The three white vans navigated through a picturesque stretch of rural England in the middle of the night, winding toward a British air base that America is using to wage war on Iran.
It was 12:45 a.m. on Sunday when one of the men inside the vans — for reasons still not clear — dialed emergency services, giving authorities their first sign that a terrorism plot they had received intelligence on almost two weeks earlier might be in motion.
The police scrambled an urgent, armed response, speeding to the scene and arresting the man and four associates. A grainy photo later leaked to the media showed the five men sitting shirtless on the side of a road, their hands bound behind their backs.
Why the man called the police remains the subject of debate among investigators trying to unravel what happened that night, security officials from several countries told The New York Times. They asked for anonymity because the inquiry remains open.
It is one of many puzzles that the authorities have yet to piece together.
The call did set off a cascade of events, including the arrest of the men on suspicion of terrorism, the frantic evacuation of 85 homes, a bomb disposal robot searching the vans for explosives, and a national security meeting convened by Prime Minister Andy Burnham. He said later that there were “strong indications that Iran played a part.”
But a part in what, exactly? Mr. Burnham and other British authorities have offered few answers. The vans contained no explosives when police searched them. And within a day, all five men were released on bail, the kind of treatment typically given to common criminals, rather than terrorism suspects. The authorities could also have been hamstrung by the need to keep evidence classified and thus unable to be cited in criminal court.
The police have cast a wide net in trying to find those responsible for hiring the men, whom one official described as “unwitting chumps.” U.S. and British officials believe the operation is connected to Iran’s Islamic Revolutionary Guards Corps or a separate military headquarters in Tehran. Abbas Araghchi, Iran’s foreign minister, has rejected the accusations.
This account is drawn from interviews with investigators, local officials and residents as well as security officials in Britain, Germany, Israel and the United States who had knowledge of warnings about a plot to target U.S. bases in Britain and Europe. Some officials declined to reveal details of the case. Others conceded that the full story remains hazy, even to them. Most spoke on the condition of anonymity, citing the sensitive nature of the investigation.
For Britain, the events of the last six days have been a vivid — if at times mystifying — reminder that the American- and Israeli-led war against Iran that began eight months ago has the potential to do more than raise the price of oil.
In July, Iran’s Revolutionary Guards issued a statement warning that allowing the United States to use the base “makes London responsible” for their actions. “Any base used to launch attacks on Iranian territory,” the statement said, “is a legitimate target for our forces.”
In the end, officials found no concrete signs the men in the vans were in the final stages of an attack. But for a while last Sunday, it looked like Iran might be preparing to make good on its threat.
Vague warnings
In mid-September, U.S. military commanders received a chilling warning from American and other Western intelligence agencies, according to U.S. officials briefed on the information. R.A.F. Fairford, the base in southern England primarily used by the United States Air Force to deploy some of its largest bombers, was the target of a potential Iran-backed attack.
The murky outlines of a plot had been pieced together through a combination of intercepted communications, informants and other intelligence. Israel’s prime minister, Benjamin Netanyahu, said his intelligence officials also warned their British counterparts of a likely Iranian-sponsored attack, though they did not provide a specific target. Follow-up attacks were likely to include drones, the confidential assessments warned.
The warnings were general. Analysts could not pin down a date or concrete details about the plotters, other than concluding they were guided and supported by Tehran. Base commanders in Britain raised security levels, already elevated since the start of the war with Iran.
Residents of the nearby town of Fairford, and the villages of Kempsford and Whelford, began noticing changes. There were “rumbles that things were being moved around the base in terms of protection and levels of warnings,” said Dom Morris, a local councilor.
On Sept. 16, 11 days before the episode at the base, a resident posted in a private neighborhood Facebook group that he had seen something unusual: a man in a balaclava running through the village around 9 p.m. At least three other villagers said they had seen a masked man wearing black. It was unclear if they were speaking about the same person, or who it was.
Across Europe, concern among officials was surging. According to a senior U.S. official, Israel warned Germany that American bases there were at heightened risk, noting Spangdahlem and Ramstein in particular.
On Sept. 23, four days before the events at R.A.F. Fairford, an Iranian-backed media site posted comments from Yahya Rahim Safavi, former chief commander of the Islamic Revolutionary Guards Corps. According to SITE Intelligence Group, which tracks the online activity of jihadist organizations, Mr. Safavi condemned Europe as a “logistics hub” for America’s war on Iran, naming air bases that U.S. forces have used to conduct the war, including Ramstein in Germany, Aviano in Italy and Fairford.
