The Gig Economy of Terror – From Hatzola to Fairford

Series note – This dossier is a companion to CommandEleven Intelligence’s IRGC Series and to the Iran Homeland Threat dossier. Those pieces examined the pre-positioned end of Iran’s external operations: long-embedded sleeper infrastructure operating on standing conditions rather than live commands. This dossier examines the opposite end of the same architecture: low-trust, just-in-time labor hired off the street to carry out one task at a time. Read together, they describe a two-tier system. Readers new to the series should start with the companion reading list at the end.

Bottom Line Up Front

“Gig terrorism” is the shorthand that went mainstream after the arrests near RAF Fairford on 27 September 2026, but the model it describes has been running in plain sight for more than a decade, and it has been running at industrial scale in Europe since March 2026. A hostile state posts a task, pays a piece rate, receives proof-of-work video, and walks away from whoever it hired. The operative is disposable, the attribution is slow, and the failure rate is priced in.

Between 9 March and the end of April 2026, a front brand calling itself Harakat Ashab al-Yamin al-Islamia (HAYI) claimed a wave of arsons, bombings and threats against Jewish, Israeli, American and Iranian-dissident targets across at least five European countries. The British government now states that officers of the IRGC Quds Force almost certainly directed those attacks, and US prosecutors have charged a Kata’ib Hezbollah commander with coordinating 18 of them from Baghdad. The operatives who actually lit the fires were overwhelmingly teenagers and young men recruited online.

The Hatzola ambulance arson in Golders Green on 23 March was the model’s signature attack on a soft community target. RAF Fairford, a strategic air base from which US bombers are flying missions against Iran, is where the target set may have moved next. That “may” matters. As of today, Fairford is not an established case of gig terrorism. It is an unresolved investigation with official attribution running well ahead of public evidence. What is established is that the gig model has been pointed at progressively harder targets over six months, and that its known limitation, low operative capability, is exactly what a military installation exposes.

Key Judgments

• KJ1. The gig model is a mature, state-operated capability, not an emerging trend – Iran has used hired criminals abroad since at least 2011 and has moved steadily down-market, from professional organized crime to street-level recruits. The 2026 HAYI campaign is the model operating at volume, not its debut. (High confidence)
• KJ2. The model is designed to fail cheaply, not to succeed reliably – Low operative capability is not evidence against state direction; it is a feature of the procurement choice. States buying disposable labor accept high arrest and failure rates in exchange for deniability, speed and near-zero sunk cost. Analysts who read amateurishness as proof of non-state origin are misreading the design. (High confidence)
• KJ3. The HAYI campaign escalated in target type, not in capability – Between March and April 2026 the target set widened from Jewish community sites to US banks, a Persian-language broadcaster and an embassy threat. The means stayed at the same level throughout: accelerant, crude devices, and claims amplified online. (High confidence)
• KJ4. Fairford, if it proves state-directed, would mark the model’s first known move against a strategic military target in the UK, and the evidence so far does not settle which tier of Iran’s architecture was involved – Three readings remain open: a gig-tier tasking with predictably low capability; a higher-tier criminal contractor; or a non-Iranian or non-state origin. Current public evidence cannot distinguish between them. (Low confidence on attribution; moderate confidence that the question is the right one)
• KJ5. Designating the brand will not break the model – The UK’s July 2026 designation of the IRGC, HAYI and Russia’s GRU Volunteer Corps closes a real prosecutorial gap. But the gig model is brand-agnostic: rebranding costs almost nothing, and the recruiting pool, the platforms and the tasking chain survive a designation intact. Expect a successor brand or unbranded activity. (Moderate confidence)
• KJ6. Iranian and Russian gig markets are converging on the same labor pool – Both states recruit through the same platforms, from the same demographic of young, financially precarious men, and increasingly through the same online subcultures. Attribution of any single incident to one state will get harder, not easier. (Moderate confidence)

Sourcing and Confidence Framework

This dossier follows CommandEleven Intelligence’s standard tradecraft tiers:

