Analysis baseline: approximately March 5, 2026. Events after this date are not reflected.

Chapter Index

Chapter	Title
Prologue	What Happened on February 28, 2026
Ch. 1	The Path from Nuclear Talks to Military Action and the Structure of Justification
Ch. 2	How Past Limited Retaliation Enabled the Decision to Assassinate the Supreme Leader
Ch. 3	The 58-Day Force Redeployment from Venezuela to Iran
Ch. 4	Post-Assassination Power Structure Revealed by Persian-Language Primary Sources
Ch. 5	The Military Meaning of Five Simultaneous Kills and the Reality of Successor Placement
Ch. 6	Six-Stage Evaluation of the Intelligence Process That Made the Assassination Possible
Ch. 7	Quantifying Iran’s Remaining Military Capability by Region and Domain
Ch. 8	Verifying Wartime Fiscal Sustainability from Iran’s Actual Government Budget Figures
Ch. 9	Verifying All of Iran’s Access Routes Beyond Hormuz with Actual Data
Ch. 10	The CIA’s Pre-Assessment and Five Scenarios for ‘After the Destruction’
Epilogue	What This Attack Designed, What It Achieved, and What It Has Not

Chapter 6: Six-Stage Evaluation of the Intelligence Process That Made the Assassination Possible

── The Lineage of Capabilities Since Stuxnet: 20 Years of Evolution and an ‘All-High’ Score Across the Six-Stage Kill Chain

1. Not ‘Divine Skill’ but a ‘Reproducible Pattern’ — Premise for Scoring

Viewing the Khamenei assassination as ‘a one-time miracle’ misses the essence. The CIA tracked him for months, detected a Saturday morning senior meeting, shared the intelligence with Israel, and advanced the operation timeline [6-01][6-02] — this entire process lies on the extension of 20 years of accumulated anti-Iran intelligence operations. A ‘pattern of capability’ exists, running from Stuxnet (Operation Olympic Games) through the Fakhrizadeh assassination and the nuclear archive seizure to this decapitation.

This chapter deconstructs the process through the six stages of the kill chain — the standard military/intelligence evaluation framework: Find (discover) → Fix (lock) → Fuse (integrate) → Isolate (sever) → Finish (strike) → Exploit (sustain) — defining ‘what constitutes a high score’ at each stage, then applying open-source evidence to score each phase. It also examines the structure of the US-Israel intelligence alliance that enabled this operation and why Iran’s counterintelligence was ‘penetrated.’

2. Six-Stage Scorecard — What Is Visible at Each Phase from Open Sources

Table 6-1: Intelligence Process Scorecard for the Khamenei Assassination — Six Stages

Phase	What Constitutes a High Score	Evidence Confirmed This Time (Open Sources)	Rating
① Find (Discover)	Long-term tracking of high-value target’s location and behavioural patterns	CIA tracked Supreme Leader’s location for ‘months.’ BBC references accumulation of ‘pattern of life’ [6-01][6-03].	HIGH. Months-long continuous tracking indicates grasping not one-off intelligence but ‘behavioural regularity.’ This becomes the foundation for all subsequent phases.
② Fix (Lock)	Real-time confirmation of ‘he is there now’ through multiple means	‘Saturday morning senior meeting’ detected, operation advanced [6-02]. Not single-source but the ‘product’ of ‘SIGINT/cyber/HUMINT meeting indicators × long-term behavioural pattern × same-day multi-sensor confirmation’ [6-01][6-02].	HIGH. ‘Meeting detection → advance’ is evidence of real-time capability. That ‘advancement’ was possible itself shows operational readiness was in a ‘launchable at any time’ state.
③ Fuse (Integrate)	Share intelligence within the alliance (US-Israel) and translate into integrated targeting	CIA shared location intelligence with Israel [6-01]. Guardian describes division of labour: ‘Israel built agents/networks inside Iran over years; US adds technological depth’ [6-04].	HIGH. NSA internal documents (ACLU release) showing institutionalized SIGINT cooperation [6-05] are the precondition enabling ‘rapid confirmation and advancement.’ Not improvised — pre-existing pipes.
④ Isolate (Sever)	Disrupt escape, command, and communications; deny the target ‘time to react’	Al Jazeera cites a US military top briefing: ‘first move was blinding/disruption via Cyber/Space’ [6-06]. US Cybercom/Spacecom involvement suggested.	HIGH (though details unpublished). ‘First move’ being non-kinetic (cyber/space) is evidence of a design to collapse C2 (command/communications) first, making escape and dispersal difficult.
⑤ Finish (Strike)	Deliver decisive strike (decapitation) on the first move	3 sites hit simultaneously within 1 minute. 5 deaths including Khamenei confirmed by multiple media [6-07][6-08].	HIGH (militarily). The combination of ‘daytime surprise + simultaneous multi-site + cyber severance’ achieved decapitation. However, strategic outcome (regime change) is a separate variable (discussed below).
⑥ Exploit (Sustain)	Post-decapitation, chain to follow-on targets (missile network, security organs, etc.)	ISW/CTP timeline shows increasing attacks on internal security organs (police, Basij, revolutionary courts) [6-09]. Target count expanded 3,000 → 5,000+.	IN PROGRESS. Not ‘decapitation and done’ but transitioning to ‘deep strikes + internal security targeting.’ However, whether this connects to political objective achievement is uncertain.

