Kitaneh Fitzpatrick, Zachary Coles, Johanna Moore, Dana Alexander Gray, Amin Soltani, and Frederick W. Kagan
November 28, 5:00 pm ET
The Iran Crisis Updates are produced by the Critical Threats Project (CTP) at the American Enterprise Institute with support from the Institute for the Study of War (ISW). To receive Iran Crisis Updates via email, please subscribe here.
Social media users circulated calls for protests following the US-Iran world cup match on November 29 although it is unclear to what extent these demonstrations will materialize. Some protest organization groups and other prominent social media users circulated calls for protests on November 29, possibly in an attempt to coopt or challenge pro-regime celebrations on city streets.[1] Some social media users disagreed with the November 29 call to protests and highlighted pre-organized protests scheduled for December 5-7.[2] Another anti-regime social media user circulated ways to support the protest movement until demonstrations resume on December 5, further suggesting that protesters remain focused on unrest planned for December 5-7.[3] The Neighborhood Youth of Karaj protest organization similarly alluded to requiring more time to reinforce its organizational capabilities and supplies before protests resume on December 5, as CTP previously reported.[4] Recent social media activity from groups purporting to be protest organizations suggest diverging approaches to coordinating unrest, one of which calls for large crowds and emphasizes continuous protest activity, the other of which seemingly requires more time and preparation. This rhetorical schism could indicate that protest organization groups remain primarily local and lack a coherent, nation-wide structure.
Anti-regime Black Reward hacker group claimed to have leaked a conversation between Basij Deputy Commander Ghassem Ghoureishi and state-affiliated media actors referencing intra-regime fissures over ongoing protests. Black Reward claimed a cyberattack on IRGC-affiliated Fars News Agency’s website on November 25, which Fars later confirmed.[5] The recorded discussion between Ghoureishi and his subordinates purportedly originated from Fars’ digital archives. The two-and-a-half-hour-long audio file confirmed extensive protest activity and other acts of defiance on November 15, including significant strikes in 22 of Iran’s 31 provinces and almost complete store closures in Tehran city. Ghouresishi additionally stated that Supreme National Security Council Secretary Ali Shamkhani, President Ebrahim Raisi, and Judiciary Chief Gholam Hossein Mohseni Ejei separately met with reformists at unspecified dates, possibly corroborating prior reporting that senior Iranian officials had met with prominent reformists to discuss strategies to quell ongoing unrest.[6] The audio file also referenced directives allegedly given by Supreme Leader Ayatollah Ali Khamenei to violently crack down on dissent. One of the speakers noted that Khamenei complained that members of the Expediency Discernment Council—a council that mediates between regime entities and advises the supreme leader—had failed to condemn demonstrations and separately warned LEC Commander Hossein Ashtari against failing to sufficiently suppress protests. The conversation similarly included referenced waning morale among security personnel.[7]
Black Reward has previously described itself as a group of anti-regime Iranian hackers who support the Mahsa Amini protest movement, although no entity has been able to confirm the group’s identity nor the veracity of their information.[8] The group previously claimed to have hacked sensitive information relating to the Iranian nuclear program on October 21.[9] CTP cannot authenticate Black Reward’s leaked audio file. The conversation does allude to intra-regime fractures congruent with CTP’s prior reporting and assessments, however, and is completely plausible if not verifiable. CTP does not regard this audio file as independent confirmation of previous assessments, however, as it has not been authenticated by any reputable actor.
The Iranian regime is coordinating with Qatari officials to suppress public acts of defiance among Iranians in Doha, including members of the Iranian national football team. An anonymous FIFA security official told CNN that IRGC members chastised Iranian players for failing to sing the national anthem in the November 21 match against England, suggesting that Qatar either assisted with or permitted IRGC extraterritorial operations in Doha. The source added that Iranian officials had threatened to torture the family members of Iran team players who demonstrated sympathy with anti-regime protesters and forbade them from interacting with foreigners.[10] The New York Times similarly reported on November 21 that Qatari officials banned Iranian fans from attending matches if they possessed pre-1979 Iranian flags, further corroborating reports of Qatari-Iranian cooperation to suppress anti-regime activity in Doha.[11] Anti-regime outlet Iran International additionally published a November 27 report claiming that Iranian and Qatari officials secretly coordinated to control which Iranians attend the World Cup matches.[12] The November 27 report included the leaked Black Reward audio file allegedly featuring Ghoureishi, wherein an official claimed that Basij officials had identified over 500 ”counterrevolutionaries” attending the tournament.[13] Ghoureishi claimed that Qatari officials promised to prevent Iranian attendees from displaying pre-1979 flags and engaging in other acts of dissent.[14]
Key Takeaways
- Social media users circulated calls for protests following the US-Iran world cup match on November 29, although it is unclear to what extent these demonstrations will materialize.
