Tehran’s plot to murder a US protected witness

One name frequently surfaces in connection with overseas murders allegedly ordered by the Islamic Republic: Naji Sharifi Zindashti.

The 49-year-old, known as the "big guy," reportedly has at least 10 murder charges spanning 29 years. Acting on orders from the Islamic Republic’s Intelligence Ministry, Zindashti and his associates have executed numerous acts of transnational repression, including assassinations and kidnappings, leading to sanctions by the US and UK.

His targets? Iranian dissidents, opposition activists, and defectors.

In one particularly harrowing example, Zindashti's operatives kidnapped Ahwazi-Arab activist Habib Asiod (Chaab) from Turkey, delivering him to Tehran for execution.

Zindashti’s record, which also includes drug trafficking and retaliatory killings, has led to his arrest, trial, and imprisonment on multiple occasions. Initially detained in Iran, he reportedly escaped prison. While in Turkey, he was arrested in 2007 in Istanbul with 77 kilograms of heroin and again in 2018 after a shootout with Turkish narcotics police, but political intervention secured his release, allowing him to return to Iran.

In December 2020, the Iranian intelligence ministry (MOIS) once again summoned Zindashti for a deadly mission. This time, the targets were an Iranian male defector and his female companion, whose origins remain uncertain.

For months, Zindashti deftly utilized his extensive network of underworld contacts to set Tehran’s deadly plan into motion. Likely operating from his secluded base in Iran’s Aghond Mountains, tucked behind the village of Zinedasht in the Sumay-ye Beradust district of Urmia, he meticulously directed every move.

When Zindashti needed an assassin in the US but couldn’t find one, his labyrinth of dangerous connections led him to his trusted ally in Canada, Damion Patrick John Ryan. This connection was facilitated through the Askari brothers, Siavash and Sahand – Iranians who were well-known to Canadian police for their deep gang affiliations and criminal enterprises.

A Canadian security source disclosed to Iran International, "They had worked together before; it is believed that Ryan previously, in the spring of 2016, arranged for the killing of two international fugitives in Canada at Zindashti's request."

Ryan, a Hells Angels’ member, was in custody at the time in Canada’s Manitoba province awaiting trial on drug smuggling and trafficking charges.

Zindashti and Ryan’s conversations, through the encrypted messaging service Sky ECC, initially focused on "a specific job in the United States."

Despite the challenges of operating in the US, Ryan hinted at having a potential hitman.

The Canadian said, "East coast is very hard for me. West I can do more and have more options... I might have someone for this job, very far away, but this person would travel... we need a car and equipment."

That same day, on Sky ECC, Ryan messaged someone he mentioned could be available for the "job in Maryland".

The individual in question was Adam Richard Pearson, another Canadian tied to the Hell’s Angels, who was wanted for murder and on the run for the murder of a man in late 2019 in Alberta, Canada.

Pearson had long since fled Canada and was living illegally in Minnesota under an alias. He accepted the murder contract and coordinated with Ryan on the payment, method of execution, and required personnel. In exchange for $100,000 from Ryan, Pearson agreed to carry out the double assassination.

On January 30, 2021, Zindashti reached out to Ryan, inquiring about the progress of their deadly plot. Ryan replied that he was still organizing and needed more funds.

Days later, Zindashti assured Ryan that his organization, labeled by the US Treasury Department as the Naji Zindashti Terror Network, was ready to proceed with the murder plan.

The parties ultimately agreed on a total operational cost of $350,000, with an additional $20,000 allocated for travel expenses.

An American intelligence source who spoke to Iran International highlighted the significance of the hefty price tag on the planned assassination. Tehran had previously set a bounty of $300,000 for the killing of John Bolton, the former US National Security Advisor, in retaliation for the death of Qasem Soleimani, the IRGC’s Quds Force commander.

"It seems Ryan understood the great importance of this operation for Zindashti [the Islamic Republic] and demanded a high amount. Apart from the high amount for the murder, $20,000 for travel expenses for a relatively short distance is very high," the source said.

Given Ryan’s strategy, which involved having two assassins equipped to "shoot [the victim] in the head a lot" and to "erase his head from his torso" in order to make an example, it seemed that the individual was highly significant to Tehran.

