The U.S.-Israel war with Iran has stoked fears that Tehran could activate dormant agents abroad to execute terror plots.
“I believe there’s sleeper cells all over the world,” Ontario Premier Doug Ford said at a press conference on March 10. “As we know, they’re in the U.S. They’re in Canada.”
According to U.S. media reports, American officials have intercepted encrypted communication believed to have come from Iran that could act as an “operational trigger” to activate “sleeper assets.”
Days after the war began, Qatari authorities announced the arrest of 10 suspects allegedly assigned to spy on “vital and military facilities” in the Gulf nation for the Iranian regime.
But counterterrorism experts say the threat of Iranian sleeper cells is largely overstated.
Dan Stanton, director of the national security program at the University of Ottawa’s Professional Development Institute who also worked for more than 30 years at CSIS, says the Iranian regime does not use ‘sleeper cells’ but rather ‘criminal proxies’ in Canada.
Sleeper cells are understood to be groups of covert agents who remain embedded within a population until they are directed to act — an idea that “often evokes the image of a Russian spy or terrorist living next door, laying low, blending in and waiting to be called upon to carry out an operation,” writes Shannon Nash, a counterterrorism expert who has studied the topic extensively.
“This concept, and the fear of an enemy operating from within, is particularly jarring and plays on society’s perception of security.”
Anxiety around sleeper cells tends to resurface whenever tensions escalate between the U.S. and Iran. But one Canadian security expert says their deployment is not the modus operandi of Iran’s Islamic Revolutionary Guard Corps (IRGC) in Canada.
“They don’t use them,” said Dan Stanton, director of the national security program at the University of Ottawa’s Professional Development Institute.
Stanton, who worked with the Canadian Security Intelligence Service (CSIS) for more than 30 years, says the actual threat lies in Tehran’s use of local criminal networks for targeted intimidation and violence.
“They don’t use sleeper cells in that sense of deep cover agents. They use what we would call criminal proxies. These are people that would do surveillance, harass people or try to kill people.”
Regime critics, activists targeted
Public figures, both in government positions and in the diaspora, who are critical of the Iranian regime are often subject to targeted campaigns or plots against their life.
Among them is former Canadian justice minister and outspoken critic of the Iranian regime Irwin Cotler. In 2024, the RCMP informed Cotler that they had foiled a plot by agents of Iran to kill him.
In a statement to CBC, CSIS wrote that the intelligence agency works closely with “foreign partners and domestic law enforcement” to counter the actions of Iranian intelligence services and their proxies.
“In more than one case this involved detecting, investigating and disrupting potentially lethal threats against individuals in Canada,” it wrote.
Former Canadian justice minister Irwin Cotler tells CBC chief correspondent Adrienne Arsenault about the alleged Iranian assassination plot that has had him under 24/7 police protection and why he thinks more needs to be done to stop the regime’s transnational repression.
In the U.S., two Russians were sentenced to 25 years in prison last October in connection with a murder-for-hire plot targeting Masih Alinejad, an Iranian American journalist and activist, on behalf of the government of Iran.
A few years earlier, the U.S. Justice Department announced charges against an Iranian national for attempting to arrange for the assassination of former national security advisor John Bolton on U.S. soil.
“All of us who were targeted by Iran should be worried, but so should other people now that this attack has begun,” said Bolton, whose security detail was removed in January 2025.
“It was obviously wrong for Trump to take away the protection that was afforded — not just to me but to several other former senior officials — because the threat arose from what we did as part of our official duties,” Bolton told CBC News in an interview.
Thomas Juneau, who teaches at the University of Ottawa’s Graduate School of Public and International Affairs, says the IRGC targets the families of Iranian dissidents as a way to punish or silence them.
“There have been multiple documented cases … parents, siblings, close friends, other family members who are still in Iran who will be aggressively interrogated by intelligence services,” said Juneau.
“And in more extreme cases, [they] will be physically beaten, tortured or [suffer] other kinds of negative consequences, such as financial assets frozen, careers suspended, jobs lost.”
Lone wolf attacks most likely
Intelligence experts stressed that lone wolves with a range of possible motives and affiliations are more likely to be behind acts of violence in Canada than deep-cover Iranian agents.
