For years, Western European democracies have been confronted with covert operations by the Iranian intelligence service MOIS (Ministry of Intelligence and Security). Dutch and Belgian intelligence services have long warned about Iran’s activities on their territory, which, alongside political espionage and interference, form part of a deliberate strategy to silence critical voices and political opponents. In Belgium, this has reportedly gone so far as to include plans to kidnap a Member of Parliament. These developments underscore the urgent need to strengthen intelligence and security services, giving them the capabilities to proactively disrupt such activities. After all, the democratic rule of law is being directly attacked — and must be protected.

Our expert, Prof. Kenneth Lasoen, appeared on VTM Nieuws to provide analysis.

MOIS Espionage Practices

MOIS operates with well-trained agents who, through sympathisers and blackmail, build and direct local networks. Activists, journalists, and refugees critical of the Iranian regime are systematically monitored and intimidated. In addition to traditional tailing and physical surveillance, MOIS increasingly employs digital means. Through cyberattacks, they put pressure on government and infrastructure systems or steal sensitive information. The Iranian regime also experiments with so-called ‘hostage diplomacy’, in which kidnappings and detentions are used as political bargaining chips. In 2023, for example, the MOIS agent Assadi — convicted in Belgium — was exchanged for a Belgian journalist and several other European hostages.

A stark example of such pressure involves Darya Safai, a member of the Belgian Chamber of Representatives and human rights activist. The Iranian regime views her as a dissident. According to foreign intelligence, the Belgian intelligence service VSSE was informed of a plan to abduct Safai via Turkey and transport her to Tehran. The trigger appeared to be her resolution to have the Iranian Revolutionary Guard placed on the European terror list. Safai herself publicly stated she was not afraid: “I know what kind of monsters you are. You torture, rape, and murder. But I will never stop fighting for freedom.” The Belgian judiciary has launched an investigation. If true, this case demonstrates Tehran’s willingness to exploit foreign territory for political repression.

Intelligence Services and Their Disruption Capabilities

In the Netherlands and Belgium, the AIVD and VSSE are responsible for detecting foreign threats and monitoring other intelligence services operating on their territory. This includes tracking foreign agencies — a task requiring specialised skills that fall under the category of counterintelligence. However, when security services uncover plans, they must also be capable of actively disrupting them. Recently, Belgium’s Committee I, the oversight body for the intelligence services, has repeatedly pointed out that the legal framework remains unclear regarding the VSSE’s authority — and thus legal capacity — to engage in disruption operations. Clarifying this should be a government priority, as the threat extends far beyond Iran.

MOIS’s attempts to silence dissidents outside Iran are a direct attack on the core values of the democratic rule of law. The kidnapping case involving Darya Safai illustrates the danger lurking behind every façade of diplomacy. Only through vigilance, transparent information-sharing, and decisive action can Belgium and the Netherlands counter this creeping interference. It is also crucial that politicians, activists, and journalists who are potential targets receive concrete protective measures. Safeguarding individual freedoms and the rule of law requires constant vigilance against intelligence services that overstep boundaries — and this demands that security services have the manpower, expertise, and legal powers to carry out disruption operations.

Want to Learn More About Intelligence Work? 

Interested in the world of intelligence services, counter-espionage, deception operations, and protection against technical spying methods? The Knowledge Centre for Security Intelligence (KSI) offers training and courses in threat assessment and intelligence methodology. Discover our programmes on our website or contact us at info@ksi.institute