• [CONFIRMED] – established by court record, conviction, guilty plea, official government attribution, or multiple independent primary sources
• [ASSESSED] – CommandEleven Intelligence’s analytical judgment drawn from confirmed facts, or a claim made by officials that has not yet been tested publicly
• [SPECULATIVE] – plausible but single-source, unverified or inferential; included because it bears on forecasting
• [DATA DEFICIT] – a gap where public evidence does not exist or has not been released

A note on sources: this dossier relies heavily on official statements (UK Home Office, US Department of Justice, ASIO, Metropolitan Police), court reporting, and established research bodies (ICCT, IISS). Official statements are themselves claims; where a government attribution has not been tested in court, it is marked accordingly. In keeping with CommandEleven Intelligence’s public-release standard, this dossier discusses organizational structure and strategy only. It contains no operational or technical detail on devices, methods or targeting.

What “Gig Terrorism” Actually Describes

The term borrows from the platform economy for a reason. Strip away the ideology and the structure of a HAYI-style operation is recognizably that of a ride-hailing or delivery app:

The analogy holds in one more respect that matters for policy. In the platform economy, the company’s core asset is not its drivers; it is the platform. In gig terrorism, the principal’s core asset is not any cell; it is the recruiting and tasking infrastructure. Arresting operatives, even arresting dozens of them, removes labor the principal never valued.

What the term does not describe

Gig terrorism is easily confused with three adjacent models. The distinctions are analytically important:

• Classic proxy warfare – Hezbollah or Kata’ib Hezbollah are trained, ideologically committed organizations with their own command structures and interests. They are partners, however unequal. A gig operative is hired labor with no organizational identity at all.
• The pre-positioned sleeper cell – CommandEleven Intelligence’s Iran Homeland Threat dossier set out the conditions-based model: operatives embedded for years, issued standing conditions at insertion, and trusted to act without a live signal. That is a high-trust, high-investment asset. The gig operative is the opposite: zero-trust, zero-investment, hired days before the task and abandoned after it.
• Professional contract crime – When the IRGC hired senior figures in an Eastern European organized crime group to kill journalist Masih Alinejad, it was buying a capability, not casual labor. That is outsourcing, but to a professional tier. The gig model sits below it.

In practice, Iran runs all three at once. The useful way to think about it is as a labor market with tiers, and the most important question in any incident is which tier was hired.

FIGURE 1: The Three-Tier Labor Market

Why a State Buys Violence This Way

The economics explain the model better than the ideology does.

• Deniability – Every layer of cut-outs between principal and operative adds friction to attribution. ASIO’s Director-General described the Australian tasking chain as running from the IRGC through a series of overseas cut-outs and facilitators to coordinators who then tasked local Australians. It took roughly ten months from the first Australian attack to a public attribution. During that window, the attacks had their full psychological effect and the principal paid no diplomatic price.
• Cost – A professional assassination contract in the Alinejad case was priced at $500,000. A HAYI-era arson operative was paid, by most accounts, a fraction of the cost of a used car. For the price of one professional operation, a principal can commission dozens of gig tasks.
• Volume over quality – This is the point most commentary misses. A principal who can launch twenty cheap attacks in six weeks does not need any single one to succeed. The *campaign* is the weapon: it forces protective deployments, drains police overtime, frightens communities, and dominates headlines. The UK’s response to the spring 2026 wave included a dedicated Community Protection Team, 1,000 extra officer shifts a week, and a record £250 million three-year protective-security package. Measured against what the principal spent, that is a very favorable exchange.
• Legal arbitrage – Until July 2026, British prosecutors generally had to prove a foreign-power connection to bring the heaviest national-security charges against a hired arsonist. Where that link could not be proved, a state-directed attack could be prosecuted as ordinary criminal damage. The model deliberately operated in that gap.
• Losses are pre-absorbed – Arrests cost the principal nothing it had invested. The operative carries the entire legal risk.

