical anti-Jewish vocabulary they have, and the one they reach for is Christian, not Islamic.
When CBS asked about the group’s structure and whether anyone was being paid, the administrator deleted the account.
That deletion is the moment the cover failed under direct questioning. The other tells in this section are tells of composition — what the operators wrote, in which language, with which vocabulary. The deletion is a tell of behaviour. Asked the operational question that any real militant group could answer with practiced rhetoric — we are a network of believers, we accept no payment, our cause is justice — the administrator chose silence and disappearance over even a propaganda answer. A real Shia operative would have welcomed the question as an opportunity to declaim. The HAYI administrator walked away.
CBS quoted Lucas Webber, a senior threat intelligence analyst at Tech Against Terrorism, on the day of the attack: HAYI looks “less like a grassroots European cell that came out of nowhere and more like an astroturfed terror brand that has appeared suddenly in online ecosystems.” ¹¹ That phrase — astroturfed terror brand — is the technical term for what the operational fingerprint describes. The branding is real; the grass roots are manufactured. A Tech Against Terrorism analyst, on the day the pipeline was preparing to deliver the Iran-link framing to the public, told CBS what HAYI looked like to a specialist examining it. The framing the pipeline carried the next day did not absorb that finding.
The pipeline’s research-body stage — the International Centre for Counter-Terrorism in The Hague — examined the same materials and produced findings the rest of the pipeline would carry forward. The ICCT report, published on the day of the Golders Green attack and titled Hybrid Threat Signals: Assessing Possible Iranian Involvement in Recent Attacks in Europe, contained the linguistic and visual analysis that mainstream outlets would cite the next day as institutional cover for the framing the IMDA’s earlier report had built. Read carefully, the ICCT’s own findings undermine the framing the report’s headline endorsed.
The ICCT’s central paragraph on HAYI’s authenticity, in the institute’s own words: “Doubts regarding the authenticity of HAYI are, however, not only raised by the appearance of its Telegram channel and the likely falsely claimed attack in Greece, but also by inconsistencies within the claim material itself. For example, the videos contain noticeable linguistic errors. Further, the Arabic inscription beneath the group’s logo, which closely resembles the flag of Hezbollah and other pro-Axis groups, except for featuring a Soviet SVD sniper rifle instead of the more typical AK-style imagery, includes multiple mistakes, including the misspelling of the word ‘Islamic.’” ¹²
Three findings in one passage, every one of them the ICCT’s own analysis.
The first: the videos contain noticeable linguistic errors. Plural. In the videos themselves — not just on a static logo. A supposedly Iranian-aligned Shia militant group whose own video output contains noticeable linguistic errors in the language it claims as its own.
The second: the logo is a near-clone of Hezbollah’s flag and the flags of other pro-Axis groups — except for one substitution. The AK-style rifle that appears in every actual pro-Iranian Shia militia’s iconography has been replaced with a Soviet Dragunov SVD. The Iranian-Iraqi-Lebanese militia ecosystem runs on Iranian-supplied or Iranian-copied AK-pattern rifles. The Kalashnikov silhouette is the universal symbol of every actual pro-Iranian Shia militia from Lebanon to Yemen.¹³ The Dragunov SVD is a Soviet-era designated-marksman rifle associated with Russian and Russian-aligned forces. For a supposedly Iranian-aligned proxy to brand itself with an SVD rather than an AK is the visual equivalent of an American militia branding itself with a British SA80 instead of an M16. It is the kind of detail that would never appear on real branding. It is the kind of detail you get when somebody reaches for generic menacing rifle rather than the appropriate symbol for the milieu being imitated.
The third: the Arabic inscription beneath the logo includes multiple misspellings, and the ICCT specifies one of them — the word Islamic. The error matters at the level of the vowel. As with the altered wa-jāhidū in the founding statement, the position of a single diacritical mark changes the word. The Arabic for Islamic — الإسلامية (Islamiyya)— requires a small symbol called a hamza placed beneath the initial alif: إ. The hamza signals the short vowel i — which is what makes the word read Islām. Move the hamza above the alif and the vowel becomes a, producing Aslām — not a word in Arabic. The position of the hamza is not decorative. It is taught in the first weeks of Arabic literacy and reproduced correctly by every Muslim child who learns to read the Qur'an. A supposedly Islamic militant group cannot spell Islamic in Arabic on its own logo. The institution whose research-body credibility the pipeline relied on for institutional cover, when it actually read the Arabic on HAYI's own branding, found multiple errors — including this one.
The ICCT’s report contains a fourth, separate finding on a piece of material the institute analysed in addition to the logo. The second HAYI Telegram channel — created on 21 March 2026, two days before the Golders Green attack, with a QR code in the claim video pointing directly to it — is also identified as inconsistent. The ICCT’s words: “there are also a number of inconsistencies with this account, foremost the misspelling of the Arabic channel name, likely resulting from an incorrect English translation.” ⁹
Read that carefully. A Telegram channel name is not a hand-drawn graphic where a letter might be miscopied. It is text typed into a box, with the option to correct it before publication. The ICCT’s specific characterisation — “likely resulting from an incorrect English translation” — is the institute identifying English as the source language for the channel name. Someone composed the name in English first and translated it into Arabic. The Arabic came out wrong. They published it anyway. A real Arabic-speaking group names itself in Arabic first and transliterates into English for foreign audiences. The direction documented here is the reverse — the signature of a non-native creator working from an English original.
These are real findings, and they are the findings of the institution whose research-body credibility the pipeline relied on for institutional cover. They are, in their own way, evidence that no Arabic speaker built HAYI’s brand. The altered Quranic verse in HAYI’s founding statement is not among them — the foundational error that requires Quranic literacy to identify is absent from the ICCT’s report.
But the more important analytical move the ICCT made is what it did with the inconsistencies it did identify. Julian Lanchès did not stop at the inconsistencies. He absorbed them into the Iranian-backed thesis. The misspelled Arabic, the SVD substitution, the dubiously authentic Telegram accounts, the falsely claimed attacks in Greece — all of it, in the ICCT’s reading, became evidence of a plausible-deniability layer on top of Iranian state backing. The argument runs: HAYI’s amateurism is too sloppy for Iranian intelligence operatives to have produced directly, but consistent with Iran outsourcing the operation to locally recruited disposable proxies on the Russian sabotage model. The inconsistencies, in this reading, are not evidence against Iranian involvement. They are evidence of Iranian involvement at one operational remove.
That move is the analytical decision the ICCT did not justify. The inconsistencies are consistent with Iranian backing via disposable proxies. They are also consistent with an operation that has nothing to do with Iran and is using Iranian-aligned distribution channels as cover. The same evidence supports both readings equally. The choice of which reading to fit the evidence to is the analytical move that determines the conclusion — and the ICCT’s reasoning for choosing the Iranian-backed reading rests on the dissemination through Iraqi militia channels, which is exactly the inference our analysis is contesting. Distribution is not origin. Channel administration can be genuine, persuaded, paid, infiltrated, or shared. The ICCT treated the dissemination network as evidence of origin, which allowed it to read the inconsistencies as plausible-deniability tactics rather than as evidence of fabrication. With a different starting assumption, the same inconsistencies become the fingerprint of an operation that is not what it claims to be.
The ICCT laundered the framing forward. Lanchès identified the inconsistencies and absorbed them into a thesis that the rest of the evidence — the altered Qur’an, the American English administrator, the Christian and Jewish philosophical reasoning, the no-Persian — does not support. He did not interrogate the upstream evidentiary base the IMDA had built. He did not test alternative readings. He published a report he knew or should have known would be picked up by mainstream outlets as institutional confirmation. The pickup happened the next day. The framing the public received rested on an analytical move the pipeline’s research-body stage made without justifying it, on a foundation the pipeline’s state-authoritative stage had built without disclosing what its evidence actually contained.
The institutional failure to identify HAYI’s source-language problem was not because the evidence was hidden. The evidence was published, by named specialists, in mainstream outlets, within days of the Golders Green attack. Two separate institutional sources, working independently, reached the same conclusion: HAYI’s materials were AI-generated.
The first was Aymenn Jawad al-Tamimi, examining HAYI’s multi-language communiqué for Middle East Eye. Al-Tamimi is one of the more credentialled subject-matter specialists on jihadist propaganda working in the open-source space. He holds a BA in Classics and Oriental Studies from Brasenose College, Oxford, and a PhD from Swansea University on the role of historical narratives in Islamic State propaganda — for which he received Swansea’s James Callaghan Thesis Prize for best doctoral thesis in 2024–25. He has been cited as expert by The New York Times, The Wall Street Journal, The Washington Post, AFP, and the Associated Press. His professional affiliations include the Middle East Forum, the Hoover Institution, the Washington Institute for Near East Policy, and — relevantly — the ICCT itself.¹⁴ He is not a marginal figure. His finding on HAYI was published in mainstream English-language media on 24 March 2026.
