San Diego Military & Defense Monitor — Special Report
The Southern Flank: Border Vulnerability, Sleeper Cells, and the Iranian Threat Approaching from Mexico
Fifteen miles south of Naval Air Station North Island lies the busiest land border crossing in the Western Hemisphere. As U.S. forces wage war against Iran, that proximity — and three decades of documented Hezbollah infrastructure in Latin America — has moved from background concern to active operational threat.
Key numbers
- 15 mi Distance: NAS North Island to Tijuana–San Diego border crossing
- 1,740 Iranian nationals encountered at U.S.-Mexico border, 2020–2025
- 700,000+ Iranian-descent population in Southern California — largest outside Iran
- 27+ Iran-linked plots connected to U.S. documented by Washington Institute researchers
- 2,500+ Iranian nationals arrested inside U.S. since 2021
The San Diego–Tijuana metropolitan region is, depending on how one counts, either the busiest or the second-busiest land border crossing on earth. More than 70,000 vehicles and tens of thousands of pedestrians cross daily through the San Ysidro and Otay Mesa ports of entry alone. Camp Pendleton's southern perimeter sits roughly 40 miles north of that crossing. Naval Air Station North Island is approximately 15 miles away. Naval Base San Diego, homeport to the Pacific Fleet's most capable surface combatants, lies even closer. No analysis of the threat to San Diego's military and defense-industrial complex under Operation Epic Fury is complete without a frank accounting of what that geography means in a wartime counterintelligence and counterterrorism environment.
That accounting requires confronting two distinct but related threat streams. The first is the potential for Iran and its proxy Hezbollah to exploit established networks in Latin America — including documented relationships with Mexican criminal organizations — as conduits for infiltrating operatives, moving weapons, or positioning surveillance assets close to San Diego's military installations. The second, and more immediately alarming, is the possibility that individuals who entered the United States through the southern border during the period of reduced enforcement between 2021 and 2025 may now be subject to activation as "sleeper" assets — a concern elevated from theoretical to operational by an extraordinary intelligence development this week.
Breaking Intelligence — March 9, 2026
U.S. Intercepts Encrypted Iranian Signal Believed to Be "Operational Trigger" for Sleeper Assets
The U.S. government has intercepted an encrypted transmission believed to have originated in Iran that may constitute an "operational trigger" for sleeper assets positioned outside the country, according to a federal alert reviewed by ABC News and reported by multiple outlets on March 9–11, 2026. The alert cites "preliminary signals analysis" of a transmission "likely of Iranian origin" relayed across multiple countries shortly after the death of Supreme Leader Ayatollah Ali Khamenei on February 28.
The transmission was delivered to "clandestine recipients" via a new shortwave radio frequency — not via traditional internet or cellular networks, which are more easily monitored. Intelligence officials noted that upon the frequency's activation, an eerie male voice began with "Tavajjoh! Tavajjoh!" — the Persian word for "attention" — followed by a seemingly random string of numbers consistent with a numbers station format historically used to communicate with covert agents.
The alert instructs law enforcement agencies to increase monitoring of suspicious radio-frequency activity. Federal authorities emphasized there is "no operational threat tied to a specific location," but FBI Director Kash Patel stated he had instructed counterterrorism and intelligence teams to "be on high alert and mobilize all assisting security assets." The Joint Terrorism Task Forces throughout the country, including San Diego's JTTF, are reported to be operating around the clock.
The Geographic Reality
Why Proximity to the Mexican Border Is a Specific Threat Amplifier for San Diego's Military Complex
The San Diego–Tijuana border region has unique characteristics that distinguish it from other stretches of the 1,954-mile U.S.-Mexico boundary. It is not simply the busiest crossing — it is the most surveilled, the most resourced in terms of enforcement personnel, and the most intensively studied by both U.S. and foreign intelligence services. It is also, paradoxically, one of the most penetrated: decades of cartel activity have produced sophisticated tunneling infrastructure, corrupt officials on both sides of the line, and well-established human smuggling networks capable of moving individuals with custom cover identities into the United States at the request of whoever can pay.
The Military-Border Proximity Problem
Naval Air Station North Island to San Ysidro Port of Entry: approximately 15 miles. Naval Base San Diego to San Ysidro: approximately 8 miles. Marine Corps Recruit Depot to San Ysidro: approximately 7 miles. Camp Pendleton northern boundary to Tijuana: approximately 55 miles. Any hostile actor who successfully crosses the border at Tijuana enters a metropolitan area that is, within minutes of driving, proximate to the homeport of a carrier strike group, the training base for the Pacific Fleet's Marines, and the headquarters of Naval Special Warfare Command. The military geography of San Diego is inescapable — and so is its relationship to the border.
Congressional testimony has noted the specific relationship between Tijuana tunnel infrastructure and the security of San Diego military installations. During a House hearing on narcoterrorism, a DEA official described massive tunneling operations linking Tijuana to San Diego as comparable in sophistication to Hezbollah's tunneling operations on the Lebanon border — and noted that Hezbollah was known to have shared tunneling expertise with cartel-affiliated groups. That testimony was delivered over a decade ago. The tunnels have not disappeared; in recent years, multiple sophisticated cross-border tunnels with rail systems, ventilation, and electricity have been discovered in the San Diego–Tijuana corridor, primarily by the DEA and CBP working together.
Iran's Latin American Network
Hezbollah in the Western Hemisphere: A Three-Decade Infrastructure That Now Points North
Hezbollah — Iran's most capable proxy and a designated Foreign Terrorist Organization whose funding flows approximately 70 percent from Tehran — has maintained a continuous operational presence in Latin America since the 1980s. It is not a recent or speculative development. Two geographical hubs have dominated its regional presence: the Tri-Border Area where Argentina, Brazil, and Paraguay converge, and Venezuela under the Maduro regime. From these bases, Hezbollah has built a network of financial infrastructure, document forgery operations, human smuggling routes, and criminal partnerships that stretches from South America through Central America to Mexico and ultimately to the U.S. border.
A 2025 RAND Corporation study, Hezbollah's Networks in Latin America, found that the militant group's Western Hemispheric networks could exploit cross-border vulnerabilities and manipulate existing trafficking routes into the United States. The same study noted that Hezbollah has historically used California as a fertile base for fundraising while avoiding operational activities — but assessed that the calculus could shift under the pressure of direct military confrontation with the United States and Israel. That confrontation is now underway.
"Hezbollah's Latin American networks could exploit cross-border vulnerabilities, manipulate existing trafficking routes into U.S. territory. Defense strategists should pay careful attention to the continuity of intent and the organization's proven ability to execute high-casualty operations thousands of miles from Lebanon."— RAND Corporation, "Hezbollah's Network on America's Southern Doorstep," April 2025
The Hezbollah–cartel nexus, while not universally accepted in terms of its operational depth, is documented through federal court records and DEA testimony. Hezbollah has known connections to the Los Zetas cartel. In 2011, Colombian-Lebanese drug trafficker Ayman Joumaa was indicted by a federal grand jury for distributing cocaine — and for money laundering that funneled proceeds to Hezbollah. The Joumaa network laundered hundreds of millions of dollars through cocaine trafficking and used car sales in the United States before being disrupted by Customs and Border Protection, the FBI, and partner agencies. In 2024, Argentinian authorities flagged suspected Hezbollah activity at the port of Iquique, Chile, where one of the organization's most notorious money launderers was spotted — suggesting continued operational activity in the hemisphere even as Hezbollah was suffering significant military losses in Lebanon.
The route from Hezbollah's Latin American network to San Diego's military installations is not theoretical. The Washington Times has reported that Hezbollah has specifically used access routes from El Paso, Texas, to San Diego as high-value entry corridors. Former DEA Chief of Operations Michael Braun stated publicly that Hezbollah and the cartels "rely on the same criminal weapons smugglers, document traffickers and transportation experts" — the same shadow facilitators who move fentanyl north can move people with specialized operational purposes in the same direction.
Documented Iranian / Hezbollah Infiltration Route: South America → U.S.-Mexico Border
Iranian Nationals at the Border: What the Court Records and CBP Data Show
The data on Iranian nationals at the U.S.-Mexico border changed dramatically between 2019 and 2025. According to CBP data compiled by the Middle East Forum, approximately 90 Iranian nationals were encountered at U.S. land borders during the entire period from 2000 to 2019 — roughly 4.5 per year. From 2020 through 2025, that number rose to approximately 1,740 encounters — roughly a 19-fold increase. Former CBP Commissioner Rodney Scott stated that thousands of Iranian nationals were documented entering the United States illegally between 2022 and 2025. Since 2021, more than 2,500 Iranian nationals have been arrested inside the United States.
Five Iranians Detained Between Tijuana and Tecate Under FBI Observation (December 2023)
Mexican authorities detained five Iranian nationals — accompanied by a Haitian driver serving as their guide — whose vehicle was stopped at a toll booth between the Baja California border cities of Tijuana and Tecate. The group was suspected of attempting to cross into the United States. Iran International reported that two of the five were said to be under FBI observation at the time of their detention. The incident attracted limited public attention but illustrated the specific geography of concern: the Tijuana-Tecate corridor sits directly adjacent to the San Diego metropolitan area and its dense concentration of military installations and cleared defense contractor facilities.
Iranian Nationals on U.S. Security Watch List Apprehended at Texas–Mexico Border (2023)
Two Iranian nationals who were on a U.S. security watch list were apprehended at the Texas–Mexico border in 2023, stoking security concerns about the efficacy of watch list–based screening at high-volume crossing points. The case underscored that even known persons of security concern were attempting — and nearly succeeding — at crossing the southern border using established smuggling routes. In Texas, law enforcement agencies have been tracking growing numbers of "special interest aliens" from the Middle East who crossed the southern border, with Iranian nationals representing a persistent category of elevated concern.
Iran Plotted to Assassinate Israel's Ambassador to Mexico
U.S. officials disclosed in November 2025 that Iran had plotted to assassinate Israel's ambassador to Mexico — a plan initiated at the end of 2024 and led by a Quds Force Unit 11000 operative who had spent several years handling and recruiting Iranian agents across Latin America from the Iranian Embassy in Venezuela. The plot was active through the first half of 2025 before being thwarted. The case is particularly significant for San Diego's threat picture because it demonstrates that IRGC-QF's Latin American network is not limited to fundraising — it is actively conducting assassination planning in Mexico, using Mexico as an operational staging ground for lethal operations. The network infrastructure that nearly killed an ambassador in Mexico City is geographically and organizationally connected to routes that terminate at the Tijuana–San Diego border crossing.
The significance of the Iranian Embassy in Venezuela as a regional IRGC-QF coordination hub cannot be overstated. U.S. officials, DEA leadership, and intelligence analysts have consistently identified Venezuela — whose government maintains warm relations with Tehran — as the primary Western Hemisphere staging point for Iranian intelligence operations. Former DEA administrator Michael Braun stated that members of the elite Quds Force were showing up in Latin America and that he was "not opposed to the belief that they could be commanding and controlling Hezbollah's criminal enterprises from there." That assessment, first offered over a decade ago, has only been reinforced by subsequent intelligence reporting and prosecuted cases.
Venezuela's Decapitation — Eight Weeks Before Operation Epic Fury
The timing invites a hypothesis that has not been prominently advanced in mainstream coverage: the January 3, 2026 U.S. capture of Nicolás Maduro in Operation Absolute Resolve — publicly framed as a narcoterrorism law-enforcement action — may have simultaneously served as a preemptive strike against the primary Western Hemisphere command-and-control node for IRGC-Quds Force operations in the Americas. If true, this would mean that the Trump administration, knowing it was preparing to strike Iran (Operation Epic Fury commenced February 28, 2026), moved first to dismantle Tehran's most capable regional retaliatory infrastructure — eight weeks before the first bombs fell on Iranian soil.
Venezuela as IRGC-QF's Western Hemisphere Headquarters
The factual basis for this hypothesis is not inferential. It is documented. Secretary of State Marco Rubio, speaking in a Fox News interview in December 2025 — weeks before the Venezuela operation — stated directly: "Iran, its IRGC, and even Hezbollah has a presence in South America, and one of their anchor presence — especially for the Iranians — is inside of Venezuela." The Atlantic Council's January 2026 analysis of the Venezuela-Iran connection, published immediately after Maduro's capture, provided the most specific structural description available in open-source literature: the IRGC-Quds Force maintains a robust presence in Venezuela specifically organized around Department 11000 (the QF subunit responsible for international terrorist plots) and Department 840 (overseas assassination operations), led by Ahmad Asadzadeh Goljahi. This is not a financial support network or a propaganda operation. It is an active covert operations command structure headquartered in the Venezuelan capital.
The operational significance of the Caracas node was confirmed by the November 2025 IRGC-QF assassination plot against Israel's ambassador to Mexico. According to Jerusalem Post reporting on the case, the plot was orchestrated in part by an undercover Quds Force officer stationed in Caracas. The assassination was to be carried out in Mexico City — precisely the operational geography that connects to the San Diego threat corridor. The Caracas node was not merely providing financial facilitation. It was directing active lethal operations in Mexico, using cartel-adjacent networks, targeting a diplomat in a city 1,800 miles from San Diego. The same infrastructure, activated for a different objective, terminates at the Tijuana–San Diego border.
Based on the Atlantic Council's December 2025 sourcing, the IRGC-QF structure in Venezuela encompassed:
- Department 11000 (IRGC-QF): International terrorist plot coordination — the same unit whose operative directed the 2025 Mexico assassination attempt and whose predecessor cell managed the 2011 Arbabsiar cartel-recruitment operation from Tehran
- Department 840 (IRGC-QF): Overseas assassination operations — the unit directly implicated in the series of 2022–2024 murder-for-hire plots against U.S. officials and dissidents documented in federal indictments, including the Asif Merchant case
- Hezbollah External Security Organization / Unit 910: Extraterritorial operations infrastructure, co-located with and dependent on the Venezuelan safe-harbor environment, with documented reach to Margarita Island and the Paraguaná Peninsula as secondary staging points
- Iranian Embassy Caracas: Diplomatic cover for Quds Force officers under official accreditation — a pattern documented across multiple IRGC-QF operations globally and specifically confirmed in the Mexico assassination case
The Timing Case: Eight Weeks as Strategic Lead Time
Operation Absolute Resolve was executed on January 3, 2026. Operation Epic Fury commenced February 28, 2026. The gap is 56 days — eight weeks. During that window:
- The IRGC-QF's primary Western Hemisphere command node (Caracas) was disrupted by the removal of its state patron
- The Venezuelan government's ability to shield Iranian intelligence personnel from U.S. surveillance was degraded
- IRGC and Hezbollah personnel in Venezuela faced an immediate question of personal security and exposure
- Any pre-positioned retaliatory plans that had been developed through the Caracas node required rapid reconstruction under degraded communications security
- The FBI and intelligence community had eight weeks to identify, surveil, and disrupt IRGC-linked networks in the Western Hemisphere before Iran had any confirmed reason to activate them against the United States
CSIS's January 2026 analysis of Operation Absolute Resolve noted something subtle but significant: the U.S. strikes were deliberately surgical, avoiding damage to the broader Venezuelan military command structure. The assessment concluded that the Trump administration may have wanted to preserve the military apparatus it would need to keep order in the transition period. That same logic, extended to the intelligence domain, suggests a deliberate calculation: remove the political patron, expose and disrupt the covert networks, but avoid the kind of chaotic collapse that would scatter IRGC-QF assets into ungoverned spaces where surveillance becomes harder.
The Atlantic Council's analysis drew the strategic implication explicitly: for Tehran, Operation Absolute Resolve was "meaningful because it unsettles a core assumption — that leadership insulation and escalation risk reliably constrain U.S. action." Iranian strategic planning had long assumed that U.S. concern about escalation would protect state-patron relationships like Venezuela. That assumption was falsified on January 3, 2026. The question the intelligence community was racing to answer in the eight weeks that followed is whether the disruption of the Caracas node was comprehensive enough — or whether IRGC-QF had redundant networks in Bolivia, Cuba, Nicaragua, and the Tri-Border Area that could reconstitute the retaliatory planning pipeline before Epic Fury commenced.
What Maduro's Capture Did — and Did Not — Accomplish
The capture of Maduro eliminated the state patron relationship that made Venezuela uniquely valuable to IRGC-QF. It did not eliminate the personnel. Quds Force officers and Hezbollah Unit 910 operatives who were in Venezuela on January 3, 2026 did not disappear when Maduro was removed. They faced three options: exfiltrate to Iran or Lebanon via third-country routes; relocate to Bolivia, Cuba, or Nicaragua — the remaining Latin American states with Iranian diplomatic infrastructure; or go to ground within Venezuela under the transitional Rodríguez government, whose posture toward Iranian intelligence personnel was uncertain and rapidly evolving.
Critically, the U.S. pressure campaign to dismantle Iranian intelligence infrastructure throughout Latin America did not begin with Maduro's capture — it preceded it. The Jerusalem Post documented that the Trump administration had been pushing Bolivia, Ecuador, Argentina, Chile, Peru, and Panama to designate the IRGC as a terrorist organization and expel suspected Iranian intelligence operatives since late 2025. Ecuador had already designated the IRGC in September 2025. Argentina designated the IRGC Quds Force specifically in January 2026. The effect of these coordinated diplomatic moves was to narrow the IRGC-QF's viable operating environment throughout the hemisphere simultaneously with the kinetic disruption in Caracas.
