1.0 Introduction 

The Ministry of Intelligence and Security (MOIS), or Vezarat-e Ettela’at va Amniat-e Keshvar (VEVAK) in Farsi, is Iran’s primary intelligence agency, responsible for both domestic security and operations abroad. Established shortly following the revolution, MOIS was formally established in 1984 and has since played a pivotal role in shaping Iran’s domestic and foreign security landscape. It monitors the population at home, targets opponents abroad, and uses an array of front organisations and covert networks beyond Iran’s borders. MOIS agents are known as “Unknown Soldiers of Imam Zaman,” the name that Ayatollah Khomeini gave them. [source]

2.0 History and Symbols

2.1 History of the MOIS

From SAVAK to MOIS

Before the MOIS was established in 1984, Iran’s main intelligence agency was the Bureau for Intelligence and Security of the State (SAVAK).  After the 1953 CIA-backed coup restored Shah Mohammad Reza Shad Pahlavi, the U.S., the U.K. and Israel helped build a new intelligence service, the SAVAK, in 1957. The CIA and Mossad provided training and funds to the SAVAK, as confirmed by a classified Senate Foreign Relations Committee report. SAVAK was developed into a powerful secret police, running several prisons, including Evin and Komiteh. Its first director was General Teymur Bakhtiar, later dismissed and assassinated. [source, source, source] 

Although officially a civilian agency, SAVAK had close ties to the military, where many of its officers served simultaneously in branches of the Armed forces. The establishment of SAVAK was driven by three primary objectives, according to Hakk Uyger from Turkey’s National Intelligence Academy: [source, source]

1. The suppression of opposition 
2. The surveillance of social groups to prevent any threat to the monarchy
3. Control of media activities throughout the country

There is a documented use of torture and coercion in the SAVAK. During mass protests in 1978, the SAVAK and military used harsh repression and caused thousands of deaths. Despite its reach, the SAVAK failed to anticipate and contain the scale of revolutionary opposition. After the Shah fled Iran in January 1979, SAVAK became a primary target for reprisals. [source, source]

Approximately 80 senior officials were tried and executed, and the organisation was formally dissolved by Khomeini in 1979. [source, source] 

Aside from inheriting its physical headquarters, some of SAVAK’s tactics, personnel and outlook was integrated into MOIS. At the same time, MOIS was shaped by a leadership cadre composed mainly of SAVAK’s erstwhile victims, creating institutional distrust. [source]

Rise of the Komiteh’s 1979 – 1984

After the fall of the Shah, intelligence functions were handled by revolutionary committees (Komiteh’s). Khomeini ordered this formation considering his concerns that a police force may be more loyal to the shah than to the new revolutionary regime. Kumitehs were established in neighbourhoods, police stations, mosques and even youth centres. This became the first post-revolution institutional framework of intelligence. [source, source]

At the same time, in 1979, a decree formally created the IRGC, including an intelligence unit focused on universities and opposition groups, especially the Mijahedin-e Khalq (MEK). IRGC intelligence was also staffed by revolutionary figures, who shaped the later competitive relationship between IRGC intelligence and the MOIS. [source, source]

MOIS Early Establishment 

A major MEK bombing in Tehran in 1982 killed over 80 people and injured approximately seven hundred. The attack triggered a push to centralise intelligence and create a professional ministry. The Majles passed the legislation that created MOIS on 18 August 1983; it was officially established in August 1984, confirming Mohammad Reyshahri as the first Minister of Intelligence. The establishment of the new ministry required the transfer of most of the IRGC intelligence units resources in late 1983 and 1984. The legacy intelligence organisations, especially the Revolutionary Guard, were “slow to comply” with the new bill. [source]

Initially, under the direction of Intelligence Minister Mohammad Reyshahri, MOIS focused on eliminating Iranian elements, mainly MEK. As Steven R. Ward stated, collecting information was not the priority. At the time, the PLO provided the most foreign information to the Iranian government. Interestingly, the Soviet KGB allegedly exploited this information sharing arrangement; by supplying the revolutionary government with false/misleading intelligence, tensions were worsened between Iran and the U.S.. [source, source]

“Like its predecessor, the MOIS approached intelligence less as the collection and analysis of foreign secrets than as investigative work to protect the revolution by countering seditious domestic threats and foreign espionage.” [source]

