CommandEleven Intelligence // Europe Desk. Foresight Audit, status as of November 3, 2026. Criminal proceedings are active. Everything attributed to the prosecution is an allegation made in open court, and both defendants are presumed innocent.
Bottom Line Up Front
Between September 28 and October 1 we published three dossiers on the RAF Fairford incident, Part 1, Part 2 and Part 3. On October 27 two men were charged, and Part 4 compared the headline judgments with the charges. This audit goes further. It scores every forward-looking judgment in Parts 1 and 2 under the Foresight Record rules, quotes what we wrote, and adds two calls made on air.
Eight judgments are scored: three confirmed, three partly confirmed and two not confirmed. Six more cannot be scored until the courts or the record say more. On the Record’s method (confirmed counts 1, partly confirmed 0.5) that is 4.5 of 8, or 56 percent. The strongest results came on what the vans did not contain and on why the suspects were bailed. The weakest came on the protest reading, which we called the one most likely to be underweighted, and on a broadcast forecast of further attacks in London and Manchester.
The Iranian attribution, our leading line from the first dossier, is scored partly confirmed, not fully confirmed. Britain’s Prime Minister said the plot was “almost certainly” directed by the IRGC, and prosecutors allege a handler acting for Iran. No court has tested either claim. That score moves to confirmed on a guilty plea or verdict, and stays where it is until then.
Key Judgments
KJ1: Where we were right, the evidence is public and hard. No explosives were found, the bail decision reflected thin evidence of a viable attack capability, and installations supporting the Iran war were treated as live targets. All three are on the record. [CONFIRMED]
KJ2: Where we were partly right, the missing piece is a court. Iran is the leading attribution, the Rear-Area Hypothesis holds for Fairford, and a participant did call the police. Each rests on official statements or prosecution allegations that have not been tested. [ASSESSED, moderate confidence]
KJ3: Our misses were on the protest reading and on timing. We said the direct-action protest hypothesis was the one most likely to be underweighted. The charges describe a paid, state-directed operation instead. A broadcast forecast of further attacks within ten days did not come true. [CONFIRMED]
KJ4: The central factual question about the night of September 26 to 27 is still open. Two calls to police are on the record, and the public does not know which one led to the arrests. Whether the authorities held specific intelligence before the night is also unanswered. [DATA DEFICIT]
KJ5: There are now three public versions of what the operation was meant to be. The prosecution describes petrol-filled vans and a bomb message sent to drivers. US officials describe a drone attack on parked bombers. Only the first has been alleged in court, and no source ties the second to the men charged. [REPORTED]
How We Scored
Every call is scored under the Foresight Record’s rules. The original is quoted and dated, the score rests on evidence published afterwards, and a claim with no dated original is not scored. Confirmed counts 1 and partly confirmed counts 0.5. Where an official attributes something without publishing evidence, we score partly confirmed. Where the attribution also rests on secondary evidence, we score confirmed. A claim that depends on a verdict is held as open until the court rules.
Parts 1 and 2 also stated facts that were true when written, such as the roles of the two bases and the MacDill incident list. Those are not forecasts and are not scored. Part 4’s nine-row table compared the headline judgments with the charges but did not register them. Here they are registered.
The Scored Calls
| ID | Judgment | Source | Score |
|---|---|---|---|
| FA-01 | Release on bail meant investigators lacked unambiguous evidence of a viable attack capability | Part 1, Sept 28 | CONFIRMED |
| FA-02 | Epic Fury installations are live targets; the IRGC declaration is an operational threat | Part 1, Sept 28 | CONFIRMED |
| FA-03 | Fairford should not yet be called a foiled bomb plot | Part 2, Oct 1 | CONFIRMED |
| FA-04 | A state-directed proxy operation, most plausibly Iranian, is the leading line | Part 1, Sept 28 | PARTIALLY CONFIRMED |
| FA-05 | The Rear-Area Hypothesis holds on targeting and intent, not yet on attribution | Part 2, Oct 1 | PARTIALLY CONFIRMED |
| FA-06 | A participant calling the police is atypical of a disciplined state operation | Part 2, Oct 1 | PARTIALLY CONFIRMED |
| FA-07 | Direct-action protest is the hypothesis most likely to be underweighted | Part 1, Sept 28 | NOT CONFIRMED |
| FA-08 | Broadcast: further attacks in London and Manchester within ten days | On air (Survival Dispatch) | NOT CONFIRMED |
FA-01. The bail decision
What we said (Part 1, September 28). The release on bail “indicates that at the 36-hour point, investigators either had not recovered material that unambiguously established a viable attack capability, or held intelligence that cannot yet be converted into admissible evidence.” We added that the two most-circulated accounts of the vans’ contents “directly conflict.”