Phases ①–⑤ all rate ‘High,’ evidencing military success across the intelligence process. Phase ⑥ is in progress with outcome uncertain. The ‘all-high’ rating demonstrates the operation’s intelligence-side success. However, this success is ‘military success’ and is explicitly a separate variable from ‘strategic success (achieving regime change).’

3. Not ‘A Single Ultra-Secret Source’ — Targeting Built on ‘Products’

The most important structure shown by ② (Fix) in the scorecard is that this intelligence was established not by ‘one informant’ or ‘one wiretap’ but through the ‘product’ of multiple intelligence sources [6-01][6-02].

The first layer is long-term behavioural pattern tracking (Pattern of Life). CBS reported CIA tracked for ‘months’ and BBC referenced ‘pattern of life accumulation’ [6-01][6-03]. This is the work of collecting Khamenei’s movement routes, meeting frequency/location/participants, and communication patterns over extended periods to extract ‘regularity.’

The second layer is real-time detection of meeting indicators. The ‘Saturday morning senior meeting’ intelligence was obtained through means separate from long-term tracking — probably more immediate methods [6-02]. SIGINT (communications intercept), cyber-derived information, or HUMINT (human intelligence), or some combination thereof.

The third layer is same-day confirmation through multiple sensors. The reporting that ‘the operation was advanced’ [6-02] suggests the meeting intelligence was not processed as unconfirmed single-source information but was cross-validated through multiple means before the ‘GO’ decision. No intelligence agency would accept the risk of advancing a Supreme Leader assassination on single-source intelligence.

This three-layer ‘product’ aligns with patterns established in past anti-Iran operations. Research papers on Stuxnet (Operation Olympic Games) explicitly state that precisely striking high-value targets requires ‘integrated operations bundling SIGINT/GEOINT/MASINT/HUMINT’ [6-10]. The Khamenei assassination lies on the extension of this pattern.

4. Alliance Division of Labour — Israel’s HUMINT × America’s Technical ISR

Table 6-2: US-Israel Intelligence Alliance Division of Labour — Contribution to This Operation

Responsible Party	Primary Contribution Area	Evidence and Implications for This Operation
Israel	HUMINT (human intelligence) / local networks	Guardian describes ‘built agents/networks inside Iran over years’ [6-04]. The 2018 nuclear archive seizure (removing tens of thousands of documents from a deep Tehran vault) as precedent demonstrating ‘quality of access’ [6-11]. AP-affiliated reporting describes combination of ‘spies, smuggled drones, and AI’ [6-12].
United States	Technical ISR (SIGINT/GEOINT/cyber/space) / global collection	CIA handled months of tracking and location intelligence sharing [6-01]. Al Jazeera suggests US Cybercom/Spacecom initial involvement [6-06]. NSA internal documents (ACLU release) confirm collabouration in access/intercept/targeting/analysis/reporting between NSA and Israeli SIGINT units [6-05].
Integration (alliance interface)	Institutionalized SIGINT cooperation + integrated targeting	NSA internal documents summarise structure involving CIA/Mossad and others [6-05]. This operation’s ‘rapid confirmation and advancement’ is the consequence of ‘pre-existing collabourative work, standardized sharing, and analysis pipes’ maintained in peacetime. Tempo impossible through improvisation.