From the perspective of the San Diego threat picture, the net assessment is this: Operation Absolute Resolve likely degraded — but did not eliminate — the Western Hemisphere IRGC-QF network that poses the most credible operational threat to California's defense infrastructure. The Caracas command node has been disrupted. The trained personnel it directed remain at large in a degraded but not destroyed network. The Mexico operational infrastructure that the Caracas node was running — cartel contacts, safe houses, document channels, surveillance routes — was not destroyed by Maduro's capture. And the retaliatory motivation that Operation Epic Fury created arrived eight weeks after the disruption began — with unknown operational effect on whatever reconstitution the surviving network had been able to achieve in the interim.
The Sleeper Cell Question
How Real Is the Threat? What Intelligence Agencies and Analysts Actually Assess
The term "sleeper cell" has been deployed with varying degrees of precision in public discourse since Operation Epic Fury began. It is worth being precise. A sleeper cell is a covert group of trained operatives — often associated with a terrorist organization or foreign intelligence agency — who infiltrate a target country and remain dormant for an extended period, blending into the local population until they receive a specific signal or order to act. The individuals are trained to stay under the radar, sometimes for years or decades. The defining feature is patience. Former intelligence officials say that patience is what distinguishes a sleeper operation from an opportunistic attack.
Against this definition, what do intelligence agencies actually assess about Iranian sleeper capabilities in the United States? The Washington Times, drawing on research by the Washington Institute for Near East Policy, reports that Iranian agents or proxies have been connected to at least 27 plots in the United States over the past decade, including surveillance operations and attempted attacks. The existence of that planning infrastructure does not, by itself, confirm the presence of large-scale dormant terror cells — but it does confirm the existence of networks capable of conducting operations on U.S. soil on relatively short notice.
Factors Limiting Border Infiltration Risk
- Iranian irregular migration has sharply declined since early 2025 peak; Colombia and Panama recorded near-zero Iranian crossings by May 2025
- The 3–6 month journey through 7 countries exposes operatives to surveillance at multiple chokepoints
- Iran likely prefers less scrutinized entry routes (forged EU passports, diplomatic cover) over the heavily monitored southern border
- Every Iranian crossing the southern border is individually interviewed and screened as a "special interest alien"
- U.S.-Mexico security cooperation has increased significantly; Mexico transferred 29 high-value criminal suspects to U.S. custody in early 2025
- No confirmed evidence of a large-scale Iranian sleeper-cell network currently operating inside the U.S., per Washington Times review
Factors Elevating Border Infiltration Risk
- Iranian border encounters surged nearly 19-fold between 2019 and 2025; 2,500+ Iranian nationals arrested inside U.S. since 2021
- IRGC-QF Latin American network confirmed conducting active assassination operations in Mexico as recently as 2025
- Hezbollah cartel relationships provide access to tunnel infrastructure and document forgery in the Tijuana corridor
- Forged passport rings in Brazil and Thailand allow Iranian operatives to travel as nationals of Visa Waiver Program countries
- Encrypted "operational trigger" intercepted March 9, 2026 — consistent with activation signal for pre-positioned assets
- Southern California's 700,000+ Iranian-American population provides large potential cover population for blending
The most sobering element of the current threat picture is the convergence of these factors with the timing of the intercepted transmission. U.S. signals intelligence intercepted what officials are describing as a sophisticated encrypted broadcast consistent with a numbers station — a format historically used by intelligence services worldwide to communicate with covert agents in the field. The signal appeared shortly after the killing of Khamenei and was relayed across multiple countries before being detected. Former DHS Assistant Secretary for Counterterrorism Elizabeth Naumann stated that "a country like Iran does not have the capability to beat us militarily, so they rely on asymmetric means. They will look to use cyberattacks, they will look to use proxies like Hezbollah, criminal agents." That analysis describes exactly the threat vector that the southern border represents.
"The latent national security issue was not so much that Iranian terrorists would blow up something so much as that they would spy. For some time in the foreseeable future, U.S. homeland security will have no choice but to consider the migrants in light of both espionage and Iran's promises of retaliation."— Todd Bensman, Center for Immigration Studies, on the specific national security calculus of Iranian border crossers
What Makes This Border Crossing Specifically Dangerous for the Military Community
San Diego's relationship with its southern neighbor is characterized by extraordinary economic and human integration. Approximately 100,000 people legally cross the border every day for work, school, medical care, and commerce. The Tijuana–San Diego metroplex functions, in many respects, as a single binational urban region. This integration is a profound economic and cultural asset. In a wartime counterintelligence environment, it is also a vulnerability.
The specific concern for the military and defense-industrial community is not primarily that an Iranian operative would conduct a mass-casualty attack using the border as an entry route — though that possibility cannot be dismissed. The more operationally realistic concern, grounded in the historical pattern of Iranian intelligence activity, is that the border provides a relatively accessible route for individuals whose mission is surveillance, technical collection, or the establishment of forward support infrastructure for operations directed from overseas. An operative whose purpose is to photograph the approaches to NAS North Island, identify the residence of a senior general atomics program manager, or establish contact with a pre-recruited asset at a cleared contractor does not need to carry weapons through a port of entry — they need only to establish a plausible cover identity and blend into a metropolitan area of three million people with a large Iranian-heritage community.
Key Indicators Law Enforcement and the Defense Community Are Monitoring
- Shortwave radio activity: Following the intercepted numbers station transmission on March 9, law enforcement has been instructed to monitor for unusual or new shortwave radio-frequency signals in the San Diego area — a specific technical indicator for covert agent communication
- "Special interest alien" crossings: CBP continues to screen every Iranian national crossing the southern border under enhanced protocols; any surge in crossing attempts from the Baja California corridor will trigger heightened federal response
- Suspicious surveillance activity near military installations: Photography or observation of base perimeters, waterfront access points, contractor facilities, or military family residential areas by individuals who cannot be readily identified
- Unusual financial transactions: Iranian procurement networks use cryptocurrency and multi-country wire transfers; FinCEN has issued guidance to financial institutions in border regions about transaction patterns consistent with IRGC-linked activity
- Hezbollah fundraising network activity: Southern California has historically been one of Hezbollah's most productive U.S. fundraising zones; any increase in activity by known or suspected Hezbollah-affiliated networks in the region is a potential indicator of broader operational preparation
- Tunnel discovery activity: CBP and DEA continue active monitoring of the Tijuana–San Diego tunnel corridor; any newly discovered tunnel with characteristics exceeding drug trafficking purposes — such as electrical systems or communications infrastructure — warrants immediate federal escalation
The current security posture at the border reflects an elevated threat environment. In direct response to Operation Epic Fury, Customs and Border Protection and the Border Patrol have increased surveillance at all San Diego–area ports of entry, elevated their screening protocols for nationals of countries with documented IRGC relationships, and increased coordination with the FBI's San Diego field office and NCIS counterintelligence personnel. The Department of Homeland Security's intelligence arm (I&A) has issued specific threat advisories to state and local law enforcement in California addressing the Iran conflict's domestic threat implications.
California Governor's Office of Emergency Services and the San Diego County Sheriff's Department have both received federal threat briefings and are coordinating with the FBI's Joint Terrorism Task Force. The JTTF structure — which integrates federal, state, and local law enforcement — is specifically designed for the kind of multi-jurisdictional threat that a motivated foreign intelligence service operating across the Tijuana–San Diego metropolitan area would present.
The Offshore Drone Threat: FBI Warns California Law Enforcement of Iranian UAV Attack Aspirations
A new and qualitatively distinct threat dimension emerged publicly on March 11–12, 2026, when ABC News first reported — and multiple outlets subsequently confirmed — that the FBI's Joint Terrorism Task Force had distributed a formal bulletin to California law enforcement agencies warning of an Iranian aspiration to launch unmanned aerial vehicle attacks against the West Coast from an unidentified vessel offshore. For San Diego, home to the largest concentration of U.S. naval power in the Pacific, the implications are direct.
"We recently acquired information that as of early February 2026, Iran allegedly aspired to conduct a surprise attack using unmanned aerial vehicles from an unidentified vessel off the coast of the United States homeland, specifically against unspecified targets in California, in the event that the U.S. conducted strikes against Iran."— FBI Joint Terrorism Task Force bulletin, distributed late February 2026, as reported by ABC News, March 11, 2026
The bulletin was distributed in late February — just days before the U.S. and Israel launched Operation Epic Fury on February 28. The intelligence was described as acquired in early February 2026, predating the strikes, meaning Iran was pre-planning offshore drone options as a contingency retaliatory measure before the first bomb fell. The FBI alert explicitly acknowledged no information on timing, method, specific targets, or perpetrators beyond the broad California designation.
California Governor Gavin Newsom confirmed awareness of the threat at a March 11 press conference, noting that he had activated the State Operations Center when the war began and that "drone issues have always been top of mind." Newsom stated the state is coordinating through the California Governor's Office of Emergency Services and transmitting federal intelligence to local agencies in real time. The Los Angeles County Sheriff's Department confirmed it is operating at an elevated readiness posture, monitoring for lone-actor attacks, sleeper cells, and cyber threats simultaneously. The LAPD stated it is coordinating with federal and state partners in real time, noting no known specific threats to Los Angeles as of March 12.
San Diego: The Primary Strategic Target on the West Coast
While the FBI bulletin referenced "unspecified targets in California," the logic of Iranian targeting doctrine points directly at San Diego. No other location on the West Coast presents the concentration of high-value military targets that San Diego does: the Pacific Fleet's primary home port, the Navy's nuclear-powered carrier strike group infrastructure, NAVSPECWARCOM (Naval Special Warfare Command — the Navy SEAL enterprise), NAVWAR (the command that operates U.S. military satellite and communications networks), MCAS Miramar, and the Marine Corps Recruit Depot. A single successful drone strike on San Diego's naval waterfront — particularly the 32nd Street Naval Station, where multiple warships are often berthed simultaneously — would carry strategic symbolic weight far exceeding its physical damage.
The FOX 5/KUSI San Diego report confirmed that the FBI's San Diego field office declined to comment on the bulletin, consistent with the broader FBI posture of neither confirming nor denying specifics. The San Diego Police Department had not issued a public statement as of the date of this report, though law enforcement sources indicate the JTTF structure is fully activated in San Diego County.
The Shahid Bagheri Factor: Iran's Offshore Drone Carrier
The FBI's concern about an "unidentified vessel" carrying attack drones is not hypothetical — it has a specific precedent in Iran's recent naval development. Iran commissioned the IRIS Shahid Bagheri in February 2025, a converted commercial container ship repurposed as the world's first dedicated fixed-wing drone carrier. The vessel features an angled 180-meter flight deck, a ski-jump launch ramp, and documented capacity for Ababil-3N carrier drones, JAS-313 stealth drones, and Mohajer-6 reconnaissance drones. Iranian military officials stated the ship had an operational range of 22,000 nautical miles — sufficient to operate anywhere in the Pacific — and could remain at sea for up to a year without refueling.
That specific threat was eliminated early. U.S. Central Command announced on March 2, 2026 — within 96 hours of Operation Epic Fury commencing — that the Shahid Bagheri had been struck by U.S. forces. CENTCOM later released footage on March 6 showing the vessel ablaze. Military analysts noted that CENTCOM publicly identified the Shahid Bagheri as one of the most strategically important early targets precisely because it represented Iran's primary platform for extending drone warfare beyond the Strait of Hormuz into open ocean. Its destruction was described by analysts as stripping the IRGC Navy of its most ambitious attempt to create a mobile offshore drone warfare base with Pacific reach.
However, the destruction of the Shahid Bagheri does not eliminate the offshore vessel threat entirely. Intelligence officials have long assessed that Iran's pre-positioning strategy involves not only purpose-built military vessels but also commercial ships, fishing vessels, and flag-of-convenience cargo ships that could conceal drone launch infrastructure. The FBI's bulletin referred to an "unidentified vessel" — suggesting the concern extended beyond any single known platform.
Technical Assessment: Could Iranian Drones Actually Reach San Diego?
Defense analysts interviewed by Fox 5 San Diego and other outlets offered measured assessments of the feasibility question. The core technical constraint is range: Iran's primary attack drone, the Shahed-136, has an operational range of approximately 800 to 1,550 miles depending on variant. San Diego is roughly 7,500 miles from Iranian territory — far beyond any direct-launch scenario. The threat, if real, would depend entirely on a vessel closing within launch range of the California coast.
Retired U.S. Navy Captain Armen Kurdian, interviewed by FOX 5/KUSI, assessed the Iranian Navy's conventional capabilities as minimal and noted that any Iranian vessel flying a false flag across the Pacific would generate significant maritime intelligence alerts. Carnegie Endowment scholar Nicole Grajewski told TIME that Iran does not currently have the range to execute such an attack, and that even if it could get close enough, the slow, loud profile of Shahed-series drones would make them relatively easy to intercept. Law enforcement sources cited by FOX 11 Los Angeles described the intelligence as "uncorroborated" and "cautionary," with no current evidence that Iran has the active capability to execute such an operation from the Pacific.
The countervailing concern, however, is pre-positioning. ABC News National Security Contributor and former DHS intelligence chief John Cohen explicitly raised the possibility of drone equipment being pre-positioned on vessels already in or near U.S. waters before the war began — a scenario that would bypass the Pacific-transit detection problem entirely. Cohen also specifically cited Iran's documented presence in Mexico and South America as a potential alternative launch corridor, directly connecting the offshore drone threat to the land-border threat matrix that defines San Diego's unique vulnerability profile.
Early February 2026: FBI acquires intelligence indicating Iranian aspirations for an offshore drone attack against California as a contingency retaliatory measure in the event of U.S. strikes against Iran.
Late February 2026: FBI JTTF distributes bulletin to California law enforcement agencies. The warning goes out days before Operation Epic Fury begins.
February 28, 2026: Operation Epic Fury commences. U.S. and Israeli forces strike Iranian territory. Supreme Leader Khamenei is killed.
March 2, 2026: CENTCOM announces the IRIS Shahid Bagheri — Iran's drone carrier and the vessel most capable of projecting offshore UAV power toward the Pacific — has been struck by U.S. forces within 96 hours of the war's start.
March 6, 2026: CENTCOM releases footage showing the Shahid Bagheri ablaze following a second visible strike.
March 11, 2026: ABC News first publicly reports the FBI bulletin. Governor Newsom confirms awareness. LAPD, LASD, and San Francisco PD issue statements of elevated readiness.
March 12, 2026: Times of San Diego and City News Service report continued law enforcement vigilance. FBI San Diego field office declines comment. The threat is characterized as "aspirational" but not yet dismissed.
What This Means for San Diego Specifically
The offshore drone threat adds a third attack vector to San Diego's already complex threat environment — joining the land-border infiltration route and the cyber intrusion threat documented elsewhere in this report. Unlike the border and cyber threats, which require human assets or digital access, an offshore drone attack could be executed with minimal local infrastructure: a vessel, launch crew, and pre-positioned drones. The U.S. military's destruction of the Shahid Bagheri significantly degraded the most capable platform for executing this scenario, but the intelligence community's concern about pre-positioned assets on non-military vessels remains an open question.
The proximity of San Diego's naval installations to the Pacific coastline — NAS North Island sits directly on the water, and the 32nd Street Naval Station's piers are visible from public roads — means that a drone launched from even a modest vessel within 50 miles of the coast could potentially reach high-value targets. The U.S. Navy's counter-drone capability, including systems developed and deployed out of San Diego, is the primary defensive answer to this scenario. San Diego is also the home port for the Navy's emerging unmanned surface vessel program — the same program that first tested the LUCAS drone that was later used in strikes against Iran — giving the region both unique exposure and unique defensive expertise.
- Add to watch indicators: Any maritime activity by vessels of unknown origin operating in unusually close proximity to the California coast, particularly slow-moving or stationary vessels in areas not consistent with normal shipping lanes
- Add to watch indicators: Any reports of drone sightings over San Diego's naval waterfront, Coronado Island, or Point Loma — the elevated terrain directly overlooking the submarine base — that cannot be attributed to authorized military or commercial operations
The Mexico Launch Corridor: The More Credible Threat Vector
Expert analysis and the body of evidence assembled in this report converge on a conclusion that the official FBI bulletin language — "unidentified vessel off the coast" — may actually describe the less operationally plausible attack scenario. A more credible and more immediately actionable threat vector runs directly through Tijuana and Baja California, using Iran's established relationships with Mexican criminal organizations to provide the launch infrastructure that IRGC itself cannot place in the Pacific without detection.
Former DHS intelligence chief John Cohen made this case explicitly in his ABC News commentary on the FBI alert, stating that Iran's documented presence in Mexico and South America, combined with its drone stockpile and its now-activated retaliatory incentive, creates a ready-made surrogate launch capability. Cohen was not speculating abstractly — he was describing a convergence of three independently documented threat streams that, when combined, point directly at the Tijuana–San Diego corridor as the most operationally efficient route for an Iranian drone strike against Southern California's naval targets.
Three Streams Converging: IRGC Networks, Cartel Drones, Tijuana Geography
Stream One — IRGC's Mexico infrastructure: Iran's operational presence in Mexico is not theoretical. The 2011 Mansour Arbabsiar case documented that the IRGC-Quds Force specifically attempted to recruit Mexican cartel contacts (through an individual who turned out to be a DEA informant) to carry out an assassination on U.S. soil. The 2025 IRGC-QF Unit 11000 assassination plot against Israel's ambassador to Mexico confirmed that the IRGC continues to run active covert operations out of Mexico. Dr. Walid Phares, co-secretary general of the Transatlantic Parliamentary Group, told Iran International that the IRGC's most important strategic objective in Latin America was precisely access to the Mexican border. The infrastructure — financial channels, safe houses, human networks, document forgery — already exists.