Al-Tamimi’s reading of HAYI’s multi-language statement: “I think there was an initial AI prompt to give an answer in one of the three languages and then it was machine translated into the other two.” The same article reported that two separate AI-detection tools run by Middle East Eye gave the statement a “high likelihood of having been AI-generated.” ¹⁵
The second source was Adam Hadley, founder and CEO of Tech Against Terrorism, a UN-backed counter-extremism initiative. Hadley told The National that HAYI’s materials had been “generated using ChatGPT or similar,” describing HAYI as “probably the first AI-led terrorist movement.” ¹⁶ Two named institutional voices, working in different organisations, reaching the same conclusion. Both findings were on the public record before the pipeline’s framing reached its second day in the public mind.
A real Iranian-aligned Shia militant group does not produce its founding communiqué through ChatGPT. The IRGC has its own media apparatus. Hezbollah has its own media apparatus. Asaib Ahl al-Haq has its own media apparatus. These organisations have spent decades building production capability in Arabic, in Persian, in the visual and rhetorical idioms of their tradition.¹⁷ They do not need a machine-translation tool to write a claim of responsibility, and if they did, the document they produced would not be the document HAYI produced. The signatures the analysts identified — uneven multi-language output, machine-translation artefacts, ChatGPT-style phrasing — are signatures of an operation that had no in-house Arabic capability and substituted a commercial AI tool for the apparatus a real militant group spends years building.
That substitution is itself a finding. It tells you what the operators had and what they did not. They had access to AI tools, an English-fluent author, and the visual symbology of Iranian-aligned militancy at the level you can absorb from photographs. They did not have a native Arabic speaker, a Persian speaker, a Shia jurisprudential reasoner, or anyone with Muslim religious formation deep enough to catch a Quranic vowel. The gap between what the operators had and what a real Iranian-aligned Shia militant group has is the gap between an astroturfed terror brand and a real one — to use Lucas Webber’s phrase.
The way real institutional jihadist groups produce claims of responsibility is documented. Counter-terrorism analysts who track this material — the SITE Intelligence Group’s Rita Katz, The Long War Journal‘s Tom Joscelyn, others — have written extensively about how the architecture works.¹⁸ The Islamic State runs claim production through the Amaq News Agency, a semi-autonomous wire service inside the group’s Central Media Diwan. Provincial bureaus submit raw footage and event details. Central oversight enforces messaging protocols. The system was built over years of institutional investment. When the group is directly involved in an attack, the claim typically appears within twenty-four hours, includes specific details about the attacker, and is corroborated through the group’s verified-direct channel — for ISIS, the Nashir Media Foundation. When the group is not directly involved and is claiming opportunistically, the claim takes longer, lacks attacker details, and tends to appear only on the Amaq-equivalent broad-distribution layer.
The pattern is institutional. It rests on years of media-production capacity, dedicated personnel, established templates, encrypted distribution architecture, and chains of editorial review. Hezbollah operates al-Manar television and the Mayadeen network. Asaib Ahl al-Haq operates Sabereen News. The IRGC operates its own state media apparatus. These are not infrastructures that can be assembled in days. They are the products of decades of investment by movements with stable identities, recognised leadership, internal hierarchies, and institutional histories that the analyst community has been documenting for years.¹⁹
HAYI, on the public record, did not exist before 9 March 2026. There are no known references to the group online or offline before that date — the ICCT confirmed this in its own report. On 9 March, a Telegram channel affiliated with the Iraqi pro-Iranian militia Liwa Zulfiqar circulated a HAYI announcement of “the start of its military operations against US and Israeli interests around the world.” On 11 March, two days after the Liège attack, the first claim video appeared. By Rotterdam on 13 March, the production workflow had compressed to thirty-nine minutes from attack to branded video on Iraqi Telegram channels. For the Amsterdam Jewish school attack on 16 March, the ICCT’s own timestamps showed a Telegram mention apparently preceding the attack itself by one minute — almost certainly clock drift or time-zone formatting, but the institute flagged it as an anomaly. By the Golders Green attack on 23 March, two weeks after HAYI first appeared online, the brand was producing claim videos with embedded Google Maps street views, photographs of the targeted ambulances, and biographical research on Rabbi Abraham Isaac HaCohen Kook to justify the primary target selection.²⁰
The technical production of a one-to-two minute branded video is fast. A competent editor with a pre-built template can assemble one in under an hour from supplied footage. That is not the analytical question. The analytical question is whether the institutional architecture HAYI’s materials demonstrate — distribution channels with hundreds of thousands of pre-arranged followers in the pro-Iranian Iraqi Telegram ecosystem, branding templates ready to deploy, the cultural-fluency layer that produces Religious Zionist vocabulary and Anglo-American Jewish religious-political reasoning, the multi-language statement-assembly capacity, the persona of a Shia militant group — could have been built between 9 March, when HAYI first appeared online, and the production of the first claim videos. The answer is no. The dissemination network pre-existed HAYI; the ICCT documented that the first HAYI Telegram channel was registered in 2023, two years before activation. The branding was prepared before the campaign began, applied consistently to incoming footage from 11 March onward. The cultural fluencies the materials demonstrate are not built in days. What appeared in fourteen days was the activation of pre-existing infrastructure plus the application of pre-prepared branding to attack footage. Which means the architecture was built before HAYI publicly existed. The group is either the cover for an operation that already had the apparatus in place, or the brand layer on top of someone else’s.
The same gap shows up in the soundtrack of HAYI’s videos. Sharon Adarlo, a conflict analyst writing for Militant Wire and quoted by CBS on the day after the Golders Green attack, noted that HAYI’s videos used orchestral music rather than the Islamic nasheeds commonly used as soundtracks on jihadist propaganda.²¹ Nasheeds — vocal religious chants, traditionally performed without instruments, drawing on a musical tradition rooted in the recitation of Qur’anic and devotional Arabic — are the standard soundtrack convention of Sunni and Shia jihadist media production. ISIS produces nasheeds through its Ajnad Foundation. Hezbollah produces nasheeds through its media wing. Real Islamist propaganda uses them because they are the genre Islamist audiences expect, the genre that signals religious seriousness, and — for many Salafi-jihadi traditions specifically — the only musical form considered religiously permissible. Instrumental music is theologically contested in Islamist circles, with significant traditions holding it impermissible.
HAYI used orchestral music. Western orchestral music, with strings and horns and the sweeping cinematic feel of film scoring. A choice that signals nothing to a jihadi audience and everything to a Western one — the soundtrack convention of action films and political thrillers, not of Islamist religious media. The choice is small. It is also revealing. The operators reached for what menacing sounds like in their own cultural vocabulary — the language of Western cinema — rather than for what menacing sounds like in the tradition HAYI claims as its own. Once again, the operators were fluent in something they should not have been, and unfluent in something they should have been.
The point is not that Iran cannot produce Western-cultural propaganda. It can, and it does. Since the start of the US-Israeli war on Iran, Iran-based outlets — including Explosive Media, which has acknowledged to the BBC that the Iranian government is a customer — have produced an entire genre of AI-generated, LEGO-style animated videos using English-language hip-hop to mock Trump and reframe the war for Western audiences. Al Jazeera, MS NOW, and the BBC have documented the genre.²²
But these are different production tasks for different audiences. Iran’s LEGO videos are propaganda — outward-facing, made for Western non-Muslim audiences, aimed at winning narrative ground in the Western information space. The conventions of that task are hip-hop, LEGO animation, English-language lyrics, cultural reference points Westerners recognise. The form matches the function. HAYI’s videos are not making that kind of communication. HAYI’s videos claim to be internal Shia militant claims of responsibility for attacks framed as jihad — a sacred religious act, in the framework of Islamic militancy, declared to a Muslim audience inside the in-group conventions of the Axis of Resistance. That production task uses nasheeds. It uses Quranic recitation. It uses the visual idiom of Hezbollah and the IRGC. The conventions are solemn, religious, inward-facing — because the task is religious and inward-facing. Iran’s LEGO videos do not use nasheeds because LEGO videos for Western audiences are not religious communications. HAYI’s videos claim to be religious communications. They use orchestral music. The form does not match what HAYI claims to be.
There is one more language fact that closes the case for this section, and it is the language HAYI has not produced.