Noteworthy here is the ‘structural difficulties of CIA anti-Iran HUMINT’ described in Reuters investigative reporting [6-13]. Reuters’ long-form investigation detailed how Iran captured CIA collabourators by exploiting communication tools and operational vulnerabilities, and how Iran is ‘the hardest target’ with a structure that relies on overseas and online recruitment.

Given this constraint, this operation’s ‘months of tracking → meeting detection → rapid advancement’ most likely required Israeli local access as an indispensable complementary element, not US HUMINT alone. The US casts the ‘net’ with technology (SIGINT/cyber/space); Israel secures ‘points’ with local HUMINT — this division of labour operated on NSA’s institutionalized cooperation framework. This is the most consistent reading.

5. Why Was Iran ‘Penetrated’? — Structural Weaknesses in Counterintelligence

Understanding only the attacking side’s capabilities cannot fully explain why this operation succeeded. Iran is a state with massive intelligence organs. Per USIP’s overview, over a dozen intelligence agencies coexist in parallel, with the civilian MOIS (Intelligence Ministry) and military IRGC-IO (Revolutionary Guards Intelligence Organisation) forming the ‘dual structure’ core [6-14]. With this scale, why was the Supreme Leader’s location ‘penetrated’?

Three hypotheses are derivable from open sources.

First hypothesis: resource optimisation toward domestic control and anti-dissident suppression [6-14]. The bulk of Iranian intelligence activity is devoted to monitoring and detecting domestic opposition movements. Responding to the December 2025 large-scale protests would have accelerated this tendency. A structural bias exists where counterintelligence against external penetration is deprioritised.

Second hypothesis: ‘holes’ fixed in place by inter-organisational competition [6-14][6-15]. Jurisdictional disputes and information hoarding exist between MOIS and IRGC-IO. Long War Journal describes a structure where they ‘cooperate but also friction’ [6-15]. When ‘holes’ appear in counterintelligence, turf consciousness can delay the response to plug them.

Third hypothesis: OPSEC failure of peripheral personnel (security detail, drivers) [6-16]. Times of Israel reported, in a separate 2025 case, the pattern where ‘even if the principal avoids devices, bodyguards’ and drivers’ smartphones become tracking vulnerabilities.’ No matter how strictly Khamenei maintained communications discipline, if peripheral OPSEC fails at a single point, behavioural patterns are exposed.

These three hypotheses are not mutually exclusive. Rather, the regime’s design itself embeds counterintelligence vulnerabilities. Intelligence organs optimised for domestic control become structurally vulnerable to external penetration. Organisational parallelism distorts information sharing. And even a massive security apparatus can be undermined by a single smartphone at the periphery. US-Israeli attack capabilities are optimised for these structural weaknesses.

These three hypotheses connect not as parallel alternatives but as a causal chain. Resources optimise toward domestic control and cross-border suppression (first hypothesis). This fixes organisational parallelism and resource allocation distortions (second hypothesis). Counterintelligence tilts toward ‘internal politics’ and ‘political security,’ structurally thinning the ‘area defence’ against external technical and human penetration. The attacking side (US-Israel) has spent 20 years building capabilities optimised for this thinness — pre-positioning, remote operation, multi-channel approaches. And peripheral OPSEC failure (third hypothesis) is the most concrete manifestation of this structural thinness. Iran’s intelligence apparatus is not ‘weak.’ Being ‘strong in a different direction’ produces the very distortion that incubates the attacker’s capabilities — this is the reality of ‘co-evolution.’