Eventually, Zindashti would turn Ryan over to his close associate, a man by the name of Nihat Abdulkadir Asan, based in Iran. Quickly after they were in contact, Ryan informed Asan that a four-member team was primed and ready for action.

In the days that followed, Asan sent Ryan crucial information, including photos and the address of the man and woman marked for assassination, setting the stage for their deadly mission.

When Ryan saw photos of the woman accompanying the man and learned she had to be killed as well, the agreed-upon $375,000 no longer satisfied him. Tempted by greed, he considered demanding more, hoping to extract a greater profit from the deadly brokerage.

Ryan messaged Asan, "You know two people cost more than one." Asan assured him, "No problem."

A source familiar with Zindashti's network told Iran International, the series of messages indicate that the Islamic Republic was in a hurry to have this job done as quickly as possible.

"Perhaps the Ministry of Intelligence, which had ordered this murder, wanted to give the leader of the Islamic Republic a New Year's gift—a gift for the new year and the beginning of the new solar century," the source said.

Around March 8, 2021, Asan messaged Ryan again, providing him with a phone number and instructing him to call and say, "20000$ I have to bring from you." According to a federal indictment, Ryan received this $20,000 payment at that time, coordinated by Asan. Rather than receiving his fee through cryptocurrency, as typically done, Ryan was instructed to collect the amount by making a call.

A source familiar with Zindashti's network told Iran International: "The person who gave this amount to Ryan must be part of Zindashti's financial network active in Europe and Canada, which in recent years has shifted from the drug market to money laundering and circumventing sanctions for the Islamic Republic."

According to the indictment, released on December 29, 2023, the primary target of Tehran’s international assassination network was a man who fled Iran, while the secondary target was a woman who accompanied him to the US.

Neither the indictment nor the Justice Department’s 2024 press release mentions the names of the two individuals targeted for assassination.

Upon request for further information, legal authorities, the Minnesota prosecutor’s office, the FBI, and the Department of Justice all declined to provide information or comment, citing the ongoing nature of the case.

The brutal violence emphasized in Ryan’s messages raises the question: What motivated the assassin to want to make such a gruesome example of the targets?

Since the Islamic Revolution in 1979, a significant number of dissidents and critics of the Iranian state have sought refuge in the US.

An unspecified number of experts and scientists involved in Iran's nuclear and military activities have also sought protection in the US, with Iran suspecting these individuals of leaking information to the Americans. In some cases, these individuals live under witness protection programs with changed identities.

A source connected with US intelligence told Iran International: "One of the individuals living under a witness protection program with a changed identity in the United States, along with their partner, were the terror targets that Zindashti's network was planning for. More information will be released in the future; I can only say that the man targeted in Maryland is of great importance to the Islamic Republic."

Another intelligence source in the US confirmed to Iran International that the man targeted in the Maryland assassination plot still lives under witness protection, but with a new identity.

A legal expert and national security specialist suggested that the change in the identity of the assassination target could explain why the security, legal, and judicial aspects of the case made the indictment issuance and notification about this attack so time-consuming.

"As you say, at least one of the targets of this attack is a person under a witness protection program. In these circumstances, considering the necessity of coordination between several agencies to create a new identity for the targets of this attack and the time-consuming nature of their resettlement, it is understandable why the process of issuing an indictment and notifying [the public] about them took nearly three years," the source said.

At the time, Zindashti's terror network, like many criminal organizations, used Sky ECC, the largest encrypted messaging service, on modified phones for communication and coordination of their crimes.

Established in Vancouver, Canada in 2008 and owned by Sky Global, Sky ECC reportedly had 170,000 active users worldwide, with 70,000 using the service monthly, according to Europol. Sky ECC even offered a $5 million prize to anyone who could compromise its technology—a strong assurance for any criminals who may have sought to use the network.

Between 3 million and 6 million encrypted messages were exchanged daily among users of this service.

Zindashti first messaged Ryan through Sky ECC in December 2020, and their communications continued seamlessly until March 2021.

According to the US indictment, Tehran's assassination plot on US soil was meticulously orchestrated through the Sky ECC platform. A four-member assassination team was assigned, with addresses, photos, and target details exchanged. The payment amount was agreed upon, and $20,000 was paid for the team's travel expenses.

