U.S. law enforcement braced itself for Iranian revenge attacks after the killing of Maj. Gen. Qassim Suleimani, leaked documents show.

The U.S. State Department has long called the Iranian government “the world’s worst state sponsor of terrorism,” but Iran’s militant activities have almost exclusively taken place in Africa, Asia and Latin America, far from the U.S. border.

Iranian-backed actors have not killed anyone on American soil since 1980, and U.S. officials long believed that Iran would only attack the American homeland if faced with an existential threat. Law enforcement documents released as part of the BlueLeaks hack show that some officials believed the Suleimani’s death on January 2 may have crossed that line.

“Historically, retaliation by Iran and its proxies has taken place in ‘third party’ locations, and not on U.S. soil, but the significance of Soleimani’s death is such that the JRIC cannot dismiss the potential for Homeland attacks,” stated a January 3 memo from the Joint Regional Intelligence Center, a clearinghouse for Federal and local law enforcement officials in southern California.

Just six months before, officials had written that they do “not foresee an immediate increase in threat or risk for violence in the JRIC [area of responsibility] related to increasing U.S.-Iranian tensions.”

Law enforcement officials may once again have to determine whether Iran will strike at the homeland. A mysterious series of explosions has rocked Iran for the past few weeks, and Iranian and Israeli officials alike have insinuated that the United States and Israel were involved.

Iranian agents and the Iranian-backed Lebanese militant group Hezbollah have long struck at U.S. and Israeli civilian targets abroad—as well as Jewish diaspora communities—in response to geopolitical tensions and military clashes.

But the only successful Iranian attack within America happened forty years ago, when a Muslim-American convert murdered an exiled former Iranian official in Maryland. Iranian-backed militants have not shed blood on American soil since.

“It’s hard to say why,” said Matthew Levitt, director of the Reinhard Program on Counterterrorism and Intelligence at The Washington Institute for Near East Policy.

Iran and Hezbollah are looking to carry out “reasonably deniable” attacks, and going after the American homeland might be seen as “poking the bear,” he told the National Interest, adding that America is a harder target because U.S. law enforcement prioritizes Iranian threats.

“We’ve also gotten lucky,” Levitt said.

Whatever the reason, the sense that Iran would not target America began to change in 2011.

Assassins had been killing Iranian nuclear scientists in a series of brazen motorcycle attacks, and Iran began sponsoring attacks against its adversaries, particularly Israel. Many of the plots were foiled, but Hezbollah operatives murdered five Israeli tourists in Bulgaria in July 2012.

Then U.S. authorities foiled a plot on American soil. Federal prosecutors arrested Iranian-American citizen Manssor Arbabsiar, a cousin of Iran’s Brig. Gen. Abdulreza Shahlai, for attempting to assassinate the Saudi ambassador by blowing him up in Washington’s popular Café Milano.

“It wasn’t targeting American interests, but it would have killed Americans,” Levitt said.

Iranian officials were even aware that members of Congress ate at the café—and were fine with the possibility of harming them—Arbabsiar claimed.

Arbabsiar plead guilty in 2012. The U.S. government later designated Shahlai a terrorist and placed a $15 million bounty on him.

One leaked memo by the JRIC, written in September 2012, reveals the growing sense of alarm that Arbabsiar’s plot and other attacks had raised.

“If these events were, in fact, tacitly endorsed by the Iranian government, they represent global projection of power,” the memo states. “Press coverage cites concern by Israeli officials that the recent series of events could be the start of a wave of global attacks.”

The memo noted that Department of Homeland Security officials had hosted a conference call with Jewish community leaders “to provide outreach regarding possible threats to Diaspora communities within the United States,” and urged local law enforcement to report any suspicious activity.

However, JRIC officials said that there was “no credible information indicating Iranian elements or Hizballah…are planning operations within the JRIC seven-county area of responsibility.”

JRIC officials noted in a later memo that some experts “assess the plot, far outside [Iranian Revolutionary Guard] historical norms, must have been a rogue action; others assess such a plan could not have been developed without Iranian government/military knowledge.”

Federal law enforcement began investigating another Iranian-backed plot in 2013. Lebanese-American citizen Ali Kourani had been recruited by Hezbollah to stake out targets and even prepare bomb-making material for an eventual attack on America as a  “sleeper agent.”

The specific event that would have triggered Hezbollah to order an attack “is a little bit of a mystery,” said Levitt, who had served as an expert witness during Kourani’s trial. “They’re a patient group, used to playing the long game.”

He noted that the group still would like to avenge the assassination of Imad Mughniyeh, a Hezbollah commander who was killed in a joint U.S.-Israeli operation in 2007.

Kourani became an informant after meeting with FBI agents several times in 2016 and 2017. But federal prosecutors believed that Kourani was attempting to mislead them, and charged him with terrorism in June 2017. He was convicted and sentenced to forty years in prison in December 2019.

U.S. officials also broke up an Iranian spy ring in 2018 that had spied on Iranian-American exiles and Jewish institutions.

Iran’s intelligence gathering “suggests the potential of a threat to the Homeland,” the Department of Homeland Security’s Counterterrorism Mission Center wrote in a July 2019 assessment.

“We are unaware of any specific, credible threat to the Homeland from [Hezbollah] or Iran-linked actors, but [Hezbollah] or Iran could conduct operations in the United States against targets similar to those attacked elsewhere in the West,” the assessment stated, claiming that Iran prefers “specifically chosen targets” and “often-sophisticated operations” that “take years of planning” over “random targets of opportunity.”

Still, none of this translated into an immediate sense of alarm. JRIC officials wrote in a June 21, 2019 appraisal that there was a “low probability” of Iranian attacks on California in response to then-ongoing tensions in the Middle East, although the possibility “cannot be ruled out.”

“Iranian-linked groups with a history of successful, lethal violence, such as [Hezbollah], may have predetermined geopolitical ‘red lines’ to trigger retaliatory attacks within the United States, or against U.S. assets abroad,” the appraisal noted. “Experts lack understanding of what those triggers may be and what plans may be in place to respond to them.”

Suleimani’s killing seemed to be just that trigger—after all, Iranian leaders had vowed “harsh revenge.” And U.S. forces had also attempted to kill Shahlai, the alleged architect of the Café Milano plot, in Yemen.

JRIC officials noted on the morning after that the killing “may place U.S. military, government, and commercial facilities and personnel, as well as American citizens overseas and in the Homeland at greater risk of attack by Iranian-linked or self-selected pro-Iranian actors.”

Homeland Security officials sent out a nationwide bulletin on January 4, stating that there is no “specific, credible threat to the Homeland” but that an “attack in the homeland may come with little or no warning.”

Border authorities began detaining Iranian-Americans, following a now-leaked directive to look for individuals with Iranian, Lebanese, or Palestinian “links” or a history of Iranian military service.

Law enforcement officials in Florida even noted with alarm that Twitter users were trying to “incite” Iran to “bomb Florida first.”

Iran eventually retaliated, not with a covert terrorist attack but an overt missile strike on a U.S. base in Iraq on January 8. Iranian-backed forces have continued to clash with U.S. troops in Iraq.

No terrorist plot seems to have materialized. The Department of Homeland Security issued another bulletin warning about Iranian-backed terrorism in retaliation for Suleimani’s death, but that bulletin expired in March and has not been updated.

But this doesn’t mean that the threat has completely passed.

“You do have to have a higher level of concern,” Levitt said.

“Doesn’t mean that they’re going to do something tomorrow,” he stated. “It does mean we have to be careful.”

Matthew Petti is a national security reporter at the National Interest. Follow him on Twitter: @matthew_petti.

Image: Reuters.