In the 1990s, MOIS consolidated itself as the core intelligence agency, expanding its domestic surveillance and covert assassinations abroad. Targeting externally based Iranian opponents of the Revolution was one the primary objectives of MOIS. There was also a large purge inside the MOIS in the late 1990’s/ early 2000’s, for its involvement in the “Chain murders.” These were a series of brutal assassinations of Iranian writers and intellectuals attributed to MOIS. [source]

MOIS in the 21st Century evolved into a more professional and bureaucratic intelligence ministry, expanded its counter espionage and cyber capabilities, and continued to remain deeply involved in internal surveillance and political control. IRGC and MOIS tensions grew, and persist today.  [source]

2.2 Symbols 

The former emblem of MOIS depicts Iran’s emblem at the top, also known as Nishan Rasmi. It consists of four crescents and a sword, surmounted by a shadda. The four curves are a stylised representation of the Arabic word ‘Allah’. Beneath is the “Islamic Republic of Iran” and at the bottom, is the inscription for the “Ministry of Intelligence.”

The image on the right depicts what is the new emblem for the Ministry, seen during national television broadcasts. It features an eight pointed star – a polygon that carries religious significance in Islamic culture. The two pointed salients on either side resemble the Arabic ‘la’ meaning “no” or “not” – interpreted as “Neither East, nor West, Islamic Republic.” At the center of the star, an eye symbolises the ministries role as the a surveillant of the Islamic Republic of Iran. [source]

3.0 Organisation 

3.1 Place within broader government

Command Structure

MOIS operates under the ultimate authority of the Supreme Leader, Mojtaba Khamenei. The Supreme Leader appoints the Minister of Intelligence, and holds oversight of the ministry’s direction. The President cannot remove the appointee without Khamenei’s approval, and Khamenei sets the overall direction of foreign and domestic policies. The Minister of Intelligence serves as the top executive within the organisation, directing all intelligence and security functions. Additionally, the Supreme National Security Council (SNSC) sets Iran’s national security policies and ensures they remain aligned with the Supreme Leader’s directives. [source, source] 

Iran’s constitution requires its armed forces to coordinate all military-related intelligence activities with MOIS. The same provision obliges every ministry, institution, government-owned companies, all military and police bodies to provide specialised information to MOIS, and to supply any additional information the ministry requires. Therefore, the constitution requires the IRGC and the Quds Force to report their actions to MOIS. [source, source] 

Organisation

The internal structure of the MOIS is not publicly disclosed. A 1995 employment law requires the ministry to prepare an organisational chart approved by the President. At the same time, Iranian law prohibits disclosing information about MOIS except within the limits of administrative duties. External estimates of the ministry’s internal structure vary widely. The Library of Congress in 2012 assessed that the ministry contains at least 15 directorates. This contrasts to a French research center specialising in intelligence organisations stating the MOIS consists of five primary directorates with over a dozen secondary ones. [source, source]

The 2023 book on the MOIS by Steven Ward offers one of the most detailed studies of the ministry and evaluates the plausibility of the existing claims on MOIS’ internal structure. He concludes MOIS most likely operates through roughly eight principal directorates, centers and organisations. Among these, Ward states that MOIS “almost certainly” has additional directorates for personnel, training, finance and others. The ministry also has regional centers across Iran to monitor and combat regime opponents. Ward lists the MOIS directorates as: [source]

1. Internal security 
2. Counterterrorism 
3. Foreign intelligence operations
4. Counterintelligence
5. Analysis
6. Protection (security)
7. Technical collection 
8. Economic/ anticorruption 

3.2 Key Figures 

Seyed Esmaeil Khatib 

Khatib, born 1961, is a cleric and has served as the Minister of Intelligence since August 2021.  According to the organisation United Against Nuclear Iran, Khatib had a long background in Iran’s security institutions. Rising from IRGC intelligence during the Iran-Iraq War to senior roles in MOIS and the Judiciary’s intelligence arm, he began seminary training in Qom in the mid 1970’s. [source]

Mojtaba Khamenei

Khamenei is the son of Iran’s Ayatollah Ali Khamenei, Iran’s former Supreme Leader who was killed in the US-Israeli strike in February 2026. The BBC believes he has since been confirmed as his fathers successor. At 56, he steps into the role despite having spent most of his life outside the public eye.  [source, source] 

For years, however, he was widely believed to wield quiet, but significant political influence within Iran. US diplomatic cables published by WikiLeaks in the late 2000s described him as “the power behind the robes.” His rise, however, is controversial in the system founded on rejecting hereditary rule – as well as the fact he remains only a mid-ranking cleric. [source]