Then, suddenly, in early March 2021, communication between the criminals plotting the assassinations was abruptly cut off.

Since 2018, Belgian and Dutch police had been investigating Sky ECC, which operated three servers in France. Europol believed that, despite its public claims, Sky ECC was turning a blind eye to the widespread use of its service by criminals. The US federal indictment against CEO Jean-Francois Eap accused the company of cooperating with criminals under a "don't ask, don't tell" policy.

In December 2019, French police, having gained access to Sky ECC's servers earlier in the year, joined the investigation, intercepting metadata such as location details, device numbers, and users' online activity times.

On December 13, 2019, a Paris court authorized the French judicial police to install a monitoring tool on Sky ECC's servers in Roubaix, allowing them to intercept decrypted messages. By February 15, 2020, French police were intercepting these messages live.

After three weeks of live interception, on March 9, 2021, Europol launched coordinated raids in Belgium, the Netherlands, and France, arresting numerous users, seizing the company's servers, and obtaining hundreds of millions of messages. The Belgian prosecutor's office announced they had broken Sky ECC's encryption, accessing over 6 million encrypted messages from major criminal organizations: "We succeeded in breaking the encryption of this service and penetrating their system. We'll send the prosecution's bank account number to Sky ECC to collect our $5 million reward!"

The $5 million reward was never paid, and on March 10, 2021, Sky ECC's website went offline and vanished into the digital abyss.

As the crackdown on European-based Sky ECC servers continued, authorities – unknowingly – disrupted Tehran's plan to kill the Iranian man and woman in Maryland.

On March 12, a California court issued international arrest warrants for the CEO and sales director of Sky ECC. On March 15, the FBI seized the company's website and domains. On March 19, BlackBerry also stopped providing infrastructure services to the messaging service.

The simultaneous seizure of Sky ECC messaging domains, control of its servers by the police, and suspension of the company's activities seemingly disrupted Tehran's killers' communication.

Zindashti's network lost its ability to coordinate with assassins in the USA and Canada, leading to the failure of the Islamic Republic's planned murder operation in Maryland.

This time, the unfinished murder project wasn't due to the FBI uncovering the plot, Mossad infiltrating Iran's security apparatus, or their intelligence support to the US, nor was it due to the incompetence of the assassination team or double agents. Instead, the hastily yet generously funded plan by the Islamic Republic's assassins was thwarted by a “simple” communication disruption.

Just three months after the inception of Zindashti’s murderous plot on behalf of Tehran, it was halted – as the criminals were seemingly left with no other form of communication.

Before shutting down its website, Sky ECC sent a final message to its users, warning them that their communications would soon be intercepted by law enforcement.

An indictment by the Southern District of California confirms that Sky Global, in addition to France, also had an encrypted server in Canada.

The hacking of Sky ECC's servers in France and Europol's access to at least a billion messages suggest that user messages, which were automatically deleted from users' phones after seven days, were still stored on the company's servers.

Iran International's investigation shows that no legal action has been taken against Sky Global or its executives, nor have its servers in Canada been seized.

There is no record or published information indicating that the hacked messages from this service, similar to what happened in Europe, led to the arrest of anyone in Canada or the US, except for two individuals connected to Zindashti's terror network.

In response to Iran International's inquiries, Canada's federal law enforcement agency emphasized the importance of their close cooperation with the FBI.

A spokesperson for the Royal Canadian Mounted Police (RCMP) stated that they are committed to combating foreign interference on Canadian soil. However, they did not comment on the details of this case or confirm which individuals are under investigation, citing the ongoing criminal investigation in the country.

Separately, a security source in Canada who spoke to Iran International suggested that legal challenges might have prevented action against Sky ECC's servers in Canada. Additionally, the high volume of decrypted messages from the company's servers in France made conducting random searches difficult.

In response to questions about pending actions following the indictment, Kelly Thornton, press director of the US Attorney's Office for the Southern District of California, which issued arrest warrants for Sky Global's CEO and sales director, told Iran International: "We are not in a position to comment on this ongoing case."