CommandEleven Intelligence Assessment:

The single most common analytical error in gig-terrorism cases is treating low sophistication as exculpatory. When Al Jazeera’s analysts noted after Fairford that a state wanting to hit the base would probably have assembled a more capable team, the observation was reasonable on its own terms. But under the gig model, capability is not what the principal is buying. The correct question is not “was this competent enough to be state-directed?” but “was this cheap enough, fast enough and deniable enough to fit the procurement pattern?” (ASSESSED)

Lineage: The Gig Model Before It Had a Name

The HAYI campaign did not appear from nowhere. It is the most recent step in a fifteen-year progression that runs from professional criminal contractors toward disposable street labor.

FIGURE 2: Lineage Timeline, 2011–2026

Three patterns stand out.

• The labor is getting younger and cheaper –  In 2022 the IRGC was paying a senior organized crime figure. By 2024, Foxtrot was supplying teenagers. By 2026, the Rotterdam synagogue suspects were aged 17 to 19, three of the four people arrested over the foiled Paris bank bombing were minors, and one of the Hatzola arsonists was 17 when charged.
• The link to the principal is getting thinner – The Leyton arsonists did not know they were working for Wagner. The Zeraati knifeman claimed not to know his victim was a journalist. The Natland jury heard he neither knew nor cared who he was being sent to kill. Thin links are the point: an operative who does not know the principal cannot betray them.
• Attribution is getting faster – Australia took ten months. The UK took under four months to go from the Hatzola arson to designating the brand behind it. The US took under ten weeks to charge the alleged coordinator. Western services are learning to read the model, and that learning curve matters for Fairford.

The Parallel Track: Russia’s “Disposable Agents”

Any honest account of the gig model has to include Russia, for two reasons: Moscow industrialized the approach in Europe first, and British police confirmed this week that Russia is one of the lines of inquiry at Fairford.

German, Polish, Czech and Baltic services have described the same structure Iran uses, under a different name: the “disposable” or “single-use” agent. Recruits are found through what look like ordinary part-time job adverts, paid small sums, and tasked with photographing facilities, vandalism, arson or worse. Czech intelligence has stressed that many recruits do not know they are working for Russia at all.

The scale reported in 2026 is significant:

• The ICCT documented 151 Russian-linked sabotage incidents in Europe between February 2022 and February 2026, with the pace rising in the second half of that period; Poland accounted for the largest share. (ASSESSED – reported via secondary coverage of the ICCT dataset; CommandEleven Intelligence has not reviewed the underlying data.)
• Investigative reporting cited in that coverage counted more than 20 million Telegram recruitment posts disguised as easy job offers in the first half of 2026 alone. (SPECULATIVE – single investigative source; the figure cannot be independently verified and likely includes non-sabotage fraud.)
• Poland’s Internal Security Agency has reportedly described Russia running two tracks at once: the Telegram disposable-agent pipeline, and a second, more professional track drawing on organized crime, former soldiers and mercenaries. (ASSESSED – reported, not published by the agency.)
• Threat researchers at Truesec reported in September 2026 that Russia-linked actors have begun recruiting from “The Com,” a largely online subculture of young men that already trades in violence-for-hire, and linked at least two UK attacks to that activity. (SPECULATIVE – single vendor report.)

The Polish two-track observation is the most important item on this list for Fairford. If Russia runs a professional track alongside its gig track, there is every reason to believe Iran does too. The Alinejad plot shows it can. The question at Fairford is which track, and whose.

The Escalation Arc: From Hatzola to Fairford

This is the spine of the dossier. Laid out in sequence, the 2026 campaign shows a clear widening of target type over six months, with no matching rise in operative capability.

FIGURE 3: The Escalation Ladder – see `fig3-escalation-ladder.png`

Phase 0: Activation (28 February – early March)

The US-Israeli war with Iran began on 28 February 2026. HAYI’s Telegram channel had been created in 2024 and left dormant; it came to life in early March. Europol warned of elevated risk to Jewish and US-linked sites in Europe. On 9 March, according to US prosecutors, Kata’ib Hezbollah commander Mohammad Baqer al-Saadi posted a public call to arms to “warriors of Islam” the same day the first European attack took place.