Stream Two — Cartel drone capability: The convergence of IRGC networks with Mexican cartel drone infrastructure represents a genuinely new threat dimension that has been developing for years but has reached operational maturity as of 2025–2026. The data is stark. CBP detected 34,682 drone flights within 500 meters of the U.S.-Mexico border in fiscal year 2025 alone — compared to 7,678 along the Canadian border. Between 2021 and 2025, Mexican cartels conducted 221 documented weaponized drone attacks, killing 77 people, according to the National Counterterrorism Innovation, Technology, and Education Center (NCITE). The CJNG operates a dedicated "Drone Operators" unit responsible for 42 attacks resulting in 21 deaths. In October 2025, three explosive-laden cartel drones struck the Baja California state attorney general's office in Tijuana — a hardened government building less than one mile from the California border.
The cartels are not merely using commercial off-the-shelf drones for surveillance and smuggling — they have developed FPV (first-person-view) kamikaze strike capabilities modeled directly on Ukrainian battlefield tactics. A July 2025 Defense News report revealed that Ukrainian counterintelligence was investigating suspected infiltration of Ukraine's International Legion by Latin American operatives with alleged cartel ties who joined specifically to acquire FPV drone combat training. Some of these operatives came from Mexico's own cartels, according to Mexico's National Intelligence Center. The knowledge transfer from the world's most active drone battlefield to organizations operating eight miles from NAS North Island is now documented.
The Pre-Built Intelligence Architecture: Drug Runners and CBP Watchers
What makes the cartel drone infrastructure particularly valuable as an IRGC force-multiplier is not just the weapons capability — it is the accumulated intelligence. Years of systematic cartel drone operations along the Tijuana–San Diego corridor have produced something that Iran's IRGC could not purchase, steal, or develop on its own in any reasonable timeframe: a detailed, continuously updated operational picture of CBP sensor coverage, patrol rhythms, response times, and airspace blind spots along the most militarily significant stretch of the U.S.-Mexico border.
The scale of this drone surveillance enterprise is documented in federal data and law enforcement testimony. DHS Executive Director for Counter-Drone Operations Steven Willoughby told Congress in July 2024 that hostile organizations flew roughly 27,000 drones within 500 meters of the border in the first six months of 2024 alone. CBP's full fiscal year 2025 figure reached over 42,000 detected near-border flights. These are detected flights — the number of undetected sorties is, by definition, unknown. CSIS analyst Henry Ziemer has noted that the border "remains a wicked problem from a counter-UAS standpoint" because at over 3,100 kilometers in length, persistent detection across the full stretch is operationally impossible with current resources.
The cartel drone mission set along this corridor is well-documented by law enforcement. According to Axon's counter-UAS analysis and multiple Border Patrol field reports, cartels use drones to scout security vulnerabilities, identify agent locations and response times before launching smuggling runs, and guide drug mules in real time around active patrol positions. In El Paso and New Mexico, drones have been observed mapping Border Patrol routes and identifying weak points along the border wall. Del Cueto, a former Border Patrol union president, confirmed that drones had been spotted flying over border patrol stations and ports of entry, gathering layout and operational intelligence. Cartel reconnaissance drones have operated under thermal imaging at night for five or more years, building a multi-year dataset of patrol patterns under all lighting and weather conditions.
The drug delivery mission is equally mature. CBP seized a single drone in October 2023 carrying 3.6 pounds of fentanyl pills — enough to kill tens of thousands of people. The International Narcotics Control Board reported that traffickers have migrated to custom-built drones capable of carrying payloads up to 220 pounds. The payload range is significant: a drone that can reliably deliver 220 pounds of narcotics across a defended border can deliver a warhead of equivalent mass. Iran's Shahed-136 carries an 88-pound warhead. Cartel delivery drones already exceed that payload threshold.
THE DAVIS-MONTHAN PRECEDENT: A CARTEL DRONE INSIDE A U.S. AIR FORCE BASE
The threat is not merely theoretical on the San Diego side of the border. Security Info Watch documented a particularly alarming incident in which a sophisticated, high-speed cartel reconnaissance drone penetrated the airspace over Davis-Monthan Air Force Base in Tucson, Arizona — an active military installation housing the 355th Wing and the Air Force's aircraft boneyard. The drone paused above fuel storage tanks, evaded two pursuit helicopters, and escaped back across the border without being destroyed or its operators identified.
Davis-Monthan is 60 miles from the Mexican border. NAS North Island is 15 miles from Tijuana. The cartel drone that surveilled Davis-Monthan was conducting exactly the kind of pre-attack reconnaissance that a weaponized follow-on strike would require: identifying high-value infrastructure (fuel tanks), assessing defensive response capability (two helicopters scrambled, neither successful), and demonstrating that penetration of a secured U.S. military installation's airspace was achievable with commercial drone technology.
The counter-drone coordination failures at the border compound the problem significantly. DroneXL's analysis of the February 2026 El Paso airspace closure — in which the Pentagon's own laser systems shot down a CBP MQ-9 Guardian drone worth $30 million — documented that agencies operating counter-drone laser systems at the border have no functioning deconfliction system. They are, in the analyst's phrase, "flying blind in each other's airspace." The same deconfliction failure that destroyed a $30 million U.S. government asset would apply in an Iranian drone attack scenario: a Shahed-class weapon or a high-performance cartel FPV approaching San Diego's naval waterfront from the Tijuana direction would enter an airspace where CBP, DoD, FAA, and local law enforcement counter-drone systems are not reliably coordinated. The cartels' years of reconnaissance have almost certainly captured this coordination gap in their operational picture — and IRGC planners would value that intelligence enormously.
THE TIJUANA PROXIMITY PROBLEM
The Tijuana–San Diego metropolitan area is the world's busiest land border crossing. It is also the world's most drone-saturated border corridor. The geographic distances from Tijuana to San Diego's naval installations are not merely concerning — they are operationally decisive:
- NAS North Island (home of the Pacific Fleet carrier air wings): ~15 miles from the San Ysidro port of entry
- Naval Base San Diego / 32nd Street (Pacific Fleet home port): ~8 miles from San Ysidro
- MCRD San Diego (Marine Corps Recruit Depot): ~7 miles from San Ysidro
- NAVWAR (Naval Information Warfare Systems Command): ~9 miles from San Ysidro
- NAB Coronado (Naval Special Warfare Command / SEAL teams): ~14 miles from San Ysidro
Iran's Shahed-136 has an operational range of 800–1,550 miles. Cheap commercial FPV drones have ranges of 3–7 miles. The entire U.S. Pacific Fleet's home port complex is well within range of a drone launched from Tijuana, Baja California — a city where cartel drone attacks on government facilities are now a documented, recurring reality.
Stream Three — The September 2025 FBI cartel-drone bulletin: Critically, the FBI was already tracking this exact convergence before Operation Epic Fury began. The same ABC News report that first published the Iran offshore drone bulletin also revealed a separate FBI bulletin from September 2025 warning that unidentified Mexican cartel leaders had authorized drone attacks using explosive-laden UAVs against U.S. law enforcement and military personnel along the U.S.-Mexico border. The FBI called such an attack "unprecedented but exemplifies a plausible scenario." That bulletin predates the war by six months. The cartel drone infrastructure was already being assessed as a potential threat to U.S. military personnel along the border before Iran had any retaliatory motive. With Operation Epic Fury now providing that motive, the two threat streams — Iranian intent, cartel capability — are directly aligned.
The IRGC-Cartel Operational Logic
The value of the cartel route to Iran is not primarily military — it is operational security. A Shahed-class drone launched from a ship in the Pacific would be tracked from the moment it crossed the radar horizon of any U.S. naval vessel, leaving an unambiguous signature pointing back to Iran. A drone launched from Tijuana by cartel infrastructure, using commercial off-the-shelf hardware that is already detected crossing the border by the thousands daily, presents a fundamentally different attribution problem. The launch could occur in a residential or industrial area of Tijuana indistinguishable from the cartel-on-cartel drone warfare that Mexican authorities already track as routine criminal activity. U.S. counter-drone systems at the border are calibrated against small commercial drones used for drug smuggling — not against Iranian Shahed-class kamikaze weapons that would be delivered pre-positioned and assembled on-site by IRGC-trained operators working through cartel infrastructure.
The IRGC has a documented doctrine of using criminal intermediaries precisely to maintain plausible deniability. The 2011 Arbabsiar plot, the 2024 assassination-for-hire cases, and the 2025 IRGC-QF Mexico operation all follow the same pattern: Iranian intelligence identifies an objective, recruits or contracts local criminal infrastructure to provide logistics and cover, and maintains operational separation from the actual execution. Applying that same doctrine to a drone attack — Iranian drones, cartel operators, Tijuana launch site, San Diego naval targets — is not a leap of analytical imagination. It is the logical extension of IRGC's demonstrated playbook, applied to a capability the cartels have independently developed and Iran has independently fielded at scale in active combat.
The Atlantic Council's counterterrorism program made a directly relevant observation in its September 2025 analysis of cartel drone adoption: should U.S. policy escalate to direct kinetic strikes against cartels — which the Trump administration has in fact done — FPV drones could quickly be redirected toward U.S. personnel and infrastructure, including border patrols and "critical nodes in urban environments." The cartels already have the motive (retaliation for Trump's FTO designations and military strikes) and the platform. Iran has the motive (Operation Epic Fury) and the relationships. The analytical question is not whether this convergence is theoretically possible — it is whether it has already been activated.
Defense Contractors and the Power Grid: The Softer Targets a Drone Can Reach
The naval installations at NAS North Island and Naval Base San Diego are hardened military targets with active security perimeters, on-base counter-drone capability, and armed response forces. A drone attack on those facilities would be militarily audacious but operationally constrained by the defenses in place. The more analytically compelling drone target set in San Diego may be the softer, largely undefended infrastructure that sustains those bases — and that sits, largely unprotected, within easy drone range of the Tijuana corridor.
Defense Contractors: General Atomics and the Reaper Connection
General Atomics Aeronautical Systems (GA-ASI), headquartered in Poway in northern San Diego County with major facilities throughout the region, is not merely a defense contractor — it is the company that built the MQ-9 Reaper drone that killed IRGC-Quds Force commander Qasem Soleimani on January 3, 2020. That single act of targeted killing, directed by President Trump and executed by a drone launched from a GA-ASI platform, represents one of the most operationally and symbolically significant assassinations in the Islamic Republic's history. IRGC doctrine explicitly calls for retaliation not just against the government that ordered the killing, but against the institutions and individuals that enabled it. The MQ-9 program office, the engineers, the manufacturing facilities in Poway, Adelanto, and El Mirage — all are documented objects of IRGC retaliatory intent.
GA-ASI's Poway headquarters and its Kearny Mesa facilities are located entirely outside any military perimeter. They operate in commercial and light-industrial zones with standard commercial security: perimeter fencing, security guards, surveillance cameras. They have no organic anti-drone systems. A Shahed-class weapon, or even a commercially modified FPV drone carrying several pounds of explosives and guided by a cartel operator in Tijuana, could reach GA-ASI facilities from the border without crossing any military installation airspace whatsoever. The psychological and strategic impact of a successful strike on the facility that produced the drone that killed Soleimani would exceed anything Iran could achieve by hitting a warship pier.
Northrop Grumman, L3 Technologies, Cubic Defense, BAE Systems San Diego, and SAIC — all maintain major facilities in San Diego County in similarly undefended commercial settings. The DHS intelligence community, as documented in the IRGC threat assessments cited throughout this report, has specifically identified defense contractor facilities as a target category in Iranian retaliatory planning. The connection between IRGC retaliatory doctrine and the specific geographic vulnerability of San Diego's defense industrial base — sitting in commercially accessible locations within drone range of Tijuana — is direct and requires no inference.
The Power Grid: San Diego's Demonstrated Achilles Heel
Perhaps the most strategically significant soft target in San Diego's threat landscape is its electrical grid — and its documented history of catastrophic single-point failure makes it uniquely attractive to an adversary with limited resources and maximum strategic ambition.
On September 8, 2011, a single maintenance worker at the North Gila substation near Yuma, Arizona made a routine error removing a capacitor bank from service. Over the next 11 minutes, that single action triggered 23 cascading failure events across five interconnected power grids, cutting electricity to nearly 7 million people across San Diego County, southern Orange County, Imperial Valley, Yuma, and Baja California Norte. The San Diego Gas & Electric service area — all 3.5 million customers, all 4,100 square miles — went dark simultaneously. Flights were cancelled. Sewage pumps failed. Hospital backup generators were tested to failure. Traffic signals went dark from San Diego to the Arizona border, creating gridlock that took hours to clear. The outage cost the San Diego regional economy an estimated $100 million in a single day.
The root cause was structural: at the time of the 2011 blackout, San Diego's sole 500-kilovolt interconnection to the Western grid was the Southwest Power Link (SWPL) — a single transmission line running from the Palo Verde Nuclear Generating Station in Arizona to SDG&E's Miguel substation in San Diego County. As the FERC investigation found, San Diego was uniquely vulnerable among California's major metropolitan areas precisely because it had only one high-voltage import pathway. When the SWPL was overwhelmed, the San Onofre Nuclear Generating Station switchyard automatically isolated San Diego from the rest of the Western Interconnection — and local generation could not compensate. The entire grid island collapsed in seconds.
THE 2011 BLACKOUT: SINGLE FAILURE, REGIONAL CATASTROPHE
Trigger: One maintenance worker removes a capacitor bank at North Gila substation, Yuma, AZ.
Cascade: 23 failure events across 5 power grids in 11 minutes.
Result: ~7 million people lose power — all of San Diego County (1.4 million SDG&E meters), Baja California, Imperial Valley, parts of Arizona.
Duration: 12 hours before full restoration; grid described as "fragile" for days after.
Economic impact: $100+ million to the San Diego regional economy in one day.
Root cause: San Diego depended on a single 500 kV transmission line (the Southwest Power Link) for the majority of its imported power. When that line was compromised, there was no adequate backup pathway.
Critical note: SDG&E in August 2025 announced the Golden Pacific Powerlink — a new 500 kV line from Imperial Valley — to add a second high-voltage import pathway. Construction is not expected to begin until the end of the decade. The single-pathway vulnerability therefore remains unresolved as of March 2026.
The 2011 event was an accident. What an adversary with knowledge of SDG&E's grid topology could accomplish deliberately with targeted physical or drone-based attacks on critical transmission infrastructure is qualitatively different — and significantly worse. The SWPL and its key chokepoints, including the Miguel substation in Chula Vista (which receives 500 kV power from Arizona and redistributes it throughout the San Diego grid), are large, outdoor installations with no meaningful overhead protection. Transmission towers along the SWPL corridor are similarly exposed. As Domestic Preparedness documented in its 2025 critical infrastructure analysis, electrical substations were traditionally protected only by chain-link fencing designed to deter theft — not overhead drone attack. Ballistic walls added after the 2013 Metcalf substation sniper attack provide protection against rifle fire; they provide no protection against a drone descending vertically onto transformer equipment.
The specific drone-based attack methods documented in open-source research are directly applicable to substation infrastructure. Thermite-loaded drones — which produce molten metal at 4,000 degrees Fahrenheit capable of burning through transformer casings — have been used in Ukrainian battlefield operations. Graphene powder dispersal drones can short-circuit high-voltage equipment through arc-over events. A conventional FPV drone loaded with a shaped charge, launched from the Tijuana side of the border and guided to the Miguel substation or to a transmission tower on the SWPL right-of-way, would not need to cross any military airspace, penetrate any base perimeter, or overcome any specialized security system. It would need only to reach a large outdoor electrical facility that any Google Maps search reveals in full detail.
The Iran-Grid Connection: A Pattern Already Established Abroad
Iran's targeting of electrical infrastructure is not hypothetical — it is documented operational practice. CSIS's March 2026 analysis of Iran's drone campaign in the Gulf during the first week of Operation Epic Fury specifically documented Iranian strikes against "energy infrastructure" targets alongside military installations, consistent with Iran's established doctrine of combining military and economic disruption to maximize coercive pressure. Iranian-linked cyber actors (documented separately in the contractor threat section of this report) have specifically targeted SCADA and industrial control systems — the same systems that manage power grid switching operations — with the FAD Team claiming unauthorized access to multiple such systems as recently as March 2026.
Utility Dive's January 2026 investigation — published before Operation Epic Fury commenced — documented that DHS had already issued private warnings to U.S. energy companies to harden their facilities against drone attack, citing specifically the Iran threat context. The publication quoted Fortem Technologies Chief Business Officer Brien O'Connell directly: "The electric grid was never designed with aerial threats in mind." Most utilities, O'Connell noted, lack even basic airspace awareness — the ability to detect and track drones operating near their facilities. The FY2026 National Defense Authorization Act expanded counter-drone authorities, but training and deployment of those capabilities is prioritized for major events like the World Cup over utility infrastructure protection.
For San Diego specifically, the convergence is acute: a grid with a documented history of catastrophic single-point failure, key substations located in commercially accessible areas with no overhead drone defense, transmission infrastructure running through open terrain accessible from the Tijuana corridor, and an adversary — IRGC operating through cartel surrogate infrastructure — with both the motivation and the demonstrated capability to deploy drone-borne incendiary and explosive payloads against undefended targets. The 2011 blackout required a single accidental failure at a substation 200 miles away. A targeted drone strike on the Miguel substation in Chula Vista — 10 miles from the border — would not need to be accidental.