In nearly two months since HAYI announced itself, the group has issued statements and videos in English, Arabic, and Hebrew. It has not produced one word of Persian. CBS News reported the absence on the day after the Golders Green attack, and RFE/RL reported it again three weeks later. The Persian language has been entirely missing from HAYI’s output across the entire campaign.²³
This absence is not a small detail. Persian is the operational and ideological centre of gravity of the Iranian state and the network of proxies the pipeline’s framing places HAYI inside. The IRGC operates in Persian. Iranian state media operates in Persian. Khamenei’s communications are in Persian. The Iranian-language audiences that pro-Iranian militant groups care about read and listen in Persian. When Hezbollah wants to signal alignment with Iran, it produces Persian-language material alongside its Arabic. When Asaib Ahl al-Haq communicates with its Iranian sponsors, it does so in Persian. When the Houthis broadcast solidarity with Iran, Persian appears in the output. Real pro-Iranian militant groups produce Persian material as a matter of course. It is the language of the audience that matters to them.²⁴
A supposedly Iranian-linked Shia militant group that has never produced one word of Persian is not what it claims to be. The absence is structural. It is not the kind of gap a real Iranian proxy would have. It is, however, exactly the kind of gap an operation built by people whose source languages are English and Hebrew — and whose Arabic is produced by machine translation — would have. The languages HAYI does use are the three languages someone reading Western and Israeli media would default to. The language HAYI does not use is the one a real Iranian proxy could not afford to be without.
The synthesis is straightforward. The Qur’an in HAYI’s founding statement is altered. The vocabulary describes Israel and Jews in terms no Muslim militant uses. The English text was composed on American-defaulted hardware. The Telegram administrator wrote to CBS in American English, reasoned from Christian and Jewish philosophy, and deleted the account when asked who was paying. The ICCT found the logo Arabic misspelled, the iconography wrong, the second channel name machine-translated from English. Middle East Eye and Tech Against Terrorism found the materials AI-generated. The soundtrack does not match the production task HAYI claims to be performing. And the language a real Iranian proxy must produce is the one language HAYI has never produced.
There is a pattern in the operational fingerprint that has to be named. The errors HAYI’s materials contain are not the errors of a real organisation that has slipped on minor details. They are the errors of an operation built to be recognised as something it is not. The mistakes follow a consistent grammar — they are the mistakes of someone filling in a checklist of what Western analysts expect Iranian-aligned militancy to look like, without the deep knowledge of the tradition required to fill the checklist correctly.
Consider three of the findings already established. The Dragunov on the logo. Western analysts looking at Iranian-aligned militia branding have a mental model for what they expect to see — weapon imagery, raised fist, Arabic calligraphy, a flag-style composition. The HAYI logo has all of that. The general checklist is filled. What is wrong is the specific weapon. The Kalashnikov silhouette is the universal symbol of every actual pro-Iranian Shia militia from Lebanon to Yemen. The Dragunov is not. The error is not the absence of weapon imagery. It is weapon imagery filled in by somebody who knew the genre required a rifle and did not know which rifle.
The routing through Iraqi militia Telegram channels. Western analysts watch the Iraqi pro-Iranian militia ecosystem because that is where Iranian-aligned content normally appears. Asaib Ahl al-Haq, Liwa Zulfiqar, the Sabereen aggregator — these are the channels Western OSINT specialists already monitor. Content posted on those channels is content already pre-flagged for attribution. A real Iranian operation is not optimising its content placement for Western analyst detection — it has its own audience, internal to the Iranian-aligned ecosystem, that the placement is for. Content placed on exactly the channels Western analysts watch, in the sequence Western analysts would expect, is content placed for Western analyst consumption.
And the third instance, which appears in the post-Golders Green operational record. On 15 April 2026, an incendiary device was thrown into the car park of Iran International’s offices in Wembley — the most prominent Persian-language broadcaster critical of the Iranian regime, based in London. HAYI claimed responsibility. Three young men were arrested after a police chase: Oisin McGuinness, twenty-one, and Nathan Dunn, nineteen, both from Watford, and a sixteen-year-old. None of the three fits any ideological profile of pro-Iranian militancy. The device was thrown into a car park and went out on its own. The Met has stated it is not treating the incident as terrorism. Iran International has been a documented IRGC target on British soil for years — the UK’s own counter-terrorism leadership has flagged repeated Iranian state plots against the broadcaster, and the operational tradecraft of those plots involves contractors with surveillance teams and proper preparation, not teenagers throwing burning containers into car parks.²⁵
The point is not that Iran could not target Iran International. Iran has targeted Iran International, repeatedly, with the kind of professional tradecraft the documented record describes. The point is that an operation building a fictitious Iranian-aligned militant brand from scratch would, on any reasonable construction of the design problem, include an Iran International–style target on the list of attacks. Western analysts looking for Iranian-state activity in Europe have a known pattern: Iranian operations sometimes target Iran International. If the operation is being built to be read as Iranian-aligned, the target list has to include the targets a real Iranian operation would attack. Not including one would be the gap in the checklist that gives the brand away. Including one is the checkbox filled.
Three instances, the same logic. The Dragunov is the wrong rifle, but it is a rifle, because the genre requires one. The Iraqi channels are the right channels for distribution, because Western analysts watch them — but a real Iranian operation does not need to optimise for Western detection. The Iran International attack is the right kind of target for an Iranian-aligned brand, but the operational signature of the attackers is wrong for an actual IRGC operation against that target. In each case, the signature visible to Western analysts has been populated. The depth of execution beneath the signature is not what a real operation in that tradition would produce.
The operators are not necessarily inside any of the traditions whose imagery they are deploying. They are people who know what Iranian operations are supposed to look like to Western analysts, and they are giving the analysts what those analysts expect to see.
No Muslim hands on the production. Not in the Qur’an, not in the vocabulary, not in the source language of the Arabic, not in the conceptual framework of the administrator, not in the iconography, not in the soundtrack, not in the languages chosen, and not in the language conspicuously avoided. The fingerprint of the operators is the fingerprint of people fluent in Anglo-American Jewish religious-political life and in Western media production — and unfluent in Arabic, in the Qur’an, in Persian, in Shia jurisprudence, in the iconography of real Iranian-aligned militias, in the soundtrack conventions of jihadist media, and in the vocabulary Muslim militants actually use to describe Israel and Jews. That fingerprint is not the fingerprint of a Shia Islamic militant group. It is the fingerprint the original article’s conclusions already pointed toward. The new evidence is consistent with what The Silence After the Lie identified. It is not consistent with anything else.
The Handler That Could Not Be in Iran
The Iranian-handler thesis the pipeline carried required a particular workflow to be running, in real time, from somewhere. The ICCT’s own report described it: “the close proximity of these channels to Iranian-aligned networks, combined with the near-immediate reporting and access to attack footage, suggests that they were informed of the incidents almost in real time, either directly by the perpetrators or via intermediaries.” ²⁶ That sentence describes a coordinator. Someone receiving mobile-phone footage from teenagers in Belgium and the Netherlands within minutes of attacks. Someone applying branded templates to that footage, producing edited claim videos, and pushing them through pre-arranged Telegram channels with hundreds of thousands of followers — fast enough to land branded content within thirty-nine minutes of an attack at four in the morning. A real-time editorial desk, with reliable two-way connectivity into European Telegram infrastructure, working through the night.
The framing the pipeline carried assumed this desk was Iranian, or directed by Iran. That is what Iranian-linked meant by the time it reached the British public. Either the IRGC was running the desk directly, or it was running through proxies it had directed and equipped. Either way, the operational coordination — the editorial work of receiving, branding, and distributing the material — was placed within the Iranian operational orbit. That placement is what allowed the framing to characterise the attacks as Iranian-backed. Without it, the framing has nothing to attach to.
This section examines whether that desk could have been running from inside Iran during the period in question. The answer, on the public record, is that it could not.
On 28 February 2026, following the US-Israeli strikes on Iran, the Iranian government cut its country off from the global internet. NetBlocks, the network observatory that monitors connectivity disruptions worldwide, reported Iran’s internet connectivity dropping to roughly four per cent of ordinary levels within hours of the strikes. Cloudflare Radar described the traffic that day as “close to zero across all major regions.” Through March, the connectivity held at one to two per cent of pre-war levels — a near-total state-imposed blackout, sustained day after day, while the HAYI campaign was running.²⁷
By 21 April 2026, NetBlocks had recorded fifty-three consecutive days of disruption — the longest nationwide internet blackout ever recorded in any country. Iran is, NetBlocks noted, “the first country to have had internet connectivity and then subsequently lost it by reverting to a national network.” ²⁸ Not Russia during the invasion of Ukraine. Not Israel during the war on Gaza. No conflict, in the history of measured connectivity, had produced anything comparable. The Iranian government had imposed on its own population a deeper and longer informational lockdown than any other state had attempted.