The dormant channel is itself a finding. A brand registered two years before the war and switched on within days of it is not a grassroots movement. It is a pre-positioned capability, the online equivalent of a sleeper cell. (ASSESSED)

Phase 1: Soft community targets (9 – 24 March)

• 9 March, Liège – a makeshift device damaged a synagogue.
• 13 March, Rotterdam – synagogue arson; five suspects aged 17 to 19 arrested, prosecutors citing terrorist intent.
• 14 March, Amsterdam – a device exploded outside a Jewish school.
• 23 March, Golders Green, London: the Hatzola arson – At about 1:40 a.m., hooded attackers doused four volunteer ambulances in the car park of the Machzike Hadath synagogue. Oxygen cylinders aboard the vehicles exploded, damaging the synagogue and shattering windows in neighboring flats. Damage was put at around £1 million.
• 24 March, Antwerp – a car set alight in the Jewish quarter; two minors arrested.

Hatzola became the defining image of the wave for three reasons. The target was a lifesaving service, not a symbol. The attack put life at risk through a secondary explosion the attackers may not have anticipated. And it was the first time the model struck in Britain under the HAYI brand, triggering the national response that followed.

Hatzola, confirmed record – Four men – Hamza Iqbal (20), Rehan Khan (19), Judex Atshatshi (18) and Saif Ali (18) – pleaded guilty at the Old Bailey on 28 August 2026 to destroying or damaging property while reckless as to whether life would be endangered. Three set the fires; one waited in a getaway car. A fifth defendant has pleaded not guilty to assisting an offender. Sentencing is expected in spring 2027 after a related trial. (CONFIRMED) Notably, the prosecution suggested a terrorist connection but did not raise Iranian direction in court; that link rests on the UK government’s July statement and the US complaint against al-Saadi, not yet on a British courtroom finding. (DATA DEFICIT – the recruitment and payment trail for the Hatzola operatives has not been made public.)

Phase 2: Target diversification (15 March – 17 April)

Within a week of the first synagogue attacks, the target set broadened beyond Jewish community sites:

• 15 March, Amsterdam – an explosive device at an office complex housing Bank of New York Mellon. Al-Saadi allegedly posted the claim video the next day with a warning to Europeans to keep away from American and Zionist interests.
• 28 March, Paris – police foiled an attempt on a Bank of America office as a suspect tried to light the device; four arrested, three of them minors.
• 15 April, London – an attempted arson against the Park Royal offices of Iran International, the Persian-language broadcaster whose presenter had been stabbed in 2024; the same night, a firebomb attack on Finchley Reform Synagogue failed to ignite.
• 17 April, London – HAYI claimed it planned to attack the Israeli embassy with “dangerous substances.” Jars found nearby proved harmless. Also, that night, a failed arson at a Hendon building formerly used by a Jewish charity.

This is the first escalation step, and it is significant – The campaign moved from purely antisemitic targeting to American commercial interests, dissident media and diplomatic premises: target categories that map directly onto the IRGC’s traditional external-operations priorities. The antisemitic wave was the entry point, not the whole agenda. (ASSESSED)

Phase 3: Brand opportunism (29 April)

On 29 April, a 45-year-old man stabbed two Jewish men on Golders Green Road. HAYI claimed the attack within about an hour and released footage soon after. Investigators judged the claim likely opportunistic: the attacker had no identified link to the network. Tech Against Terrorism noted that attaching the brand to an attack with physical casualties would mark a significant escalation even if HAYI had no role in it.