- Add to watch indicators: Any drone activity detected near SDG&E's Miguel substation (Chula Vista), the Southwest Power Link transmission corridor, or the Sycamore Canyon and Peñasquitos substations — key nodes in the San Diego grid's import infrastructure
- Add to watch indicators: Any drone surveillance activity over or near General Atomics facilities in Poway, Kearny Mesa, or Rancho Bernardo, or near other major defense contractor campuses in undefended commercial zones
- Add to watch indicators: Any reconnaissance drone activity along the SDG&E transmission rights-of-way in eastern San Diego County near the U.S.-Mexico border, particularly in the Boulevard and Jacumba Hot Springs corridor where the Southwest Power Link enters San Diego County from Imperial Valley
Southern California's Iranian-American Community: A Complex Security Variable
Any honest assessment of the border threat to San Diego's military community must address — carefully and without prejudice — the significance of Southern California's Iranian-American population. More than 700,000 people of Iranian descent live in Southern California, representing the largest concentration of Iranians outside Iran itself. The vast majority are refugees from the Islamic Republic or their descendants, people who fled precisely the regime that now threatens their adopted country. Many are among the most ardent supporters of the U.S. military campaign against a government they regard as their oppressor.
This community is not a security threat. It is, however, a complex security variable. Iranian intelligence services — whose operational doctrine, as documented in multiple federal prosecutions, includes coercing individuals through family members remaining in Iran — specifically target diaspora communities as pools of potential recruited assets. The 2024 Asif Merchant prosecution documented how the IRGC identified, approached, and attempted to use diaspora contacts to establish assassination infrastructure. The FAA contractor case documented how a cleared employee with Iranian ties was recruited as an agent. These cases do not represent the Iranian-American community; they represent the Iranian government's exploitation of that community as a targeting opportunity.
For the defense community, the practical implication is that the FBI's outreach to the Iranian-American community is not merely about gathering intelligence on potential threats — it is about protecting community members who are themselves targets of Iranian government coercion. The FBI's Victim Services program has specifically engaged with Iranian-Americans in Southern California who have been approached by Iranian intelligence services and are seeking protection rather than prosecution. That outreach is a critical component of the counterintelligence effort in a region where the military-border-diaspora nexus creates a uniquely complex threat environment.
Security experts quoted in Military.com's March 10, 2026 analysis noted that Hezbollah's proxies have "traditionally used California as a fertile base for financing and have avoided other activities here," but stressed that "given the military threat Iran now faces, that could change." The killing of Khamenei — an event without precedent in the Islamic Republic's history — has fundamentally altered the calculus of an organization whose identity was built around a single supreme leader's authority. What that means for the operational posture of Iran's proxy networks in Southern California is one of the most urgent questions confronting the intelligence community today.
Sources & Formal Citations
- Middle East Forum. "Could Iran Infiltrate the U.S.-Mexico Border?" MEF Observer, June 19, 2025. https://www.meforum.org/mef-observer/could-iran-infiltrate-the-u-s-mexico-border
- Niskanen Center. "What the Data Really Says About Iranians at the Southern Border." June 18, 2025. https://www.niskanencenter.org/what-the-data-really-says-about-iranians-at-the-southern-border/
- Iran International. "Mexico Detains 2 Iranians Who Were Allegedly 'Under FBI Observation.'" December 9, 2023. https://www.iranintl.com/en/202312094159
- Axios. "Iran Plotted to Assassinate Israel's Ambassador to Mexico, U.S. Officials Say." November 7, 2025. https://www.axios.com/2025/11/07/iran-assasination-attempt-israel-ambassador-mexico
- RAND Corporation. "Hezbollah's Network on America's Southern Doorstep." RealClearDefense via RAND, April 1, 2025. https://www.rand.org/pubs/commentary/2025/04/hezbollahs-network-on-americas-southern-doorstep.html
- ABC News. "Iran May Be Activating Sleeper Cells Outside the Country, Alert Says." March 9, 2026. https://abcnews.com/US/iran-activating-sleeper-cells-alert/story?id=130897687
- Washington Times. "Encrypted Message Detected by U.S. Triggers Warning About Iranian Sleeper Cells." March 11, 2026. https://www.washingtontimes.com/news/2026/mar/11/encrypted-message-detected-us-triggers-warning-iranian-sleeper-cells/
- Washington Times. "How Real Is the Threat of Iranian Sleeper Cells in the U.S.?" March 11, 2026. https://www.washingtontimes.com/news/2026/mar/11/real-threat-iranian-sleeper-cells-us/
- Fox News. "Enemy Within: Counterterrorism Experts Fear Sleeper Cells Could Be Poised Inside U.S." March 2026. https://www.foxnews.com/politics/after-u-s-israel-strike-kills-iranian-leaders-fbi-shifts-high-alert-home
- Military.com. "Iran's Threats on U.S. Soil: Sleeper Cells, Lone Wolves, Cyberattacks and Eerie Numbers Code." March 10, 2026. https://www.military.com/daily-news/2026/03/10/irans-threats-us-soil-sleeper-cells-lone-wolves-cyberattacks-and-eerie-numbers-code.html
- OAN / NewsNation. "U.S. Officials: Iran Believed to Have Sent 'Operational Trigger' to Activate Sleeper Cells Abroad Amid Operation Epic Fury." March 9, 2026. https://www.oann.com/newsroom/u-s-officials-iran-believed-to-have-sent-operational-trigger-to-activate-sleeper-cells-abroad-amid-operation-epic-fury/
- The National Desk. "Iran May Be Trying to Activate Sleeper Cells Abroad, U.S. Intercepts Message." March 9, 2026. https://thenationaldesk.com/news/americas-news-now/iran-may-be-trying-to-activate-sleeper-cells-abroad-us-intercepts-message-president-donald-trump-chuck-schumer
- The National Desk / Fact Check Team. "Sleeper Cell Risks Spike as Iranian Strikes Continue." March 11, 2026. https://thenationaldesk.com/news/fact-check-team/fact-check-team-sleeper-cell-risks-spike-as-iranian-strikes-continue-united-state-intelligence-target-operatives
- NewsNation. "Iran Sleeper Cells Can Bring 'War to America,' Security Experts Say. How Serious Is the Threat?" March 10, 2026. https://www.newsnationnow.com/us-news/military/iran-sleeper-cells-war-america-reality-security-experts/
- Washington Times / Library of Congress. Testimony on Narcoterrorism and the Long Reach of U.S. Law Enforcement (DEA, House Hearing). 112th Congress. https://www.congress.gov/event/112th-congress/house-event/LC3031/text
- Washington Times. "Hezbollah Uses Mexican Drug Routes Into U.S." (DEA official Michael Braun testimony and reporting). 2009, updated coverage through 2024. https://www.washingtontimes.com/news/2009/mar/27/hezbollah-uses-mexican-drug-routes-into-us/
- Liberty University / Academic Analysis. "An Analysis of the Terror-Crime Link at the U.S.-Mexican Border." (Hezbollah-Los Zetas nexus documentation). https://digitalcommons.liberty.edu/cgi/viewcontent.cgi?article=2550&context=honors
- FIU Jack D. Gordon Institute. "Transnational Organized Crime in Mexico and the Government's Response." 2025. https://gordoninstitute.fiu.edu/news-events/the-policy-spotlight/2025/transnational-organized-crime-in-mexico-and-the-governments-response.html
- RAND Corporation. "Targeting Cartels as Terrorists Puts New Tools in Play." April 10, 2025. https://www.rand.org/pubs/commentary/2025/04/targeting-cartels-as-terrorists-puts-new-tools-in-play.html
- U.S. Customs and Border Protection. "CBP Access 2024.02 — Counter-Fentanyl Operations." Updated through 2025. https://www.cbp.gov/about/congressional-resources/cbp-access/2024-02
- Center for Immigration Studies. "About Those 11 Iranian Migrants Captured at Mexico-Arizona Frontier — What Homeland Security Does." Bensman, Todd. https://cis.org/Oped/About-Those-11-Iranian-Migrants-Captured-MexicoArizona-FrontierWhat-Homeland-Security-Does
- Wikipedia / Open-Source Compilation. "Iranian External Operations." Current entry, updated March 2026. https://en.wikipedia.org/wiki/Iranian_external_operations
- U.S. Department of State. "Presidential Determination on Major Drug Transit or Major Illicit Drug Producing Countries for Fiscal Year 2026." September 16, 2025. https://www.state.gov/releases/office-of-the-spokesperson/2025/09/presidential-determination-on-major-drug-transit-or-major-illicit-drug-producing-countries-for-fiscal-year-2026
- Times of San Diego / City News Service. "Report: FBI Warns Local Police of Iran's Desire to Attack California with Drones." March 12, 2026. https://timesofsandiego.com/military/2026/03/12/report-fbi-warns-local-police-of-irans-desire-to-attack-california-with-drones/
- ABC News. "FBI Warns Iran Aspired to Attack California with Drones in Retaliation for War." March 11, 2026. https://abcnews.com/US/fbi-warns-iran-aspired-attack-california-drones-retaliation/story?id=130973820
- The Hill. "FBI Warns Iran 'Aspired' to Strike California Coast with Drones." March 11, 2026. https://thehill.com/homenews/state-watch/5779497-iran-threat-west-coast/
- FOX 5 San Diego / KUSI. "What Kind of Attack Drones Does Iran Have and Could They Reach the U.S. West Coast?" March 12, 2026. https://fox5sandiego.com/news/california-news/iran-drone-threat-california/
- FOX 5 San Diego / KUSI. "Report: FBI Warned Iran Aspired to Attack California with Drones in Retaliation for War." March 12, 2026. https://fox5sandiego.com/news/california-news/california-iran-drone-threat-fbi/
- CNN Politics. "Gov. Gavin Newsom Says No 'Imminent Threat' to California After FBI Memo on Possible Iran Drone Attacks." March 12, 2026. https://www.cnn.com/2026/03/12/politics/california-iran-drone-threat-newsom
- TIME. "California Monitoring Threat of Potential Iran Drone Attack." March 12, 2026. https://time.com/article/2026/03/12/iran-drone-attack-california-gavin-newsom-trump-fbi-warning/
- FOX 11 Los Angeles. "FBI Warns California of Alleged Iranian Drone Threat from Offshore Vessels." March 11, 2026. https://www.foxla.com/news/fbi-warning-iran-drone-threat-california
- Army Recognition. "Possible U.S. Capabilities Behind the Strike on Iran's Shahid Bagheri Drone Carrier." March 2026. https://www.armyrecognition.com/news/navy-news/2026/possible-u-s-capabilities-behind-the-strike-on-irans-shahid-bagheri-drone-carrier
- Wikipedia. "IRIS Shahid Bagheri." Updated March 2026. https://en.wikipedia.org/wiki/IRIS_Shahid_Bagheri
- GPS World. "UAV Updates: Attack Drones Deployed in the Iran Conflict." March 2026. https://www.gpsworld.com/uav-updates-attack-drones-deployed-in-the-iran-conflict-and-autonomous-boats-at-roboboat-2026/
- San Diego Union-Tribune. "'Suicide' Drone First Tested by San Diego Warship Used in Attack Against Iran." March 1, 2026. https://www.sandiegouniontribune.com/2026/03/01/suicide-drone-first-tested-by-san-diego-warship-used-in-attack-against-iran/
- Foreign Affairs. "Iran's Drone Advantage." March 2026. https://www.foreignaffairs.com/iran/irans-drone-advantage
- Brookings Institution. "How Mexican Cartels Are Using Drones, Now and in the Future." February 2026. https://www.brookings.edu/articles/how-mexican-cartels-are-using-drones-now-and-in-the-future/
- Cronkite News / Arizona PBS. "Concerns Grow as Mexican Cartels Embrace Drones for Drug Smuggling, Attacks on Rivals." February 14, 2026. https://cronkitenews.azpbs.org/2026/02/14/drones-mexican-cartels-border/
- Small Wars Journal. "Drones and Border Cartels." February 13, 2026. https://smallwarsjournal.com/2026/02/13/drones-and-border-cartels/
- Small Wars Journal / NCITE. "Mapping Weaponized Drone Attacks Attributed to Mexican Drug Cartels." February 16, 2026. https://smallwarsjournal.com/2026/02/16/mexican-cartel-drone-attacks-report/
- Atlantic Council. "Drug Cartels Are Adopting Cutting-Edge Drone Technology. Here's How the U.S. Must Adapt." September 29, 2025. https://www.atlanticcouncil.org/blogs/new-atlanticist/drug-cartels-are-adopting-cutting-edge-drone-technology-heres-how-the-us-must-adapt/
- Texas Public Radio. "Mexican Drug Cartels' Use of Weaponized Drones Causing Concern on the Border." March 2, 2026. https://www.tpr.org/border-immigration/2026-03-02/mexican-drug-cartels-use-of-weaponized-drones-causing-concern-on-the-border
- Wikipedia. "2026 United States Intervention in Venezuela — Operation Absolute Resolve." Updated March 2026. https://en.wikipedia.org/wiki/2026_United_States_intervention_in_Venezuela
- CSIS. "Imagery from Venezuela Shows a Surgical Strike, Not Shock and Awe." January 10, 2026. https://www.csis.org/analysis/imagery-venezuela-shows-surgical-strike-not-shock-and-awe
- Atlantic Council. "The Venezuela-Iran Connection and What Maduro's Capture Means for Tehran, Explained." January 12, 2026. https://www.atlanticcouncil.org/blogs/menasource/the-venezuela-iran-connection-and-what-maduros-capture-means-for-tehran-explained/
- Brookings Institution. "Making Sense of the U.S. Military Operation in Venezuela." January 15, 2026. https://www.brookings.edu/articles/making-sense-of-the-us-military-operation-in-venezuela/
- Iran International. "Rubio Says Venezuela Is 'Anchor' for Iran's IRGC, Hezbollah in Americas." December 3, 2025. https://www.iranintl.com/en/202512030490
- Jerusalem Post. "U.S. Pushes South America to Proscribe IRGC, Hamas, Hezbollah." (Documents Caracas-based Quds Force officer directing 2025 Mexico assassination plot.) January 2026. https://www.jpost.com/international/article-884381
- CBS News. "Trump Says U.S. Is 'in Charge' of Venezuela, Maduro Jailed in New York After U.S. Military Operation." January 4, 2026. https://www.cbsnews.com/live-updates/venezuela-us-military-strikes-maduro-trump/
- PBS NewsHour. "A Timeline of U.S. Military Escalation Against Venezuela Leading to Maduro's Capture." January 3, 2026. https://www.pbs.org/newshour/world/a-timeline-of-u-s-military-escalation-against-venezuela-leading-to-maduros-capture
- Congressional Research Service / Congress.gov. "U.S. Capture of Venezuela's Nicolás Maduro: Considerations for Congress." January 2026. https://www.congress.gov/crs-product/IN12618
- WION / Atlantic Council. "How Iran Used Venezuela's Territory to Spread Terror Across South America." January 2026. https://www.wionews.com/photos/how-iran-used-venezuela-s-territory-to-spread-terror-across-south-america-1768557988715
- NCRI (National Council of Resistance of Iran). "Exclusive Report: IRGC and Hezbollah's Presence in South America." 2023. https://www.ncr-iran.org/en/news/exclusive-report/exclusive-report-irgc-and-hezbollahs-presence-in-south-america/
- Americas Quarterly. "Reaction: Trump Says U.S. Will 'Run' Venezuela After Maduro's Capture." January 8, 2026. https://americasquarterly.org/article/reaction-trump-says-u-s-will-run-venezuela-after-maduros-capture/
- Utility Dive (Herman K. Trabish). "Utilities Lack Tools to Guard Power Grid from Drone Attacks." January 27, 2026. https://www.utilitydive.com/news/utilities-power-grid-drone-attacks-nerc-iran/813873/
- Domestic Preparedness. "Protecting Critical Infrastructure from Weaponized Drones." May 8, 2025. https://www.domesticpreparedness.com/articles/protecting-critical-infrastructure-from-weaponized-drones/
- Wikipedia. "2011 Southwest Blackout." Updated 2026. https://en.wikipedia.org/wiki/2011_Southwest_blackout
- Rocky Mountain Institute (RMI). "Lights Out in San Diego: A Case to Reexamine the Future of Our Grid." 2011. https://rmi.org/lightsoutsandiegofuturegrid
- San Diego Union-Tribune. "Blackout a Reminder of Power Grid Vulnerabilities." September 9, 2011. https://www.sandiegouniontribune.com/sdut-blackout-a-reminder-of-power-grid-vulnerabilities-2011sep09-story.html
- San Diego Union-Tribune. "Feds Blame 6 Groups for 2011 Blackout." February 4, 2014. https://www.sandiegouniontribune.com/sdut-violations-southwest-power-outage-2014feb04-story.html
- University of Colorado Hazards Center (Miles). "Quick Response Research on the September 8, 2011 San Diego Blackout." 2012. https://hazards.colorado.edu/uploads/quick_report/miles_draft_2012.pdf
- SDG&E / Sempra Energy. "San Diego Gas & Electric to Develop New 500-kV Golden Pacific Powerlink Transmission Line." Press release, August 29, 2025. https://www.sempra.com/newsroom/press-releases/san-diego-gas-electric-develop-new-electric-transmission-line-southern
- San Diego Union-Tribune. "SDG&E Wants to Build a New Transmission Line. Will It Get the OK?" August 29, 2025. https://www.sandiegouniontribune.com/2025/08/29/sdge-wants-to-build-a-new-transmission-line-will-it-get-the-ok-and-how-much-will-it-cost-ratepayers/
- CSIS. "Unpacking Iran's Drone Campaign in the Gulf: Early Lessons for Future Drone Warfare." March 2026. https://www.csis.org/analysis/unpacking-irans-drone-campaign-gulf-early-lessons-future-drone-warfare
- Palo Alto Networks / Unit 42. "Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran." March 2026. https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/
- CNN Politics. "U.S. Intelligence Community Ramps Up Warnings of Possible Retaliatory Attacks by Iran." March 10, 2026. https://www.cnn.com/2026/03/10/politics/us-intel-warning-retaliatory-attacks-iran
Border Vulnerability, Sleeper Cells, and the Iranian Threat Approaching from Mexico
Fifteen miles south of Naval Air Station North Island lies the busiest land border crossing in the Western Hemisphere. As U.S. forces wage war against Iran, that proximity — and three decades of documented Hezbollah infrastructure in Latin America — has moved from background concern to active operational threat.