6. Capability Lineage — Evolution of the ‘Pattern’ from Stuxnet to the Khamenei Assassination

Table 6-3: Lineage of Anti-Iran Intelligence Capabilities — Staged Acquisition of Capability Modules

Era	Milestone	Capability Module Acquired	Engagement with Iran-Side Weaknesses
2006-2010	Stuxnet / Operation Olympic Games [6-10]	Cyber directly causing physical destruction. Established integrated design of multiple INTs + human infiltration routes. Template for US × Israel collabouration.	Industrial/procurement/field-operation complexity becomes a supply-chain attack surface. Military counterintelligence alone cannot close it.
2018	Nuclear archive seizure (deep Tehran) [6-11]	Physical infiltration into a capital deep vault. Long-term planning, use of non-national personnel. HUMINT and logistics maturation.	Limits of internal control in a massive bureaucracy. Anti-regime, corrupt, and interest-driven layers become ‘back doors.’
2020	Fakhrizadeh assassination (remote/AI mentioned) [6-17]	‘Leave no assailant on-site’ remotization and automation. Reduced human risk while achieving precision assassination.	If counterintelligence centres on human capture, remotized execution is hard to track. Single-point OPSEC failure becomes fatal.
2025	Infiltration/pre-positioning + AI target selection (AP reporting) [6-12]	Pre-positioned means inside the country to paralyse air defence and missiles from the first move. ‘SEAD from the inside.’	Complete interception of fine-grained infiltration across the entire territory hits ‘area counterintelligence’ limits.
2026	Meeting detection → advance → decapitation (this case) [6-01][6-02][6-06]	Sense → Disrupt → Strike cycling in short time. Alliance division of labour integration reaches highest level.	As long as parallel agencies + domestic-control bias continue, even top-level OPSEC can be exposed from the periphery.

What this lineage shows is that the current operation was not ‘sudden technological innovation’ but the consequence of staged accumulation of modularized capabilities. Capabilities acquired at each milestone — cyber’s physical effect (Stuxnet), deep HUMINT (nuclear archive), remote precision assassination (Fakhrizadeh), pre-positioning (2025) — became the foundation enabling this operation’s ‘meeting detection → cyber severance → simultaneous decapitation.’

7. Military Success and Strategic Outcome Are Separate Variables

The ‘High’ rating across phases ①–⑤ means the operation was executed at extremely high completion as an intelligence process. Tracking the Supreme Leader’s location for months, advancing the operation through real-time meeting detection, severing communications via cyber/space, and killing five people in a 3-site simultaneous attack — this is unquestionably ‘success’ in military terms.

However, war outcomes are not determined by military success alone. As discussed in Chapter 2, the CIA’s leading pre-attack assessment was that ‘IRGC hardliners will succeed’ [6-18]. As verified in Chapter 5, the career of newly appointed IRGC Commander Vahidi foretells ‘militarization.’ And the ‘polycentric structure’ reconstructed in Chapter 4 shows the regime has neither ‘collapsed’ nor ‘continued’ but is ‘moving while fragmented.’

In other words, the intelligence process was a ‘success,’ but the strategic outcomes (achieving regime change, deactivating external behaviour, resolving the nuclear issue) remain unachieved, and different dynamics have begun. The military success of ⑤ Finish (strike) and the achievement of political objectives are explicitly separate variables. Blurring this distinction would be a fatal error for subsequent analysis.

8. What the ‘Reproducible Pattern’ Signals: The Next Threat

The intelligence process that enabled the Khamenei assassination demonstrated high completion across all six stages. This is not ‘divine skill’ but the activation of a ‘modularized, reproducible pattern’ accumulated over 20 years since Stuxnet.

The core of this pattern is that the alliance division of labour in the US-Israel intelligence partnership — Israel’s HUMINT/local networks × America’s technical ISR/cyber/space — is integrated on top of institutionalized cooperation frameworks (NSA-Israel SIGINT cooperation, etc.). This integration is not improvised but ‘pipes’ maintained in peacetime, serving as the precondition for producing ‘tempo’ in emergencies.

