Breaking news · U.S.–Iran conflict · United Kingdom · Military security · State threats · DINA analysis

NEW YORK and LONDON — November 10, 2026: Federal prosecutors allege that three men working through an Iran-aligned network supported nearly 20 attacks and attempted attacks and helped organize the September RAF Fairford plot, including through coded messages allegedly relayed from a New York jail.

The superseding indictment charges dual Iranian-Iraqi national Mohammad Baqer Saad Dawood Al-Saadi, Iranian national Mohsen Mohajeri and Iraqi national Mohammed Ali Al-Hassani. Prosecutors allege that the defendants supported Kata'ib Hizballah and Iran's Islamic Revolutionary Guard Corps, which the United States designates as foreign terrorist organizations. The filing does not establish their guilt, direct Iranian-government responsibility or the accuracy of every intelligence and translation judgment underlying the case.

What the new indictment alleges

According to the indictment and Justice Department release, Al-Hassani and Mohajeri were in Iran when the Fairford operation was attempted. Prosecutors allege that Al-Hassani used contacts in Britain, paid for surveillance of the base perimeter in August and on September 26 directed people driving three vans toward RAF Fairford. Some of the vans allegedly contained barrels of fuel. At least two encountered a security roadblock, and British authorities later recovered all three vans and arrested their occupants.

Al-Saadi was already detained in the United States awaiting trial on earlier terrorism charges. Prosecutors allege that he used calls with relatives in Iraq to pass coded messages to Mohajeri and Al-Hassani. The filing says that three days before the Fairford incident, Al-Saadi referred to Al-Hassani by an alias and told relatives to give him money “so we can do it.”

Reuters reported that Al-Saadi's lawyers disputed the government's interpretation in an October 14 filing, calling the coded-language theory speculative and questioning translations from Arabic. His lawyer declined to comment on Tuesday's superseding indictment. DINA has not independently authenticated the calls, translations, surveillance videos, financial transfers or alleged operational instructions.

The eight counts include alleged conspiracies to provide material support to Kata'ib Hizballah and the IRGC, material support for terrorism, attempted terrorism transcending national boundaries, conspiracy to bomb a place of public use, attempted destruction of property by fire or explosive and financing terrorism. The statutory penalties described by prosecutors range up to life imprisonment on some counts, but penalties would apply only after conviction and would be determined by a judge.

Confirmed fact: a federal grand jury returned the superseding indictment and the Justice Department unsealed it on November 10. Government allegation: the three defendants coordinated the Fairford plot and a wider campaign on behalf of an Iran-aligned network. Defense position: Al-Saadi has pleaded not guilty and his lawyers dispute the coded-message interpretation. Still unresolved: the defendants' guilt, the full evidence, the roles of the people arrested in Britain and whether Iranian officials ordered or knowingly approved the alleged conduct.

Earlier British attribution and MI5 warning

LONDON — Updated October 13, 2026: Britain's domestic intelligence chief says Iran-linked operations led to more than 50 arrests in the United Kingdom over the last year and that Iranian ambitions have expanded toward “harder targets” such as military sites. MI5 Director General Sir Ken McCallum declined to discuss the live RAF Fairford investigation, leaving the government's specific evidence in that case undisclosed.

The new assessment follows the British government's declaration that a September 27 security incident near RAF Fairford was highly likely coordinated in Iran and “almost certainly directed” by Iran's Islamic Revolutionary Guard Corps, escalating an earlier investigation into activity near the U.S.-operated bomber base.

Prime Minister Andy Burnham announced the assessment to Parliament on Monday. A joint statement from the United Kingdom, United States and 27 other governments recognized Britain's attribution and said the incident demonstrates the IRGC's willingness to project hostile activity through covert networks and proxies.

What the attribution means: This is the British government's formal intelligence assessment. It is not a judicial finding, and the government has not released the intelligence, communications or financial records underlying it. Iran denies involvement. DINA therefore reports the attribution as the UK's official conclusion—not as independently proved fact.

Britain separately summoned Iran's ambassador and sanctioned two Iranian nationals: Ruhollah Bazghandi, identified by the Foreign Office as head of counterespionage operations within the IRGC, and Shahram Ali Reza Tamarzadeh Jakki, described as a facilitator of the Zindashti criminal network involved in plots against Iranian dissidents. The sanctions impose an immediate asset freeze, travel ban and director disqualification. The Foreign Office did not say the two men were charged in, or directly responsible for, the Fairford incident.

MI5 describes a wider Iran-linked threat

In his October 13 annual threat address, McCallum said MI5's state-threat caseload had quadrupled over the past decade and now consumes more resources than during the Cold War. He said Iran-linked operations produced more than 50 arrests in the United Kingdom during the preceding 12 months.

McCallum said Iranian activity continued to use criminal proxies against opposition figures, Iranian media organizations and Israeli sites. He also attributed a spring wave of arson and sabotage targeting Jewish communities in Britain and Europe to an IRGC-linked front group, while saying the major 2026 shift was an ambition to target military sites.

Important limitation: The arrest total covers multiple Iran-linked operations and does not mean 50 people were charged, convicted or connected to RAF Fairford. McCallum did not publicly identify the military sites at issue, release supporting intelligence or name Fairford in the published speech. Reuters reported that he declined to address the Fairford incident because the investigation remains active.

British arrests and U.S. charges are not interchangeable

British authorities previously arrested seven men in the Fairford investigation. They were released on bail, and DINA had not located a British charging announcement by the updated cutoff. Police found gasoline in three vans connected to the initial five suspects but reported finding no explosives, according to the Associated Press.