- The anti-regime Black Reward hacker group claimed to have leaked a conversation between Basij Deputy Commander Ghassem Ghoureishi and state-affiliated media actors referencing intra-regime fissures over ongoing protests.
- The Iranian regime is coordinating with Qatari officials to suppress public acts of defiance among Iranians in Doha, including members of the Iranian national football team.
- At least 10 protests took place in six cities across six provinces on November 28.
- Social media users documented trucker strikes throughout Iran for the third consecutive day.
- IRGC Aerospace Force Commander Amir Ali Haji Zadeh announced that over 300 protesters and security personnel have died since anti-regime protests began on September 16, although this number is almost certainly higher.
- The Kurdish Regional Government (KRG) has stationed security forces at the Iran-Iraq border, decreasing the likelihood of an IRGC ground incursion into Iraqi Kurdistan.
Anti-Regime Protests
At least 10 protests took place in six cities across six provinces. CTP assesses with high to moderate confidence that protests occurred in the following locations on November 28:
Karaj, Alborz Province[15]
Size: Small
Demographic: Industrial workers
Protest Type: Strike and protest, third consecutive day
Karaj, Alborz Province[16]
Size: Small
Demographic: High school students
Esfahan City, Esfahan Province[17]
Size: Medium
Demographic: Industrial workers
Protest Type: Strike and protest, third consecutive day
Tehran City, Tehran Province[18]
Size: Small
Demographic: Tehran University of Art and Practical Arts University students
Tehran City, Tehran Province[19]
Size: Small
Demographic: Allameh Tabataba'i University students
Tehran City, Tehran Province[20]
Size: Small to medium
Demographic: Shahid Beheshti University students
Tehran City, Tehran Province[21]
Size: Small
CTP assesses with low confidence that protests occurred in the following locations on November 28:
Kermanshah City, Kermanshah Province[22]
Size: Small to medium
Demographic: Technical University of Kermanshah students
Sabzevar, Khorasan Razavi Province[23]
Size: Small
Demographic: Hakim Sabzevari University students and professors
Notes: Photos and uncorroborated reports, no available footage
Sanandaj, Kurdistan Province[24]
Size: Undetermined
Protester Activity: Fire lit in street
Note: CTP defines small protests as fewer than 100 individuals, medium protests as between 100 and 1,000, and protests as over one thousand.
Social media users documented trucker strikes throughout Iran for the third consecutive day. Some reported strike locations include Esfahan, Ghazvin, Hamadan, Kermanshah, Kurdistan, Lorestan, and Yazd Provinces.[25]
The Iranian Judiciary released approximately 709 detained protestors under Judiciary Chief Gholam Hossein Mohseni Ejei’s November 26 clemency order.[26] Ejei clarified on November 27 that detainees must express ”remorse” in order to receive leniency, and Ejei’s order excludes protest leaders and protestors accused of arson or assault.[27]
IRGC Aerospace Force Commander Amir Ali Haji Zadeh announced that over 300 protesters and security personnel have died since anti-regime protests began on September 16, marking the first official death toll in over two months.[28] A state-run broadcaster last announced 41 protest-related deaths on September 22.[29] The current death toll is still likely higher than the figure presented by Haji Zadeh, however. An Iranian human rights organization placed the total death toll from the Mahsa Amini protest wave at 451 on November 28.[30]
Supreme Leader Ayatollah Ali Khamenei met with senior commanders of the Artesh Navy on November 28 to commemorate a naval holiday. Khamenei’s speech was focused on naval operations and did not mention ongoing, anti-regime protests.[31]
IRGC-affiliated media reported that unidentified attackers shot and killed Basij Organization member Reza Dastani with an unspecified firearm in Esfahan City, Esfahan Province on November 28.[32]
Axis of Resistance and Regional Developments
The Kurdish Regional Government (KRG) has stationed security forces at the Iran-Iraq border, decreasing the likelihood of an IRGC ground incursion into Iraqi Kurdistan. Commander of the KRG 2nd Border Guard Brigade, Brigadier General Goran Saleh Khaled, announced on November 28 that security forces have deployed to positions along the Iran-Iraqi Kurdistan border.[33] IRGC Quds Force Commander Esmail Ghaani allegedly threatened that Iran would conduct ground operations into Iraqi Kurdistan unless Baghdad sends Iraqi military forces—notably not Kurdish military forces—to secure the border region, as CTP has previously reported.[34] Iranian Foreign Affairs Ministry spokesperson Nasser Kanani released a statement on November 28 welcoming ”official forces” along the Iran-Iraq border, however Baghdad-based Al Mada reported that Tehran is unhappy with the decision to station Kurdish forces on the border.[35]
The KRG deployment does not appear to meet Ghaani’s reported demands and may have angered Iranian officials, but it likely will decrease the prospect of the IRGC conducting ground operations against anti-regime Kurdish militants allegedly operating in Iraqi Kurdistan. The sizable KRG deployment and unfavorable terrain along the border make an IRGC ground operation unlikely to succeed. Armored and special forces units from the IRGC Ground Forces deployed to unspecified locations in northwestern and western Iran on November 25, as CTP has previously reported.[36] The deployment, however, is likely intended to aid in protest suppression in Iran’s restive Kurdish regions and to serve as additional leverage in negotiating with Baghdad and Erbil.[37] Iran may accuse Iraqi Kurdish forces of being ineffective in order to pressure the Iraqi government into security concessions to gain concessions and justify additional rocket and missile strikes in Iraqi Kurdistan.