The San Diego–Tijuana metropolitan region is, depending on how one counts, either the busiest or the second-busiest land border crossing on earth. More than 70,000 vehicles and tens of thousands of pedestrians cross daily through the San Ysidro and Otay Mesa ports of entry alone. Camp Pendleton's southern perimeter sits roughly 40 miles north of that crossing. Naval Air Station North Island is approximately 15 miles away. Naval Base San Diego, homeport to the Pacific Fleet's most capable surface combatants, lies even closer. No analysis of the threat to San Diego's military and defense-industrial complex under Operation Epic Fury is complete without a frank accounting of what that geography means in a wartime counterintelligence and counterterrorism environment.
That accounting requires confronting two distinct but related threat streams. The first is the potential for Iran and its proxy Hezbollah to exploit established networks in Latin America — including documented relationships with Mexican criminal organizations — as conduits for infiltrating operatives, moving weapons, or positioning surveillance assets close to San Diego's military installations. The second, and more immediately alarming, is the possibility that individuals who entered the United States through the southern border during the period of reduced enforcement between 2021 and 2025 may now be subject to activation as "sleeper" assets — a concern elevated from theoretical to operational by an extraordinary intelligence development this week.
U.S. Intercepts Encrypted Iranian Signal Believed to Be "Operational Trigger" for Sleeper Assets
The U.S. government has intercepted an encrypted transmission believed to have originated in Iran that may constitute an "operational trigger" for sleeper assets positioned outside the country, according to a federal alert reviewed by ABC News and reported by multiple outlets on March 9–11, 2026. The alert cites "preliminary signals analysis" of a transmission "likely of Iranian origin" relayed across multiple countries shortly after the death of Supreme Leader Ayatollah Ali Khamenei on February 28.
The transmission was delivered to "clandestine recipients" via a new shortwave radio frequency — not via traditional internet or cellular networks, which are more easily monitored. Intelligence officials noted that upon the frequency's activation, an eerie male voice began with "Tavajjoh! Tavajjoh!" — the Persian word for "attention" — followed by a seemingly random string of numbers consistent with a numbers station format historically used to communicate with covert agents.
The alert instructs law enforcement agencies to increase monitoring of suspicious radio-frequency activity. Federal authorities emphasized there is "no operational threat tied to a specific location," but FBI Director Kash Patel stated he had instructed counterterrorism and intelligence teams to "be on high alert and mobilize all assisting security assets." The Joint Terrorism Task Forces throughout the country, including San Diego's JTTF, are reported to be operating around the clock.
Why Proximity to the Mexican Border Is a Specific Threat Amplifier for San Diego's Military Complex
The San Diego–Tijuana border region has unique characteristics that distinguish it from other stretches of the 1,954-mile U.S.-Mexico boundary. It is not simply the busiest crossing — it is the most surveilled, the most resourced in terms of enforcement personnel, and the most intensively studied by both U.S. and foreign intelligence services. It is also, paradoxically, one of the most penetrated: decades of cartel activity have produced sophisticated tunneling infrastructure, corrupt officials on both sides of the line, and well-established human smuggling networks capable of moving individuals with custom cover identities into the United States at the request of whoever can pay.
The Military-Border Proximity Problem
Naval Air Station North Island to San Ysidro Port of Entry: approximately 15 miles. Naval Base San Diego to San Ysidro: approximately 8 miles. Marine Corps Recruit Depot to San Ysidro: approximately 7 miles. Camp Pendleton northern boundary to Tijuana: approximately 55 miles. Any hostile actor who successfully crosses the border at Tijuana enters a metropolitan area that is, within minutes of driving, proximate to the homeport of a carrier strike group, the training base for the Pacific Fleet's Marines, and the headquarters of Naval Special Warfare Command. The military geography of San Diego is inescapable — and so is its relationship to the border.
Congressional testimony has noted the specific relationship between Tijuana tunnel infrastructure and the security of San Diego military installations. During a House hearing on narcoterrorism, a DEA official described massive tunneling operations linking Tijuana to San Diego as comparable in sophistication to Hezbollah's tunneling operations on the Lebanon border — and noted that Hezbollah was known to have shared tunneling expertise with cartel-affiliated groups. That testimony was delivered over a decade ago. The tunnels have not disappeared; in recent years, multiple sophisticated cross-border tunnels with rail systems, ventilation, and electricity have been discovered in the San Diego–Tijuana corridor, primarily by the DEA and CBP working together.
Hezbollah in the Western Hemisphere: A Three-Decade Infrastructure That Now Points North
Hezbollah — Iran's most capable proxy and a designated Foreign Terrorist Organization whose funding flows approximately 70 percent from Tehran — has maintained a continuous operational presence in Latin America since the 1980s. It is not a recent or speculative development. Two geographical hubs have dominated its regional presence: the Tri-Border Area where Argentina, Brazil, and Paraguay converge, and Venezuela under the Maduro regime. From these bases, Hezbollah has built a network of financial infrastructure, document forgery operations, human smuggling routes, and criminal partnerships that stretches from South America through Central America to Mexico and ultimately to the U.S. border.
A 2025 RAND Corporation study, Hezbollah's Networks in Latin America, found that the militant group's Western Hemispheric networks could exploit cross-border vulnerabilities and manipulate existing trafficking routes into the United States. The same study noted that Hezbollah has historically used California as a fertile base for fundraising while avoiding operational activities — but assessed that the calculus could shift under the pressure of direct military confrontation with the United States and Israel. That confrontation is now underway.
"Hezbollah's Latin American networks could exploit cross-border vulnerabilities, manipulate existing trafficking routes into U.S. territory. Defense strategists should pay careful attention to the continuity of intent and the organization's proven ability to execute high-casualty operations thousands of miles from Lebanon."
— RAND Corporation, "Hezbollah's Network on America's Southern Doorstep," April 2025The Hezbollah–cartel nexus, while not universally accepted in terms of its operational depth, is documented through federal court records and DEA testimony. Hezbollah has known connections to the Los Zetas cartel. In 2011, Colombian-Lebanese drug trafficker Ayman Joumaa was indicted by a federal grand jury for distributing cocaine — and for money laundering that funneled proceeds to Hezbollah. The Joumaa network laundered hundreds of millions of dollars through cocaine trafficking and used car sales in the United States before being disrupted by Customs and Border Protection, the FBI, and partner agencies. In 2024, Argentinian authorities flagged suspected Hezbollah activity at the port of Iquique, Chile, where one of the organization's most notorious money launderers was spotted — suggesting continued operational activity in the hemisphere even as Hezbollah was suffering significant military losses in Lebanon.
The route from Hezbollah's Latin American network to San Diego's military installations is not theoretical. The Washington Times has reported that Hezbollah has specifically used access routes from El Paso, Texas, to San Diego as high-value entry corridors. Former DEA Chief of Operations Michael Braun stated publicly that Hezbollah and the cartels "rely on the same criminal weapons smugglers, document traffickers and transportation experts" — the same shadow facilitators who move fentanyl north can move people with specialized operational purposes in the same direction.
Documented Iranian / Hezbollah Infiltration Route: South America → U.S.-Mexico Border
Iranian Nationals at the Border: What the Court Records and CBP Data Show
The data on Iranian nationals at the U.S.-Mexico border changed dramatically between 2019 and 2025. According to CBP data compiled by the Middle East Forum, approximately 90 Iranian nationals were encountered at U.S. land borders during the entire period from 2000 to 2019 — roughly 4.5 per year. From 2020 through 2025, that number rose to approximately 1,740 encounters — roughly a 19-fold increase. Former CBP Commissioner Rodney Scott stated that thousands of Iranian nationals were documented entering the United States illegally between 2022 and 2025. Since 2021, more than 2,500 Iranian nationals have been arrested inside the United States.
Five Iranians Detained Between Tijuana and Tecate Under FBI Observation (December 2023)
Mexican authorities detained five Iranian nationals — accompanied by a Haitian driver serving as their guide — whose vehicle was stopped at a toll booth between the Baja California border cities of Tijuana and Tecate. The group was suspected of attempting to cross into the United States. Iran International reported that two of the five were said to be under FBI observation at the time of their detention. The incident attracted limited public attention but illustrated the specific geography of concern: the Tijuana-Tecate corridor sits directly adjacent to the San Diego metropolitan area and its dense concentration of military installations and cleared defense contractor facilities.
Iranian Nationals on U.S. Security Watch List Apprehended at Texas–Mexico Border (2023)
Two Iranian nationals who were on a U.S. security watch list were apprehended at the Texas–Mexico border in 2023, stoking security concerns about the efficacy of watch list–based screening at high-volume crossing points. The case underscored that even known persons of security concern were attempting — and nearly succeeding — at crossing the southern border using established smuggling routes. In Texas, law enforcement agencies have been tracking growing numbers of "special interest aliens" from the Middle East who crossed the southern border, with Iranian nationals representing a persistent category of elevated concern.
Iran Plotted to Assassinate Israel's Ambassador to Mexico
U.S. officials disclosed in November 2025 that Iran had plotted to assassinate Israel's ambassador to Mexico — a plan initiated at the end of 2024 and led by a Quds Force Unit 11000 operative who had spent several years handling and recruiting Iranian agents across Latin America from the Iranian Embassy in Venezuela. The plot was active through the first half of 2025 before being thwarted. The case is particularly significant for San Diego's threat picture because it demonstrates that IRGC-QF's Latin American network is not limited to fundraising — it is actively conducting assassination planning in Mexico, using Mexico as an operational staging ground for lethal operations. The network infrastructure that nearly killed an ambassador in Mexico City is geographically and organizationally connected to routes that terminate at the Tijuana–San Diego border crossing.
The significance of the Iranian Embassy in Venezuela as a regional IRGC-QF coordination hub cannot be overstated. U.S. officials, DEA leadership, and intelligence analysts have consistently identified Venezuela — whose government maintains warm relations with Tehran — as the primary Western Hemisphere staging point for Iranian intelligence operations. Former DEA administrator Michael Braun stated that members of the elite Quds Force were showing up in Latin America and that he was "not opposed to the belief that they could be commanding and controlling Hezbollah's criminal enterprises from there." That assessment, first offered over a decade ago, has only been reinforced by subsequent intelligence reporting and prosecuted cases.
Venezuela's Decapitation — Eight Weeks Before Operation Epic Fury
The timing invites a hypothesis that has not been prominently advanced in mainstream coverage: the January 3, 2026 U.S. capture of Nicolás Maduro in Operation Absolute Resolve — publicly framed as a narcoterrorism law-enforcement action — may have simultaneously served as a preemptive strike against the primary Western Hemisphere command-and-control node for IRGC-Quds Force operations in the Americas. If true, this would mean that the Trump administration, knowing it was preparing to strike Iran (Operation Epic Fury commenced February 28, 2026), moved first to dismantle Tehran's most capable regional retaliatory infrastructure — eight weeks before the first bombs fell on Iranian soil.
Venezuela as IRGC-QF's Western Hemisphere Headquarters
The factual basis for this hypothesis is not inferential. It is documented. Secretary of State Marco Rubio, speaking in a Fox News interview in December 2025 — weeks before the Venezuela operation — stated directly: "Iran, its IRGC, and even Hezbollah has a presence in South America, and one of their anchor presence — especially for the Iranians — is inside of Venezuela." The Atlantic Council's January 2026 analysis of the Venezuela-Iran connection, published immediately after Maduro's capture, provided the most specific structural description available in open-source literature: the IRGC-Quds Force maintains a robust presence in Venezuela specifically organized around Department 11000 (the QF subunit responsible for international terrorist plots) and Department 840 (overseas assassination operations), led by Ahmad Asadzadeh Goljahi. This is not a financial support network or a propaganda operation. It is an active covert operations command structure headquartered in the Venezuelan capital.
The operational significance of the Caracas node was confirmed by the November 2025 IRGC-QF assassination plot against Israel's ambassador to Mexico. According to Jerusalem Post reporting on the case, the plot was orchestrated in part by an undercover Quds Force officer stationed in Caracas. The assassination was to be carried out in Mexico City — precisely the operational geography that connects to the San Diego threat corridor. The Caracas node was not merely providing financial facilitation. It was directing active lethal operations in Mexico, using cartel-adjacent networks, targeting a diplomat in a city 1,800 miles from San Diego. The same infrastructure, activated for a different objective, terminates at the Tijuana–San Diego border.
Based on the Atlantic Council's December 2025 sourcing, the IRGC-QF structure in Venezuela encompassed:
- Department 11000 (IRGC-QF): International terrorist plot coordination — the same unit whose operative directed the 2025 Mexico assassination attempt and whose predecessor cell managed the 2011 Arbabsiar cartel-recruitment operation from Tehran
- Department 840 (IRGC-QF): Overseas assassination operations — the unit directly implicated in the series of 2022–2024 murder-for-hire plots against U.S. officials and dissidents documented in federal indictments, including the Asif Merchant case
- Hezbollah External Security Organization / Unit 910: Extraterritorial operations infrastructure, co-located with and dependent on the Venezuelan safe-harbor environment, with documented reach to Margarita Island and the Paraguaná Peninsula as secondary staging points
- Iranian Embassy Caracas: Diplomatic cover for Quds Force officers under official accreditation — a pattern documented across multiple IRGC-QF operations globally and specifically confirmed in the Mexico assassination case
The Timing Case: Eight Weeks as Strategic Lead Time
Operation Absolute Resolve was executed on January 3, 2026. Operation Epic Fury commenced February 28, 2026. The gap is 56 days — eight weeks. During that window:
- The IRGC-QF's primary Western Hemisphere command node (Caracas) was disrupted by the removal of its state patron
- The Venezuelan government's ability to shield Iranian intelligence personnel from U.S. surveillance was degraded
- IRGC and Hezbollah personnel in Venezuela faced an immediate question of personal security and exposure
- Any pre-positioned retaliatory plans that had been developed through the Caracas node required rapid reconstruction under degraded communications security
- The FBI and intelligence community had eight weeks to identify, surveil, and disrupt IRGC-linked networks in the Western Hemisphere before Iran had any confirmed reason to activate them against the United States
CSIS's January 2026 analysis of Operation Absolute Resolve noted something subtle but significant: the U.S. strikes were deliberately surgical, avoiding damage to the broader Venezuelan military command structure. The assessment concluded that the Trump administration may have wanted to preserve the military apparatus it would need to keep order in the transition period. That same logic, extended to the intelligence domain, suggests a deliberate calculation: remove the political patron, expose and disrupt the covert networks, but avoid the kind of chaotic collapse that would scatter IRGC-QF assets into ungoverned spaces where surveillance becomes harder.
The Atlantic Council's analysis drew the strategic implication explicitly: for Tehran, Operation Absolute Resolve was "meaningful because it unsettles a core assumption — that leadership insulation and escalation risk reliably constrain U.S. action." Iranian strategic planning had long assumed that U.S. concern about escalation would protect state-patron relationships like Venezuela. That assumption was falsified on January 3, 2026. The question the intelligence community was racing to answer in the eight weeks that followed is whether the disruption of the Caracas node was comprehensive enough — or whether IRGC-QF had redundant networks in Bolivia, Cuba, Nicaragua, and the Tri-Border Area that could reconstitute the retaliatory planning pipeline before Epic Fury commenced.
What Maduro's Capture Did — and Did Not — Accomplish
The capture of Maduro eliminated the state patron relationship that made Venezuela uniquely valuable to IRGC-QF. It did not eliminate the personnel. Quds Force officers and Hezbollah Unit 910 operatives who were in Venezuela on January 3, 2026 did not disappear when Maduro was removed. They faced three options: exfiltrate to Iran or Lebanon via third-country routes; relocate to Bolivia, Cuba, or Nicaragua — the remaining Latin American states with Iranian diplomatic infrastructure; or go to ground within Venezuela under the transitional Rodríguez government, whose posture toward Iranian intelligence personnel was uncertain and rapidly evolving.
Critically, the U.S. pressure campaign to dismantle Iranian intelligence infrastructure throughout Latin America did not begin with Maduro's capture — it preceded it. The Jerusalem Post documented that the Trump administration had been pushing Bolivia, Ecuador, Argentina, Chile, Peru, and Panama to designate the IRGC as a terrorist organization and expel suspected Iranian intelligence operatives since late 2025. Ecuador had already designated the IRGC in September 2025. Argentina designated the IRGC Quds Force specifically in January 2026. The effect of these coordinated diplomatic moves was to narrow the IRGC-QF's viable operating environment throughout the hemisphere simultaneously with the kinetic disruption in Caracas.