CommandEleven Intelligence Assessment – Opportunistic claiming is a hallmark of a brand built for perception rather than operations. It inflates the apparent reach of the campaign at zero cost, and it muddies attribution for every future incident. After 29 April, any violence against a Jewish target in Europe could be claimed, and each false claim trained the public to assume Iranian direction. That cuts both ways, as Fairford now shows. (ASSESSED)

Phase 4: The state strikes back (April – July)

The response was the fastest and broadest Western reaction to Iranian proxy activity to date:

• By 6 May – more than 80 arrests in the UK connected to the London attacks; a dedicated Metropolitan Police Community Protection Team announced. (CONFIRMED)
• 01 May – UK terrorism threat level raised to SEVERE, citing, among other factors, the elevated threat to Jewish and Israeli people and institutions. (CONFIRMED)
• Late April – the Independent Reviewer of Terrorism Legislation, Jonathan Hall KC, called the wave “the biggest national security emergency” in almost a decade and urged legislation to proscribe the IRGC. (CONFIRMED)
• 15 May – the US Justice Department announced the arrest of al-Saadi, a 32-year-old Kata’ib Hezbollah commander, charging him with six terrorism counts. The complaint alleges that he and associates planned, coordinated and claimed at least 18 attacks in Europe and two in Canada in the name of HAYI, which it describes as a component of Kata’ib Hezbollah, and that he tried to task an undercover officer against a Manhattan synagogue and Jewish institutions in Los Angeles and Scottsdale. (CONFIRMED as charges; allegations untested at trial.)
• 10 June – more than 20 governments issued a joint statement condemning Iran’s use of international and local criminal networks for attacks across North America, Europe and Australia. (CONFIRMED)
• 13 July – days after the National Security (State Threats) Act 2026 received Royal Assent, the Home Secretary designated the IRGC, HAYI (styled by the government as the Islamic Movement of Companions of the Right, IMCR) and Russia’s GRU Volunteer Corps. The government stated that IRGC Quds Force officers “almost certainly directed IMCR attacks across Europe.” (CONFIRMED as government attribution.)

Phase 5: A strategic military target? (27 September)

Then came Fairford. The ladder that began with a synagogue in Liège and ran through ambulances, banks and a broadcaster may have reached a US bomber base in Gloucestershire. Or it may not have. The next section sets out what the public record can and cannot support.

What escalated, and what did not – Across six months, the targets climbed the ladder: community sites → US commercial interests → dissident media → diplomatic premises → potentially a strategic air base. The means did not. Every confirmed HAYI-era attack used accelerant, crude devices, or threats, and many failed outright. That mismatch is the central analytical fact of the campaign. A gig workforce can be pointed at harder targets; it cannot be made more capable by pointing it there. (ASSESSED)

Fairford: Known, Claimed, Missing

Confirmed

• At about 12:45 a.m. on Sunday 27 September, a resident of Whelford, about two miles from RAF Fairford, reported three white vans blocking a road and a group of hooded men in balaclavas. Armed officers responded within minutes and a major incident was declared. (CONFIRMED)
• Five men, all British nationals from London aged 23 to 25, were arrested on suspicion of explosives offences and later of preparing a terrorist act. Around 85 homes were evacuated while the vans were examined. (CONFIRMED)
• Counter-terrorism police stated on Tuesday that “no improvised explosive devices were found” in the vehicles. (CONFIRMED)
• All five were released on police bail on Monday 28 September under stringent conditions. Police stressed the investigation continues and that foreign-state involvement has not been ruled out; lines of inquiry include Iran, Russia and non-state militants. (CONFIRMED)
• RAF Fairford hosts US B-1 bombers that have been flying missions against Iran. In July, the IRGC declared that bases used for attacks on Iranian territory would be treated as legitimate targets. (CONFIRMED)
• Iran’s embassy in London has categorically denied involvement. (CONFIRMED)

Claimed

• President Trump said the men had been under surveillance for a long time and intended major damage to US interests. (ASSESSED – no supporting evidence released; one analyst quoted by Al Jazeera suspected a mix-up with a different surveillance target.)
• Secretary of State Rubio said the plot “clearly involved the hands of a foreign actor” and that more would come out. (ASSESSED – official claim, no public evidence.)
• On 30 September, Prime Minister Andy Burnham told the BBC there were “strong indications that Iran played a part,” while calling the investigation ongoing and complex. (ASSESSED – the most significant statement to date, and a notable shift from Defence Secretary Wes Streeting’s earlier refusal to draw a connection.)
• Reported police remarks at the bail announcement noted that such activity may be committed by proxies for a foreign state, often for financial gain. (SPECULATIVE: CommandEleven Intelligence has seen this only in secondary social-media reporting of the police statement.)

