The Iranian police have arrested two individuals in the western and northern districts of the capital, Tehran, for allegedly operating as “infiltrators” under the guise of journalists. According to a report by representative, the suspects used their media credentials as a cover to gather classified intelligence on military and sensitive installations before transmitting the data to hostile foreign entities.
Table of Contents
Details of the Operation and Allegations
On Tuesday, 19 May, the Tehran Greater Police Information Center issued an official statement confirming that the arrests were the result of a complex, targeted intelligence operation. The authorities stated that the detainees actively exploited their status as media professionals to gain access to, and collect confidential information regarding, crucial military and security infrastructure. This gathered intelligence was subsequently forwarded to various foreign-based networks.
According to police claims, the detained individuals were deeply integrated into an organised espionage network operating both within the borders of Iran and internationally. However, official sources have withheld specific details regarding the identities of the suspects, the specific media outlets they claimed to represent, or the foreign agencies with which they were allegedly collaborating.
Use of Starlink and Encrypted Communications
Preliminary investigations conducted by the police revealed that the suspects maintained encrypted communications with an overseas operations room. To bypass domestic communication restrictions and ensure transmission security, the individuals utilised Starlink satellite internet technology. Law enforcement officials confirmed that a Starlink receiver was confiscated from the suspects’ possession during the raid.
Contextual Background of Security Sweeps
This operation follows a broader pattern of crackdowns on unauthorised communication technology and national security threats within the country. On 14 March, Iranian authorities executed a nationwide sweep resulting in the detention of 27 individuals on security-related charges. During that operation, the Islamic Revolutionary Guard Corps (IRGC) reported that three Starlink terminals were seized from 13 of the detained suspects.
The table below outlines the documented security operations involving Starlink seizures and espionage allegations in Iran:
| Date of Operation | Number of Detainees | Equipment Confiscated | Primary Allegations and Activity | Law Enforcement Agency |
| 14 March | 27 individuals | 3 Starlink terminals | Nationwide security-related offences | Islamic Revolutionary Guard Corps (IRGC) |
| 19 May | 2 individuals | 1 Starlink receiver | Espionage and military data collection under media cover | Tehran Greater Police |
Ongoing Investigations
The Iranian intelligence services and local police are continuing their investigations to identify further collaborators linked to this specific network. The seized encrypted devices and Starlink hardware have been forwarded to forensic analysts to determine the exact volume of data transmitted and to trace the external nodes of the operation.