According to Tara Kangarlou, author of the Heartbeat of Iran, Mojtaba Khamenei “holds a lot of power in the IRGC apparatus; he has his hands in pretty much every infrastructure you can imagine in Iran: so a lot of money, power and influence.” [source]

The Telegraph reports he has accumulated a property empire, including assets in London. He owns two luxury flats costing equivalent to roughly USD 46 million, and is yards from the Israeli embassy in Kensington Palace Gardens. They were bought through Ali Ansari, an Iranian banker, who is now sanctioned by the UK for financing the IRGC. [source] 

3.3 Recruitment

3.3.1 Methods 

MOIS uses multiple channels to identify and bring in new personnel. According to the Congressional Research Service (CRS), one way the ministry recruits is through universities – especially at Imam Mohammad Bagher University in Tehran. A second way is through personal recommendations from a MOIS employee. [source]

3.3.2 Requirements 

The Faculty of Information, which is a higher education center that operates under the supervision of the Ministry of Intelligence was created specifically to train its intelligence personnel. All students of the university are required to join MOIS after their studies. According to Treadstone 71, a high school diploma is the minimum required education to enter Ministry training. The admissions within the Faculty of Information are carried out according to MOIS’ own selection criteria, which is: [source, source]

• Must be Muslim and an Iranian citizen
• Believe in Belayat-e-Faqih and the Islamic Republic 
• Sound mental and physical health as checked by MOIS physicians
• Must pass rigorous security screening 
• Maximum 22 years of age for an undergraduate and 27 for graduate students

However, the CRS stated the MOIS previously recruited Christians, Sunnis and even Jews – indicating the requirement of subscribing to velayat faqih isn’t as stringent. The MOIS takes three times as many applicants as it has spaces, then weeds them out through a series of brutal tests. [source, source] 

3.3.3 Foreign Recruitment 

MOIS actively recruits sources outside of Iran through Iranian embassies, consulates, cultural centres and front organisations. For example, a Paris-based group called “Supporting Iranian Refugees” had been used by MOIS to recruit Iranian asylum seekers and pressure them into reporting on fellow Iranians living in France. They even recruited members of the Mujahadeen-e-Khalq (MEK) outside of Iran to spread disinformation about the group.

The ministry also deploys operatives abroad to kidnap targeted individuals, transport them back to Iran, and subject them to imprisonment or execution. In 2020, MOIS announced that Iranian agents abducted German-Iranian dissident Jamshid Sharmahd while he was transiting through Dubai and secretly transferred him to Iran. He was later sentenced to death and executed. In addition, MOIS actively works to infiltrate exile organisations and create internal rifts among opposition movements overseas.  [source, source, source] 

4.0 Tactical-Operational Information

4.1 Notable Operations 

4.1.1. Surveillance against protesters 

MOIS routinely monitors and suppresses internal dissent within Iran. The nationwide protests triggered by the death of Mahsa Amini in 2022 have likely significantly intensified the ministry’s surveillance activities. 

While arrests and street level suppression are typically carried out by uniformed security forces like the IRGC, police and Basij, MOIS is largely responsible for surveillance, monitoring protest networks, and identifying organisers/participants in coordination with other intelligence bodies. The United Nations Independent International Fact‑Finding Mission on the Islamic Republic of Iran documented that Iranian authorities, likely MOIS, used digital tools such as mobile apps and AI to monitor compliance with laws and track protest related online activity. [source source, source] 

Dissident outlets such as the National Council of Resistance of Iran have published a leaked document suggesting MOIS intensely tracked industrial sector strikes and protest networks. However, the full verification of this document is unknown and should thus be treated with caution. It tracks protests in detail, from the number of workers involved to the exact sites affected. They supposedly monitor social media activity to identify organisers, detaining some for questioning, and using them to gather information on their colleagues. [source]  

4.1.2 Chain assassinations 

In the late 1980s and 1990s, MOIS was implicated in a series of targeted killings and disappearances of Iranian dissidents, writers and intellectuals within Iran. These murders claimed the lives of more than 80 critics in the regime, and were carried out in apparent coordination by intelligence operatives using methods like staged accidents, shootings, and poisonings. 

