• The Joint Comprehensive Plan of Action (JCPOA) talks are slated to resume in Vienna on November 29, during which the US will indirectly negotiate with the new hardline Iranian government led by President Ebrahim Raisi for the first time.
• Iran’s expedited nuclear activity and boosted stocks of enriched uranium indicate that the country could achieve nuclear breakout capabilities within the coming weeks or months. The trajectory of the upcoming talks during this critical phase will therefore determine the potential for a military escalation in the region.
• As long as the impasse continues, the threat of Iranian attacks through both direct means and indirect proxy hostilities will remain high, as Tehran seeks to build pressure on the US and its allies. This could materialize on various fronts, including cyberspace, maritime zones, and attacks by Iran’s proxy forces in Iraq, Yemen, Syria, Lebanon, and the Gaza Strip.
• Western nationals operating or residing in the Middle East are advised to regularly review emergency and contingency protocols as a basic security precaution due to the risk of hostilities between Iran, the US, and its allies. Contact us at [email protected] or +44 20-3540-0434 for contingency planning and consultation.

JCPOA talks, Statements by International Bodies

• On November 3-4, Iran, the EU, and the US agreed to resume negotiations to revive the Joint Comprehensive Plan of Action (JCPOA) in Vienna on November 29.
• On November 17, the International Atomic Energy Agency (IAEA) released findings indicating that, as of early November, Iran had amassed a stockpile of 17.7 kg of 60 percent enriched uranium.
• On November 17, the US, Australia, and the UK issued a joint cybersecurity advisory against Iranian state-sponsored cyberattacks.
• Rafael Grossi, the IAEA’s Director-General, stated that his agency was slowly “going blind” in Iran, per a November 21 report. On November 24, following a visit to Tehran, he stated that no agreement had been reached on giving the IAEA regular access to its nuclear facilities.

Developments in, around Iran

• On November 3, Iranian news reported that the Islamic Revolutionary Guard Corps (IRGC) successfully foiled a US attempt to seize an Iranian oil tanker in the Gulf of Oman.
• According to Iranian state media reports on November 9, Iran’s armed forces detected and warned two US unmanned aerial vehicles (UAVs) that were miles away from Iran’s south-eastern coast during the “Zulfiqar-1400” military exercises.
• On November 15, senior US defense official John Kirby stated that, during the past week, a naval helicopter belonging to Iran’s Army circled the USS Essex three times in an “unsafe and unprofessional manner,” flying as close as 20 meters to the vessel.
• Reports from November 16-17 indicated that Iran had resumed the production of the parts for advanced centrifuges at the Karaj nuclear facility, which is unmonitored by the IAEA.
• On November 21, the commander of the IRGC Navy, Alireza Tangsiri, announced that nine IRGC personnel were killed in alleged clashes with the US Navy in the Persian Gulf at an unspecified time. The US CENTCOM denied the allegations on November 23, stating the claim referred to events in the 1980s.

Israeli Statements

• On November 23, Defense Minister Benny Gantz stated that Iran was utilizing two bases in Chabahar and the Qeshm island in southern Iran to conduct maritime attacks using unmanned aerial vehicles (UAVs).
• Prime Minister Naftali Bennett stated on the same day that disputes [regarding Iran] could arise with the “best of our friends” and that Israel was not obligated by the JCPOA, as it is not a party to the deal.
• Bennett added that Iran has surrounded Israel with missiles while “sitting in Tehran” and that “to chase the terrorist…sent by the IRGC-Quds Force (IRGC-QF) does not pay off anymore. We must go for the dispatcher”.