What the record shows. Prosecutors told the court that the vans held metal drums, two containing petrol, plastic water butts and internet-enabled dashcams, and that no explosives or improvised devices were found. The tabloid-sourced account of viable incendiary devices was wrong. The charges that followed rest on payments, reconnaissance and communications, which fits the second half of our either-or. Score: CONFIRMED.
FA-02. Live targets
What we said (Part 1, September 28). Irrespective of attribution, the incident confirms that installations supporting Epic Fury are “treated by the US as live targets,” and that the IRGC’s July declaration “has moved from rhetoric to an operational threat picture that commanders are acting on.” [ASSESSED, high confidence]
What the record shows. Prosecutors allege a reconnaissance run along the perimeter on August 22 at the handler’s request. US officials say they moved B-1 and B-52 bombers out of Fairford in early October over a suspected Iranian plan for a drone attack, according to the Wall Street Journal and others. The UK sanctioned two Iranians on October 12. The commanders did act on the threat. Score: CONFIRMED.
FA-03. Not a foiled bomb plot
What we said (Part 2, October 1). “The RAF Fairford incident is genuinely ambiguous and should not yet be described as a foiled bomb plot.” Police had recovered petrol but no explosives and had bailed all five men within about 36 hours. [ASSESSED, moderate confidence]
What the record shows. The prosecution’s account is that the drivers were told to park and walk away, then received a message that there was a bomb in the vehicles. There was none. Score: CONFIRMED.
FA-04. The Iranian proxy line
What we said (Part 1, September 28). “A state-directed proxy operation – most plausibly Iranian – is the leading line.” We marked it low-to-moderate confidence and said it “remains unproven.” We also named, as an indicator, charges under the National Security Act 2023, which “would signal state-threat attribution.”
What the record shows. Both charges are under the 2023 Act. Prosecutors say police believe Abdulkarim assisted Iran, that a handler known as “Ali” acted in Iran’s interest and that he paid about £70,000 to an intermediary. On October 12 Prime Minister Andy Burnham told Parliament the plot was “almost certainly” directed by the IRGC, but the reporting we reviewed shows no public evidence behind that statement. Iran denies any role. This is official attribution plus allegations in court, with no verdict. Score: PARTIALLY CONFIRMED. It moves to confirmed on a plea or conviction.
FA-05. The Rear-Area Hypothesis
What we said (Part 2, October 1). The hypothesis that the Iran war is being extended through proxies to the home territory of states hosting its launch points “is supported at the level of targeting and threat intent, but not yet at the level of attribution.” [ASSESSED, moderate confidence]
What the record shows. At Fairford, the attribution gap has closed at the official level, as FA-04 sets out. At MacDill, the other half of the hypothesis, nothing has moved. A civilian was detained after the September 26 perimeter breach, but he has not been publicly named, no charges have been reported and no one has linked him to a state or a group. Score: PARTIALLY CONFIRMED.
FA-06. The self-reporting pattern
What we said (Part 2, October 1). In both cases “a participant contacted the emergency services himself,” and this pattern is “atypical of disciplined state-directed operations and more typical of ideologically framed actors who ‘warn’ before acting, or of recruited amateurs whose resolve breaks.” [ASSESSED, high confidence]
What the record shows. The observation holds. Prosecutors told the court that one of the five men called police after the message about a bomb. The interpretation does not hold as written. The caller was reacting to a message that, on the prosecution’s account, came from the operation’s own organizer after the drivers had been told to leave the vans. That is neither a warning by an ideologue nor an amateur’s nerve breaking. Part 4 raised the possibility that the call was part of the design. Score: PARTIALLY CONFIRMED.