The blackout was not a passive failure. The Iranian government built a whitelist. Ordinary Iranians, private businesses, and most of the country’s economy were offline. Connectivity was granted only to those the state had specifically approved — officials, state-affiliated media, security-cleared entities. Government spokeswoman Fatemeh Mohajerani stated that the state was permitting access only to those who could “get the voice out” — meaning those approved to broadcast on the state’s behalf. Whitelist applications were routed through the state-run Bale messaging app, registered with state telecoms. Every approved connection passed through the state’s gateway. Every packet was logged at the state level.²⁹
This is the connectivity environment the Iranian-handler thesis requires the editorial desk to have been running through. From inside Iran, during the period of the blackout, the desk would have needed reliable, low-latency, two-way connectivity into European Telegram infrastructure — receiving mobile-phone footage from teenagers in Belgium and the Netherlands, applying branded templates, pushing edited videos out to pre-arranged Iraqi militia channels, in some cases within thirty-nine minutes of an attack. That workflow requires bandwidth, speed, and operational privacy. The state-whitelist environment offered none of those things to anyone the state had not specifically approved. Every outgoing packet would have passed through the state gateway, logged and visible to the state security apparatus that had imposed the blackout precisely to prevent unmonitored outbound traffic.
Could the Iranian state itself have run the desk from inside the whitelist environment? The technical answer is yes. The operational answer is that doing so would mean direct state sponsorship of rapid-tempo European attack coordination at the exact moment the state was imposing the blackout to prevent that kind of outbound traffic. It would mean every editorial decision passing through the state’s logged gateway, with no plausible deniability, at the moment the state was demonstrably terrified enough of outbound information leakage to cut its entire population off the global internet. That is the opposite of how hybrid warfare operations are run. The architecture of plausible deniability requires distance between the state and the operation. The Iranian government, during the blackout, could not have given itself less distance from the operation if it had tried.
There is a further fact in the public record that complicates the Iranian-handler thesis from a different direction.
Within forty-six minutes of the Golders Green attack, scene footage of the burning ambulances was on a US-based news aggregator account with around a million followers, registered location Nashville, Tennessee. The post — at 02:21 AM London time — announced that the account had also “seen footage of the attackers” but did not yet publish it. Forty-nine minutes after that, at 03:10 AM, the same account published surveillance footage from the Machzike Hadath Synagogue’s own CCTV system. The footage shows the synagogue’s car park at the moment of the attack, with at least one Hatzola ambulance visible in the frame, bearing a visible in-frame timestamp of 01:36:06 on 23 March 2026 and a camera label reading “Front RHS” — consistent with one camera in the synagogue’s own multi-camera installation. By later that day, the same or related footage had appeared on Sky News, the Jerusalem Post, IBTimes UK, London Now, the National Pulse, Townhall, and the Jewish Edition. The Metropolitan Police’s senior officer on the case, Superintendent Sarah Jackson, said: “We are in the process of examining CCTV and are aware of online footage.” The Met was still examining the footage. Other parties had already published it.³⁰
The ICCT’s own description of the editorial workflow it was studying noted that the channels it identified were “informed of the incidents almost in real time, either directly by the perpetrators or via intermediaries.” The CCTV that appeared on Breaking911 documents the same phenomenon for a different set of intermediaries — people watching the attack location’s information environment closely enough, and connected to global media reliably enough, that internal synagogue surveillance footage was in the hands of a US-based aggregator within forty-six minutes of capture and on its public-facing account by 03:10 AM London time, with broadcast media following within hours. There was a someone. The someone was real. The someone moved fast.
How the footage moved between capture and global publication is not something this article can establish. The Met has not stated. The synagogue has not stated. No party has publicly described the path. What the article can say is what the path was not. The Machzike Hadath Synagogue’s CCTV system is not accessible to the Iranian state. It is not accessible to the IRGC. It is not accessible to Iranian-aligned proxies in Iraq or Lebanon. Whatever path the footage took into Anglosphere media within the first hour of the attack, that path did not run through Iran, and it did not require Iranian state involvement. The investigative question of who routed the footage and through what mechanism is a question for the institutions whose responsibility it is to investigate.
That has implications for the Iranian-handler thesis the pipeline carried. The thesis required real-time editorial coordination from somewhere — receiving footage, branding it, pushing it out fast. The thesis implied the somewhere was Iran or Iranian-directed. But the underlying material — the synagogue’s own surveillance of the attack — was already in Anglosphere media before HAYI’s branded claim video existed. The HAYI editorial desk that produced the branded claim video four hours later did not need to be in Iran to obtain attack footage. The footage was already moving through the open information environment, in the languages and on the platforms HAYI’s operators were demonstrably fluent in. Whatever the answer to the investigative question turns out to be, it is not the one the pipeline carried.
The clearest documented example of the editorial workflow the framing required is in the ICCT’s own report. The Rotterdam synagogue arson on 13 March 2026 occurred at approximately 03:40 AM. The first text mention of the attack on the four pro-Iranian Telegram channels the ICCT was studying was published at 03:57 AM — seventeen minutes later. The corresponding HAYI claim video, branded with the group’s logo and tagged with the date and location of the incident, was released at approximately 04:19 AM. From the moment the attack occurred to the moment a branded HAYI video was on a Shia militia Telegram channel, thirty-nine minutes had passed. The ICCT documented the timing in the body of its report.³¹
That is the workflow window the Iranian-handler thesis must explain. Attack at 03:40. First report at 03:57. Branded video at 04:19. Inside that window: someone received mobile-phone footage of the attack from teenagers in Rotterdam, applied the HAYI logo and the tagging template, and pushed the finished video to pre-arranged Iraqi militia Telegram channels. That is editorial work. It requires receiving raw material, processing it, and distributing the finished product. It cannot be done by someone passively watching a feed. It requires a desk.
The ICCT framed this workflow as evidence of Iranian backing — as material flowing from the perpetrators’ side, through Iranian-aligned coordination, into the amplification network. That framing is what the pipeline’s distribution stage carried to the public the next day. It is also the framing the analysis in this section is contesting on three grounds. The connectivity environment inside Iran during the period in question would not have supported the workflow. The underlying attack footage in the case of Golders Green was already moving through Anglosphere media before the HAYI claim video existed. And the same logic applies to Rotterdam: the footage of an arson attack at a synagogue in the early hours of a Friday morning is not material that could only have reached an editorial desk through Iranian intelligence channels. The phone footage of the perpetrators was on the perpetrators’ own phones, on whatever networks they used to share it, and the desk that produced the HAYI video needed only access to those networks — not to Iran.
That access raises the structural question section two has been working toward. If the desk does not have to be in Iran, where could it have been?
The logical possibilities are finite. The first is inside Iran, on the state whitelist, operating with explicit state approval and through the state’s logged gateway. The connectivity case has already been made. This possibility requires the Iranian state to be running the operation directly, with full visibility, at the moment the state was demonstrably terrified enough of outbound information leakage to cut its entire population off the global internet. It would mean the IRGC or its equivalent commanding the editorial desk through the state’s own monitored network, with no plausible deniability and no operational distance. It is the opposite of how hybrid warfare runs. It can be ruled out on operational grounds even though the technical possibility exists.
The second is through the Iraqi Telegram channels the ICCT documented as the dissemination network. Asaib Ahl al-Haq, Liwa Zulfiqar, the Sabereen aggregator channel, and others within the broader Iraqi Telegram ecosystem the ICCT studied. Iraq was not under blackout. Iraqi connectivity to European Telegram infrastructure was normal. An editorial desk operating through these channels could in principle have run the workflow the ICCT described. But this possibility, if accepted, dissolves the framing the pipeline carried rather than confirming it. The framing the pipeline carried was that the attacks were Iranian-backed — not Iraqi-routed, not ecosystem-adjacent, but directed by Iran. The militia organisations behind some of these channels — Asaib Ahl al-Haq most directly — have documented operational ties to the IRGC’s Quds Force.³² The Telegram channel administrators and operational chains of the channels themselves have not been independently documented. The militia’s political alignment does not transfer automatically to the channel’s operational chain. To accept that the workflow ran through Iraqi infrastructure is to give up the strong form of the Iranian-handler thesis the pipeline depended on, and to retreat to a weaker claim. That retreat is partly defensible and partly not. The dissemination of HAYI’s material through these channels is established on the public record. What is not established is that those channels originated the material, edited the material, were operationally directed by Iran in disseminating HAYI material, or were operationally responsible for the attacks themselves. The weaker claim, examined honestly, splits in two: the dissemination part runs through channels affiliated with Iranian-aligned militias; the production and execution parts do not. The retreat from Iran-backed to a weaker version is therefore not a retreat to a coherent thesis. It is a retreat that holds for one operational layer and collapses for the other two. And in any case, neither version of the claim is what the public was told. The public was told Iran-linked, in a tone that implied direction.