The reason Iran’s counterintelligence was ‘penetrated’ lies not in simple capability deficiency but in weaknesses embedded in the regime’s structure itself — domestic-control bias, hole fixation through organisational parallelism, and peripheral OPSEC failure. The attacking side’s capabilities and the defending side’s weaknesses have ‘co-evolved,’ and as a result, this decapitation achieved unprecedented success in both quality and scale.

However, whether this military success translates into strategic success is an entirely separate question. The answer to that question depends on Iran’s remaining military capability (Chapter 7), fiscal sustainability (Chapter 8), and external access vulnerability (Chapter 9), examined from here forward. The intelligence ‘pattern’ functioned perfectly. The question is what lies beyond what the ‘pattern’ destroyed.

Chapter 6 — References

[6-01] CBS News, “CIA Intelligence: US-Israel Strike on Ayatollah Ali Khamenei,” cbsnews.com (CIA months of tracking, location intelligence shared with Israel)  [Link]

[6-02] Reuters, “Israel, US Launched Strikes as Iranian Leader Met With Inner Circle, Sources Say,” reuters.com (meeting detection → operation advanced)  [Link]

[6-03] BBC, “How Months of Tracking Led to Strike on Khamenei,” bbc.com (pattern of life accumulation)  [Link]

[6-04] The Guardian, “How Israeli Sleight and US Might Led to the Assassination of Ali Khamenei,” theguardian.com (Israel HUMINT/local network × US tech division of labour)  [Link]

[6-05] ACLU, “NSA Intelligence Relationship with Israel,” aclu.org/documents (NSA internal docs: collabouration in access/intercept/targeting/analysis/reporting)  [Link]

[6-06] Al Jazeera, “Inside the US-Israel Plan to Assassinate Iran’s Khamenei,” aljazeera.com (‘first move was blinding via Cyber/Space,’ US Cybercom/Spacecom)  [Link]

[6-07] Al Jazeera, “Who Are Iran’s Senior Figures Killed in US-Israeli Attacks,” aljazeera.com (5 deaths confirmed)  [Link]

[6-08] IranWire, “Iran Confirms Deaths of Top Military Leaders,” iranwire.com (‘near-complete decapitation’)  [Link]

[6-09] ISW/CTP, “Iran Update Morning Special Report, March 1, 2026,” understandingwar.org (increasing attacks on internal security organs, target count progression)  [Link]

[6-10] Security and Defence (academic paper), “Operation Olympic Games: Cyber Sabotage as a Tool of American Intelligence,” securityanddefence.pl (integrated design of multiple INTs + human infiltration)  [Link]

[6-11] Harvard Kennedy School Belfer Centre, “The Iran Nuclear Archive: Impressions and Implications” (nuclear archive seizure overview, early 2018 intelligence operation)  [Link]

[6-12] Times of Israel/AP, “How Israel Used Spies, Smuggled Drones and AI to Stun and Hobble Iran,” timesofisrael.com (infiltration, pre-positioning, AI target selection)  [Link]

[6-13] Reuters Investigates, “Special Report: CIA’s Iran Operations,” reuters.com/investigates (structural difficulties of CIA anti-Iran HUMINT, collabourator capture)  [Link]

[6-14] Iran Primer / USIP, “Profiles: Iran’s Intelligence Agencies,” iranprimer.usip.org (dozen+ parallel agencies, MOIS/IRGC-IO dual structure and competition)  [Link]

[6-15] Long War Journal, “Analysis: Unpacking Iran’s Counterintelligence Apparatus,” longwarjournal.org (MOIS × IRGC cooperation and friction, jurisdictional disputes)  [Link]

[6-16] Times of Israel, “Israel Targeted Top Iranian Leaders by Hacking, Tracing Their Bodyguards’ Phones,” timesofisrael.com (bodyguard smartphone tracking)  [Link]

[6-17] BBC, “Mohsen Fakhrizadeh: How Iran’s Top Nuclear Scientist Was Killed,” bbc.com (remote/AI mentioned, Iran-side claims organised)  [Link]

[6-18] Reuters, “Prior to Iran Attacks, CIA Assessed Khamenei Would Be Replaced by Hardline IRGC,” reuters.com (CIA pre-assessment)  [Link]