From the perspective of the San Diego threat picture, the net assessment is this: Operation Absolute Resolve likely degraded — but did not eliminate — the Western Hemisphere IRGC-QF network that poses the most credible operational threat to California's defense infrastructure. The Caracas command node has been disrupted. The trained personnel it directed remain at large in a degraded but not destroyed network. The Mexico operational infrastructure that the Caracas node was running — cartel contacts, safe houses, document channels, surveillance routes — was not destroyed by Maduro's capture. And the retaliatory motivation that Operation Epic Fury created arrived eight weeks after the disruption began — with unknown operational effect on whatever reconstitution the surviving network had been able to achieve in the interim.
How Real Is the Threat? What Intelligence Agencies and Analysts Actually Assess
The term "sleeper cell" has been deployed with varying degrees of precision in public discourse since Operation Epic Fury began. It is worth being precise. A sleeper cell is a covert group of trained operatives — often associated with a terrorist organization or foreign intelligence agency — who infiltrate a target country and remain dormant for an extended period, blending into the local population until they receive a specific signal or order to act. The individuals are trained to stay under the radar, sometimes for years or decades. The defining feature is patience. Former intelligence officials say that patience is what distinguishes a sleeper operation from an opportunistic attack.
Against this definition, what do intelligence agencies actually assess about Iranian sleeper capabilities in the United States? The Washington Times, drawing on research by the Washington Institute for Near East Policy, reports that Iranian agents or proxies have been connected to at least 27 plots in the United States over the past decade, including surveillance operations and attempted attacks. The existence of that planning infrastructure does not, by itself, confirm the presence of large-scale dormant terror cells — but it does confirm the existence of networks capable of conducting operations on U.S. soil on relatively short notice.
Factors Limiting Border Infiltration Risk
- Iranian irregular migration has sharply declined since early 2025 peak; Colombia and Panama recorded near-zero Iranian crossings by May 2025
- The 3–6 month journey through 7 countries exposes operatives to surveillance at multiple chokepoints
- Iran likely prefers less scrutinized entry routes (forged EU passports, diplomatic cover) over the heavily monitored southern border
- Every Iranian crossing the southern border is individually interviewed and screened as a "special interest alien"
- U.S.-Mexico security cooperation has increased significantly; Mexico transferred 29 high-value criminal suspects to U.S. custody in early 2025
- No confirmed evidence of a large-scale Iranian sleeper-cell network currently operating inside the U.S., per Washington Times review
Factors Elevating Border Infiltration Risk
- Iranian border encounters surged nearly 19-fold between 2019 and 2025; 2,500+ Iranian nationals arrested inside U.S. since 2021
- IRGC-QF Latin American network confirmed conducting active assassination operations in Mexico as recently as 2025
- Hezbollah cartel relationships provide access to tunnel infrastructure and document forgery in the Tijuana corridor
- Forged passport rings in Brazil and Thailand allow Iranian operatives to travel as nationals of Visa Waiver Program countries
- Encrypted "operational trigger" intercepted March 9, 2026 — consistent with activation signal for pre-positioned assets
- Southern California's 700,000+ Iranian-American population provides large potential cover population for blending
The most sobering element of the current threat picture is the convergence of these factors with the timing of the intercepted transmission. U.S. signals intelligence intercepted what officials are describing as a sophisticated encrypted broadcast consistent with a numbers station — a format historically used by intelligence services worldwide to communicate with covert agents in the field. The signal appeared shortly after the killing of Khamenei and was relayed across multiple countries before being detected. Former DHS Assistant Secretary for Counterterrorism Elizabeth Naumann stated that "a country like Iran does not have the capability to beat us militarily, so they rely on asymmetric means. They will look to use cyberattacks, they will look to use proxies like Hezbollah, criminal agents." That analysis describes exactly the threat vector that the southern border represents.
"The latent national security issue was not so much that Iranian terrorists would blow up something so much as that they would spy. For some time in the foreseeable future, U.S. homeland security will have no choice but to consider the migrants in light of both espionage and Iran's promises of retaliation."
— Todd Bensman, Center for Immigration Studies, on the specific national security calculus of Iranian border crossersWhat Makes This Border Crossing Specifically Dangerous for the Military Community
San Diego's relationship with its southern neighbor is characterized by extraordinary economic and human integration. Approximately 100,000 people legally cross the border every day for work, school, medical care, and commerce. The Tijuana–San Diego metroplex functions, in many respects, as a single binational urban region. This integration is a profound economic and cultural asset. In a wartime counterintelligence environment, it is also a vulnerability.
The specific concern for the military and defense-industrial community is not primarily that an Iranian operative would conduct a mass-casualty attack using the border as an entry route — though that possibility cannot be dismissed. The more operationally realistic concern, grounded in the historical pattern of Iranian intelligence activity, is that the border provides a relatively accessible route for individuals whose mission is surveillance, technical collection, or the establishment of forward support infrastructure for operations directed from overseas. An operative whose purpose is to photograph the approaches to NAS North Island, identify the residence of a senior general atomics program manager, or establish contact with a pre-recruited asset at a cleared contractor does not need to carry weapons through a port of entry — they need only to establish a plausible cover identity and blend into a metropolitan area of three million people with a large Iranian-heritage community.
Key Indicators Law Enforcement and the Defense Community Are Monitoring
- Shortwave radio activity: Following the intercepted numbers station transmission on March 9, law enforcement has been instructed to monitor for unusual or new shortwave radio-frequency signals in the San Diego area — a specific technical indicator for covert agent communication
- "Special interest alien" crossings: CBP continues to screen every Iranian national crossing the southern border under enhanced protocols; any surge in crossing attempts from the Baja California corridor will trigger heightened federal response
- Suspicious surveillance activity near military installations: Photography or observation of base perimeters, waterfront access points, contractor facilities, or military family residential areas by individuals who cannot be readily identified
- Unusual financial transactions: Iranian procurement networks use cryptocurrency and multi-country wire transfers; FinCEN has issued guidance to financial institutions in border regions about transaction patterns consistent with IRGC-linked activity
- Hezbollah fundraising network activity: Southern California has historically been one of Hezbollah's most productive U.S. fundraising zones; any increase in activity by known or suspected Hezbollah-affiliated networks in the region is a potential indicator of broader operational preparation
- Tunnel discovery activity: CBP and DEA continue active monitoring of the Tijuana–San Diego tunnel corridor; any newly discovered tunnel with characteristics exceeding drug trafficking purposes — such as electrical systems or communications infrastructure — warrants immediate federal escalation
The current security posture at the border reflects an elevated threat environment. In direct response to Operation Epic Fury, Customs and Border Protection and the Border Patrol have increased surveillance at all San Diego–area ports of entry, elevated their screening protocols for nationals of countries with documented IRGC relationships, and increased coordination with the FBI's San Diego field office and NCIS counterintelligence personnel. The Department of Homeland Security's intelligence arm (I&A) has issued specific threat advisories to state and local law enforcement in California addressing the Iran conflict's domestic threat implications.
California Governor's Office of Emergency Services and the San Diego County Sheriff's Department have both received federal threat briefings and are coordinating with the FBI's Joint Terrorism Task Force. The JTTF structure — which integrates federal, state, and local law enforcement — is specifically designed for the kind of multi-jurisdictional threat that a motivated foreign intelligence service operating across the Tijuana–San Diego metropolitan area would present.
The Offshore Drone Threat: FBI Warns California Law Enforcement of Iranian UAV Attack Aspirations
A new and qualitatively distinct threat dimension emerged publicly on March 11–12, 2026, when ABC News first reported — and multiple outlets subsequently confirmed — that the FBI's Joint Terrorism Task Force had distributed a formal bulletin to California law enforcement agencies warning of an Iranian aspiration to launch unmanned aerial vehicle attacks against the West Coast from an unidentified vessel offshore. For San Diego, home to the largest concentration of U.S. naval power in the Pacific, the implications are direct.
"We recently acquired information that as of early February 2026, Iran allegedly aspired to conduct a surprise attack using unmanned aerial vehicles from an unidentified vessel off the coast of the United States homeland, specifically against unspecified targets in California, in the event that the U.S. conducted strikes against Iran."
— FBI Joint Terrorism Task Force bulletin, distributed late February 2026, as reported by ABC News, March 11, 2026The bulletin was distributed in late February — just days before the U.S. and Israel launched Operation Epic Fury on February 28. The intelligence was described as acquired in early February 2026, predating the strikes, meaning Iran was pre-planning offshore drone options as a contingency retaliatory measure before the first bomb fell. The FBI alert explicitly acknowledged no information on timing, method, specific targets, or perpetrators beyond the broad California designation.
California Governor Gavin Newsom confirmed awareness of the threat at a March 11 press conference, noting that he had activated the State Operations Center when the war began and that "drone issues have always been top of mind." Newsom stated the state is coordinating through the California Governor's Office of Emergency Services and transmitting federal intelligence to local agencies in real time. The Los Angeles County Sheriff's Department confirmed it is operating at an elevated readiness posture, monitoring for lone-actor attacks, sleeper cells, and cyber threats simultaneously. The LAPD stated it is coordinating with federal and state partners in real time, noting no known specific threats to Los Angeles as of March 12.
San Diego: The Primary Strategic Target on the West Coast
While the FBI bulletin referenced "unspecified targets in California," the logic of Iranian targeting doctrine points directly at San Diego. No other location on the West Coast presents the concentration of high-value military targets that San Diego does: the Pacific Fleet's primary home port, the Navy's nuclear-powered carrier strike group infrastructure, NAVSPECWARCOM (Naval Special Warfare Command — the Navy SEAL enterprise), NAVWAR (the command that operates U.S. military satellite and communications networks), MCAS Miramar, and the Marine Corps Recruit Depot. A single successful drone strike on San Diego's naval waterfront — particularly the 32nd Street Naval Station, where multiple warships are often berthed simultaneously — would carry strategic symbolic weight far exceeding its physical damage.
The FOX 5/KUSI San Diego report confirmed that the FBI's San Diego field office declined to comment on the bulletin, consistent with the broader FBI posture of neither confirming nor denying specifics. The San Diego Police Department had not issued a public statement as of the date of this report, though law enforcement sources indicate the JTTF structure is fully activated in San Diego County.
The Shahid Bagheri Factor: Iran's Offshore Drone Carrier
The FBI's concern about an "unidentified vessel" carrying attack drones is not hypothetical — it has a specific precedent in Iran's recent naval development. Iran commissioned the IRIS Shahid Bagheri in February 2025, a converted commercial container ship repurposed as the world's first dedicated fixed-wing drone carrier. The vessel features an angled 180-meter flight deck, a ski-jump launch ramp, and documented capacity for Ababil-3N carrier drones, JAS-313 stealth drones, and Mohajer-6 reconnaissance drones. Iranian military officials stated the ship had an operational range of 22,000 nautical miles — sufficient to operate anywhere in the Pacific — and could remain at sea for up to a year without refueling.
That specific threat was eliminated early. U.S. Central Command announced on March 2, 2026 — within 96 hours of Operation Epic Fury commencing — that the Shahid Bagheri had been struck by U.S. forces. CENTCOM later released footage on March 6 showing the vessel ablaze. Military analysts noted that CENTCOM publicly identified the Shahid Bagheri as one of the most strategically important early targets precisely because it represented Iran's primary platform for extending drone warfare beyond the Strait of Hormuz into open ocean. Its destruction was described by analysts as stripping the IRGC Navy of its most ambitious attempt to create a mobile offshore drone warfare base with Pacific reach.
However, the destruction of the Shahid Bagheri does not eliminate the offshore vessel threat entirely. Intelligence officials have long assessed that Iran's pre-positioning strategy involves not only purpose-built military vessels but also commercial ships, fishing vessels, and flag-of-convenience cargo ships that could conceal drone launch infrastructure. The FBI's bulletin referred to an "unidentified vessel" — suggesting the concern extended beyond any single known platform.
Technical Assessment: Could Iranian Drones Actually Reach San Diego?
Defense analysts interviewed by Fox 5 San Diego and other outlets offered measured assessments of the feasibility question. The core technical constraint is range: Iran's primary attack drone, the Shahed-136, has an operational range of approximately 800 to 1,550 miles depending on variant. San Diego is roughly 7,500 miles from Iranian territory — far beyond any direct-launch scenario. The threat, if real, would depend entirely on a vessel closing within launch range of the California coast.
Retired U.S. Navy Captain Armen Kurdian, interviewed by FOX 5/KUSI, assessed the Iranian Navy's conventional capabilities as minimal and noted that any Iranian vessel flying a false flag across the Pacific would generate significant maritime intelligence alerts. Carnegie Endowment scholar Nicole Grajewski told TIME that Iran does not currently have the range to execute such an attack, and that even if it could get close enough, the slow, loud profile of Shahed-series drones would make them relatively easy to intercept. Law enforcement sources cited by FOX 11 Los Angeles described the intelligence as "uncorroborated" and "cautionary," with no current evidence that Iran has the active capability to execute such an operation from the Pacific.
The countervailing concern, however, is pre-positioning. ABC News National Security Contributor and former DHS intelligence chief John Cohen explicitly raised the possibility of drone equipment being pre-positioned on vessels already in or near U.S. waters before the war began — a scenario that would bypass the Pacific-transit detection problem entirely. Cohen also specifically cited Iran's documented presence in Mexico and South America as a potential alternative launch corridor, directly connecting the offshore drone threat to the land-border threat matrix that defines San Diego's unique vulnerability profile.
Early February 2026: FBI acquires intelligence indicating Iranian aspirations for an offshore drone attack against California as a contingency retaliatory measure in the event of U.S. strikes against Iran.
Late February 2026: FBI JTTF distributes bulletin to California law enforcement agencies. The warning goes out days before Operation Epic Fury begins.
February 28, 2026: Operation Epic Fury commences. U.S. and Israeli forces strike Iranian territory. Supreme Leader Khamenei is killed.
March 2, 2026: CENTCOM announces the IRIS Shahid Bagheri — Iran's drone carrier and the vessel most capable of projecting offshore UAV power toward the Pacific — has been struck by U.S. forces within 96 hours of the war's start.
March 6, 2026: CENTCOM releases footage showing the Shahid Bagheri ablaze following a second visible strike.
March 11, 2026: ABC News first publicly reports the FBI bulletin. Governor Newsom confirms awareness. LAPD, LASD, and San Francisco PD issue statements of elevated readiness.
March 12, 2026: Times of San Diego and City News Service report continued law enforcement vigilance. FBI San Diego field office declines comment. The threat is characterized as "aspirational" but not yet dismissed.
What This Means for San Diego Specifically
The offshore drone threat adds a third attack vector to San Diego's already complex threat environment — joining the land-border infiltration route and the cyber intrusion threat documented elsewhere in this report. Unlike the border and cyber threats, which require human assets or digital access, an offshore drone attack could be executed with minimal local infrastructure: a vessel, launch crew, and pre-positioned drones. The U.S. military's destruction of the Shahid Bagheri significantly degraded the most capable platform for executing this scenario, but the intelligence community's concern about pre-positioned assets on non-military vessels remains an open question.
The proximity of San Diego's naval installations to the Pacific coastline — NAS North Island sits directly on the water, and the 32nd Street Naval Station's piers are visible from public roads — means that a drone launched from even a modest vessel within 50 miles of the coast could potentially reach high-value targets. The U.S. Navy's counter-drone capability, including systems developed and deployed out of San Diego, is the primary defensive answer to this scenario. San Diego is also the home port for the Navy's emerging unmanned surface vessel program — the same program that first tested the LUCAS drone that was later used in strikes against Iran — giving the region both unique exposure and unique defensive expertise.
- Add to watch indicators: Any maritime activity by vessels of unknown origin operating in unusually close proximity to the California coast, particularly slow-moving or stationary vessels in areas not consistent with normal shipping lanes
- Add to watch indicators: Any reports of drone sightings over San Diego's naval waterfront, Coronado Island, or Point Loma — the elevated terrain directly overlooking the submarine base — that cannot be attributed to authorized military or commercial operations
The Mexico Launch Corridor: The More Credible Threat Vector
Expert analysis and the body of evidence assembled in this report converge on a conclusion that the official FBI bulletin language — "unidentified vessel off the coast" — may actually describe the less operationally plausible attack scenario. A more credible and more immediately actionable threat vector runs directly through Tijuana and Baja California, using Iran's established relationships with Mexican criminal organizations to provide the launch infrastructure that IRGC itself cannot place in the Pacific without detection.
Former DHS intelligence chief John Cohen made this case explicitly in his ABC News commentary on the FBI alert, stating that Iran's documented presence in Mexico and South America, combined with its drone stockpile and its now-activated retaliatory incentive, creates a ready-made surrogate launch capability. Cohen was not speculating abstractly — he was describing a convergence of three independently documented threat streams that, when combined, point directly at the Tijuana–San Diego corridor as the most operationally efficient route for an Iranian drone strike against Southern California's naval targets.
Three Streams Converging: IRGC Networks, Cartel Drones, Tijuana Geography
Stream One — IRGC's Mexico infrastructure: Iran's operational presence in Mexico is not theoretical. The 2011 Mansour Arbabsiar case documented that the IRGC-Quds Force specifically attempted to recruit Mexican cartel contacts (through an individual who turned out to be a DEA informant) to carry out an assassination on U.S. soil. The 2025 IRGC-QF Unit 11000 assassination plot against Israel's ambassador to Mexico confirmed that the IRGC continues to run active covert operations out of Mexico. Dr. Walid Phares, co-secretary general of the Transatlantic Parliamentary Group, told Iran International that the IRGC's most important strategic objective in Latin America was precisely access to the Mexican border. The infrastructure — financial channels, safe houses, human networks, document forgery — already exists.
