Leaked Iranian security documents reveal a coordinated state plan to violently suppress domestic protests through the use of lethal force, widespread surveillance and systematic internet shutdowns, Fox News reported Tuesday.
The documents, reviewed by Fox News, allegedly outline the Islamic Republic’s internal strategy to prevent or crush future uprisings, particularly following the widespread unrest that erupted across Iran in 2019 in response to economic collapse and rising fuel prices.
Father looking for his son's body among dozens of casualties after Iranian regime's protest crackdown
According to Alireza Jafarzadeh, deputy director of the France-based National Council of Resistance of Iran (NCRI), the documents contain “clear operational plans” authorizing Iran’s Islamic Revolutionary Guard Corps (IRGC) to use deadly force “to kill as many people as needed to stay in power.”
“These documents show the regime's efforts to prevent the resurgence of the uprising and, if it occurred, to suppress it,” Jafarzadeh said during a press briefing Tuesday. He claimed the documents were obtained from inside the regime by the Iranian opposition group Mujahedin-e Khalq (MEK), which has longstanding sources within Iran's security apparatus.
Excerpts of the documents reviewed by Fox News reportedly show that Iran’s Supreme National Security Council developed the plan following the 2019 protests. One top-secret document, dated March 3, 2021, details a four-tiered escalation model for law enforcement and national security operations, depending on the severity of unrest.
Under the most extreme category, labeled “armed security situation,” full command is immediately transferred to the IRGC, bypassing regular law enforcement. This protocol was reportedly activated during the most recent wave of protests in Iran, which broke out in late 2025 and escalated in early 2026.
The exact death toll from that crackdown remains unclear, but estimates range from at least 6,000 to potentially as many as over 30,000. According to the leaked documents, the regime tracked the escalation in three stages: initial law enforcement action, followed by non-lethal confrontations and culminating in an “armed security situation” phase beginning January 8, 2026, when the IRGC took over command and launched a violent crackdown.
The documents also suggest that in such scenarios, the IRGC coordinates with other security agencies while Iran’s Ministry of Communications imposes sweeping internet restrictions, including full blackouts, to block the flow of information.
One of the files, referred to as the “Comprehensive Security Plan of Tehran,” spans 129 pages and outlines extensive surveillance and suppression tactics. It reportedly singles out MEK members, as well as relatives of executed political dissidents, labeling them “level number one” enemies to be monitored and controlled.
“[The leak] also shows how far the regime is prepared to go to kill as many people as needed, which they did in January 2026,” said Jafarzadeh. “However, these killings further convinced the people that there is only one way to end the killings, and that is to overthrow the regime.”