The third is somewhere else entirely, with the Iraqi militia infrastructure used as cover. Under this possibility, the editorial desk is operating from any location with reliable internet access — the United Kingdom, the United States, Israel, anywhere in Europe, anywhere with a domestic broadband connection — and is pushing finished material into the Iraqi Telegram channels for amplification. The dissemination network does the political work of making the material look Iranian-backed. The actual editorial work is happening elsewhere. This possibility is consistent with everything section one of this article documented about HAYI’s operators: their fluency in English, in American spelling conventions, in Religious Zionist vocabulary, in the iconographic vocabulary of axis-of-resistance branding without the substance, in Christian and Jewish philosophical reasoning rather than Islamic. The desk that produced HAYI’s materials does not show the fluencies a desk inside Iran or running through Iraqi militia editorial structures would show. It shows the fluencies of operators working from somewhere with deep cultural literacy in Western and Israeli media space.
The article does not assert the third possibility. It identifies it as available. The ICCT did not identify it as available because the ICCT treated the dissemination network as evidence of origin. That assumption — that material distributed through Iranian-aligned channels must have originated within Iranian-aligned operational structures — is the analytical move the section has been working to dismantle. Distribution is not origin. A Telegram channel administrator can be genuine, persuaded, paid, infiltrated, or shared. A channel that amplifies particular content can amplify content the channel’s usual ecosystem did not originate. The Iraqi Telegram channels the ICCT identified were the route HAYI’s material took into the amplification ecosystem. They were not necessarily the place HAYI’s material was produced. The ICCT’s reading collapsed those two questions into one. The evidence does not support that collapse.
What the public record establishes about the editorial desk is structural. It moved fast. It produced AI-generated multi-language statements with English as the source. It used American spelling on a UK target. It reasoned from Christian and Jewish philosophy. It deployed Religious Zionist vocabulary on the founding statement of a supposedly Shia Islamist group. It altered a Quranic verse no Muslim composes. It used the visual idiom of axis-of-resistance branding without the substance. It used orchestral music where nasheeds belong. And it was demonstrably plugged into an information environment that had already moved synagogue surveillance footage of the Golders Green attack into US-based and broadcast media before the HAYI claim video for that attack appeared. None of that fingerprint is consistent with a desk inside Iran. None of it is consistent with a desk running through Iraqi militia editorial structures. All of it is consistent with a desk operating from a location with deep cultural fluency in Anglo-American Jewish religious-political life and Western media production, using the Iraqi militia channels as the relay path into the global information environment.
The handler that the pipeline’s framing required could not have been in Iran. The Iraqi militia infrastructure is a route, not an editor. Where the editorial desk actually was is a question for the institutions whose job it is to investigate. What this article establishes is that the question exists, and that the answer the pipeline delivered is not consistent with the public record.
What Came After Golders Green
The first article documented the attacks HAYI claimed between 9 and 23 March — Liège, Rotterdam, two in Amsterdam, the Bank of New York Mellon site, Golders Green, alongside the falsely claimed incidents in Greece, Antwerp, Heemstede, France, and Haarlem. Five real attacks. Five fabrications or misrepresentations. The pattern of mixing genuine arson with falsely claimed incidents to manufacture the appearance of a coordinated transcontinental campaign was established in those first two weeks.
After Golders Green, the campaign continued. The pattern continued with it.
On 12 April 2026, two suspects climbed the fence of the Beth Yaakov Synagogue in Skopje, North Macedonia — the country’s only synagogue — poured accelerant on the entrance, and threw a firebomb. The doors and courtyard were charred. The fire did not sustain. The North Macedonian Foreign Minister condemned the attack publicly. The country’s top five religious leaders, including the head of the Islamic Religious Community, issued a joint statement of condemnation. North Macedonia had not seen a synagogue attack since the Holocaust. Three days later, on 15 April, HAYI released a video claiming responsibility, describing the synagogue as a “symbol of the historical and cultural identity of Jews of this region” with a “deep connection with the Zionist regime.” The vocabulary had shifted. Zionist regime is the standard hostile-rhetoric term used by Iran, Hezbollah, and the Iraqi Shia militias — the language a real axis operative would actually write. The operators were correcting the tells the earlier material had made visible.³³
The same HAYI video also claimed the Eclipse Grillbar in Munich, a Jewish-owned restaurant attacked the previous Friday with a small explosive device causing minimal damage. The video noted that the attack had occurred after midnight when the restaurant was closed, but added that it “could have happened during the day and the Zionists would have been killed.” The Munich Public Prosecutor’s Office opened an investigation, including an investigation of the HAYI video itself.³⁴
Then came the London cluster. On the evening of 15 April, an incendiary device was thrown into the car park of Iran International’s offices in Wembley — the attack discussed in section one of this article. On the same night, two men attempted an arson attack on the Finchley Reform Synagogue in north London by filling bottles with what was suspected to be petrol and throwing a brick at them.⁴³ When the bottles failed to ignite, the suspects fled. They were subsequently arrested and charged. Two days later, on the night of 17 April, an attempted arson hit the Hendon offices of a building that still bore the sign of Jewish Futures, a Jewish educational organisation. Three bottles containing accelerant were placed against the building and set alight; the bottles failed to ignite fully and the damage was minor. On 16 April, HAYI had posted a video claiming responsibility for a drone attack on the Israeli Embassy in Kensington, with two figures in protective clothing and a message that the embassy was being targeted with “radioactive and dangerous carcinogenic materials.” The Metropolitan Police investigated, closing public access to Kensington Gardens. The Met announced on Saturday 18 April that no hazardous materials had been found and that the incident was over. The HAYI claim of an Embassy drone strike — like the claimed attacks in Greece, Heemstede, France, and Haarlem before it — described an event that did not happen.³⁵
Overnight on 18–19 April, an arson attack hit the Kenton United Synagogue in Harrow. There was minor smoke damage to a room inside. A 17-year-old boy was arrested, charged, and pleaded guilty at Westminster Magistrates’ Court to arson not endangering life. In the police interview reported in court, the suspect said: “I have no hate towards the Jewish people or their community. I didn’t know it was a synagogue. I genuinely thought it was an empty building.” He was bailed pending sentencing, with conditions including staying away from synagogues. An accomplice filmed the attack, and the footage was released by HAYI in the claim video that followed.³⁶
The Met’s count by late April had moved to twenty-six arrests across the entire campaign, eight charges, one conviction. The first terrorism-related arrest came on 26 April, more than a month after Golders Green and after the entire London cluster — and it was on suspicion of preparing terrorist acts only, not on any predicate of foreign-state direction. Across the campaign, the suspect demographic has been consistent. The Rotterdam attackers were teenagers from Tilburg, aged seventeen to nineteen. The Golders Green attackers charged are eighteen, nineteen, twenty, and seventeen years old. The Iran International suspects are sixteen, nineteen, and twenty-one. The Kenton suspect is seventeen. The Finchley Reform suspects fled when their petrol bottles failed to ignite. None of the demographic profiles matches what an ideologically committed Shia militant cell, or any committed jihadi network, would produce. The profile that matches is the profile the Met has publicly named — paid criminal proxies, recruited for cash, with no allegiance to the cause.
There is a third fact the campaign produces that the demographic profile alone does not explain. Across Belgium, the Netherlands, North Macedonia, Germany, France, and the United Kingdom — across nearly two months and more than a dozen claimed attacks — not one person has been killed and not one person has been injured. Bottles fail to ignite. Fires fail to sustain. Accelerant is poured on benches and courtyards rather than on doors. A burning container thrown into the Iran International car park, in the Met’s words, “immediately put itself out.”⁴⁴ Attacks are staged at night, when synagogues are empty and Jewish-owned restaurants are closed. The Munich communiqué itself notes that the attack on the Eclipse Grillbar “could have happened during the day and the Zionists would have been killed” — an admission, in HAYI’s own words, that the timing was chosen to avoid this.