Stream Two — Cartel drone capability: The convergence of IRGC networks with Mexican cartel drone infrastructure represents a genuinely new threat dimension that has been developing for years but has reached operational maturity as of 2025–2026. The data is stark. CBP detected 34,682 drone flights within 500 meters of the U.S.-Mexico border in fiscal year 2025 alone — compared to 7,678 along the Canadian border. Between 2021 and 2025, Mexican cartels conducted 221 documented weaponized drone attacks, killing 77 people, according to the National Counterterrorism Innovation, Technology, and Education Center (NCITE). The CJNG operates a dedicated "Drone Operators" unit responsible for 42 attacks resulting in 21 deaths. In October 2025, three explosive-laden cartel drones struck the Baja California state attorney general's office in Tijuana — a hardened government building less than one mile from the California border.
The cartels are not merely using commercial off-the-shelf drones for surveillance and smuggling — they have developed FPV (first-person-view) kamikaze strike capabilities modeled directly on Ukrainian battlefield tactics. A July 2025 Defense News report revealed that Ukrainian counterintelligence was investigating suspected infiltration of Ukraine's International Legion by Latin American operatives with alleged cartel ties who joined specifically to acquire FPV drone combat training. Some of these operatives came from Mexico's own cartels, according to Mexico's National Intelligence Center. The knowledge transfer from the world's most active drone battlefield to organizations operating eight miles from NAS North Island is now documented.
The Pre-Built Intelligence Architecture: Drug Runners and CBP Watchers
What makes the cartel drone infrastructure particularly valuable as an IRGC force-multiplier is not just the weapons capability — it is the accumulated intelligence. Years of systematic cartel drone operations along the Tijuana–San Diego corridor have produced something that Iran's IRGC could not purchase, steal, or develop on its own in any reasonable timeframe: a detailed, continuously updated operational picture of CBP sensor coverage, patrol rhythms, response times, and airspace blind spots along the most militarily significant stretch of the U.S.-Mexico border.
The scale of this drone surveillance enterprise is documented in federal data and law enforcement testimony. DHS Executive Director for Counter-Drone Operations Steven Willoughby told Congress in July 2024 that hostile organizations flew roughly 27,000 drones within 500 meters of the border in the first six months of 2024 alone. CBP's full fiscal year 2025 figure reached over 42,000 detected near-border flights. These are detected flights — the number of undetected sorties is, by definition, unknown. CSIS analyst Henry Ziemer has noted that the border "remains a wicked problem from a counter-UAS standpoint" because at over 3,100 kilometers in length, persistent detection across the full stretch is operationally impossible with current resources.
The cartel drone mission set along this corridor is well-documented by law enforcement. According to Axon's counter-UAS analysis and multiple Border Patrol field reports, cartels use drones to scout security vulnerabilities, identify agent locations and response times before launching smuggling runs, and guide drug mules in real time around active patrol positions. In El Paso and New Mexico, drones have been observed mapping Border Patrol routes and identifying weak points along the border wall. Del Cueto, a former Border Patrol union president, confirmed that drones had been spotted flying over border patrol stations and ports of entry, gathering layout and operational intelligence. Cartel reconnaissance drones have operated under thermal imaging at night for five or more years, building a multi-year dataset of patrol patterns under all lighting and weather conditions.
The drug delivery mission is equally mature. CBP seized a single drone in October 2023 carrying 3.6 pounds of fentanyl pills — enough to kill tens of thousands of people. The International Narcotics Control Board reported that traffickers have migrated to custom-built drones capable of carrying payloads up to 220 pounds. The payload range is significant: a drone that can reliably deliver 220 pounds of narcotics across a defended border can deliver a warhead of equivalent mass. Iran's Shahed-136 carries an 88-pound warhead. Cartel delivery drones already exceed that payload threshold.
The threat is not merely theoretical on the San Diego side of the border. Security Info Watch documented a particularly alarming incident in which a sophisticated, high-speed cartel reconnaissance drone penetrated the airspace over Davis-Monthan Air Force Base in Tucson, Arizona — an active military installation housing the 355th Wing and the Air Force's aircraft boneyard. The drone paused above fuel storage tanks, evaded two pursuit helicopters, and escaped back across the border without being destroyed or its operators identified.
Davis-Monthan is 60 miles from the Mexican border. NAS North Island is 15 miles from Tijuana. The cartel drone that surveilled Davis-Monthan was conducting exactly the kind of pre-attack reconnaissance that a weaponized follow-on strike would require: identifying high-value infrastructure (fuel tanks), assessing defensive response capability (two helicopters scrambled, neither successful), and demonstrating that penetration of a secured U.S. military installation's airspace was achievable with commercial drone technology.
The counter-drone coordination failures at the border compound the problem significantly. DroneXL's analysis of the February 2026 El Paso airspace closure — in which the Pentagon's own laser systems shot down a CBP MQ-9 Guardian drone worth $30 million — documented that agencies operating counter-drone laser systems at the border have no functioning deconfliction system. They are, in the analyst's phrase, "flying blind in each other's airspace." The same deconfliction failure that destroyed a $30 million U.S. government asset would apply in an Iranian drone attack scenario: a Shahed-class weapon or a high-performance cartel FPV approaching San Diego's naval waterfront from the Tijuana direction would enter an airspace where CBP, DoD, FAA, and local law enforcement counter-drone systems are not reliably coordinated. The cartels' years of reconnaissance have almost certainly captured this coordination gap in their operational picture — and IRGC planners would value that intelligence enormously.
The Tijuana–San Diego metropolitan area is the world's busiest land border crossing. It is also the world's most drone-saturated border corridor. The geographic distances from Tijuana to San Diego's naval installations are not merely concerning — they are operationally decisive:
- NAS North Island (home of the Pacific Fleet carrier air wings): ~15 miles from the San Ysidro port of entry
- Naval Base San Diego / 32nd Street (Pacific Fleet home port): ~8 miles from San Ysidro
- MCRD San Diego (Marine Corps Recruit Depot): ~7 miles from San Ysidro
- NAVWAR (Naval Information Warfare Systems Command): ~9 miles from San Ysidro
- NAB Coronado (Naval Special Warfare Command / SEAL teams): ~14 miles from San Ysidro
Iran's Shahed-136 has an operational range of 800–1,550 miles. Cheap commercial FPV drones have ranges of 3–7 miles. The entire U.S. Pacific Fleet's home port complex is well within range of a drone launched from Tijuana, Baja California — a city where cartel drone attacks on government facilities are now a documented, recurring reality.
Stream Three — The September 2025 FBI cartel-drone bulletin: Critically, the FBI was already tracking this exact convergence before Operation Epic Fury began. The same ABC News report that first published the Iran offshore drone bulletin also revealed a separate FBI bulletin from September 2025 warning that unidentified Mexican cartel leaders had authorized drone attacks using explosive-laden UAVs against U.S. law enforcement and military personnel along the U.S.-Mexico border. The FBI called such an attack "unprecedented but exemplifies a plausible scenario." That bulletin predates the war by six months. The cartel drone infrastructure was already being assessed as a potential threat to U.S. military personnel along the border before Iran had any retaliatory motive. With Operation Epic Fury now providing that motive, the two threat streams — Iranian intent, cartel capability — are directly aligned.
The IRGC-Cartel Operational Logic
The value of the cartel route to Iran is not primarily military — it is operational security. A Shahed-class drone launched from a ship in the Pacific would be tracked from the moment it crossed the radar horizon of any U.S. naval vessel, leaving an unambiguous signature pointing back to Iran. A drone launched from Tijuana by cartel infrastructure, using commercial off-the-shelf hardware that is already detected crossing the border by the thousands daily, presents a fundamentally different attribution problem. The launch could occur in a residential or industrial area of Tijuana indistinguishable from the cartel-on-cartel drone warfare that Mexican authorities already track as routine criminal activity. U.S. counter-drone systems at the border are calibrated against small commercial drones used for drug smuggling — not against Iranian Shahed-class kamikaze weapons that would be delivered pre-positioned and assembled on-site by IRGC-trained operators working through cartel infrastructure.
The IRGC has a documented doctrine of using criminal intermediaries precisely to maintain plausible deniability. The 2011 Arbabsiar plot, the 2024 assassination-for-hire cases, and the 2025 IRGC-QF Mexico operation all follow the same pattern: Iranian intelligence identifies an objective, recruits or contracts local criminal infrastructure to provide logistics and cover, and maintains operational separation from the actual execution. Applying that same doctrine to a drone attack — Iranian drones, cartel operators, Tijuana launch site, San Diego naval targets — is not a leap of analytical imagination. It is the logical extension of IRGC's demonstrated playbook, applied to a capability the cartels have independently developed and Iran has independently fielded at scale in active combat.
The Atlantic Council's counterterrorism program made a directly relevant observation in its September 2025 analysis of cartel drone adoption: should U.S. policy escalate to direct kinetic strikes against cartels — which the Trump administration has in fact done — FPV drones could quickly be redirected toward U.S. personnel and infrastructure, including border patrols and "critical nodes in urban environments." The cartels already have the motive (retaliation for Trump's FTO designations and military strikes) and the platform. Iran has the motive (Operation Epic Fury) and the relationships. The analytical question is not whether this convergence is theoretically possible — it is whether it has already been activated.
Defense Contractors and the Power Grid: The Softer Targets a Drone Can Reach
The naval installations at NAS North Island and Naval Base San Diego are hardened military targets with active security perimeters, on-base counter-drone capability, and armed response forces. A drone attack on those facilities would be militarily audacious but operationally constrained by the defenses in place. The more analytically compelling drone target set in San Diego may be the softer, largely undefended infrastructure that sustains those bases — and that sits, largely unprotected, within easy drone range of the Tijuana corridor.
Defense Contractors: General Atomics and the Reaper Connection
General Atomics Aeronautical Systems (GA-ASI), headquartered in Poway in northern San Diego County with major facilities throughout the region, is not merely a defense contractor — it is the company that built the MQ-9 Reaper drone that killed IRGC-Quds Force commander Qasem Soleimani on January 3, 2020. That single act of targeted killing, directed by President Trump and executed by a drone launched from a GA-ASI platform, represents one of the most operationally and symbolically significant assassinations in the Islamic Republic's history. IRGC doctrine explicitly calls for retaliation not just against the government that ordered the killing, but against the institutions and individuals that enabled it. The MQ-9 program office, the engineers, the manufacturing facilities in Poway, Adelanto, and El Mirage — all are documented objects of IRGC retaliatory intent.
GA-ASI's Poway headquarters and its Kearny Mesa facilities are located entirely outside any military perimeter. They operate in commercial and light-industrial zones with standard commercial security: perimeter fencing, security guards, surveillance cameras. They have no organic anti-drone systems. A Shahed-class weapon, or even a commercially modified FPV drone carrying several pounds of explosives and guided by a cartel operator in Tijuana, could reach GA-ASI facilities from the border without crossing any military installation airspace whatsoever. The psychological and strategic impact of a successful strike on the facility that produced the drone that killed Soleimani would exceed anything Iran could achieve by hitting a warship pier.
Northrop Grumman, L3 Technologies, Cubic Defense, BAE Systems San Diego, and SAIC — all maintain major facilities in San Diego County in similarly undefended commercial settings. The DHS intelligence community, as documented in the IRGC threat assessments cited throughout this report, has specifically identified defense contractor facilities as a target category in Iranian retaliatory planning. The connection between IRGC retaliatory doctrine and the specific geographic vulnerability of San Diego's defense industrial base — sitting in commercially accessible locations within drone range of Tijuana — is direct and requires no inference.
The Power Grid: San Diego's Demonstrated Achilles Heel
Perhaps the most strategically significant soft target in San Diego's threat landscape is its electrical grid — and its documented history of catastrophic single-point failure makes it uniquely attractive to an adversary with limited resources and maximum strategic ambition.
On September 8, 2011, a single maintenance worker at the North Gila substation near Yuma, Arizona made a routine error removing a capacitor bank from service. Over the next 11 minutes, that single action triggered 23 cascading failure events across five interconnected power grids, cutting electricity to nearly 7 million people across San Diego County, southern Orange County, Imperial Valley, Yuma, and Baja California Norte. The San Diego Gas & Electric service area — all 3.5 million customers, all 4,100 square miles — went dark simultaneously. Flights were cancelled. Sewage pumps failed. Hospital backup generators were tested to failure. Traffic signals went dark from San Diego to the Arizona border, creating gridlock that took hours to clear. The outage cost the San Diego regional economy an estimated $100 million in a single day.
The root cause was structural: at the time of the 2011 blackout, San Diego's sole 500-kilovolt interconnection to the Western grid was the Southwest Power Link (SWPL) — a single transmission line running from the Palo Verde Nuclear Generating Station in Arizona to SDG&E's Miguel substation in San Diego County. As the FERC investigation found, San Diego was uniquely vulnerable among California's major metropolitan areas precisely because it had only one high-voltage import pathway. When the SWPL was overwhelmed, the San Onofre Nuclear Generating Station switchyard automatically isolated San Diego from the rest of the Western Interconnection — and local generation could not compensate. The entire grid island collapsed in seconds.
Trigger: One maintenance worker removes a capacitor bank at North Gila substation, Yuma, AZ.
Cascade: 23 failure events across 5 power grids in 11 minutes.
Result: ~7 million people lose power — all of San Diego County (1.4 million SDG&E meters), Baja California, Imperial Valley, parts of Arizona.
Duration: 12 hours before full restoration; grid described as "fragile" for days after.
Economic impact: $100+ million to the San Diego regional economy in one day.
Root cause: San Diego depended on a single 500 kV transmission line (the Southwest Power Link) for the majority of its imported power. When that line was compromised, there was no adequate backup pathway.
Critical note: SDG&E in August 2025 announced the Golden Pacific Powerlink — a new 500 kV line from Imperial Valley — to add a second high-voltage import pathway. Construction is not expected to begin until the end of the decade. The single-pathway vulnerability therefore remains unresolved as of March 2026.
The 2011 event was an accident. What an adversary with knowledge of SDG&E's grid topology could accomplish deliberately with targeted physical or drone-based attacks on critical transmission infrastructure is qualitatively different — and significantly worse. The SWPL and its key chokepoints, including the Miguel substation in Chula Vista (which receives 500 kV power from Arizona and redistributes it throughout the San Diego grid), are large, outdoor installations with no meaningful overhead protection. Transmission towers along the SWPL corridor are similarly exposed. As Domestic Preparedness documented in its 2025 critical infrastructure analysis, electrical substations were traditionally protected only by chain-link fencing designed to deter theft — not overhead drone attack. Ballistic walls added after the 2013 Metcalf substation sniper attack provide protection against rifle fire; they provide no protection against a drone descending vertically onto transformer equipment.
The specific drone-based attack methods documented in open-source research are directly applicable to substation infrastructure. Thermite-loaded drones — which produce molten metal at 4,000 degrees Fahrenheit capable of burning through transformer casings — have been used in Ukrainian battlefield operations. Graphene powder dispersal drones can short-circuit high-voltage equipment through arc-over events. A conventional FPV drone loaded with a shaped charge, launched from the Tijuana side of the border and guided to the Miguel substation or to a transmission tower on the SWPL right-of-way, would not need to cross any military airspace, penetrate any base perimeter, or overcome any specialized security system. It would need only to reach a large outdoor electrical facility that any Google Maps search reveals in full detail.
The Iran-Grid Connection: A Pattern Already Established Abroad
Iran's targeting of electrical infrastructure is not hypothetical — it is documented operational practice. CSIS's March 2026 analysis of Iran's drone campaign in the Gulf during the first week of Operation Epic Fury specifically documented Iranian strikes against "energy infrastructure" targets alongside military installations, consistent with Iran's established doctrine of combining military and economic disruption to maximize coercive pressure. Iranian-linked cyber actors (documented separately in the contractor threat section of this report) have specifically targeted SCADA and industrial control systems — the same systems that manage power grid switching operations — with the FAD Team claiming unauthorized access to multiple such systems as recently as March 2026.
Utility Dive's January 2026 investigation — published before Operation Epic Fury commenced — documented that DHS had already issued private warnings to U.S. energy companies to harden their facilities against drone attack, citing specifically the Iran threat context. The publication quoted Fortem Technologies Chief Business Officer Brien O'Connell directly: "The electric grid was never designed with aerial threats in mind." Most utilities, O'Connell noted, lack even basic airspace awareness — the ability to detect and track drones operating near their facilities. The FY2026 National Defense Authorization Act expanded counter-drone authorities, but training and deployment of those capabilities is prioritized for major events like the World Cup over utility infrastructure protection.
For San Diego specifically, the convergence is acute: a grid with a documented history of catastrophic single-point failure, key substations located in commercially accessible areas with no overhead drone defense, transmission infrastructure running through open terrain accessible from the Tijuana corridor, and an adversary — IRGC operating through cartel surrogate infrastructure — with both the motivation and the demonstrated capability to deploy drone-borne incendiary and explosive payloads against undefended targets. The 2011 blackout required a single accidental failure at a substation 200 miles away. A targeted drone strike on the Miguel substation in Chula Vista — 10 miles from the border — would not need to be accidental.
- Add to watch indicators: Any drone activity detected near SDG&E's Miguel substation (Chula Vista), the Southwest Power Link transmission corridor, or the Sycamore Canyon and Peñasquitos substations — key nodes in the San Diego grid's import infrastructure
- Add to watch indicators: Any drone surveillance activity over or near General Atomics facilities in Poway, Kearny Mesa, or Rancho Bernardo, or near other major defense contractor campuses in undefended commercial zones
- Add to watch indicators: Any reconnaissance drone activity along the SDG&E transmission rights-of-way in eastern San Diego County near the U.S.-Mexico border, particularly in the Boulevard and Jacumba Hot Springs corridor where the Southwest Power Link enters San Diego County from Imperial Valley
Southern California's Iranian-American Community: A Complex Security Variable
Any honest assessment of the border threat to San Diego's military community must address — carefully and without prejudice — the significance of Southern California's Iranian-American population. More than 700,000 people of Iranian descent live in Southern California, representing the largest concentration of Iranians outside Iran itself. The vast majority are refugees from the Islamic Republic or their descendants, people who fled precisely the regime that now threatens their adopted country. Many are among the most ardent supporters of the U.S. military campaign against a government they regard as their oppressor.