Since September 28, 2021, when the prosecution issued an order to seize the bank accounts of Sky Global and its CEO Jean-François Eap, along with 70 of its internet domains, no further judicial action has been taken in this case.

Meanwhile, one of the prosecutors in this case in Belgium, on the third anniversary of Europol's 2021 raid on the service's users, announced that based on information obtained from SkyECC's servers, 592 cases were opened against 4,439 suspects, resulting in 1,139 years of prison sentences in 87 cases and the seizure of nearly $270 million in dirty money from criminals.

The Minnesota indictment, referring to communications within Zindashti's network, stated: "Sky ECC messages show," indicating that the FBI in all likelihood succeeded in accessing the messages exchanged between Zindashti's network and the two criminals in the US and Canada.

Reports by other media further confirm that the hacked messages from the Sky ECC messaging network, in addition to Europol, were also provided to the FBI.

Still, many questions remain.

When did the FBI access the messages exchanged within Zindashti's network? Also, why was Pearson, the Canadian criminal involved in this conspiracy and living in the US, not arrested until Canada requested his extradition for unrelated murder charges, which was over four months after the servers were hacked in France?

In response to Iran International's inquiries about how it discovered the planned attack, the delay in arresting individuals linked to Zindashti's network, and whether it had accessed the company's servers in Canada, the FBI stated that it would not comment on the matter.

According to a security source in Canada who spoke to Iran International, Pearson's arrest likely alerted the FBI to the planned attack: "It seems that Adam Pearson's arrest in Minnesota following Canada's request for his extradition due to a murder he committed there was the origin of uncovering Zindashti's network's assassination plot. He had a SkyECC mobile phone, which likely fell into the FBI's hands upon his arrest."

Federal court documents concerning Pearson’s arrest show that after Canada requested his extradition on July 23, 2021, the Federal Prosecutor's Office in Minnesota only listed the murder charge. There was no mention of Pearson's involvement in the assassination plot tied to Tehran, indicating that the FBI and the judiciary were unaware of this aspect until after his arrest on the unrelated murder charge.

In the case related to Tehran’s murder plot, Pearson's illegal residency and possession of an illegal weapon are noted as additional crimes. However, there is no mention of these crimes in the extradition documents, and no information is available in the federal case database about such a case being opened.

A US legal expert and national security specialist, who spoke to Iran International, suggested that a confidential investigation might have been initiated simultaneously. This expert proposed that after the FBI accessed Pearson's mobile phone, which had the Sky ECC app, and retrieved messages from the hacked Sky ECC servers, they may have discovered the assassination plot. The lengthy process of gathering sufficient evidence for prosecution and security considerations could have delayed formal charges until January 2024.

Even though messages on the Sky ECC messaging network are automatically deleted, the FBI was still able to access them. This happened after Pearson was arrested in the US on July 26, 2021. The FBI gained access to these messages through the Sky Global mobile phone that Pearson had. This phone helped the FBI retrieve messages that had been obtained from the hacked Sky ECC servers in France and previously shared with them by Europol.

Another sign that the police didn’t discover Zindashti's network's assassination plot in Maryland until after Pearson’s arrest is a warning poster issued by Vancouver police on May 17, 2021, 40 days after the Sky ECC servers were hacked and shut down. The poster listed six criminals, including Ryan.

At the time, the Vancouver police chief announced that these six criminals were not wanted by the police and the warning was issued merely for public caution in dealing with them.

Pearson, who was extradited to Canada in February 2022, was sentenced to 8 years in prison in June 2023 for his involvement in the murder of a young man in 2019.

Ryan, a 43-year-old criminal who was arrested in Ontario in February 2022, remains detained in Manitoba. His case is ongoing in Canada, where he faces charges of murder and possession of numerous illegal weapons. No verdict has been reached yet.

The Canadian Ministry of Justice has stated that the extradition process can proceed concurrently with domestic criminal proceedings. This means that, after the Canadian legal proceedings conclude and verdicts are issued, Pearson and Ryan can still be extradited to the US to face charges related to the Maryland murder plot while serving their sentences in Canada.

At this stage, the prosecution of the Zindashti terror network’s plot to murder a US witness protection target on American soil remains pending.