No real Shia militant campaign has a casualty record like that. Hezbollah’s bombing of the Israeli Embassy in Buenos Aires in 1992 killed twenty-nine. The AMIA bombing in 1994 killed eighty-five. The Beirut barracks bombing in 1983 killed two hundred and forty-one US service members. The Khobar Towers bombing in 1996 killed nineteen. The Burgas bus bombing in 2012 killed six. The IRGC’s documented assassination operations against Iranian dissidents in Europe have killed people. Across forty years and on every continent, the consistent pattern of real Shia militant operations against Western, Israeli, and Jewish targets is the production of casualties — because that is the operational point of armed jihad in the framework these groups operate within. A supposedly Shia Islamic militant group, declaring jihad against Western and Israeli interests, conducting a transcontinental campaign over nearly two months, that produces a body count of zero, is not a campaign that exists anywhere in the historical record. HAYI is the first. The campaign was not designed to kill. It was designed to look as if it had been.
Two further structural facts emerge from the post-Golders Green record.
The first is that the fabrication pattern continued. The Israeli Embassy drone claim — like the Greece, France, Antwerp, Heemstede, and Haarlem claims before it — was not an actual attack. HAYI continued, after Golders Green, to claim incidents the public record does not contain. The behaviour of mixing real attacks with manufactured ones to amplify apparent reach was not a feature of the early campaign that the operators outgrew. It is a feature of the campaign throughout.
The second is the inverse fact. Between 23 March and the end of April, the campaign expanded its target set from synagogues, Jewish schools, and an American bank into Persian-language media (Iran International), an Israeli diplomatic site (the Embassy drone claim), and a Jewish educational charity. The targeting profile broadened in exactly the directions the brand needed to broaden to maintain its claim of being an Iranian-aligned militant organisation operating across multiple categories of legitimate-from-the-perspective-of-the-claimed-identity targets. Each new target type closed a checklist gap. By late April, HAYI’s claimed target set covered every category of target a Western analyst would expect a real Iranian-aligned militant campaign in Europe to attack — synagogues, a Jewish school, Jewish-owned businesses, an Iranian dissident broadcaster, and a claimed strike on an Israeli embassy. The brand had been completed.
The campaign that followed Golders Green did not contradict the analysis of section one. It extended it. The fingerprint stayed the same. The targeting evolved in the directions the brand-construction required. The fabrication pattern persisted. The suspect demographic remained — across multiple countries, multiple cities, multiple supposed cells — the same demographic of recruited teenagers and young adults with no identifiable ideological commitment to the cause they were nominally serving. And the Metropolitan Police, faced with this pattern, characterised it publicly as paid criminal proxies rather than as terrorism.
On 29 April 2026, HAYI did what its claim apparatus had done across the campaign — but for the first time, the underlying event involved real wounded people. A 45-year-old man with what the Metropolitan Police Commissioner publicly described as a history of serious violence and mental health issues walked through Golders Green in broad daylight with a knife and stabbed two Jewish men, aged 76 and 34, before attempting to stab the police officers who arrested him.⁴⁶ He did not flee. Hours later, at 15:21 BST, HAYI claimed responsibility for the attack, calling him one of their “lone wolves.” The pattern is the pattern the article has already catalogued. HAYI claimed the firebombing in Greece that did not happen. It claimed the attack in Heemstede that was a household gas explosion. It claimed an attack in Antwerp that was a botched theft from a Moroccan woman whose car was then set on fire. It claimed an attack in Haarlem that occurred before the supposed group existed. It claimed a drone strike on the Israeli Embassy that was three benign jars in Kensington Gardens. Now it has claimed the stabbing of two Jewish men by an unstable man with no established Iranian links and no established connection to any Islamic militant group. The claim apparatus claims everything. That is its function. It is not an apparatus that organises attacks. It is an apparatus that converts attacks — real, manufactured, falsely attributed, or unrelated — into evidence for the narrative the operators were paid to construct. The Golders Green stabbing was carried out by a man the police had reason to know about. The attack occurred at 11:16 BST. HAYI's claim video appeared on Telegram at 15:21 BST — four hours later.
The Met Now Says It
In the nearly two months since the Golders Green attack, the Metropolitan Police have made twenty-six arrests connected to the broader campaign of attacks attributed to HAYI. Eight people have been charged with arson-related offences. One has been convicted of arson. On 26 April, nearly two months after the Golders Green attack, one man was arrested on suspicion of preparing terrorist acts — the first arrest in the entire investigation under terrorism legislation. The investigation that began under the lens of an Iranian-directed Islamic terror campaign has been worked, in operational terms, almost entirely as a series of paid-proxy arson cases. The numbers tell their own story. Twenty-six arrests. Eight arson charges. One arson conviction. One terrorism-related arrest, nearly two months in.
The senior officers running the investigation have characterised it in their own words. On 19 April, after a series of attacks on synagogues and Jewish premises across north and northwest London, Deputy Commissioner Matt Jukes and Deputy Assistant Commissioner Vicki Evans, the United Kingdom’s Senior National Co-ordinator for Counter Terrorism Policing, gave a joint press conference outside Kenton United Synagogue in Harrow. Their statements are on the public record, archived in full on the Metropolitan Police website. They are not consistent with the framing the pipeline carried.³⁷
Evans’s characterisation of the operational pattern is precise. “I have spoken at length of the Iranian regime’s routine uses of criminal proxies. We are considering whether this tactic is being used here in London — recruiting violence as a service. Individuals carrying out these crimes often have no allegiance to the cause and are taking quick cash for their crimes. To anyone even considering getting involved — my message to you would be this: the stakes are high, and it is absolutely not worth the risk for a small reward. Those tasking you will not be there when you are arrested and face court. You will be used once and thrown away without a second thought.” ³⁷ That is the Met’s senior counter-terrorism coordinator describing what the investigation has actually found — not Iranian operatives committing attacks, but criminal proxies recruited for cash, with no ideological allegiance to the cause they are nominally serving. Violence as a service. The phrase she chose is the precise opposite of the framing the pipeline sold to the public. The pipeline framing was Iranian-directed Islamic terror. The framing the Met is now publicly using is recruited criminal violence dressed in cause language nobody believes.
Jukes drew the comparison directly. “We’ve seen a pattern with other actors of thugs for hire, people taking cash that looks like quick and easy money. This is part of the modern hybrid war fought by proxies.” ³⁸ The other actors he was referring to are documented. In March 2024, an arson attack hit a London warehouse linked to Ukrainian aid. Six men were later convicted — five of aggravated arson, a sixth of failing to disclose information about terrorist acts. The ringleader, Dylan Earl, had been recruited by Russia’s Wagner Group via Telegram and was sentenced in October 2025 to seventeen years for what the prosecution described as state-sponsored arson on behalf of Wagner — the first conviction under the National Security Act 2023. The pattern Jukes is describing — thugs for hire, taking cash, quick and easy money — is the pattern documented in the Earl case. Evans’s violence as a service names the same model. The Met is publicly characterising the HAYI cases as operationally similar to the Wagner-Earl proxy model, while continuing to leave the upstream-actor question open.
The Earl precedent is not the only documented payment trail in the proxy model. The Soufan Center, in its 17 April 2026 brief on the broader pattern, reported that the minors recruited for the foiled Bank of America Paris attack on 28 March were paid €500–1,000 each — small sums, in line with the quick cash characterisation Evans and Jukes have given the London cases. The proxy model the Met is now publicly describing is not a thesis. It is a documented operational pattern with named figures, in jurisdictions across Europe, in cases where the foreign sponsor has either been named or remains the open question.³⁹
What the Met is not doing is what the Earl case shows can be done. In the Earl case, the foreign sponsor was named at sentencing. The court heard evidence that Earl was acting as a Wagner proxy. The judge sentenced him on that basis. The state-sponsored hostile-activity legislation Parliament passed in 2023 — the National Security Act — was framed for exactly this scenario. It enables prosecutors to bring charges that name the foreign sponsor, that carry significant additional sentences, and that make the foreign-state involvement part of the public court record. Nearly two months into the HAYI investigation, with twenty-six arrests, eight arson charges, and one arson conviction, that legislation has not been used. The first arrest under terrorism legislation came on 26 April — nearly two months in, and on suspicion only of preparing terrorist acts, not on any foreign-state-direction predicate. The legislation Parliament wrote for the kind of attack the pipeline framing described is sitting unused. The Met has not named a foreign sponsor.
This is the disjunction that defines section three. The pipeline carried a story of Iranian-directed Islamic terrorism. The senior officers running the investigation are publicly characterising the cases as a paid-proxy criminal campaign, structurally comparable to the Wagner-Earl model. The legislation written for foreign-state-directed hostile activity is not being applied. No foreign sponsor has been named. Nearly two months in, the gap between what the public was told and what the Met is operating against is not a gap of nuance. It is a gap that requires explanation.
