A multinational investigation into bomb plots targeting Israeli diplomats earlier this year has produced the clearest evidence yet that Iran was involved, illustrating the risks to the west if it fails to reach detente with Tehran over its nuclear weapons programme.
Talks on Iran's nuclear aspirations resume in Moscow on Monday, and western intelligence officials have told the Guardian the price of failure could be high. With Israel refusing to rule out military action if diplomacy fails, intelligence officials fear the volley of attacks carried out by Iranian operatives show Tehran is capable of an asymmetric response. Though the officials admit that predictions are extremely difficult to make, their concerns are based on investigations into plots against Israeli diplomats in India, Thailand and Georgia in February which point to the involvement of Iran.
In India, local agencies told ministers a bomb attack which badly injured the wife of the Israeli military attaché in New Delhi in February was the work of an Iranian "security entity". Their conclusions have not previously been made public and Indian officials have made significant efforts to avoid blaming Tehran, an ally and oil supplier.
The governments of Georgia and Thailand, which both uncovered bomb plots on the day of the Delhi attack, have also not officially blamed Iran.
European intelligence officials told the Guardian they now found it difficult to judge Tehran's "risk calculus".
"Until recently it was possible to see why they were doing what they have been doing," one intelligence official said. "Now it has become very unpredictable. It's very hard to see the logic behind [the February bombings], other than perhaps demonstrate an ability to cause problems in the event of war or a desire for revenge of some kind."
Tehran, which said the Delhi bombing was a "false flag" operation by enemies hoping to smear Iran, insists its nuclear programme is peaceful. Israel and western countries say Tehran aims to build nuclear weapons and have imposed a series of sets of sanctions over the last five years. Israel has repeatedly threatened military strikes. Expectations of the talks in Moscow on 18 and 19 June are low.
Police evidence, witness statements and court documents seen by the Guardian, plus interviews with local and international law enforcement and security officials, indicate that the attempted triple-bombing on 13 and 14 February was conducted by a well co-ordinated network of about a dozen Iranians and prepared over at least 10 months.
The evidence includes the identification of at least 10 Iranians allegedly involved in the plots, money transfers to key individuals from Iran, the use of Iranian phone connections and the flight following the attacks of conspirators to Iran.
"The question is not was this Iran-backed or Iran-organised but who in Iran was running all this," said one western security official.
The first elements of the plot were put in place in April 2011 when at least five Iranians who have been implicated in the attacks travelled to Thailand and India, apparently on reconnaissance missions, investigators say. Their journeys came around four months after a spike in tension between Iran, Israel and the west following the killing in Tehran of Majid Shahriari, a nuclear scientist, by a bomb stuck to his vehicle by a motorcyclist.
They also followed reports that Israel and the US were to blame for a computer worm called Stuxnet, which infected the operating systems at Iran's uranium enrichment plant in Natanz.
Travel documents, phone records, police inquiries and customs data show how, in a series of trips by key individuals over the summer and autumn of 2011, flats were hired, local helpers recruited, transport arranged, finances organised and surveillance of targets carried out.
Houshang Afshar Irani has been identified by Indian police as the man who attached a magnetic charge to the car of the wife of the Israeli defence attaché in Delhi. Copies of his passport show he first visited the city in April 2011 for 10 days before returning on 29 January this year. At 11.30pm on 13 February, almost seven hours after reaching the Indian capital's main airport 75 minutes after the bomb attack, he flew to Malaysia and then on to Tehran via Dubai.
Analysis by Indian investigators of the type of explosive used in Delhi reveal it to be a variant of TNT. The shell of the bomb was manufactured outside India and magnetic strips used to attach the device to the car in Delhi were identical to those recovered in Bangkok and Tbilisi.
The attack in Bangkok involved at least five people, all Iranians. One, a 31-year-old woman identified as Leila Rohani, visited Thailand twice in 2012 and rented the house off the central Sukhumvit Road that was partly destroyed when 28-year-old Saeed Moradi, also Iranian, appears to have prematurely detonated a device. Moradi, who suffered serious injuries, was arrested. From Bangkok, Rohani travelled to Kuala Lumpur and then on to Tehran, investigators have found.
A second alleged conspirator was detained at the airport, also en route for Tehran. This man, Sedaghatzadeh Masoud, 31, is believed to be the overall co-ordinator of the international operation. Masoud is in custody in Malaysia, pending possible extradition to Thailand.
As in Delhi, a reconnaissance trip also appears to have been conducted in Thailand in April 2011. Members of the cell were pictured with bar girls in the sleazy resort of Pattaya days before the blast.
Details of the Tbilisi plot and its links to the other two attacks are less clear. Indian investigators say the mobile phone number used by Irani, the alleged Delhi bomber, during his 2011 visit to India was also used in June last year in the Georgian capital, linking the two plots.
There are questions about who might be responsible within Iran. One possibility is that the attacks were sub-contracted to the Iran-backed Hezbollah militant group. The attack came close to the fourth anniversary of the assassination of Imad Mughniyeh, its operations chief, in a car bombing in Damascus.
A team of top Indian police officers has been set to travel to Tehran for several weeks but the trip now appears unlikely to go ahead.
Analysts speculate that one reason India may have been chosen as a location for the attacks is that their perpetrators could count on the desire of Delhi to keep friendly relations with Tehran and to "go easy" on any investigation or prosecution.
"Let's just say the demands of diplomacy and those of police work don't necessarily always coincide," said one senior Indian police officer involved in the investigation.
India has, however, asked Interpol and the Iranian ministry of foreign affairs for assistance in its inquiry.
Investigators are also looking at a possible attack in Baku, Azerbaijan, which apparently involved local criminals with links to Iran targeting Israeli and American officials.
