Daniele Garofalo, an intelligence analyst and security consultant, told TML that Hamas has focused on propaganda, fundraising and political networks in Europe, but may now have covert networks with operational capabilities
Haniyeh Bodyguard Case Points to Wider Hamas Networks in Europe as UK Probes Airbase Plot
Daniele Garofalo, an intelligence analyst and security consultant, told TML that Hamas has focused on propaganda, fundraising and political networks in Europe, but may now have covert networks with operational capabilities
By Giorgia Valente / The Media Line
New details about a man arrested in Britain nearly a year ago over an alleged Hamas plot in Europe are drawing renewed attention to the group’s suspected clandestine infrastructure on the continent. The Sunday Times reported that the man, known only as Mohammed A., previously served on Ismail Haniyeh’s security detail. Prosecutors allege that he helped move weapons into Austria for a planned attack on Israeli or Jewish targets.
The newly reported link to Haniyeh, the late Hamas political leader, has not yet been established in court. It adds a question about Mohammed A.’s background to an investigation in which German prosecutors allege that Hamas members built weapons stores across Europe. Mohammed A., a British national, was arrested in London on November 3, 2025, under a German warrant.
Germany’s Federal Prosecutor’s Office alleges that Mohammed A. is a Hamas member and that, on two occasions during the summer of 2025, he met another suspect, Abed Al G., in Berlin and received five handguns and ammunition. Prosecutors say he subsequently transported the weapons to Austria and stored them in Vienna as part of preparations for attacks against Israeli or Jewish facilities in Germany and elsewhere in Europe. He remains in Britain and has not yet been transferred to Germany.
The case forms part of a much wider German investigation. On September 8, prosecutors charged seven other men with alleged Hamas membership, preparing a serious act of violence threatening the state, and weapons offenses.
According to the indictment, Hamas’ military wing had been establishing weapons depots in Europe and, by July 2025, was pursuing a concrete plan for an attack in Germany or Austria targeting representatives of Israel, Jewish people, or individuals considered pro-Israel. Prosecutors allege that the attack was intended for early October 2025, near the second anniversary of Hamas’s October 7, 2023, attack on Israel.
By the time three suspects were arrested in Berlin on October 1, 2025, prosecutors say the group had obtained a functioning fully automatic rifle, 13 pistols and more than 700 rounds of ammunition. German authorities allege that senior Hamas figures had tasked members of the network with obtaining the weapons and describe Mohammed A., who is being prosecuted separately, as having played a prominent role in the operation. Prosecutors further allege that he recorded a video claiming the planned attack in Hamas’ name. The allegations have not yet been adjudicated, and Hamas has denied links to the suspects.
For Daniele Garofalo, an intelligence analyst and security consultant specializing in counterterrorism, counterinsurgency, and cognitive warfare, the significance of the investigation lies less in one suspect than in the structure investigators say they have uncovered.
“For a long time, Hamas’s presence in Europe was observed primarily through propaganda activities, fundraising, political and associative networking, and logistical support. The most recent investigations instead suggest that a clandestine and potentially operational dimension must also be taken more seriously,” Garofalo told The Media Line.
He said the alleged acquisition and storage of weapons distinguish this case from an attack improvised by an individual acting alone.
“There are at least three elements that deserve attention. The first is the transnational dimension: individuals, weapons and logistical infrastructure appear to move across several European states. The second concerns procurement,” Garofalo noted. “The third element concerns the selection of potential targets, predominantly Israeli, Jewish, or associated with support for Israel.”
Garofalo nevertheless cautioned against extrapolating from the investigation to the existence of a large Hamas terrorist infrastructure comparable with the networks once built by the Islamic State or al-Qaida in Europe. “The available data do not allow such a conclusion. They do, however, indicate a change that European security services can no longer regard as marginal: the possible transition, at least for some components, from predominantly political, financial and logistical infrastructures to operational-support capabilities,” he said.
The newly reported background of Mohammed A. could become particularly significant if established in court. Garofalo said that a confirmed previous position inside Haniyeh’s security apparatus would have to be considered when assessing whether the suspect operated independently or maintained connections with more established organizational structures.
“If it is ultimately confirmed through judicial proceedings that an individual who was previously part of Haniyeh’s personal security apparatus later participated in clandestine activities in Europe, it would be difficult to interpret him simply as a sympathizer who became independently radicalized,” Garofalo said. “His previous proximity to the leadership would become a relevant indicator in assessing the possible relationship between the organization’s central structures and European networks.”
