US intercepts Iran signal that may activate domestic sleeper cells

The intercepted signal was not a digital message — it was a shortwave radio broadcast. U.S. intelligence detected the transmission shortly after Khamenei's death on February 28. The broadcast appeared designed for 'clandestine recipients possessing the encryption key,' according to federal alert language reported by Newsweek. This is the Cold War spy tradecraft playbook: numbers stations transmit coded sequences on shortwave frequencies that any radio can receive but only the intended recipient with the key can decode. They don't use the internet or cell towers, making them nearly impossible to block or trace to a specific receiver.

The federal alert described the broadcast as 'likely of Iranian origin' and said it matched the pattern of messages meant to impart instructions to 'covert operatives or sleeper assets.' Crucially, the alert also stated there was 'no operational threat tied to a specific location' — a distinction between a warning signal intercepted in transit and evidence of an imminent attack. Intelligence officials told CNN there was 'nothing to indicate there have been any increased threats or activated sleeper agents since the U.S. first launched strikes against Iran.' ABC News Fox News

The most alarming detail wasn't the signal — it was what Kash Patel had done to the team responsible for detecting exactly this kind of threat. In early March 2026, just days before the U.S.-Israel strikes on Iran began on February 27, Patel fired approximately a dozen agents and staff members from CI-12, the FBI's Washington Field Office counterintelligence squad dedicated to Iranian threats. The agents weren't fired for performance reasons. They were fired because they had previously worked on the investigation of Trump's alleged retention of classified documents at Mar-a-Lago.

Sources told CNN that the gutting of CI-12 was 'devastating to the FBI's Iran program.' The squad's value was not just in its agents but in the confidential informants those agents had cultivated over years inside Iranian-American communities — sources who trusted specific agents personally and wouldn't necessarily cooperate with replacements. One source told CNN bluntly: 'You can't replicate that with new agents. These sources will go away.' Congresswoman Grace Meng formally raised concerns about the firings in a letter to DOJ on March 3. Washington Times HS Today

Iran's capacity to deploy operatives inside the United States is not theoretical. The IRGC's Quds Force and Iranian intelligence services have maintained dormant networks in the U.S. for decades, most visibly through the Lebanese Hezbollah cells that U.S. law enforcement has tracked since the 1990s. In 2022, the DOJ indicted an IRGC officer for plots to assassinate former National Security Adviser John Bolton. In 2023, Iranian-linked operatives were charged with planning attacks on journalists and dissidents inside the U.S.

Military.com's reporting on the sleeper cell alert documented the historical infrastructure: IRGC proxy networks embedded in diaspora communities across North America, Hezbollah's operational cells that have existed in U.S. cities since the 1980s, and repeated assassination plots against former U.S. officials including Secretary of State Mike Pompeo and retired General Mark Milley. The threat is real and documented — but it is also the kind of threat that benefits most from exactly the long-term human intelligence the CI-12 firings dismantled. Iran International HS Today

Two violent incidents occurred within days of the intercepted signal. In Austin, Texas, on March 1, 2026, a 53-year-old suspect opened fire at Buford's Backyard Beer Garden, killing two people and wounding 15 others. Hours later in Toronto, gunfire struck a boxing gym run by Iranian-Canadian dissident Salar Gholami, who had been a vocal critic of the Iranian regime. Neither attack was confirmed as Iran-directed, and law enforcement did not publicly connect them to the operational trigger intercept. But the proximity in time and the targeting of an Iranian dissident in one case amplified concerns about whether activation signals had reached operational assets.

Federal law enforcement officially cautioned against drawing connections. The FBI's public statement did not confirm an activated network. Intelligence analysts interviewed by NewsNation said the genuine threat — IRGC proxy networks — is 'plausible but not publicly confirmed' and that separating government operational posture from confirmed plots requires careful scrutiny of official language. Police1 The Hill

The DHS partial shutdown created a documented gap in the response infrastructure. The Department of Homeland Security was operating under reduced capacity due to budget conflicts and personnel departures when the sleeper cell alert was issued. Trump, pressed by reporters on whether Iran had activated cells inside the U.S., said 'we've been very much on top of it' — and then blamed the DHS shutdown for weakening the response infrastructure. The implicit admission was significant: the president simultaneously claimed vigilance and attributed any vulnerabilities to a shutdown his administration was responsible for managing.

Senate Minority Leader Chuck Schumer called for emergency DHS funding in a floor statement on March 10, citing the security gap created by the partial shutdown during wartime. The funding dispute illustrated how domestic political battles over the budget — entirely separate from the Iran war — created concrete counterterrorism vulnerabilities that intelligence officials described as avoidable. ABC News The Hill

The civil liberties dimension of the sleeper cell alert is distinct from the threat assessment dimension. When the FBI director authorizes 'additional domestic surveillance resources' in response to a foreign intelligence alert, the legal authority for that surveillance depends on whether the subjects are U.S. persons, whether a FISA Court order is required, and whether the wartime framing of the Iran conflict is being used to claim expanded authorities that bypass judicial oversight.

Post-September 11 history is instructive: the warrantless wiretapping program authorized by President Bush after 9/11 operated for years before becoming public, was later found to have violated FISA by the Foreign Intelligence Surveillance Court itself, and swept up an unknown number of U.S. persons' communications. The pattern of post-9/11 surveillance expansion — justified by emergency, revealed years later — has made civil liberties advocates deeply attentive to wartime domestic surveillance announcements. The ACLU and Brennan Center for Justice were tracking the Iran war's domestic surveillance implications in real time. Brennan Center Washington Times