[1] https://twitter.com/Shahinlooo/status/1597218078659874816?s=20&t=tLewy0FV6fJjtD7admMYFg ; https://twitter.com/JavananBoushehr/status/1597304444420784129?s=20&t=7izahXtcqyGWPrDg0sbmnA ; https://twitter.com/Shahinlooo/status/1597218078659874816?s=20&t=cHElV4Oh36yfDpHEczIkjw ; https://twitter.com/Javanan_mashhad/status/1597221388477419521?s=20&t=tLewy0FV6fJjtD7admMYFg
[2] https://twitter.com/ArmiNoza/status/1597266036591845377?s=20&t=KhIY7nl0oQ9WaDYUrJUoRg ; https://twitter.com/shotorifeshari/status/1597258725081116673?s=20&t=KhIY7nl0oQ9WaDYUrJUoRg ;
[3] https://twitter.com/arixolin/status/1597145727804661760?s=20&t=2IqlMPrP7rbS4HP1kmmAKA
[4] https://www.understandingwar.org/backgrounder/iran-crisis-update-november-27
[5] https://twitter.com/KhosroKalbasi/status/1596197794771243008 ; https://www.timesofisrael.com/irans-fars-news-agency-hit-by-cyberattacks-blames-israel/
[6] https://www.wsj.com/articles/iran-protests-government-mahsa-amini-11669137860
[7] https://www.iranintl.com/202211287937
[8] https://www.cyberscoop dot com/iran-nuclear-emails-hack-leak-black-reward/
[9] https://twitter.com/Natsecjeff/status/1583570154486607872?s=20&t=DQGho3r559VqSnYTuayOMA
[10] https://www.cnn.com/2022/11/28/football/iran-soccer-family-threats-intl-spt
[11] https://www.nytimes.com/2022/11/21/sports/soccer/iranian-fans-persian-flags-protests-england-game.html
[12] https://www.iranintl.com/en/202211279876
[13] https://www.iranintl.com/en/202211279876; https://www.criticalthreats.org/analysis/iran-crisis-update-october-21
[14] https://www.iranintl.com/en/202211279876
[15] https://twitter.com/iranworkers/status/1597190685366812672?s=20&t=VDzeZNbYKx48SysZP0p6tw ; https://twitter.com/AtenaDaemi/status/1597258567111049216?s=20&t=VDzeZNbYKx48SysZP0p6tw ; https://twitter.com/indypersian/status/1597270528871796737?s=20&t=VDzeZNbYKx48SysZP0p6tw
[16] https://twitter.com/iranworkers/status/1597138328918183936?s=20&t=OpiEtSbzWOTjkg5ZS7YZSQ ; https://twitter.com/CoordinatingA/status/1597248715714367489?s=20&t=OpiEtSbzWOTjkg5ZS7YZSQ
[17] https://twitter.com/iranworkers/status/1597213698715947008?s=20&t=SWeK9_WHdOoH3YQ30fS2KA ; https://twitter.com/RadioFarda_/status/1597221323469881345?s=20&t=SWeK9_WHdOoH3YQ30fS2KA
[18] https://twitter.com/iranworkers/status/1597250090401660930?s=20&t=U01o7AWDuX-bssOS3qflbw ; https://twitter.com/IranIntlbrk/status/1597211025513730048?s=20&t=U01o7AWDuX-bssOS3qflbw ; https://twitter.com/Bidarzani/status/1597225978216198146?s=20&t=U01o7AWDuX-bssOS3qflbw ; https://twitter.com/HassanRonaghi/status/1597212284677685249?s=20&t=U01o7AWDuX-bssOS3qflbw ; https://twitter.com/indypersian/status/1597215344069951490?s=20&t=U01o7AWDuX-bssOS3qflbw
[19] https://twitter.com/iranworkers/status/1597246680390602752?s=20&t=FtoisAQCfXyKhDjdqLzVSg ; https://twitter.com/IranIntlbrk/status/1597220972922228737?s=20&t=FtoisAQCfXyKhDjdqLzVSg ; https://twitter.com/hra_news/status/1597239861047607302?s=20&t=RlIEBfEafAYl5SRSTeBFwg
[20] https://twitter.com/iranworkers/status/1597167528274325504?s=20&t=ViJ5bgCeR4z0mSC5C7xEDA ; https://twitter.com/IranIntlbrk/status/1597133582853582848?s=20&t=ViJ5bgCeR4z0mSC5C7xEDA ; https://twitter.com/RadioFarda_/status/1597160331759218689?s=20&t=Idkr0gx87181TBO-mt9qhw ; https://twitter.com/hra_news/status/1597149324407754752?s=20&t=FNKS3m4utKUADNjhq-FtLg