Separately, British counterterrorism police opened an investigation Sunday after a report of three suspicious vehicles apparently traveling toward Royal Air Force (RAF) Fairford in Gloucestershire, an airbase used by US bombers to strike Iran.
Police said armed officers arrested five men in nearby Whelford, initially on suspicion of offenses under the Explosives Act and then on suspicion of preparing for an attack under Section 5 of the Terrorism Act. Bomb-disposal specialists examined the vehicles as investigators sought to establish what had happened.
Police have not publicly identified who may have been behind the suspected activity, although news reports suggest the arrests may be linked to a longer-running investigation. Iran’s Revolutionary Guards have previously warned that bases used to launch attacks on Iran could be targeted, but there is no publicly established link between Iran and Sunday’s incident. There is also no established connection between the Fairford arrests and the German Hamas investigation.
Security analyst Don Bowser said it was too early to assess whether the incidents were related because responsibility for the suspected activity near Fairford had not been established. “Once we know that—whether it is the Russians, the Iranians, somebody else, or an Islamist terrorist group—we can begin to assess it,” Bowser told The Media Line.
“But Western intelligence agencies generally have far greater resources and experience dealing with Middle Eastern terrorism than with Russian irregular warfare. There were very few Russia specialists before, and that capacity still has not been fully rebuilt. So, the ability to intercept people linked to Middle Eastern terrorist groups is probably higher than it is when dealing with Russian irregular warfare.”
Beyond the specific attribution in the Fairford case, Bowser said European security agencies must increasingly account for states and organizations that use individuals and networks that are not necessarily conventional operatives.
“More often, these are people already connected through criminal networks and who are not afraid to use violence,” Bowser said. “This follows a pattern we have seen with Russia: contacting people who can be given a specific assignment. It is essentially ‘gig terrorism’—contracting out an attack to someone.”
“It is usually not as directly connected as in the Hamas case. You may have individuals contacted to carry out one assignment or several assignments. So, we are seeing a pattern here.”
Bowser also warned that recruiters could seek to exploit people already strongly mobilized around the Israeli-Palestinian conflict in Europe, arguing that this could shorten the path between political militancy and an individual’s recruitment for violence. His assessment does not mean that pro-Palestinian activism itself constitutes a security threat, but rather that existing activist environments could, in his view, provide potential recruiters with individuals already intensely engaged with the issue.
“What we see now is that you have a lot of people who are Palestinian activists who can be vulnerable to manipulation. The danger is that these attacks can simply be outsourced. It is no longer necessarily the traditional model of having operatives in place for years. Instead, you find someone who is willing to carry out an attack today,” Bowser said.
“You have a pool of people who desperately want to do something against Israel. It can therefore become much easier to push some of them toward becoming violent actors.”
Bowser also pointed to the potential intersection between organized crime and politically motivated violence, an area where individuals already accustomed to illegal networks can provide states or militant organizations with another recruitment pool.
“I also would not discount the connections with organized crime,” Bowser said. “You have people already making money through different criminal activities, and then they are activated to take on an assignment. They are already accustomed to using violence, so for them it is not a major leap to do something else.”
The pressure is compounded, Bowser argued, by the erosion of some of the specialist capacity built during earlier phases of the fight against international terrorism.
“One of the main problems is that we have reduced our own capacity,” he said. “The global war on terror ended, and some of that capacity was lost. Governments have also been making austerity cuts, and experienced analysts are not always being replaced. Western agencies still have significant capabilities, but there are limits, and they are increasingly stretched.”
Garofalo argues that the lesson from the Hamas investigation is therefore methodological. Political activity, fundraising, propaganda, logistical facilitation, and clandestine operational structures should not automatically be treated as interchangeable, but neither can investigators assume that those environments are entirely disconnected.
For him, the most immediate concern is not evidence of a broad Hamas campaign across Europe—evidence for such an assessment does not currently exist—but the possibility of smaller networks able to prepare the infrastructure necessary for an attack well before an individual is visibly mobilized toward violence.
“For Europe, therefore, the most plausible risk in the short term does not appear to be a widespread terrorist campaign, for which at present we do not have sufficient evidence, but rather the existence of small transnational networks capable of preparing weapons, logistics and reconnaissance of potential targets before operational activation,” Garofalo said.
“It is precisely this type of infrastructure that becomes difficult to detect if attention is focused solely on individuals who have already mobilized toward violence.”
