"They don't want to sacrifice better-equipped, better-trained people who, if arrested, can compromise the Quds Force, give up a lot of inside information," said the Iranian-born Alfoneh.
In Burgas, Details Trickle Out
The successful strike in Burgas, a low-cost beach resort popular with young Israelis and Scandinavians, took place on the 18th anniversary of the AMIA bombing in Argentina. According to news reports, Bulgaria's prime minister has described a sophisticated conspiracy by "exceptionally experienced" terrorists.
The scope was limited, however. And there were sloppy details.
The suspected bomber carried a fake driver's license from Michigan, which has a large population with Middle Eastern roots, according to U.S. and European officials. The forger put a Louisiana address on the license, an error that could have endangered the operation. A suspected accomplice carried another fake Michigan driver's license, this one with a Michigan address, U.S. law enforcement officials say. A travel agency refused to rent a car to the nervous suspected accomplice before the attack because the license raised suspicions, officials said.
The decision to hit Israeli tourists aboard a bus further reflects limitations, experts say.
"The attempts at attacking embassies and embassy personnel have been failures, so they are shifting to soft targets," Alfoneh said.
Bulgarian authorities say the bomber and the accomplice, who apparently remains at large, arrived by plane about a month earlier. The bomber is believed to have flown in via Germany and the accomplice via Belgium, according to U.S. and European officials. Police following circumstantial leads have questioned a third person, a man of Turkish descent, but have not linked him to the attack so far, a U.S. law enforcement official said.
The target, symbolic date and context of previous activity implicate Iran and Hezbollah, counterterror officials say.
"I am convinced the origin of this attack is Shiite," an Italian counterterror official said. "In the last two years, there was growing concern that they were going to come here to Europe to do something. They know if they do it in Israel, it's more difficult and retaliation is more likely."
Israel has not offered concrete proof to back up its repeated accusations. Hezbollah and Iran deny responsibility. Iran accused Israel of orchestrating the attack on its own citizens. The process of identifying the attackers has been slow and the fingerprints sent to European and U.S. agencies and Interpol have not produced a match, according to counterterror officials.
As a result, doubts endure. The apparent use of a suicide bomber perplexes some analysts. Iran and Hezbollah carried out major suicide attacks in the 1980s and early 1990s. The tactic then spread to Sunni groups. Al Qaeda began carrying out "martyrdom operations" in the mid-1990s and made them a signature. At the same time, Iran and Hezbollah have greatly curtailed the use of suicide bombers, counterterror officials said.
The backpack bomb itself is a point of contention. The U.S. law enforcement official said aspects of the device in Burgas resembled bombs in the suspected Iranian triple plot in February. But the TNT-based explosive differs from the Iranian-made plastic explosive in the February case, according to another U.S. law enforcement official, who remains skeptical.
"I'm not convinced it's Iran and Hezbollah," he said. "I'm waiting to see the evidence."
Complicating the issue, there has been no credible claim of responsibility. Al Qaeda usually follows attacks with videos featuring declarations by the suicide bombers, the network's leaders or both. Iran and Hezbollah keep silent.
"It creates more fear," the Italian counterterror official said. "Ambiguity suits them very well. The attack itself sends the message."
Whoever they were, the masterminds probably chose Bulgaria because it has weaker law enforcement and more porous borders than most of the European Union. Bulgaria has the EU's highest proportion of Muslims, about 12 percent of the population, though so far no public information has suggested a link to the local Islamic community. Hezbollah operatives have previously been detected in Bulgaria, U.S. law enforcement officials say.
Western intelligence officials warned of Bulgaria's potential as a theater for terror five years ago. Intelligence revealed that Hezbollah chiefs and Iranian intelligence officials had put Bulgaria on a list of nations propitious for developing plots against Western targets. Iranian spy agencies prefer developing countries, where it's easier to cover their tracks, experts say.
Conflict with Israel intensified in February 2008 after a car bomb in the heart of Damascus killed Imad Mughniyah, a notorious Hezbollah military leader and ally of Iranian intelligence. Iranian and Hezbollah leaders publicly accused Israel and vowed revenge.
Within weeks, a plot was under way against the Israeli embassy in Azerbaijan. Police broke up the cell in May 2008. The suspects included Azeri accomplices, a senior Hezbollah field operative and a Hezbollah explosives expert. Police also arrested two Iranian spies, but they were released within weeks because of pressure from Tehran, Western anti-terror officials say. The other suspects were convicted.
Police in Turkey soon broke up a similar plot against Israeli targets, arresting Hezbollah operatives with Canadian and Kuwaiti passports said to be involved in smuggling a car bomb across the border from Syria in 2009.
The close partnership between Iran and Hezbollah is not without friction. There is debate in the Western intelligence community about the extent to which Hezbollah would do Iran's bidding in event of a confrontation between Tehran and the West. But many cases show that Iran and Hezbollah work together on terror activity, Western counterterror officials say.
House Painter Turned Hit Man
Iranian dissidents also found themselves in the crosshairs, according to government documents and investigators.
In July 2009, police in Glendora, Calif., arrested an Iranian-American house painter when his accomplice got cold feet and reported that he was planning a murder.
The suspect, Mohammad Reza Sadeghnia of Ann Arbor, Mich., had done surveillance on a prominent Iranian dissident who hosted a Farsi radio show, according to a report by the Glendora police. Sadeghnia hired an accomplice, an Iranian immigrant with a criminal record, paying him $27,000 via his mother in Iran, the report says.
The two conspirators holed up in a seedy motel for five days, police say. After half-hearted efforts to buy a gun, Sadeghnia decided to make the killing look like a traffic accident, according to the police report. He and his accomplice purchased a 1986 van for $1,800. They tinkered with the engine in a plan to run over the dissident and blame a mechanical problem, the report says.
"He didn't strike me as the Jason Bourne of Iran," Capt. Tim Staab of the Glendora Police said in an interview.
Suspecting that his accomplice had lost his nerve, Sadeghnia threatened to have the man's relatives killed in Iran, according to the police report.
"I have done other missions around the world," Sadeghnia warned.
Alerted by the repentant accomplice, police rushed to a hotel near the Los Angeles airport and arrested Sadeghnia, who was headed to a strip club before catching a night flight to Detroit, according to Staab.
Sadeghnia was charged with conspiracy to commit murder and pleaded guilty to a lesser crime. He served about a year in prison and got five years more probation, authorities said. When a judge allowed Sadeghnia to visit his ailing father in Iran in 2010, he never came back.
Despite Sadeghnia's amateurish exploits, there are signs he was a bona fide agent. He had plenty of cash 2014 crisp new bills in a seal from an Iranian bank, according to police. Sadeghnia admitted to the FBI that he was gathering intelligence on his target, the police report says.