This community is not a security threat. It is, however, a complex security variable. Iranian intelligence services — whose operational doctrine, as documented in multiple federal prosecutions, includes coercing individuals through family members remaining in Iran — specifically target diaspora communities as pools of potential recruited assets. The 2024 Asif Merchant prosecution documented how the IRGC identified, approached, and attempted to use diaspora contacts to establish assassination infrastructure. The FAA contractor case documented how a cleared employee with Iranian ties was recruited as an agent. These cases do not represent the Iranian-American community; they represent the Iranian government's exploitation of that community as a targeting opportunity.
For the defense community, the practical implication is that the FBI's outreach to the Iranian-American community is not merely about gathering intelligence on potential threats — it is about protecting community members who are themselves targets of Iranian government coercion. The FBI's Victim Services program has specifically engaged with Iranian-Americans in Southern California who have been approached by Iranian intelligence services and are seeking protection rather than prosecution. That outreach is a critical component of the counterintelligence effort in a region where the military-border-diaspora nexus creates a uniquely complex threat environment.
Security experts quoted in Military.com's March 10, 2026 analysis noted that Hezbollah's proxies have "traditionally used California as a fertile base for financing and have avoided other activities here," but stressed that "given the military threat Iran now faces, that could change." The killing of Khamenei — an event without precedent in the Islamic Republic's history — has fundamentally altered the calculus of an organization whose identity was built around a single supreme leader's authority. What that means for the operational posture of Iran's proxy networks in Southern California is one of the most urgent questions confronting the intelligence community today.
Sources & Formal Citations
- Middle East Forum. "Could Iran Infiltrate the U.S.-Mexico Border?" MEF Observer, June 19, 2025. https://www.meforum.org/mef-observer/could-iran-infiltrate-the-u-s-mexico-border
- Niskanen Center. "What the Data Really Says About Iranians at the Southern Border." June 18, 2025. https://www.niskanencenter.org/what-the-data-really-says-about-iranians-at-the-southern-border/
- Iran International. "Mexico Detains 2 Iranians Who Were Allegedly 'Under FBI Observation.'" December 9, 2023. https://www.iranintl.com/en/202312094159
- Axios. "Iran Plotted to Assassinate Israel's Ambassador to Mexico, U.S. Officials Say." November 7, 2025. https://www.axios.com/2025/11/07/iran-assasination-attempt-israel-ambassador-mexico
- RAND Corporation. "Hezbollah's Network on America's Southern Doorstep." RealClearDefense via RAND, April 1, 2025. https://www.rand.org/pubs/commentary/2025/04/hezbollahs-network-on-americas-southern-doorstep.html
- ABC News. "Iran May Be Activating Sleeper Cells Outside the Country, Alert Says." March 9, 2026. https://abcnews.com/US/iran-activating-sleeper-cells-alert/story?id=130897687
- Washington Times. "Encrypted Message Detected by U.S. Triggers Warning About Iranian Sleeper Cells." March 11, 2026. https://www.washingtontimes.com/news/2026/mar/11/encrypted-message-detected-us-triggers-warning-iranian-sleeper-cells/
- Washington Times. "How Real Is the Threat of Iranian Sleeper Cells in the U.S.?" March 11, 2026. https://www.washingtontimes.com/news/2026/mar/11/real-threat-iranian-sleeper-cells-us/
- Fox News. "Enemy Within: Counterterrorism Experts Fear Sleeper Cells Could Be Poised Inside U.S." March 2026. https://www.foxnews.com/politics/after-u-s-israel-strike-kills-iranian-leaders-fbi-shifts-high-alert-home
- Military.com. "Iran's Threats on U.S. Soil: Sleeper Cells, Lone Wolves, Cyberattacks and Eerie Numbers Code." March 10, 2026. https://www.military.com/daily-news/2026/03/10/irans-threats-us-soil-sleeper-cells-lone-wolves-cyberattacks-and-eerie-numbers-code.html
- OAN / NewsNation. "U.S. Officials: Iran Believed to Have Sent 'Operational Trigger' to Activate Sleeper Cells Abroad Amid Operation Epic Fury." March 9, 2026. https://www.oann.com/newsroom/u-s-officials-iran-believed-to-have-sent-operational-trigger-to-activate-sleeper-cells-abroad-amid-operation-epic-fury/
- The National Desk. "Iran May Be Trying to Activate Sleeper Cells Abroad, U.S. Intercepts Message." March 9, 2026. https://thenationaldesk.com/news/americas-news-now/iran-may-be-trying-to-activate-sleeper-cells-abroad-us-intercepts-message-president-donald-trump-chuck-schumer
- The National Desk / Fact Check Team. "Sleeper Cell Risks Spike as Iranian Strikes Continue." March 11, 2026. https://thenationaldesk.com/news/fact-check-team/fact-check-team-sleeper-cell-risks-spike-as-iranian-strikes-continue-united-state-intelligence-target-operatives
- NewsNation. "Iran Sleeper Cells Can Bring 'War to America,' Security Experts Say. How Serious Is the Threat?" March 10, 2026. https://www.newsnationnow.com/us-news/military/iran-sleeper-cells-war-america-reality-security-experts/
- Washington Times / Library of Congress. Testimony on Narcoterrorism and the Long Reach of U.S. Law Enforcement (DEA, House Hearing). 112th Congress. https://www.congress.gov/event/112th-congress/house-event/LC3031/text
- Washington Times. "Hezbollah Uses Mexican Drug Routes Into U.S." (DEA official Michael Braun testimony and reporting). 2009, updated coverage through 2024. https://www.washingtontimes.com/news/2009/mar/27/hezbollah-uses-mexican-drug-routes-into-us/
- Liberty University / Academic Analysis. "An Analysis of the Terror-Crime Link at the U.S.-Mexican Border." (Hezbollah-Los Zetas nexus documentation). https://digitalcommons.liberty.edu/cgi/viewcontent.cgi?article=2550&context=honors
- FIU Jack D. Gordon Institute. "Transnational Organized Crime in Mexico and the Government's Response." 2025. https://gordoninstitute.fiu.edu/news-events/the-policy-spotlight/2025/transnational-organized-crime-in-mexico-and-the-governments-response.html
- RAND Corporation. "Targeting Cartels as Terrorists Puts New Tools in Play." April 10, 2025. https://www.rand.org/pubs/commentary/2025/04/targeting-cartels-as-terrorists-puts-new-tools-in-play.html
- U.S. Customs and Border Protection. "CBP Access 2024.02 — Counter-Fentanyl Operations." Updated through 2025. https://www.cbp.gov/about/congressional-resources/cbp-access/2024-02
- Center for Immigration Studies. "About Those 11 Iranian Migrants Captured at Mexico-Arizona Frontier — What Homeland Security Does." Bensman, Todd. https://cis.org/Oped/About-Those-11-Iranian-Migrants-Captured-MexicoArizona-FrontierWhat-Homeland-Security-Does
- Wikipedia / Open-Source Compilation. "Iranian External Operations." Current entry, updated March 2026. https://en.wikipedia.org/wiki/Iranian_external_operations
- U.S. Department of State. "Presidential Determination on Major Drug Transit or Major Illicit Drug Producing Countries for Fiscal Year 2026." September 16, 2025. https://www.state.gov/releases/office-of-the-spokesperson/2025/09/presidential-determination-on-major-drug-transit-or-major-illicit-drug-producing-countries-for-fiscal-year-2026
- Times of San Diego / City News Service. "Report: FBI Warns Local Police of Iran's Desire to Attack California with Drones." March 12, 2026. https://timesofsandiego.com/military/2026/03/12/report-fbi-warns-local-police-of-irans-desire-to-attack-california-with-drones/
- ABC News. "FBI Warns Iran Aspired to Attack California with Drones in Retaliation for War." March 11, 2026. https://abcnews.com/US/fbi-warns-iran-aspired-attack-california-drones-retaliation/story?id=130973820
- The Hill. "FBI Warns Iran 'Aspired' to Strike California Coast with Drones." March 11, 2026. https://thehill.com/homenews/state-watch/5779497-iran-threat-west-coast/
- FOX 5 San Diego / KUSI. "What Kind of Attack Drones Does Iran Have and Could They Reach the U.S. West Coast?" March 12, 2026. https://fox5sandiego.com/news/california-news/iran-drone-threat-california/
- FOX 5 San Diego / KUSI. "Report: FBI Warned Iran Aspired to Attack California with Drones in Retaliation for War." March 12, 2026. https://fox5sandiego.com/news/california-news/california-iran-drone-threat-fbi/
- CNN Politics. "Gov. Gavin Newsom Says No 'Imminent Threat' to California After FBI Memo on Possible Iran Drone Attacks." March 12, 2026. https://www.cnn.com/2026/03/12/politics/california-iran-drone-threat-newsom
- TIME. "California Monitoring Threat of Potential Iran Drone Attack." March 12, 2026. https://time.com/article/2026/03/12/iran-drone-attack-california-gavin-newsom-trump-fbi-warning/
- FOX 11 Los Angeles. "FBI Warns California of Alleged Iranian Drone Threat from Offshore Vessels." March 11, 2026. https://www.foxla.com/news/fbi-warning-iran-drone-threat-california
- Army Recognition. "Possible U.S. Capabilities Behind the Strike on Iran's Shahid Bagheri Drone Carrier." March 2026. https://www.armyrecognition.com/news/navy-news/2026/possible-u-s-capabilities-behind-the-strike-on-irans-shahid-bagheri-drone-carrier
- Wikipedia. "IRIS Shahid Bagheri." Updated March 2026. https://en.wikipedia.org/wiki/IRIS_Shahid_Bagheri
- GPS World. "UAV Updates: Attack Drones Deployed in the Iran Conflict." March 2026. https://www.gpsworld.com/uav-updates-attack-drones-deployed-in-the-iran-conflict-and-autonomous-boats-at-roboboat-2026/
- San Diego Union-Tribune. "'Suicide' Drone First Tested by San Diego Warship Used in Attack Against Iran." March 1, 2026. https://www.sandiegouniontribune.com/2026/03/01/suicide-drone-first-tested-by-san-diego-warship-used-in-attack-against-iran/
- Foreign Affairs. "Iran's Drone Advantage." March 2026. https://www.foreignaffairs.com/iran/irans-drone-advantage
- Brookings Institution. "How Mexican Cartels Are Using Drones, Now and in the Future." February 2026. https://www.brookings.edu/articles/how-mexican-cartels-are-using-drones-now-and-in-the-future/
- Cronkite News / Arizona PBS. "Concerns Grow as Mexican Cartels Embrace Drones for Drug Smuggling, Attacks on Rivals." February 14, 2026. https://cronkitenews.azpbs.org/2026/02/14/drones-mexican-cartels-border/
- Small Wars Journal. "Drones and Border Cartels." February 13, 2026. https://smallwarsjournal.com/2026/02/13/drones-and-border-cartels/
- Small Wars Journal / NCITE. "Mapping Weaponized Drone Attacks Attributed to Mexican Drug Cartels." February 16, 2026. https://smallwarsjournal.com/2026/02/16/mexican-cartel-drone-attacks-report/
- Atlantic Council. "Drug Cartels Are Adopting Cutting-Edge Drone Technology. Here's How the U.S. Must Adapt." September 29, 2025. https://www.atlanticcouncil.org/blogs/new-atlanticist/drug-cartels-are-adopting-cutting-edge-drone-technology-heres-how-the-us-must-adapt/
- Texas Public Radio. "Mexican Drug Cartels' Use of Weaponized Drones Causing Concern on the Border." March 2, 2026. https://www.tpr.org/border-immigration/2026-03-02/mexican-drug-cartels-use-of-weaponized-drones-causing-concern-on-the-border
- Wikipedia. "2026 United States Intervention in Venezuela — Operation Absolute Resolve." Updated March 2026. https://en.wikipedia.org/wiki/2026_United_States_intervention_in_Venezuela
- CSIS. "Imagery from Venezuela Shows a Surgical Strike, Not Shock and Awe." January 10, 2026. https://www.csis.org/analysis/imagery-venezuela-shows-surgical-strike-not-shock-and-awe
- Atlantic Council. "The Venezuela-Iran Connection and What Maduro's Capture Means for Tehran, Explained." January 12, 2026. https://www.atlanticcouncil.org/blogs/menasource/the-venezuela-iran-connection-and-what-maduros-capture-means-for-tehran-explained/
- Brookings Institution. "Making Sense of the U.S. Military Operation in Venezuela." January 15, 2026. https://www.brookings.edu/articles/making-sense-of-the-us-military-operation-in-venezuela/
- Iran International. "Rubio Says Venezuela Is 'Anchor' for Iran's IRGC, Hezbollah in Americas." December 3, 2025. https://www.iranintl.com/en/202512030490
- Jerusalem Post. "U.S. Pushes South America to Proscribe IRGC, Hamas, Hezbollah." (Documents Caracas-based Quds Force officer directing 2025 Mexico assassination plot.) January 2026. https://www.jpost.com/international/article-884381
- CBS News. "Trump Says U.S. Is 'in Charge' of Venezuela, Maduro Jailed in New York After U.S. Military Operation." January 4, 2026. https://www.cbsnews.com/live-updates/venezuela-us-military-strikes-maduro-trump/
- PBS NewsHour. "A Timeline of U.S. Military Escalation Against Venezuela Leading to Maduro's Capture." January 3, 2026. https://www.pbs.org/newshour/world/a-timeline-of-u-s-military-escalation-against-venezuela-leading-to-maduros-capture
- Congressional Research Service / Congress.gov. "U.S. Capture of Venezuela's Nicolás Maduro: Considerations for Congress." January 2026. https://www.congress.gov/crs-product/IN12618
- WION / Atlantic Council. "How Iran Used Venezuela's Territory to Spread Terror Across South America." January 2026. https://www.wionews.com/photos/how-iran-used-venezuela-s-territory-to-spread-terror-across-south-america-1768557988715
- NCRI (National Council of Resistance of Iran). "Exclusive Report: IRGC and Hezbollah's Presence in South America." 2023. https://www.ncr-iran.org/en/news/exclusive-report/exclusive-report-irgc-and-hezbollahs-presence-in-south-america/
- Americas Quarterly. "Reaction: Trump Says U.S. Will 'Run' Venezuela After Maduro's Capture." January 8, 2026. https://americasquarterly.org/article/reaction-trump-says-u-s-will-run-venezuela-after-maduros-capture/
- Utility Dive (Herman K. Trabish). "Utilities Lack Tools to Guard Power Grid from Drone Attacks." January 27, 2026. https://www.utilitydive.com/news/utilities-power-grid-drone-attacks-nerc-iran/813873/
- Domestic Preparedness. "Protecting Critical Infrastructure from Weaponized Drones." May 8, 2025. https://www.domesticpreparedness.com/articles/protecting-critical-infrastructure-from-weaponized-drones/
- Wikipedia. "2011 Southwest Blackout." Updated 2026. https://en.wikipedia.org/wiki/2011_Southwest_blackout
- Rocky Mountain Institute (RMI). "Lights Out in San Diego: A Case to Reexamine the Future of Our Grid." 2011. https://rmi.org/lightsoutsandiegofuturegrid
- San Diego Union-Tribune. "Blackout a Reminder of Power Grid Vulnerabilities." September 9, 2011. https://www.sandiegouniontribune.com/sdut-blackout-a-reminder-of-power-grid-vulnerabilities-2011sep09-story.html
- San Diego Union-Tribune. "Feds Blame 6 Groups for 2011 Blackout." February 4, 2014. https://www.sandiegouniontribune.com/sdut-violations-southwest-power-outage-2014feb04-story.html
- University of Colorado Hazards Center (Miles). "Quick Response Research on the September 8, 2011 San Diego Blackout." 2012. https://hazards.colorado.edu/uploads/quick_report/miles_draft_2012.pdf
- SDG&E / Sempra Energy. "San Diego Gas & Electric to Develop New 500-kV Golden Pacific Powerlink Transmission Line." Press release, August 29, 2025. https://www.sempra.com/newsroom/press-releases/san-diego-gas-electric-develop-new-electric-transmission-line-southern
- San Diego Union-Tribune. "SDG&E Wants to Build a New Transmission Line. Will It Get the OK?" August 29, 2025. https://www.sandiegouniontribune.com/2025/08/29/sdge-wants-to-build-a-new-transmission-line-will-it-get-the-ok-and-how-much-will-it-cost-ratepayers/
- CSIS. "Unpacking Iran's Drone Campaign in the Gulf: Early Lessons for Future Drone Warfare." March 2026. https://www.csis.org/analysis/unpacking-irans-drone-campaign-gulf-early-lessons-future-drone-warfare
- Palo Alto Networks / Unit 42. "Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran." March 2026. https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/
- CNN Politics. "U.S. Intelligence Community Ramps Up Warnings of Possible Retaliatory Attacks by Iran." March 10, 2026. https://www.cnn.com/2026/03/10/politics/us-intel-warning-retaliatory-attacks-iran
Comments
Post a Comment