The Lie, the Silence, and What Comes Next
The Silence After the Lie named what happened.⁴⁰ The pipeline laundered misinformation into the mainstream. The Foundation for Defense of Democracies — a Washington-based pro-Israel organisation whose IRS filings state its mission as enhancing Israel’s image and educating the public on Israeli-Arab issues — set the predicate on 12 March 2026, when Joe Truzman in The Long War Journal floated the Iranian link in English-language coverage for the first time.⁴¹ The Israeli Ministry of Diaspora Affairs and Combating Antisemitism formalised it on 16 March, in a special report giving the predicate its state-authoritative imprint — a ministry whose stated remit is combating antisemitism but whose operational mandate, on the documented record, includes Israeli state propaganda operations.⁴² The International Centre for Counter-Terrorism in The Hague laundered it on 23 March, in a report that passed the conclusion forward without considering the motivations or operational backgrounds of its sources, despite the inconsistencies and doubts the report itself documented. The mainstream press, the BBC at its head, distributed it. Not terror with bombs or bullets. Terror with narrative. Israeli terror by narrative. A PsyOp, executed against two communities at once.
This article has put the evidence behind that naming.
The fingerprint of the people who built HAYI is the fingerprint of operators fluent in Anglo-American Jewish religious-political life and Western media production. The altered Qur’an. The Religious Zionist vocabulary. The American English of the administrator. The Christian and Jewish philosophical reasoning. The deletion of the account when asked who was paying. The misspelled Islamic in Arabic. The orchestral music where nasheeds belong. The absence of one word of Persian in nearly two months of operation. The institutional architecture that did not exist before 9 March 2026 yet was running a thirty-nine-minute editorial workflow by 13 March. None of this is the fingerprint of a Shia Islamic militant group. All of it is the fingerprint of an operation built by people fluent in the cultural and religious vocabulary of the very community the campaign was designed to terrify, dressed in the symbology of the community the campaign was designed to blame.
The Iranian-handler thesis the pipeline carried is excluded by the public record. Iran was, during the period in question, under the deepest and longest state-imposed internet blackout ever recorded. The connectivity environment did not support the workflow the framing required. The synagogue’s own surveillance footage was already moving through Anglosphere media before HAYI’s branded video for that attack existed. Distribution through Iraqi militia channels is not origin. The framing the pipeline delivered to the public is not consistent with what was operationally possible.
The Metropolitan Police, nearly two months in, have confirmed the operational shape of the campaign without confirming the predicate the pipeline sold. Recruiting violence as a service, in the words of the senior counter-terrorism coordinator. Thugs for hire, in the words of the deputy commissioner. The Wagner-Earl proxy model, named explicitly. Twenty-six arrests. Eight arson charges. One arson conviction. The legislation Parliament wrote for foreign-state-directed hostile activity has not been used. No foreign sponsor has been named. The same Met that named Wagner in the Earl case has not named Iran in this one. The reason for the absence is on the public record by virtue of being absent. The evidence the Met would need to bring an Iran charge has not been built, because what was built was never aimed at Iran.
What was built was aimed at the British public. At Jewish families in Golders Green made to fear an enemy the evidence does not support. At Muslim families across Britain carrying the weight of an attack their communities had no part in and condemn without qualification. At a public made to absorb a manufactured threat and to accept the political consequences flowing from it — the IRGC proscription campaigns accelerated, the legislation expanded, the war policy hardened, the Counter-Islam industry refed. Both communities are victims. Neither is the beneficiary. The beneficiary is the state that manufactured the fear, and the industry that profits from harvesting it.
One fact above all others should sit at the centre of this accounting. The pipeline sold the British public a story of Iranian-directed Islamic terror. Terrorism, by the definition the framing relied on, kills. Nearly two months in, across six countries and more than a dozen claimed attacks against synagogues, Jewish schools, Jewish-owned businesses, an Iranian dissident broadcaster, false claims, and a claimed strike on an Israeli embassy, the 29 April 2026 stabbing in Golders Green produced the first injuries.⁴⁶ The campaign that was framed as the gravest Iranian-linked Islamist threat to British Jews in a generation produced, while the war was still raging, an operational record of zero casualties. That is not a feature of any real jihadist campaign in living memory. It is the signature of an operation built to manufacture fear without paying the price in blood that real terror exacts. The framing was not just wrong about who. It was wrong about what.
The institutions that laundered the operation will not correct themselves. The FDD set the predicate doing exactly what a front organisation for Zionist Israeli interests is built to do. The Israeli Ministry of Diaspora Affairs built the report doing exactly what a ministry whose operational mandate includes Israeli state propaganda is built to do. The ICCT gave the framing research-body credibility without the due diligence that would have caught the Quranic alteration the IMDA’s own copy contained. The BBC and the mainstream outlets that ran the framing did so without disclosing the provenance to their audiences. The propagandists were never in the business of accuracy. The mainstream outlets that should have stood between the PsyOp and the public failed to, and face no requirement to repair the damage. The well was poisoned by actors with motive, capacity, and institutional cover to do exactly what was done — and the cleanup will not come from the people who poisoned the well.
The British government and the Metropolitan Police are complicit in the operation’s continuing effect on the British public. Nearly two months in, with twenty-six arrests, the Met has downgraded the offence from terrorism to criminality without retracting the Iran attribution that justified the original framing. The British press has followed the Met’s lead, softening the framing without correcting it. The British state and its principal broadcaster sit inside a structural relationship with Israel — diplomatic, intelligence-sharing, treaty-grounded — that constrains what they are willing to say about an Israeli information operation directed at their own public. The European Union’s Association Agreement with Israel, the United Kingdom’s bilateral partnerships, and the broader Western state architecture make Israeli information operations on Western soil something Western governments are institutionally configured to overlook rather than confront. That is not innocence. That is complicity by structural alignment.
The first article asked why no foreign sponsor had been named. This article has documented why: because the foreign sponsor named at the door of the operation is not the one the pipeline pointed at. The narrative-construction layer is on the documented record — the FDD predicate, the IMDA report, the ICCT laundering, the BBC distribution. That layer is Israeli-built. The operational-execution layer — who built the HAYI brand, ran the editorial desk, and recruited the proxies on the ground — is a separate question this article does not answer. What the evidence establishes is that the actors the public was told to suspect are excluded by the operational record. What it does not establish is who is responsible. That question has not been investigated. It must now be asked.
The hate is not reinforced by the fire. It is reinforced by the silence after the lie. The silence is not an accident. It is the product. And until the framing is publicly put right, with the same prominence the framing received, both communities will continue to be forced to experience the effects of the operation. The Jewish community will continue to fear an enemy it does not have. The Muslim community will continue to carry the blame for an attack it did not commit. And the state that manufactured the fear will continue to harvest it.
Until it is put right, both communities cannot heal and the public cannot see the true problem.
If this resonated with you, consider sharing it — that’s how the fire spreads.
James S. Coates writes about geopolitics, international law, and the decline of civilisational accountability. His books include A Signal Through Time, The Threshold, The Road to Khurasan, the memoir God and Country (published under pen name Will Prentiss) and his forthcoming Neither Gods Nor Monsters. He publishes regularly on Fireline Press and The Signal Dispatch, and his academic work appears on PhilPapers. He lives in the UK, with his family and dog who has no interest in any of this.
© 2026 James S. Coates All Rights Reserved. Fireline Press · fireline.press
Endnotes
¹ Metropolitan Police, “Further arrest in investigation led by counter terrorism officers,” 26 April 2026.
² Metropolitan Police, “Statements on linked arson attacks in north west London,” 19 April 2026. Statement by Deputy Assistant Commissioner Vicki Evans, Senior National Co-ordinator for Counter Terrorism Policing.
³ Crown Prosecution Service, “How the CPS used new National Security Act legislation to prosecute the plot to sabotage Ukrainian aid warehouses on UK soil,” July 2025. R v Earl & others, sentenced at the Old Bailey by Mrs Justice Cheema-Grubb, 24 October 2025 — the first conviction under the National Security Act 2023.
⁴ International Centre for Counter-Terrorism (ICCT), Hybrid Threat Signals: Assessing Possible Iranian Involvement in Recent Attacks in Europe, Julian Lanchès, 23 March 2026, on the HAYI announcement of 9 March 2026 circulated via Telegram channel affiliated with the Iraqi pro-Iranian militia Liwa Zulfiqar.
