How Europe’s Terrorism Reports Lost Track of Iran

Iranian missiles are displayed next to a banner with a picture of Iran’s Supreme Leader, Mojtaba Khamenei, on a street in Tehran, Iran, Sept. 27, 2026. Photo: Majid Asgaripour/WANA (West Asia News Agency) via REUTERS

In the early hours of Sunday, Sept. 27, 2026, British police arrested five men near RAF Fairford, the base from which American B-1 bombers fly strikes on Iran. Three days after the arrests, Prime Minister Andy Burnham said there were “strong indications” that Iran had played a part.

In July 2026, the Islamic Revolutionary Guard Corps (IRGC) had called any base used against Iranian territory “a legitimate target for our forces.”

The suspects in the attack, British nationals in their mid-twenties, are out on bail. No explosives were found and no one has been charged. Counter-terrorism police are examining whether the men acted for a foreign state, “knowingly or unknowingly.”

Three days before the arrests, Belgium’s threat-analysis chief, Gert Vercauteren, said those behind the March 9, 2026, bombing outside the Great Synagogue of Liège, and a car torched in Antwerp’s Jewish quarter the same week, had “certainly followed Iran’s call” to strike Jewish and Israeli targets worldwide. Within a single week, two governments had pointed to the same capital.

In mid-July, Europol, the European Union’s law enforcement agency, published its annual terrorism report, TE-SAT 2026. The usual reading is that Europe sees the Iranian threat clearly. The report does warn that pressure on Iran and its proxies “may lead to increased direct threats in the EU,” and that groups which used Europe mainly for fundraising “may increasingly consider attacks” on Jewish and Israeli targets.

Read to the end, though, and the report works more like a ledger that keeps Iran off the books.

The passage that matters is on page 8. “Hybrid threat actors,” Europol writes, continued to use proxies to commit terrorist offenses, and “not all criminal acts committed within this context are necessarily categorized as terrorism.”

The proxies may not know whom they serve. The state behind them goes unnamed. The gap is old: In 2021, Europol noted that state-linked assassinations were excluded from its attack figures.

In practice, a teenager hired on social media to torch a car outside a synagogue can be recorded as an arsonist. The report’s headline figure, 45 attacks in 2025, does not measure Iranian activity, because the classification system was never built to capture it. Call it the off-the-books war: run through local hires, logged as crime, and missing from the statistics.

Israel knows the pattern. According to an Israeli official cited by CNN, at least 60 Israelis have been indicted for spying for Iran since 2023, and the Shin Bet reports a 400 percent rise in recruitment attempts in 2025. The recruits range from 13-year-olds to 72-year-old retirees. They start with graffiti, move on to photographing military bases, and end up watching the homes of senior officials, for a few hundred to a few thousand dollars. In Israel, each one is charged as a security offender. In Europe, the same teenager may go down as an arsonist.

The report’s structure follows the same logic. Jihadism, right-wing and left-wing extremism each get a full statistical chapter. Iran’s proxy network gets about two pages out of more than 50. Europol reports arrests of EU residents who tried to join Iranian proxies without saying how many, and compresses the 2026 wave, Liège included, into one sentence about “indications” of Iranian involvement.

The most serious findings sit in footnotes. In March 2026, a Berlin court sentenced four Hamas operatives and found that the group “carries out operational activities in Europe” to prepare for possible attacks on Jewish and Israeli institutions, though it established no concrete attack plan. The four were arrested in December 2023, and those arrests are absent from the report covering that year. The EU’s terrorist designation of the IRGC, on Feb. 19, 2026, is also a footnote. It came five years after a Belgian court convicted Iranian diplomat Assadollah Assadi of plotting to bomb an opposition rally near Paris, and almost three years after Belgium sent him home in a prisoner swap.

Hezbollah gets similar treatment. The report records the 2025 arrest in Germany of a man suspected of training with the group in Lebanon after Oct. 7. The EU still separates Hezbollah’s “military wing” from its “political wing,” although Germany banned the entire organization in 2020. That same year, Europol wrote that investigators struggle to prove that funds raised in Europe reach “the military wing.” By Europol’s own account, the EU’s distinction hampers enforcement.

The pattern runs across six years of reports. In 2021, TE-SAT had a subsection titled “State-sponsored terrorism,” which said Iran “maintained operatives in Europe who might be ordered to perpetrate terrorist attacks” and cited the Iranian diplomat tried in Belgium. A year later, the same verdict appeared as the conviction of “three men and a woman,” with no mention of Iran, and the subsection was gone. In 2024, Europol warned that Hezbollah was recruiting from organized crime for attacks “including on EU soil.” The 2025 report, covering the year Sweden’s security service publicly accused Iran of using criminal gangs, listed nine suspects arrested for “acting on behalf of foreign intelligence” and named no state. In 2026, Iran returns in the conditional.

Over those years the warning disappeared and came back muted. The vocabulary moved from “state-sponsored terrorism” to “foreign intelligence” to “hybrid threat actors,” and the name of the state dropped out along the way.

The report has a defense. Europol is a law enforcement agency, not a policy body. It relies on what member states report and on their legal definitions, and it covers 2025, before most of this year’s attacks. When a state hires criminals precisely so its acts will not register as terrorism, however, the definition becomes a political choice.

Europe can count when it wants to. All nine completed jihadist attacks in 2025 were carried out by lone actors, with no group directing them, and all were counted, because the criterion is ideology. Tehran’s hired hands have a payment instead. The man who acts for the Islamic State without orders is counted, and the teenager who acts for Iran with orders and a payment may not be. What goes uncounted goes unaddressed.

Europol is the wrong target for criticism. It wrote the warning, drawing on Swedish and Dutch intelligence. The knowledge exists in European capitals. A single European picture of the threat, and a policy built on it, does not.

Britain, outside the EU and outside the report, pointed to Iran within three days. The EU’s report still says “may” about what has already happened in Liège and Antwerp, and about what is now suspected at the fence of a bomber base.

Israel should treat attacks on European synagogues as a front in Iran’s war and say so in every conversation with the EU. Jerusalem, which already prosecutes dozens of such recruits, should ask Brussels for data rather than statements, and share the intelligence that links the local hire to the handler in Tehran.

The EU can start with three steps. It can count attacks that proxies carry out on a state’s instructions as state terrorism, in a separate chapter of the next report. It can designate Hezbollah in its entirety. And it can turn the IRGC designation from a footnote into enforcement.

Europe has the information. What it lacks is a decision.