Missing (DATA DEFICIT)

• What was in the vans, and whether anything found was capable of causing damage.
• What the men were doing near the base, and whether they intended to enter it.
• Any evidence of recruitment, tasking, payment or communication with a handler.
• Whether any claim of responsibility was issued. (None is publicly known.)
• Why suspects the US describes as a serious threat were released on bail within about 36 hours.

Competing hypotheses

CommandEleven Intelligence Assessment – On the public record, H1 is the leading hypothesis, but not a dominant one. The British Prime Minister does not say “strong indications” lightly, and his statement likely reflects intelligence not yet released. But the forensic picture – no devices, rapid bail, no claim – is thinner than the political rhetoric around it, and the confident US statements preceded the British ones by several days. Until the tasking chain is shown, Fairford should be described as a suspected, not established, instance of gig terrorism. (ASSESSED – low confidence on attribution)

Indicators that would move the assessment

• Toward H1/H2 – charges under the National Security (State Threats) Act 2026 or National Security Act 2023; disclosure of payments, crypto transfers or Telegram tasking; a HAYI-style or successor-brand claim; links to anyone previously charged in the spring wave.
• Toward H3 – evidence of GRU-linked recruiters, Russian-language tasking, or overlap with known disposable-agent networks.
• Toward H4/H5 – public-order or lesser criminal charges only; charges dropped; evidence of protest material or ordinary criminal purpose.

Anatomy of a Tasking Chain

The following describes the organizational structure that court records and official statements have revealed across the cases above. It deliberately contains no operational detail.

FIGURE 4: The Tasking Chain

• Principal – IRGC Quds Force or Iran’s Ministry of Intelligence (MOIS). Sets objectives and target categories, provides money and, in some cases, target information. In the Alinejad case, IRGC officials passed targeting information about the victim’s home down the chain. (CONFIRMED)
• Facilitator / cut-out – A trusted intermediary outside Iran, often in a third country: a Kata’ib Hezbollah commander in Baghdad (al-Saadi), a crime boss sheltering in Iran or Turkey (Foxtrot’s Rawa Majid), or the unnamed overseas facilitators ASIO described. This is the layer that absorbs attribution risk for the state. (CONFIRMED in each named case.)
• Coordinator / recruiter – Finds and manages local labor, frequently through Telegram, Snapchat or criminal networks, and often under a handle (“Agent 47” in the Natland case; a 17-year-old known as “Generalen” who hired Natland). An ICCT researcher described a controller guiding a cell leader by phone, with materials supplied close to ready. (CONFIRMED/ASSESSED)
• Operative – Carries out one task. Frequently young, financially precarious, sometimes already involved in crime, sometimes coerced. Often unaware of the principal. (CONFIRMED)
• Claim and amplification layer – A brand (HAYI) whose content is pushed through a small set of anchor channels. The ICCT found that four channels, two linked to Iraqi militias including Asa’ib Ahl al-Haq and two pro-Iranian aggregators with links to sanctioned pro-Russian networks, anchored every HAYI dissemination cycle. (ASSESSED – ICCT research.)

Two further layers appear in some cases:

• A reconnaissance layer, separate from the attack layer. In March 2026, two men were charged in London under the National Security Act with assisting a foreign intelligence service after allegedly surveilling Jewish individuals and locations. (CONFIRMED as charges.) Separating surveillance from attack is standard intelligence tradecraft; it means the person who strikes need never have seen the target before.
• A coercion layer – Natland told the court he feared Foxtrot would kill him if he withdrew. (CONFIRMED as testimony.) The “gig” framing implies free contracting; the reality often includes debt, threat and fear.