Talks to resume, but challenges to remain due to Iran’s bolstered nuclear activity

1. The decision to resume indirect US-Iran talks regarding the revival of the JCPOA constitutes a breakthrough as negotiations have been suspended since June due to the change in government in Iran following the presidential elections in June. However, even during the six rounds of talks between early April and June, no major progress was made. Both Iran and the US were unwilling to yield or reach a compromise on their respective demands. Iran has staunchly pushed for the lifting of all US sanctions on the Iranian economy, while the US under the Joe Biden-led administration has demanded that Iran reverse its nuclear activities to the levels stipulated by the JCPOA, signed in 2015.
2. The US has also attempted to include Iran’s ballistic missile program in the ambit of their demands to provide sanctions relief, which Tehran continues to strongly oppose as the latter views its possession of conventional missiles as a basic sovereign right to defend and deter attacks from its adversaries. Therefore, even though President Biden was initially expected to be more lenient and shift away from his predecessor’s hardline policies against Iran, the new US administration has demonstrated that it will not hastily undo the economic pressure built on Iran over recent years without the assurance of Tehran making major concessions on its part.
3. Iran has also maintained a somewhat uncongenial relationship with the UN watchdog, the IAEA, since late February. Iran suspended the IAEA’s right to effectively monitor the former’s nuclear activities by disallowing the latter to conduct snap inspections as well as retrieve its surveillance cameras and other monitoring equipment placed in Iran’s declared nuclear facilities, which constitutes a cornerstone of the JCPOA. The two sides reached a partial agreement on September 12, whereby Iran allowed the IAEA to temporarily access its nuclear facilities and replace the memory cards of their cameras between September 22-24. However, Tehran has continued to refuse the IAEA access to the site in Karaj, which is used to produce advanced centrifuges and was the target of an attack on June 23 that was attributed by Iran to Israel. Iran stated that this alleged attack by Israel destroyed some of the surveillance equipment. Its refusal to repair the cameras thus points to an effort to accuse Israel of belligerence and portray its covert activities against Iran as ultimately futile and counterproductive.
4. As a result, the IAEA’s inability to accurately monitor Iran’s uranium enrichment activities has raised global concerns regarding the accelerated pace of Iran’s nuclear program, with the most recent estimates from November indicating that the country could achieve nuclear breakout capabilities in the next few weeks or months. This is mainly derived from the IAEA’s November 17 report indicating that Iran has roughly amassed a stockpile of 17.7 kg of 60 percent-enriched uranium and 113.8 kg of 20 percent enriched uranium. At this pace, Iran is believed to have enough enriched uranium to produce about 25 kg of weapon-grade uranium to use for a single nuclear weapon in as little as three weeks to a few months. These estimates have created the perception that Iran is fast approaching a stage in its nuclear program wherein a viable return to the 2015 nuclear deal could be impossible in the near term. FORECAST: In this context, Iran’s expedited nuclear activity and boosted stocks of enriched uranium are liable to be the main sticking points at the November 29 talks that are slated to resume in Vienna.

Iranian Demands, Likely Course of Action

1. The upcoming talks will also be the first interaction between the Iranian hardline administration by President Ebrahim Raisi and the US, albeit indirect. Iran’s new chief nuclear negotiator and deputy foreign minister Ali Bagheri Khan has not referred to upcoming talks as nuclear negotiations, but instead as “negotiations to remove unlawful and inhuman sanctions”. Additionally, Foreign Minister Hossein Amirabdollahian stated in late September that he had no interest in conducting the kind of detailed negotiation that his predecessor had worked on for years. These statements indicate the shift in the thought process of the new hardline administration in Iran. FORECAST: This hardline outlook, as compared to the previous Hassan Rouhani-led administration, likely signals that Iran will not waver from its demands in the upcoming talks. Iran will stick to its core demands on the lifting of all nuclear and non-nuclear sanctions by the US as well as a guarantee by Washington that no future US administration will unilaterally pull out of the nuclear agreement, as Donald Trump did in 2018.
2. FORECAST: Iran’s current stance also suggests that the Raisi-led government will continue to at least rhetorically push for sanctions relief, even if it is unwilling to make meaningful concessions pertaining to its nuclear program to achieve this goal. However, Tehran’s policy of “economic resistance” has also somewhat helped in keeping the country’s economy afloat despite US sanctions. Thus, the government may instead choose to focus more on advancing its nuclear program to achieve breakout capabilities as part of an overarching strategy, which would go beyond mere incremental progress as part of its pressure tactics vis-a-vis the US. This could especially be the case if Iran perceives the US as still unwilling to yield major concessions in the immediate future following the resumption of the Vienna talks. Therefore, the scale of economic relief that Washington intends to provide will directly determine whether Iran will reverse at least some of its recently bolstered nuclear capabilities in exchange.

