In September 2025, five months before the first US-Israeli strike on Iran, Gregg Roman, executive director of the American right-wing Middle East Forum, sent an email to Raz Zimmt, Israel’s most prominent Iran expert at the Institute for National Security Studies. The subject was a proposed project called the “Iranian Civil Society Vulnerability Assessment.” The goal, as Roman described it, was to combine “INSS’s analytical expertise” with “MEF’s operational focus” to produce what he called “a truly transformative understanding of the opportunities within Iran.”
That email, obtained through a tranche of documents leaked from INSS servers by a group called Handala — verified as authentic by the Israeli newspaper Haaretz — has emerged as one of the most revealing windows into the informal network of think tanks, advocacy groups, and intelligence-adjacent institutions that helped build the political and analytical case for Operation Epic Fury months before Washington made its decision.
What the Project Proposed and Who Was Involved
The leaked documents describe a proposal to gather Farsi-language open-source intelligence from social networks and build what the proposal calls “a comprehensive heat map that provides actionable information on key pressure points” in ten of Iran’s most ethnically diverse provinces. The intelligence to be gathered would include the level of presence of military, paramilitary, and law enforcement forces in ten Iranian provinces, as well as the number of political prisoners, executions, and other human rights violations, with prominent labor organizations, student groups, and women’s organizations also tracked. The project was estimated to cost $330,000 per year and would engage four researchers at the Israel-based INSS.
In September 2025, INSS recruited a Farsi-speaking reservist from the Israeli army’s Unit 8200 — the military’s signals intelligence directorate — to work on the project. That recruitment detail matters. Unit 8200 is not an academic research unit. It is Israel’s equivalent of the NSA, responsible for electronic surveillance, code decryption, and intelligence gathering. Its involvement in a project nominally framed as civil society research blurs the line between academic analysis and intelligence preparation in ways that the leaked documents themselves do not resolve. The leaked documents do not explain how any resulting research would have been operationalized, nor do they establish that it was subsequently used in military planning or intelligence operations.
Leaked emails suggest funding had not yet been secured as of December 2025. Whether the project ever launched remains unclear. What the documents do establish is that the conversation was happening, at a senior level, between two institutions with deep ties to their respective governments’ security establishments.
INSS: Academic Institution or Security Annex?
INSS describes itself as an independent research institute affiliated with Tel Aviv University. Its own 2025 annual report tells a somewhat different story. During Operation Epic Fury, the Israeli Army’s General Chief of Staff called upon INSS Executive Director Major General (Res.) Tamir Hayman to serve as Shadow Commander of IDF Intelligence, providing him with operational access as well as the opportunity to directly influence military strategy based on INSS’s Iran research. Throughout the operation, INSS Iran researchers, led by Raz Zimmt, provided hundreds of briefings to both domestic and international government officials, diplomats, and media outlets.
The leaks, published by Handala and analyzed by Haaretz, suggest that Iran’s Ministry of Intelligence has treated INSS not as a civilian think tank but as an extension of Israel’s security establishment. Handala, which presents itself as a pro-Palestinian hacktivist collective but has been identified by US officials as an Iranian cyber unit, released more than 100,000 stolen files containing internal communications, administrative documents, and operational details from senior INSS personnel, including former heads of Israeli Military Intelligence and Mossad-related figures who now occupy leadership roles at the institute.
The source of the documents — an Iranian intelligence-linked hacking group — introduces its own verification problems. Intelligence services do not leak documents for altruistic reasons. Handala’s publication of the MEF-INSS correspondence serves Iranian propaganda interests by portraying the war as the product of a coordinated hawkish network operating outside democratic accountability. That does not make the documents false. Haaretz authenticated them. But it means they arrived through a channel designed to damage Israel while serving Tehran’s narrative interests — a context that serious readers should hold in mind.
The MEF’s Place in the Pro-War Ecosystem
The Middle East Forum was founded in 1994 by Daniel Pipes and has since become one of the most hawkish voices on Iran, political Islam, and the Israeli-Palestinian conflict in American policy circles. Roman’s framing of his organization’s role in the Iran conflict is notably frank. Speaking in May at a Washington conference that included the Israeli ambassador to the US, Roman described Operation Epic Fury as “the doctrine we advocated in practice” — “for the first time in 10 years, we saw it live. 39 days of fire.”
Before the war, MEF’s influence operated through more conventional channels. In January, about a month before the first US strike on Iran, Roman wrote that the US government should funnel money to organizations inside the country through Cold War-era programs such as the National Endowment for Democracy. Then, in March, less than a week after the assassination of Ayatollah Khamenei, Roman called for $300 to $500 million for the NED, to be spent as stipends for pro-democracy activists and in support of ethnic minority groups inside Iran.
The ethnic minority dimension of both the NED funding proposal and the “vulnerability assessment” project connects to a broader pattern. According to US and Israeli sources, the early days of Operation Epic Fury involved a botched plan to arm Kurdish Iranian elements in the northwest to launch attacks on Iranian regime targets. Mapping the “pressure points” in Iran’s most ethnically diverse provinces, as the MEF-INSS project proposed, reads differently in that context than it would as a purely academic exercise.
Roman denied the project’s existence to The New Arab, refused to confirm the authenticity of the leaked correspondence, and accused the publication of acting as “the regime’s public relations.” His organization has deployed 470 Starlink satellite terminals inside Iran to circumvent government internet shutdowns and supports the Iran Freedom Congress, an umbrella group for diaspora opposition to the Islamic Republic. Those activities are openly acknowledged. The vulnerability assessment project was not.
What the Leaked Documents Actually Reveal
The documents do not establish a direct line between the MEF-INSS project and the decision to launch Operation Epic Fury. In early 2026, Netanyahu lobbied Trump for a joint military strike targeting Iranian leadership, with reports citing Israeli intelligence provided by Netanyahu as a decisive factor in the final authorization. The policy decision was made at the highest levels of two governments, not in a Washington think tank.
What the documents do reveal is the informal architecture through which hawkish policy preferences get translated into analytical products, policy recommendations, and political pressure — the ecosystem in which a regime change doctrine moves from fringe advocacy to mainstream consideration. The MEF was by its own admission advocating for exactly the military operation that was ultimately launched. INSS was providing hundreds of briefings to government officials during the operation itself while its director served as a shadow military intelligence commander.
The civil society vulnerability assessment, had it been completed, would have produced a detailed map of which Iranian provincial populations were most susceptible to unrest, which organizations might be mobilized, and which security forces were most thinly deployed — exactly the kind of operational intelligence that a regime change campaign attempting to exploit domestic disorder would need. Whether that intelligence was ever used, never completed, or remains classified is a question the leaked documents cannot answer. The fact that the question now needs to be asked tells its own story.
Original analysis inspired by Anas Ambri and Yossi Bartal from The New Arab. Additional research and verification conducted through multiple sources.
By ThinkTanksMonitor