Where the chain is weakest

The facilitator layer is the choke point. Operatives are infinitely replaceable, and the principal is out of reach. But facilitators are few, trusted, and hard to replace quickly, and they are the people who tie the brand to the state. The al-Saadi arrest is the clearest proof: one arrest at this layer produced charges covering 18 European attacks, two Canadian attacks and a planned US strike. Removing a facilitator is worth more than removing a hundred operatives. (ASSESSED)

The Brand Layer: HAYI as Astroturf

HAYI presents itself as a Khomeinist Islamic movement. The evidence suggests it is a brand manufactured for deniability and amplification.

• Pre-positioned – channel created in 2024, activated only after the war began. (CONFIRMED)
• Borrowed identity – its name echoes an Iraqi militia previously designated by the US, and its imagery mimics the logos of Iran-backed militias. (CONFIRMED)
• Tells of outside authorship – analysts noted a misspelling in the Arabic logo, a Soviet-designed sniper rifle in place of the rifle motifs standard among Iranian proxies, and a total absence of Persian in its communications. (ASSESSED)
• Perception-first design – analysts at the FDD’s Long War Journal assessed that the objective so far was visibility rather than mass casualties, turning low-cost attacks into outsized fear through rapid media amplification. (ASSESSED)
• Opportunistic claiming – the Golders Green stabbing claim. (ASSESSED)

Why this matters – A brand that exists mainly to be seen can be retired and replaced at almost no cost. The UK’s designation of HAYI was right and necessary, but it designated a label. The facilitators, recruiters and anchor channels that produced the label are the enduring capability.

FIGURE 5: HAYI Campaign Tracker, March–April 2026

The Legal and Policy Response

United Kingdom

• National Security Act 2023 –  The Leyton arson produced the first convictions under the Act for activity linked to a foreign state; the ringleader received 23 years in total. (CONFIRMED)
• National Security (State Threats) Act 2026 – Fast-tracked after the London attacks. Designated groups are treated like foreign intelligence services under key National Security Act offences, so prosecutors no longer need to prove a foreign-power link case by case. Supporting a designated group carries up to 14 years; sabotage, including arson, on a designated group’s behalf can carry life. (CONFIRMED)
• Designations (13 July 2026) – IRGC, HAYI/IMCR, GRU Volunteer Corps. (CONFIRMED)
• Protective security – £250 million over three years, funding more than 500 additional officers for Jewish community protection. (CONFIRMED)

United States

Material-support charges against al-Saadi under existing foreign terrorist organization law, with both Kata’ib Hezbollah and the IRGC already designated. The US model shows the value of having the principal pre-designated: every link in the chain becomes material support. (CONFIRMED)

Australia

First expulsion of an ambassador since the Second World War, and listing of the IRGC, after ASIO attributed two arsons to Tehran. (CONFIRMED)

The gap that remains

Every one of these tools acts on the supply side of accountability: prosecuting operatives and naming principals. None yet acts effectively on the recruitment market itself: the job-board channels, the online subcultures, and the financial precarity of the young men who answer the adverts. Germany’s Federal Criminal Police Office (BKA) has launched a public-awareness campaign warning that people recruited for small sums will face consequences. That is the right direction, but deterrence aimed at 17-year-olds is a weak lever against a principal that regards them as disposable. (ASSESSED)

Where the Term Helps, and Where It Misleads

“Gig terrorism” is useful shorthand. It captures the transactional, platform-mediated, disposable nature of the labor. But it carries four distortions that analysts and editors should correct for:

• It implies voluntary, free contracting – Many operatives are coerced, indebted or threatened. Treating them all as willing freelancers misreads both culpability and disruption opportunities.
• It flattens motive – Some recruits are purely mercenary; others are ideologically primed and need only logistics. Those groups respond to very different prevention approaches.
• It encourages premature attribution – Once the frame is in circulation, every group of young men near a sensitive site looks like an IRGC tasking. Fairford is the live test of that risk.
• It hides the professional tier – A focus on disposable teenagers obscures the fact that the same principals keep a professional criminal tier, and a pre-positioned sleeper tier, in reserve for higher-value targets.