“The Iranian regime, we should also remember, is part of a political ideology,” said political violence and terrorism researcher Broderick McDonald. “Some of the younger members of the extreme wings of the Iranian IRGC ideology have, in some cases, taken actions on their own.”
CSIS likewise told CBC the mostly likely scenario for a “violent extremist attack” involves “a lone actor whose intent to mobilize is unknown to authorities” and who “could be inspired by the conflict in the Middle East.”
There have been numerous violent incidents in the U.S. since the war began on Feb. 28, including a synagogue attack in Michigan and a shooting in Austin, Texas, where a gunman wearing Iranian-flag-themed clothing killed two and injured 14.
In Canada, a gym owned by an Iranian Canadian activist in Thornhill, Ont., that displayed pre-revolutionary Iranian flags was shot at 17 times after a large anti-regime demonstration.
Separately, the U.S. consulate in Toronto was the target of gunfire in what police are calling a “national security incident.”
“I do think the terrorist threat is worldwide, but especially in North America and Europe,” said Bolton.
“The whole point of terror is to strike people who aren’t necessarily involved directly as adversaries, to show that consequences of being unkind to the terrorist power can be fatal. So terrorism doesn’t necessarily have to be directed only at opponents of the regime in Tehran.”
Juneau cautions against drawing conclusions about the precise motives and actors behind these incidents.
“In some of the more recent cases, there’s still not enough information publicly available to come to a definitive conclusion.”
Risk of sensationalization
McDonald says the flood of false or misleading information about the war online is causing real-world confusion and harm.
“It’s one of the most polluted information environments that I’ve ever seen within a conflict,” he said. “I think we have to look at the war and sleeper cells in that context.”
Political violence and terrorism researcher Broderick McDonald says while it’s important to not overlook legitimate intelligence threats from the Iranian regime, ‘sensational’ reporting and fearmongering are dangerous and play into the ‘escalation narrative’ of the war.
McDonald says it’s important to strike a balance of acknowledging significant threats while remaining highly “aware of the broader information environment.” He also advised caution when engaging with rhetoric about threats that could stoke “Hollywood-style fears,” which “war hawks” in the U.S. and Israel can use to escalate the war.
“It’s a potent tool to also cultivate fear in the United States. And we should, I think, avoid the sensationalization of it.”
Are Canadians safe?
McDonald says Canada has a significant strategic advantage when it comes to identifying possible threats.
“We have the Five Eyes intelligence-sharing network, so not just the United States sharing intelligence with us, but also our partners in the U.K., Australia, New Zealand, and that significantly helps us to detect threats before they even arrive on our shores.”
Additionally, McDonald says Canada’s historically bipartisan commitment to staying out of “wars of choice” further shields the nation from foreign retaliation.
“Both governments, Conservative and Liberal, have pursued this kind of stance. And I think that insulates us from the threats of Iran escalating against Canada.”
Iran threatened to target American and Israeli officials at tourist sites and public places around the world. Meanwhile, U.S. President Donald Trump suggested the war could end soon. He also called NATO allies cowards for not helping to reopen the Strait of Hormuz.
CSIS said it is “focused on ensuring continued vigilance to ensure the safety and security of Canada and all Canadians” and has increased its efforts around “potential Iranian state-directed and violent extremist activity.”
Stanton says it is important to remember that Canada is “not the epicentre of espionage,” nor would it be a high-priority target for a regime struggling to survive.
Regardless of whether Iranian sleeper cells are active in Canada, the regime’s attempts to target and threaten Iranian Canadians are “absolutely” real, says Juneau.
Middle East analyst Thomas Juneau explains that Iran intimidates and pressures Iranian Canadians with the goal of sowing fear among them that they could be surveilled, thereby repressing dissent abroad.
The IRGC does not have the resources to surveil every member of the diaspora, but Juneau says “the simple fact that it is a possibility — and that they know it’s a possibility — sows fear.”
“That’s how transnational repression works,” he said. “If anything, the problem is not its exaggeration. The problem is its neglect by the Canadian government not doing enough to protect Iranian Canadians.”