FA-07. The protest hypothesis
What we said (Part 1, September 28). Direct-action protest “cannot be excluded, and is the hypothesis most likely to be underweighted in current coverage.” We added that a hybrid, with activists or criminals unknowingly tasked by a state actor, would reconcile several anomalies. [ASSESSED]
What the record shows. The prosecution alleges a paid operation run from abroad, with reconnaissance five weeks earlier and an intermediary handling about £70,000. Nothing alleged resembles a protest action. The hybrid idea did partly hold, since the drivers were reportedly not told the full plan, but the call we made was that the protest reading was being underweighted, and it was not. Score: NOT CONFIRMED.
FA-08. The broadcast forecast
What was said. On a Survival Dispatch broadcast, Syed Khalid Muhammad, Executive Director of CommandEleven Intelligence, stated that further attacks would follow in London and Manchester within ten days.
What the record shows. There were no attacks in London or Manchester in the timeframe set online. Score: NOT CONFIRMED. We count a broadcast by our Executive Director as a CommandEleven Intelligence call, and a miss counts as a miss.
Still Open
Six calls cannot be scored today. Each is stated here so that the next audit has a fixed target.
| ID | Open judgment | Why it is open | Next check |
|---|---|---|---|
| FA-09 | Part 1 KJ1: UK and US authorities held threat intelligence specific to Fairford before September 27 | The court has not addressed it. Reconnaissance on August 22 and a US official’s reported three-week-old warning are consistent but not proof. | Old Bailey, Nov 20, and any disclosure |
| FA-10 | Part 1 KJ2: the resident’s 999 call was the operational trigger; Trump’s claim of long surveillance is uncorroborated | Two calls are on record: a 00:45 call about suspicious vehicles and a farmer’s call at about 01:30. Which led to the arrests is not public. | Trial evidence |
| FA-11 | Part 2 KJ4: the strongest transatlantic link is ideological branding, not command and control | The charges link the Fairford handler to HAYI, not to the “New Weathermen Underground” or the “Earthquake Faction.” | Any MacDill charge or attribution |
| FA-12 | Part 2 KJ7: the two incidents within about 12 hours were most likely coincidence | No one has linked the MacDill breacher and the Fairford men in five weeks. | Any shared handler or payment channel |
| FA-13 | Broadcast: Iran is behind the plot | Same status as FA-04, but stated without the hedging of the written judgment. | Verdict or plea |
| FA-14 | Broadcast: the September 29 on-air account of the plan | The prosecution has described the vans and the message, but not the wider plan. | Trial evidence |
Why FA-04 is partly confirmed and FA-13 is open. The written judgment said “most plausibly Iranian” and carried a low-to-moderate confidence label. That claim is now backed by official attribution and charges. The on-air statement was flatter, and a flat statement of fact waits for a court.
Three Public Versions of the Plan
The prosecution’s account is the only one alleged in a courtroom. Two others have been reported, and they should be kept apart. [REPORTED]
- The prosecution’s version (October 27). A handler abroad, a paid intermediary in London, a reconnaissance run and five drivers told to park vans loaded with petrol and walk away. A message about a bomb followed, and one driver called police. [ALLEGED]
- The US officials’ version (October 5 and 6). The Wall Street Journal, citing US and European officials, reported an IRGC plot to hit aircraft and kill American personnel, involving multiple steps and a “diversion” in the nearby neighborhood. US officials told the New York Times the plan was loosely modeled on Ukraine’s drone strike on Russian bombers. The Journal did not say the arrested men were the recruits. [REPORTED, anonymous officials]
- The Intercept’s version (October 27). Officials described a plan to launch small drones from just outside the fence line against bombers parked in the open, and again compared it to that Ukrainian operation. [REPORTED, anonymous officials]
The two sets of accounts could describe one operation, where the vans were a diversion and the drones the intended blow. They could also describe two separate efforts. No public source settles it. The Pentagon Inspector General’s January 2026 report (DODIG-2026-045) found contradictory counter-drone guidance and unprotected installations, as the Intercept notes. The coverage we reviewed describes US installations and does not mention Fairford or other overseas bases, so the report supports the broader point that rear-area bases are exposed. It is not evidence for the Fairford drone account.