Outlook: The Next Six to Twelve Months

• Successor brands – Following HAYI’s designation, expect either a new front name or unbranded activity. The first successor claim will be an important indicator of whether the facilitator layer survived the al-Saadi arrest. (Moderate confidence)
• Military and logistics targets – Fairford, whatever its origin, has publicly demonstrated the psychological and political return on approaching a US-used base: a major incident, an evacuated village, a transatlantic political row, and wall-to-wall coverage, with no device found. That return is visible to every hostile service. Other bases hosting US assets engaged against Iran should be treated as at elevated risk of reconnaissance and harassment by hired proxies. (Moderate confidence)
• Convergence of labor markets – Iranian and Russian recruiters will increasingly draw from the same online pool. Mixed or ambiguous attributions will become more common. (Moderate confidence)
• First prosecutions under the 2026 Act – The first case to test the designation regime in court will set the practical boundary between gig terrorism and ordinary crime. If Fairford produces charges, it may be that case. (Low confidence on timing)
• Tier escalation – If gig-tier attempts against harder targets keep failing, principals may shift toward the professional criminal tier, which is costlier, rarer, and more dangerous. This is the scenario with the highest consequence and should be watched most closely. (Low confidence; high impact)

Indicators and Warnings

For security managers at community sites, bases, defence-industrial facilities and media organizations, the organizational-level indicators of gig-model activity are:

• Reconnaissance by people with no apparent connection to the site, particularly repeated filming or photography by young people.
• Online “easy money” job offers that involve photographing facilities or delivering items, circulating in local channels.
• A surge in claims by new or unfamiliar brands after incidents, especially claims issued within hours.
• Incidents clustered at night, involving multiple recruits and getaway vehicles, with rapid filming of the act itself.
• Any overlap between local criminal networks and individuals previously charged in state-threat cases.

What This Dossier Does Not Claim

• It does not claim that the Fairford suspects were tasked by Iran, by Russia or by anyone. That remains unproven.
• It does not claim that every antisemitic attack in Europe in 2026 was state-directed. Many were not, and the Golders Green stabbing claim appears to have been opportunistic.
• It does not treat US or UK government attributions that have not been tested in court as findings of fact; they are marked as claims or government attributions throughout.
• It does not claim that the individuals charged or convicted in these cases knew who ultimately directed them, except where a court has found so.
• It does not provide, and CommandEleven Intelligence will not publish, operational detail on methods, devices or targeting.

Companion Reading: CommandEleven Intelligence IRGC Series

• Iran’s Homeland Threat to the US: Sleeper Cells, Drones, and the Arbabsiar Precedent – the pre-positioned, conditions-based tier this dossier contrasts with.
• The Iranian Plot to Bomb a Washington DC Restaurant: The Arbabsiar Case
• IRGC Sleeper Cells in the United States: Intelligence Compilation
• IRGC in Latin America: Iran’s Covert Network in the Western Hemisphere – the cartel nexus, the professional-criminal tier in another theatre
• IRGC Proxy Network in the Middle East: Axis of Resistance Explained – Kata’ib Hezbollah’s place in the network that produced al-Saadi
• Iran’s Mosaic Defense Doctrine – the decentralization principle this dossier sees applied to external operations
• The Berlin-Vienna Network: Mapping Hamas’s Turkey-Coordinated European Cell – a contrasting model: a trained, armed, ideologically committed network rather than hired labor

Sources

Official and court sources

• UK Home Office / FCDO, “Support for IRGC outlawed in crackdown on foreign state proxies,” 13 July 2026
• US Department of Justice, “Iraqi National Arrested and Charged with Providing Material Support to Iranian-Backed Terrorist Organizations…,” 15 May 2026
• US Department of Justice, “Two Russian Mob Leaders Sentenced to 25 Years… on Behalf of the Iranian Government,” October 2025
• US Treasury, “Treasury Sanctions Swedish Gang and Leader Serving Iranian Regime,” March 2025
• Metropolitan Police, “Four plead guilty to Golders Green ambulance arson attack,” 28 August 2026
• Crown Prosecution Service, Leyton arson / National Security Act case summary