After initially blaming foreign enemies for the killings, President Khatami was pushed by domestic outrage to open an inquiry. By early 1999, the government announced that a group of MOIS officers had carried out the murders. The man identified as the operations leader — a former intelligence minister — died in custody before he could stand trial. Other personnel received death sentences, and the case was quickly closed. All of the accused insisted they had acted on direct orders from the ministry’s leadership. Khamenei denied state involvement in these assassinations, claiming they were the doing of “Iran’s enemies.” [source, source]

4.1.3 Cyber campaigns

MOIS has become a central actor in Iran’s offensive cyber strategy, directing or supporting hacking groups that target foreign governments, infrastructure and private companies. According to the U.S. Treasury’s sanctions announcement, MOIS has been responsible for dangerous cyber campaigns, including spear fishing and network intrusions. [source, source]

A 5 March investigation reported by The Register found that a MOIS-linked group, MuddyWater, successfully backdoored networks belonging to the U.S. This gave Iranian operatives covert access to sensitive systems and data. [source]

4.1.4 Other activities 

MOIS has repeatedly demonstrated that it is just as prepared to eliminate dissidents abroad as it is inside Iran. A clear example occurred in Turkey in November 2019, when opposition figure Massoud Molavi Vardanjani was gunned down in Istanbul. Following his arrest, the U.S. believes the shooter was under the orders of Iran’s MOIS. [source] 

In March 2024, Majid Dastjani Farahani, an Iranian intelligence officer, was listed as wanted by the FBI for his alleged connections to recruiting individuals for operations in the U.S. including lethal targeting of U.S. government officials. Among those targeted were Trump’s national security advisor, John Bolton, and former Secretary of State Mike Pompeo. Farhani, acting on behalf of Iran’s MOIS, also reportedly recruited individuals for surveillance activities in religious sites, businesses, and other facilities. [source, source]

The MEK has also been a consistent target of MOIS operations due to its oppositional nature. In 2018, Belgium authorities disrupted a MOIS-directed plot in which an Iranian operative attempted to detonate explosives at a MEK gathering in France. [source, source] 

MOIS also frequently, especially as of recently, claims to dismantle foreign espionage networks. In March 2026, MOIS announced it had arrested dozens of individuals it described as “spies, internal mercenaries and operational agents” allegedly working for hostile foreign services, especially the U.S. and Israel. [source] 

4.2 Core Purpose 

MOIS’ legal mandate is to protect the Islamic Republic by suppressing internal dissent and countering foreign intelligence threats. Operationally, MOIS engages in domestic surveillance, counterintelligence, information warfare, and intelligence operations abroad. Iran’s constitution defines MOIS’ function as:

1. Collecting, analyzing, producing, and categorizing internal and external intelligence; 
2. Uncovering conspiracy, subversion, espionage, sabotage, and sedition against the independence, security, and territorial integrity of the Islamic Republic of Iran; 
3. Protecting intelligence, news, documents, records, facilities, and personnel of the ministry;
4. Training and assisting organizations and institutions to protect their significant records, documents, and objects. [source]

4.3 Tactics 

MOIS employs a broad range of tactics depending on the task, including: 

• Utilising HUMINT networks: MOIS relies extensively on HUMINT to infiltrate opposition groups, diaspora communities, and foreign institutions. [source]
• SIGINT and cyber enabled operations: MOIS conducts cyber intrusions and digital surveillance both domestically and internationally. [source]
• Assassinations: MOIS has frequently conducted assassination operations abroad. [source]
• Information warfare: MOIS actively engages in information warfare by spreading manipulated or false information to influence perceptions of the Iranian regime. [source, source]
• Utilising proxy networks: MOIS has historically utilised proxy actors – including terrorist networks – as well as front organisations operating under guises such as refugee assistance groups or even job centres. [source]
• Sowing discord within oppositions abroad: MOIS attempts to weaken exile opposition groups by causing internal friction. [source]

4.4 Personnel size 

The personnel size of MOIS is classified. A 2019 report by the DIA states MOIS employs around 30,000 personnel, making it one of the largest civilian intelligence services in the Middle East. However, figures vary considerably and should not be treated as definitive. [source]

5.0 The Future 

The future trajectory of MOIS is increasingly unpredictable during a significantly volatile and tense environment. During the escalating regional conflict in 2026, airstrikes targeted multiple Iranian internal security and intelligence facilities, including the IRGC facility where the former Supreme Leader was. Recent reports have also indicated strikes very close to MOIS, potentially forcing organisation adaptation in the short term. [source]

6.0 Conclusion 

MOIS is an extremely important part of the regime’s security apparatus in the Islamic Republic. Its ability to operate through embassies, cultural centres, and militant proxies gives it reach beyond Iran’s borders, and is increasingly becoming a threat to neighboring states as well as those in Europe and the U.S.