US intercepts Iran signal that may activate domestic sleeper cells

The federal alert described a shortwave radio transmission intercepted after the death of AAAyatollah Ali Khamenei. Intelligence analysts assessed it as a possible 'operational trigger' — a pre-arranged signal that instructs covert operatives to activate or stand by. The format matched Cold War-era 'numbers stations': encrypted broadcasts using numerical codes that only the intended recipients with decryption keys could interpret. Iran's Islamic Revolutionary Guard Corps has maintained foreign proxy and sleeper networks in the United States for decades, including an active plot to assassinate former National Security Adviser John Bolton in 2022 and a 2023 plot to kill a Sikh separatist on U.S. soil.

The IRGC's Quds Force — its external operations unit — has historically maintained networks in North America through a combination of Hezbollah operatives, recruited Iranian nationals, criminal organizations used as cutouts, and radicalized lone actors with no direct organizational link. The 2022 Bolton plot used a Pakistani-American with connections to a criminal network to try to hire a hitman. Security analysts note that the most dangerous sleeper threat is not organized cells but lone actors who may self-activate after seeing the signal without any direct contact with Iran — making them nearly impossible to detect in advance.

FBI Director Kash Patel's authorization of additional domestic surveillance resources raised civil liberties concerns that go beyond the immediate threat. Expanded domestic surveillance during wartime has historically swept in communities far beyond those who pose any actual threat. The IRGC designation as a foreign terrorist organization — imposed by the Trump first term in 2019 — gives law enforcement broad authority to monitor anyone suspected of providing 'material support,' a standard that legal scholars have argued is broad enough to encompass protected political activity.

Trump's acknowledgment that the DHS partial shutdown weakened response infrastructure was a self-inflicted wound. The shutdown — now in its 25th day — had left more than 50,000 TSA officers missing paychecks and had degraded CISA's cybersecurity monitoring to below-minimum staffing levels. The same political standoff that Senate Democrats had been using to demand ICE accountability reforms had left the domestic security architecture at its most vulnerable point just as the Iran war escalated. Both sides pointed at each other: the White House blamed Democrats for 'holding security hostage,' and Democrats noted the shutdown was a consequence of the administration's own funding demands.

Security experts cautioned against treating the intercepted signal as proof of an imminent attack. Governments routinely intercept ambiguous communications and issue precautionary alerts to avoid being caught flat-footed. The signal's encoding was not yet confirmed as an IRGC transmission — it could be Iranian state media, a diplomatic channel, or even a deliberate deception designed to provoke U.S. overreaction and drain domestic security resources. Former DHS officials told reporters that the alert reflected 'prudent caution' rather than a confirmed threat.

The civil liberties dimension of the domestic surveillance expansion affects Muslim Americans, Iranian Americans, and Arab Americans disproportionately. During the 2001-2003 period following 9/11, the FBI ran mass surveillance programs targeting mosques and Muslim community organizations without individualized suspicion, later found to have violated the First and Fourth Amendments. The ACLU and Arab American advocacy organizations put out statements on March 10 warning against a repeat of post-9/11 community surveillance and calling on the FBI to maintain individualized suspicion standards.