⁵ Israeli Ministry of Diaspora Affairs and Combating Antisemitism, “Special Report: Harakat Ashab al-Yamin al-Islamia,” 16 March 2026 (updated 24 March 2026).
⁶ ICCT, Hybrid Threat Signals, 23 March 2026.
⁷ HAYI Golders Green communiqué, circulated via Telegram, 23 March 2026, as reproduced in the Israeli Ministry of Diaspora Affairs special report on HAYI. The opening Quranic citation is from Surah At-Tawbah 9:41. The published image shows the verb form wa-jāhadū (past tense) rather than the canonical wa-jāhidū (imperative). The canonical Arabic text of Surah 9:41 is available in every standard mushaf.
⁸ HAYI Golders Green communiqué, 23 March 2026, as reproduced in the IMDA special report.
⁹ ICCT, Hybrid Threat Signals, 23 March 2026, on the second HAYI Telegram channel created 21 March 2026: “there are also a number of inconsistencies with this account, foremost the misspelling of the Arabic channel name, likely resulting from an incorrect English translation.”
¹⁰ CBS News, “European antisemitism attacks: group threatens US-Israel interests worldwide,” Joe Stocker and Haley Ott, 24 March 2026.
¹¹ Lucas Webber, senior threat intelligence analyst at Tech Against Terrorism, quoted in CBS News, 24 March 2026.
¹² ICCT, Hybrid Threat Signals, 23 March 2026, p. 6.
¹³ Adam Rawnsley, “Is that an AK-47 on Hizballah’s flag?”, Center for a New American Security, 6 September 2016.
¹⁴ Aymenn Jawad al-Tamimi profile: Hoover Institution. Credentials: BA Brasenose College, Oxford; PhD Swansea University; James Callaghan Thesis Prize 2024–25; affiliations with Middle East Forum, Hoover Institution, Washington Institute for Near East Policy, and the ICCT.
¹⁵ Aymenn Jawad al-Tamimi, quoted in Middle East Eye, “Ashab al-Yamin: The obscure new group claiming the Jewish ambulance attack,” Areeb Ullah and Mohamed Mulla, 24 March 2026.
¹⁶ Adam Hadley, founder and CEO of Tech Against Terrorism (UN-backed), quoted in The National, March 2026.
¹⁷ Avi Jorisch, Beacon of Hatred: Inside Hizbullah’s al-Manar Television, Washington Institute for Near East Policy, 2004.
¹⁸ Rita Katz, SITE Intelligence Group, quoted in NPR, “What Does It Mean When ISIS Claims Responsibility For An Attack?”, 24 May 2017.
¹⁹ Michael Knights, “Profile: Asaib Ahl al-Haq,” The Washington Institute for Near East Policy, 27 April 2021.
²⁰ ICCT, Hybrid Threat Signals, 23 March 2026.
²¹ Sharon Adarlo, Militant Wire, quoted in CBS News, 24 March 2026.
²² Jerusalem Post, “’The regime is a customer’: BBC interviews activist behind pro-Iran Lego propaganda videos,” April 2026.
²³ Radio Free Europe / Radio Liberty, “What Is HAYI, The Shadowy Islamist Group Claiming Attacks Across Europe?”, Meliha Kesmer, 17 April 2026.
²⁴ Counter Extremism Project, “Asaib Ahl al-Haq” profile, on al-Khazali’s Persian-language meetings with Khamenei and Soleimani.
²⁵ UK Intelligence and Security Committee, Iran (special report), published July 2025, on the Iranian state threat to the UK and Iran’s use of proxy criminals to target Iranian dissidents and Jewish/Israeli targets on UK soil. Ken McCallum, Director General of MI5, annual threat update, October 2025, citing “more than twenty potentially lethal Iran-backed plots” tracked since the prior year.
²⁶ ICCT, Hybrid Threat Signals, 23 March 2026.
²⁷ NetBlocks, reports on Iran connectivity disruption beginning 28 February 2026.
²⁸ NetBlocks, statement on Iran reaching fifty-three consecutive days of disruption, c. 21 April 2026.
²⁹ Iranian government spokeswoman Fatemeh Mohajerani statement on whitelist access, March 2026, reported by Iranian state media. State-run Bale messaging app routing for whitelist applications: Article 19, “Iran’s national internet and the Bale app,” 2024.
³⁰ Breaking911 X account posts, 23 March 2026 (02:21 AM and 03:10 AM London time):
Statement of Detective Superintendent Sarah Jackson per Metropolitan Police press contact, 23–24 March 2026. Timestamp preservation:
³¹ ICCT, Hybrid Threat Signals, 23 March 2026, timing data for the Rotterdam attack of 13 March 2026.
³² Counter Extremism Project, “Asaib Ahl al-Haq” profile: “AAH is one of three prominent Iraqi Shiite militias funded and trained by Iran’s external military wing, the Quds Force of the Islamic Revolutionary Guards Corps (IRGC).” U.S. State Department, designation of AAH as a Foreign Terrorist Organization, 3 January 2020.
³³ Times of Israel, “North Macedonian synagogue hit by arson in country’s 1st antisemitic attack since Holocaust,” 15 April 2026. HAYI claim: Jerusalem Post, “Ashab al-Yamin claimed responsibility for Skopje, Munich attacks on Jewish sites,” 15 April 2026.
³⁴ Jerusalem Post, “Ashab al-Yamin claimed responsibility for Skopje, Munich attacks on Jewish sites,” 15 April 2026.
³⁵ Iran International incident, 15 April 2026: Committee to Protect Journalists, “3 arrested after arson attack on London-based Iran International,” 16 April 2026. Finchley Reform, Jewish Futures Hendon, and Israeli Embassy drone claim: Times of Israel, “Arson attempt hits London synagogue; Iran-linked group claims attack,” 18 April 2026. Met response on the Embassy drone claim: Metropolitan Police statement, 19 April 2026.
³⁶ R v [name redacted under reporting restrictions], Westminster Magistrates’ Court, April 2026, reported in The Guardian / Irish Times, “Iran behind low-level ‘hybrid warfare’ attacks in Europe, analysts say,” 23 April 2026.
³⁷ Metropolitan Police, “Statements on linked arson attacks in north west London,” 19 April 2026.
³⁸ Matt Jukes, BBC interview, 19 April 2026, reported in Times of Israel, “UK arrests 2 teens as ‘thugs for hire’ after latest arson attack on London synagogue,” 21 April 2026.
³⁹ The Soufan Center, “Iran War Exacerbates the Terrorist Threat Landscape in Europe,” IntelBrief, 17 April 2026.
⁴⁰ James S. Coates, “The Silence After the Lie: How an Israeli Influence Operation Became the News — and No One Corrected the Record,” Fireline Press, April 2026.
⁴¹ Joe Truzman, “Purported Iran-backed group claims responsibility for attacks in Belgium and Greece,” The Long War Journal / Foundation for Defense of Democracies, 12 March 2026. FDD founding mission documented in Sima Vaknin-Gil (then Director General, Israel’s Ministry of Strategic Affairs), public remarks, 2018, reported in Le Monde Diplomatique, September 2018.
⁴² The Guardian, “Israel fund US university protest Gaza antisemitism,” 24 June 2024, on the Israeli Ministry of Diaspora Affairs’ propaganda operations.
⁴³ RFE/RL, “What Is HAYI, The Shadowy Islamist Group Claiming Attacks Across Europe?”, Meliha Kesmer, 17 April 2026: “None of the attacks caused casualties.” Confirmed across reporting on the campaign through 28 April 2026.
⁴⁴ Metropolitan Police statement on the Iran International incident, 17 April 2026, reported in Euronews, “Three charged over attempted arson on Persian-language TV channel, UK police say,” 17 April 2026.
⁴⁵ Jerusalem Post, "Two wounded in London terror stabbing against Golders Green Jews, HAYI takes responsibility," 29 April 2026. The HAYI claim was first reported by SITE Intelligence Group and circulated via Iraqi Shia militia–affiliated Telegram channels.
⁴⁶ Metropolitan Police Commissioner Sir Mark Rowley, public statement at the scene of the 29 April 2026 Golders Green stabbing, reported in ITV News London, "'Shame on you': Met boss and local MP heckled after two Jewish men are stabbed in terror attack," 29 April 2026; and The Jewish Chronicle, "Golders Green stabbing: Suspect arrested as two injured," 29 April 2026. Suspect's actions and arrest detailed in Metropolitan Police statement, 29 April 2026, as reported across BBC, ITV News, Jerusalem Post, and Jewish Chronicle coverage of the same date.