Potential Interim Deal

1. Over recent weeks, Washington officials have reportedly floated the idea of an interim deal that seeks to pause Iran’s current nuclear activity in exchange for partial sanctions relief. FORECAST: While Iranian officials have reportedly dismissed the idea of a partial deal and reiterated their known demands, this scenario may be palatable to both parties as it would allow both the US and its allies on one side and Iran and its partners on the other to buy time to contemplate their next move. This is also due to the repeated threats by Israel, and to a lesser extent the US, that military options remain on the table if diplomatic efforts to revive the JCPOA fail.
2. The possibility of such a deal has been perceived by Israel as the US settling for a “less-for-less” agreement and simply emboldening Iran while it secretly continues to build up its nuclear capabilities. FORECAST: Therefore, this could widen the growing differences between Washington and Jerusalem on the Iran issue. Alternatively, if there is no interim deal, and should Iran be perceived as purposely holding back on reaching a compromise in order to utilize the extended negotiations to accelerate its nuclear program, this could imperil the trajectory of the talks between Iran and the US.
3. FORECAST: An interim agreement perceived by Israel to be severely detrimental to its interests and national security would also increase the prospects for Israeli strikes targeting Iran’s nuclear facilities even if it must do so unilaterally and without the US’s support. Israel has continuously vowed that it will not allow Tehran to attain nuclear weapons and will not hesitate to act to achieve this goal. The Israeli government has diverted significant resources and established entire directorates within the Israel Defense Forces (IDF), such as the “Third Circle” command, to prepare for such a strike.
4. Israeli political leaders have also frequently issued this warning over recent months. FORECAST: Such a scenario would likely lead to a broad-scale conflict in the Middle East region, as Iran has pledged “a shocking response” to any such attack. Iran would likely use both its own forces and order its well-armed proxies spread across the region to launch attacks against Israel and other US allies: Hezbollah in Lebanon, which possesses thousands of rockets as well as an estimated arsenal of dozens of precision-guided missiles and explosive UAVs; Shia militias in Syria and Iraq; the Yemen-based Houthi forces; and militant groups in the Gaza Strip, mainly Hamas and the Palestinian Islamic Jihad (PIJ). Such an escalation would have extensive security ramifications for firms and foreign personnel operating in the region. Although the possibility of such an occurrence is low at the current juncture, it will be increasingly more likely in the event of a breakdown or impasse in the JCPOA talks.

Iran to continue to build pressure through direct, indirect attacks on various fronts

During the process of nuclear negotiations, the threat of Iranian attacks, both direct and indirect hostilities conducted by its proxies will likely persist as a means of continually building pressure on the US and its allies. This will manifest in various domains and regions of the world, including outside the broader Middle East region as elaborated below:

Cyber Warfare

1. Cyberwarfare is one of Tehran’s preferred modus operandi to target its rivals because it allows the Iranian leadership to effectively harm its adversaries’ interests both in the public and private domains while maintaining plausible deniability. This enables Tehran to reduce the risk of a broad escalation of tensions or retaliation from its adversaries. Over recent months, there have been multiple indications that Iran has been persistently utilizing state-sponsored cyber warfare to target the critical infrastructure of its adversaries with the aim of undermining the latter’s national security. Such attacks have targeted both government and private sector companies based in the US and its allied countries, especially Israel. Some of these attacks have also been in retaliation to attacks purportedly conducted by Israel in Iran, such as an October 26 cyberattack that caused nationwide disruptions of fuel station services in Iran.
2. The joint cybersecurity advisory by the US, UK, and Australia, released on November 17, indicates the wide-scale and scope of Iranian cyber operations targeting various sectors in US-allied countries, including states like Australia, which does not have an actively hostile relationship with Iran. Iran-backed hackers have also conducted cyber-espionage by compromising Internet Service Providers (ISPs) and telecommunications networks in Israel, Saudi Arabia, Morocco, and Tunisia between July and October as indicated by a November 9 report. Moreover, on November 17, a state-sponsored Iranian news agency reportedly released the name, photograph, phone number, and address of an Israeli cyber security expert who specializes in Iranian cyber hacking efforts. This technique of releasing personal information, known as doxing, serves to overtly threaten individuals or companies that seek to expose Iran’s cyber offensives. Therefore, the risk of state-sponsored cyberattacks by Iran extends to a broad range of potential organizations, individuals, and companies, and will persist over the coming months.

Maritime arena

1. Iran has detained and seized commercial vessels on various charges and has utilized some of them to fulfill its economic or political goals, especially in the Persian Gulf surrounding Tehran’s territorial waters. For instance, on January 4, the Iranian authorities seized a South Korean ship in the Strait of Hormuz over allegations of violation of maritime environmental laws. In addition, a “shadow war” has persisted between Iran and Israel on the maritime front, with both countries having targeted vessels linked to the other in international waters spanning from the Gulf of Oman to the Mediterranean Sea. On July 29-30, a UAV attack on an Israel-linked vessel killed a British and a Romanian national, which constituted a marked escalation. The governments of Israel, the UK, and the US directly accused Iran of the attack. Although some reports suggested that the attack was in response to the killing of Iran-backed Hezbollah and IRGC operatives in an Israeli strike in Syria’s Homs on July 21-22, no similar attacks on the maritime front have occurred since then despite the increased frequency of Israeli strikes in Syria over recent months. This absence in attacks can be attributed to Iran’s cognizance that the killing of civilian crew members constituted a red line for its adversaries.
2. However, Iran has continued to detain foreign vessels, particularly on charges of illegally smuggling fuel from Iran, as indicated by such an incident on November 20 and by the release of a Vietnamese tanker on November 10 following its October 24 detention on similar charges. FORECAST: Broadly, the recent trend of security incidents in the maritime domain suggests that while Iran will likely refrain from overtly conducting a major attack at sea that could be traced back to it and significantly escalate tensions, it will continue to project strength and dominance in and around the Persian Gulf and the Gulf of Oman, which Tehran considers its backyard. This will manifest in additional detentions of vessels and the sudden boarding and inspection of foreign tankers by IRGC naval forces. This points to the persistent risk of maritime navigation in the region due to Iranian actions. Tehran will also attempt to showcase its military might by occasionally confronting US naval forces in the region, or by portraying minor face-offs as events where Iran was successful in rerouting some of the US’s maritime or air force assets. This is bolstered by a string of such alleged encounters with US military forces in November, as reported by Iranian media agencies.