What Would Change These Scores
- November 20, Old Bailey. Pleas, a trial date and any detail on Ali, the payments or the embassy link. A guilty plea on the assisting-a-foreign-intelligence-service charge would move FA-04 and FA-13 to confirmed.
- Charges against any of the six men on police bail. Charges under the designation offenses would revisit the Part 3 point that Fairford might be the first court test of the 2026 designation regime. So far it has not been.
- Disclosure on the night of September 26 to 27. Which call led to the arrests, and what the authorities knew beforehand, would settle FA-09 and FA-10.
- Anything that ties MacDill to Fairford or to a state. It would move FA-11 and FA-12.
- A link between the drone reports and the charged men. The prosecution describing a drone element, or a reliable account tying the recruits to it.
What We Learned
- We read the call as a mistake and it may have been a mechanism. Part 2 treated the 999 call as a sign of weak discipline. On the prosecution’s account, it followed a bomb message from the organizer. We should have asked who benefited from the call.
- We gave the protest reading more weight than it earned. Bail after 36 hours and a thin van load pushed us toward it. A bail decision made at the start of an investigation says little about its eventual charges.
- Our best work was on what we declined to claim. Calling it “not yet a foiled bomb plot” and refusing to attribute without evidence held up.
- Our spoken forecasts need the same rules as our written ones. The on-air calls were less hedged and scored worse.
What This Audit Does and Doesn’t Establish
- It establishes what we wrote, when, and how each judgment compares with the public record as of November 3, 2026.
- It does not establish that either defendant is guilty. Both are presumed innocent and neither has entered a plea.
- It does not establish that Iran directed the operation. Britain’s government and police say so, Iran denies it and no court has ruled.
- It does not establish that the reported drone plan and the charged operation are the same effort.
- It does not describe attack methods. Anything about drones is at the level published by the sources cited.
Frequently Asked Questions
How accurate were CommandEleven Intelligence’s RAF Fairford judgments?
Of eight judgments scored, three were confirmed, three partly confirmed and two not confirmed, which is 4.5 of 8 on the Foresight Record’s method. Six more are still open.
Did CommandEleven Intelligence say Iran was behind RAF Fairford?
We called an Iranian state-directed proxy operation the leading line, at low-to-moderate confidence, on September 28. Prosecutors now allege a handler acting for Iran. No court has ruled, so we score it partly confirmed.
What did we get wrong about RAF Fairford?
We said the protest reading was the one most likely to be underweighted, and the charges describe a paid, state-directed operation. We also misread the 999 call as a sign of weak discipline.
Was there a bomb at RAF Fairford?
No. Police found no explosives. Prosecutors say the drivers received a message that there was a bomb in the vans.
What happens next in the RAF Fairford case?
Mohmed Abdulkarim and Nouman Essghir are due at the Old Bailey on November 20. We will re-score the open calls after the hearing.
Sources
- ITV News, RAF Fairford ‘plot co-ordinated by handler working on behalf of Iran’ (October 27, 2026)
- Al Jazeera, UK prosecutors charge two after RAF Fairford incident (October 27, 2026)
- The Washington Times, Two British nationals charged in air base terror plot (October 27, 2026)
- Al Jazeera, UK blames Iran for airbase plot, sanctions two Iranian nationals (October 12, 2026)
- Times of Israel, US removed bombers from British airbase due to potential Iran drone attack (October 6, 2026, citing the Wall Street Journal)
- The Intercept, Pentagon Fears Drone Attacks on U.S. and Foreign Bases (October 27, 2026)
- Stars and Stripes, Drone tech on US bases (January 27, 2026, on the DoD Inspector General report)
- Tampa Bay 28, Investigation continues into how a civilian breached MacDill Air Force Base (October 2 and 4, 2026)
- Counter Terrorism Policing, Update on RAF Fairford investigation (September 28, 2026)