The British arrestees were described as six British nationals and one dual British-Iranian national, all in their 20s. The three defendants named in the U.S. superseding indictment are different people based on the public descriptions: Al-Saadi is detained in the United States, while prosecutors say Mohajeri and Al-Hassani were in Iran during the attempted operation. The U.S. filing therefore does not itself charge or establish the guilt of the seven people arrested in Britain.

The United States moved its B-1 bombers from RAF Fairford after officials received threat information. U.S. officials previously told Reuters they feared a possible Iranian drone attack, while British authorities had not publicly confirmed that method. Monday's attribution identifies alleged state direction but still does not establish publicly whether a drone was acquired, positioned or operational.

Why this matters

RAF Fairford has supported U.S. bomber operations in the ongoing conflict with Iran. A state-directed plot against the base would mark an attempted extension of that war onto British territory and raise urgent questions about force protection, allied intelligence sharing and civilian safety around overseas U.S. installations.

The multinational statement gives the attribution diplomatic weight, but collective endorsement is not a substitute for public evidence. Governments may legitimately protect intelligence sources and an active investigation; they also bear the burden of substantiating an allegation that could deepen an interstate conflict.

The sanctions are likewise significant but should not be misdescribed. They are executive restrictions, not criminal convictions, and the British statement links them broadly to overseas hostile activity rather than explicitly to the Fairford case.

DINA analysis: attribution raises the accountability burden

This section is independent DINA analysis. Britain's shift from saying there were “strong indications” of Iranian involvement to an explicit IRGC attribution is a material escalation. It strengthens the political basis for defensive measures and allied coordination, but it also heightens the need for Parliament, Congress and independent courts to test the evidence.

The superseding indictment supplies substantially more public detail than the earlier intelligence attribution: named defendants, alleged communications, dates, financial activity, surveillance and a described operational sequence. That is a meaningful accountability advance because the allegations can now be challenged in an adversarial court process. It is not the same as proof. Prosecutors must disclose admissible evidence, establish reliable translations and connect each defendant to each charged offense beyond a reasonable doubt.

The most responsible public conclusion remains narrower than the government's rhetoric: Britain has formally attributed the incident to Iran's IRGC; 28 other governments have recognized that attribution; Iran denies involvement; seven men remain uncharged; and the underlying intelligence is not public.

MI5's broader warning materially strengthens the case that British authorities are treating Iranian proxy activity as a sustained national-security threat rather than an isolated episode. It does not independently prove the government's Fairford attribution. That distinction is essential: an intelligence service's general threat assessment can provide context, but it cannot substitute for case-specific evidence or a fair criminal process.

Because RAF Fairford was used for strikes on Iran, officials must also explain whether base security, operational decisions or public statements increased risks to nearby communities. Accountability must extend both to any state-backed plot and to the safeguards governing foreign military operations from British soil.

Urgent follow-up and records requests

  • Obtain the full superseding indictment, docket entries, detention filings, discovery schedule and any judicial rulings on the alleged coded calls and translations from United States v. Al-Saadi et al., No. 26 Cr. 220 in the Southern District of New York.
  • Seek the October 14 defense filing challenging the government's translation and coded-message theory, plus the prosecution's response and any court findings.
  • Ask U.S. and British authorities to identify which evidence was shared across the investigation and whether any of the seven British arrestees are alleged to have driven or occupied the three vans.
  • Request an unclassified summary of the evidence supporting the UK's assessment that the incident was coordinated in Iran and directed by the IRGC.
  • Ask Counter Terrorism Policing whether investigators found drones, components, flight plans, surveillance records, communications or financing connected to the base.
  • Seek the warrant returns, custody records and charging decisions for all seven arrestees, subject to fair-trial protections.
  • Ask the Foreign Office whether either newly sanctioned individual is alleged to have any operational connection to RAF Fairford.
  • Request a chronology of warnings, bomber movements, civilian evacuation orders and allied notifications from September 27 onward.
  • Seek parliamentary and congressional briefings on the decision to use RAF Fairford for strikes on Iran and the resulting force-protection measures.
  • Track any Iranian diplomatic response, criminal charge or court filing and distinguish new evidence from political assertion.
  • Request the number of charges, prosecutions and convictions arising from the more than 50 arrests in Iran-linked operations, separated by alleged offense and operation.
  • Ask MI5 and Counter Terrorism Policing for an unclassified explanation of what distinguishes the cited military-target cases from surveillance, hostile reconnaissance or preparatory conduct.

Related DINA coverage

Sources

  1. U.S. Attorney's Office, Southern District of New York — superseding-indictment announcement and allegation summary, November 10, 2026
  2. U.S. District Court filing — redacted superseding indictment in United States v. Al-Saadi et al.
  3. Reuters — indictment, defense position and Iranian denial, November 10, 2026
  4. MI5 — Director General Sir Ken McCallum's annual threat update, October 13, 2026
  5. Reuters — MI5 warning on Iran-linked operations, military targets and the Fairford-investigation limitation, October 13, 2026
  6. UK Foreign Office — joint statement recognizing the UK's RAF Fairford attribution, October 12, 2026
  7. UK Foreign Office — ambassador summons and sanctions against two Iranian nationals, October 12, 2026
  8. Reuters — Prime Minister's parliamentary statement, Iranian denial and RAF Fairford security background, October 12, 2026
  9. Associated Press — arrests, bail status, gasoline recovery and bomber withdrawal, October 12, 2026
  10. Counter Terrorism Policing — arrest chronology and investigation status

Updated verification cutoff: November 10, 2026, 4:52 p.m. Eastern. DINA reviewed the Justice Department release, the superseding indictment, Reuters' report and defense-position summary, earlier British government statements, MI5's published assessment and prior DINA reporting. The accompanying DINA illustration remains conceptual and is not a photograph, reconstruction, charging document or item of evidence.