But without concrete intelligence about a specific target or timing, there was little the authorities could do — except tighten security and wait.
A plot emerges
That changed, dramatically, last Sunday.
A local farmer returning home from a party found her driveway blocked by the three white vans.
“I looked at it and thought ‘that is not real’,” the farmer, who declined to be identified, later told BBC News. She told reporters she saw eight to 10 people in masks running.
At 1:36 a.m., she said, she called 999, the British version of 911, and later said she believed her call “foiled whatever plans they had.”
The police timeline suggests, however, that she made her call about 50 minutes after the man in the van. It isn’t clear whether the people she saw were the suspects, or security operatives responding to the initial alert.
“This is a hugely complex and large-scale operation,” Vicki Evans, the deputy assistant commissioner for Britain’s counter terrorism police, said later on Sunday, adding: “Our activity is in the interest of national security.”
By Monday, however, the case took a surprising turn.
The men were released on bail, a rare outcome for terrorism suspects. The police said later they had discovered some gasoline, but no explosives, in the vans. Laurence Taylor, Ms. Evans’ s supervisor, told reporters the men were “subject to stringent conditions on their movement and contact with others. They absolutely remain under investigation.”
Behind closed doors, officials were trying to determine the suspects’ role, and whether Iran was using them to undermine Britain’s willingness to let the U.S. use its bases. It is not yet clear how much investigators have learned from the men about their plans.
Were they a diversion from another attack that was in the works? Had they been intercepted before they could link up with other confederates? Or was the episode an elaborate hoax designed to sow fear and create propaganda?
Some intelligence officials believed the initial call by one of the five men was part of a plan to distract the police while a broader plot unfolded. Others thought it was more likely that the five men were low-level criminals, one of whom called when they realized they had been hired to do something serious.
Mr. Taylor shared little about the investigation in his statement on Monday. But he hinted at the complexity of the case.
“Often this threat becomes visible to us as criminal activity,” he said, “often at a small scale and committed by individuals whose primary aim is not terrorism but a quick financial gain.”
Assessing future risks
The head of MI5, Britain’s domestic security agency, has warned for years about Iran-backed plots, which have often involved targeting opponents using local criminals.
“Iranian state actors make extensive use of criminals as proxies — from international drug traffickers to low-level crooks,” Ken McCallum, the group’s director general, said in 2024. Iranian journalists and dissidents in Britain have received death threats and been physically attacked.
The former prime minister of Britain, Keir Starmer, initially refused to let the Trump administration use R.A.F. Fairford for strikes on Iran, saying he would not join “regime change from the skies.” But he later gave permission for what he called “defensive” operations, and American B-52 and B-1 planes loaded with bombs began flying to Iran from Fairford. Mr. Burnham has continued the policy.
After Mr. Starmer announced the change on March 1, Iranian proxies appeared ready to act against a wider range of targets in Britain. Four ambulances belonging to a Jewish volunteer group in London were set on fire. Molotov cocktails were thrown at several synagogues in the middle of the night.
The goal appeared to be to stoke fear in the Jewish community, while signaling that Britain’s changed posture had consequences. The attacks were claimed by a group calling itself Harakat Ashab al-Yamin al-Islamia, or Hayi, which, U.S. prosecutors said, is a front for Kataib Hezbollah, a U.S.-designated terrorist group and one of the most powerful Iranian proxies in Iraq. A commander from the group was charged in the U.S. in May with leading the attacks and other incidents in Europe as part of a retaliation campaign by Tehran.
In April, Hayi posted a video claiming that the Israeli embassy in London would be attacked by drones carrying dangerous substances. Suspicious items, including two jars of a powdered substance, were found in the nearby Kensington Gardens. A massive police response was triggered, involving chemical, biological, radiological and nuclear teams. But the police later concluded that there had been no attack on the embassy and the powdered substance was not hazardous.
An actual assault on an American air base in Britain would be a dramatic escalation, officials said.
By the end of the week, the evacuated families had returned to their homes and a 1,300-foot cordon around where the vans had been was taken down. But concrete barriers were installed around the entrance of R.A.F. Fairford. As the investigation continued, the police arrested a 25-year-old dual British-Iranian national in London, on suspicion of preparing terrorist acts. He, too, was released on bail.
Julian E. Barnes contributed reporting from Washington.
The post An Iranian Threat, 3 Vans and a Phone Call: Behind the Mystery at a U.K. Air Base appeared first on New York Times.