[21] https://twitter.com/1500tasvir/status/1597300883016278024?s=20&t=FNKS3m4utKUADNjhq-FtLg
[22] https://twitter.com/iranworkers/status/1597311146151010304?s=20&t=DsS78a_8Wdsd1f9KlBsS7A
[23] https://twitter.com/iranworkers/status/1597252205077463041?s=20&t=Zh6VWIYMizcT-WdPHj-AMg
[24] https://twitter.com/SrwaZand/status/1597283107136077824?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/RadioFarda_/status/1597291308217176064?s=20&t=Idkr0gx87181TBO-mt9qhw
[25] https://twitter.com/IranIntlbrk/status/1597249192577089537?s=20&t=alzhfWM2JP3WgiSb5u6phQ ; https://twitter.com/iranworkers/status/1597197464804929537?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/iranworkers/status/1597264098718547968?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/iranworkers/status/1597264676249042945?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/iranworkers/status/1597207061666103301?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/iranworkers/status/1597202919178539011?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/iranworkers/status/1597196865111740416?s=20&t=Zh6VWIYMizcT-WdPHj-AMg ; https://twitter.com/iranworkers/status/1597265102927167490?s=20&t=Zh6VWIYMizcT-WdPHj-AMg; https://twitter.com/IranIntlbrk/status/1597139562089922561
[26] https://www.tasnimnews dot com/fa/news/1401/09/07/2813405/آزادی-709-نفر-از-زندانیان-دارای-شرایط-ارفاقات-قانونی-از-زندان-های-12-استان-کشور
[27] https://www.isna dot ir/news/1401090704339/افراد-دروغگو-و-مدعی-را-احضار-کرده-و-مستندات-بخواهید
[28] https://shahraranews dot ir/fa/news/137193/ویدئو|-سردار-حاجیزاده-بیش-از-۳۰۰-جان-باخته-و-شهید-در-وقایع-اخیر-داریم
[29] https://www.bloomberg.com/news/articles/2022-09-22/iranian-volunteer-militia-member-killed-by-rioters-irna-says?leadSource=uverify%20wall
[30] https://twitter.com/hra_news/status/1597364824320757760?s=20&t=eQ9L3N5UB8yCBttvljMEGA
[31] https://www.leader dot ir/fa/content/26166/دیدار-تعدادی-از-فرماندهان-نیروی-دریایی-ارتش
[32] https://www.isna dot ir/news/1401090704481/ترور-یکی-از-بسیجیان-فعال-اصفهان-تلاش-برای-شناسایی-و-دستگیری ; https://t.me/Sepah_lr/73492
[33] https://www dot kurdistan24 dot net/fa/story/207846-; https://www.facebook.com/%D9%82%D9%8A%D8%A7%D8%AF%D8%A9-%D8%AD%D8%B1%D8%B3-%D8%AD%D8%AF%D9%88%D8%AF-%D8%A7%D9%84%D9%85%D9%86%D8%B7%D9%82%D8%A9-%D8%A7%D9%84%D8%A7%D9%88%D9%84%D9%89-104446584295199/?ref=page_internal
[34] https://www.criticalthreats.org/analysis/iran-crisis-update-november-18
[35] https://shafaq dot com/ar/%D8%B3%DB%8C%D8%A7%D8%B3%D8%A9/%D9%8A%D8%B1%D8%A7%D9%86-%D8%AA%D8%B1%D8%AD%D8%A8-%D8%A8%D9%82%D8%B1%D8%A7%D8%B1-%D8%A7%D9%84%D8%B9%D8%B1%D8%A7%D9%82-%D9%86%D8%B4%D8%B1-%D9%82%D9%88%D8%A7%D8%AA-%D8%B9%D9%84%D9%89-%D8%A7%D9%84%D8%AD%D8%AF%D9%88%D8%AF-%D9%85%D8%B9-%D9%83%D9%88%D8%B1%D8%AF%D8%B3%D8%AA%D8%A7%D9%86; https://almadapaper dot net/view.php?cat=279116
[36] https://www.criticalthreats.org/analysis/iran-crisis-update-november-25
[37] https://www.criticalthreats.org/analysis/iran-crisis-update-november-25