Attacks by proxies

1. Conducting attacks against the interests of the US and its allies via regional proxies has been yet another strategy employed by Iran in recent years to maintain plausible deniability of the perpetrators’ ties to Iran. This ability has been facilitated by the significant resources transferred to the IRGC-QF to establish Iranian influence in various countries like Lebanon, Yemen, Iraq, and Syria. While almost all Iran-backed Shiite militias in these countries have their own domestic interests for conducting such attacks, Iran’s support to these groups, especially through the export of weapons and weapon technology, has resulted in several significant attacks against strategic targets in recent years and months. Iran’s ramped-up investments in producing and disseminating UAV technology to its proxies have been a vital contributor to this trend.
2. The Houthis in Yemen have been using UAVs as a central modus operandi to conduct increased, near-daily cross-border attacks into Saudi Arabia over recent years and months, in addition to using ballistic missiles. Most recently, on November 20, the Houthis claimed to have launched several UAVs targeting airports in Riyadh, Jeddah, and ARAMCO refineries in Jeddah. The use of UAVs has also been recorded on a more frequent basis in Iraq. US airstrikes on June 27 in Syria’s Deir Ezzor Province, specifically stated as targeting Iran-backed militias involved in UAV attacks against US interests in Iraq, indicated that Iran-backed factions are also building UAV capabilities within Syria. This is particularly the case in the al-Bukamal Syria-Iraq border area, where Iran-backed factions are heavily entrenched. This capability facilitated an October 20 aerial attack involving UAVs on the US base in Syria’s al-Tanf, which US officials attributed to Iran. On November 23, Israeli Defense Minister Benny Gantz stated that Iran had tried to smuggle explosives into the West Bank using a UAV that was launched from Syria’s T-4 airbase, which Israeli forces intercepted and shot down. If confirmed, this would also signal Iran’s efforts to use UAVs as a means of delivery to support militant groups within the Palestinian Territories.
3. Overall, the Gaza Strip, Yemen, Iraq, Syria, and Lebanon, are countries/regions where governance is weak, and which share borders with countries that are Iran’s foes or that have considerable ties with the US and the West. FORECAST: Iran will continue to utilize its proxies and use these regions as a launchpad for attacks against its rivals and their interests. Thus, cross-border attacks into Saudi from Yemen, rocket or UAV attacks targeting US interests in Iraq and Syria, infrequent attacks from Lebanon or Syria into Israel are all liable to persist in varying degrees, scope, and scale, during the course of the nuclear negotiations between Iran and the US. This is liable to pose a significant risk to strategic civilian infrastructures, including sites like airports that are sometimes used for both civilian and military purposes or are located close to military airbases. The persistence of these attacks can also expose companies and foreign personnel operating in the region to damage and casualties.

The upcoming JCPOA negotiations on November 29 will be critical in determining the course of Iran’s nuclear trajectory. Should the US and Iran fail to reach a compromise on the means to revive the agreement in the near term, or if Iran achieves a nuclear weapon, there could be wide security implications for the entire Middle East and potentially the rest of the globe as such a development will elevate the potential for a broad conflict. In the meantime, or if an interim deal is agreed upon, Iran will likely continue to conduct attacks through different mediums including cyber, via the sea, and by using its proxies across the region. However, these attacks will be measured and part of ongoing trends, as Iran is unlikely to orchestrate a major attack that could constitute as crossing a “red line” for its adversaries and significantly imperil the direction of the JCPOA talks, which would reduce any possibility of the sanctions relief necessary to meaningfully revive its economy.

1. Travelers are advised to regularly review their emergency and contingency procedures as a basic security precaution, as an escalation in tensions between Iran, the US and its allies, as a result of disagreements during JCPOA negotiations has the potential to manifest as a limited or full military confrontation.
2. Western nationals operating or residing in Iran are advised to remain cognizant of the prevailing negative sentiment toward the US and other Western European countries.
3. US citizens and other Western nationals operating or residing in other countries in the Middle East with sizeable Iranian-backed elements are advised to keep a low profile and maintain heightened vigilance, given the potential for attacks by such groups.
4. Those operating vital infrastructure, particularly in the oil sector, in Saudi Arabia are advised to review security protocols in light of the threat posed by Yemeni Houthi-perpetrated UAV and missile attacks.
5. Those managing or operating vessels in the Persian Gulf, Gulf of Oman, and the Strait of Hormuz are advised to take necessary precautions, including reviewing security protocols and adhering to international instructions, in light of the general threat of detainment by Iranian forces in the area.
6. It is also advised to remain apprised of UKMTO and US DOT Maritime Administration-issued notices, as well as being aware of NATO Shipping Center alerts.
7. Corporations operating in US-allied countries, especially Israel, are advised to take precautions to protect against cyber attacks at all times.
8. Contact us at [email protected] or +44 20-3540-0434 for contingency planning and consultation.