Introduction: The Security Logic That Survived Command
On 7 January 2026, one day before the principal lethal escalation of the nationwide uprising, Mohammad Bagher Ghalibaf chaired a closed parliamentary session in Tehran. Ahmad-Reza Radan, commander of FARAJA, the regime’s national Law Enforcement Command, and a deputy intelligence minister briefed MPs on the security and field situation. The contents of that meeting were never released. Days later, after security forces had carried out the bloodiest phase of the crackdown, Ghalibaf publicly praised FARAJA, the Basij and the IRGC for what he called the “pacification” of the situation. IranSTO’s investigation into the January 2026 mass killings has documented the scale of that repression and the institutions involved. Ghalibaf, however, had been outside direct police command for more than twenty years.
His formal authority over the national police ended in 2005. His relevance to the security system did not. Over the following two decades, his career continued to intersect with the personnel, institutions and political decisions involved in domestic coercion, first through Tehran Municipality and later from Parliament and the senior national-security system. The central question of this investigation is therefore less about the offices Ghalibaf held than about what survived the movement between them.
The first article in this series examined Ghalibaf’s cross-institutional power network and the relationships that persisted as he moved through the IRGC, national police, Tehran Municipality and Parliament. This investigation focuses on function. It traces how police and military expertise was reused in civilian administration, how municipal structures developed working interfaces with coercive institutions, how Ghalibaf classified protest and political disorder, and how his approach to enforcement changed as his formal powers changed.
His responsibility is not the same in every period. During the 2003 student unrest, Ghalibaf was national police commander and held direct authority over the institution responsible for policing the country. In 2009, he was mayor of Tehran while the operational chain of the crackdown ran through other police and IRGC commanders. In November 2019, he held no operational domestic-security command and was not a member of the Supreme National Security Council. By 2022, as Speaker of Parliament, he had returned to the senior institutional layer where national-security policy was discussed and coordinated. January 2026 brought him still closer to the decision structure surrounding mass lethal repression, although no public record reviewed by IranSTO shows him issuing a live-fire order or directing the units that carried it out.
Those differences are essential to the case. Command authority, institutional participation, political endorsement and individual operational responsibility require different forms of evidence. IranSTO’s investigation of the Supreme National Security Council showed how difficult those lines can become to reconstruct when the regime conceals deliberations, attendance records and voting records. This article does not fill those gaps withassumptionsn. Where direct attribution is supported, it is made directly. Where the record establishes institutional involvement, political legitimation or a sourced allegation, those categories remain separate.
Even within those limits, a substantial pattern emerges. Ghalibaf’s move into civilian government did not leave the organisational habits of his security career behind. Former police and IRGC personnel entered Tehran Municipality in positions that often drew on the same managerial or technical expertise they had used inside coercive institutions. City Hall expanded information systems, crisis-management structures, municipal protection, surveillance capacity and formal cooperation with security bodies. Ghalibaf later described the municipality’s performance during the 2009 post-election crisis in terms that placed it alongside the regime’s security institutions. The Tharallah Headquarters assessment he cited has never surfaced publicly, leaving unanswered what exactly Tehran Municipality had done to earn that comparison.
His political treatment of dissent shows a related continuity. Ghalibaf has acknowledged real economic and social grievances, supported controlled forms of protest and criticised enforcement methods he considered ineffective or politically damaging. But he has also repeatedly drawn a boundary around the point at which protest becomes, in his vocabulary, disorder, foreign interference, separatism or a security threat. Once that classification is made, the range of measures he considers legitimate expands. The instrument may be physical intervention, administrative punishment, digital identification, surveillance or restrictions on communications. The methods differ in visibility and political cost, but all can be used to restore control once dissent has been moved from the political sphere into the security sphere.
IranSTO uses managerial repression to describe this recurring method. The term does not imply that Ghalibaf authored a formal doctrine or secretly controlled every institution examined in this article. It describes something more observable: the transfer of security expertise into civilian administration, the integration of coercive capacity with information and management systems, and a preference for enforcement methods calibrated according to political cost, institutional efficiency and the threat perceived by the regime. Direct violence is part of that record, but it is not the only form of coercion that matters.
This becomes especially important in a career as long and institutionally varied as Ghalibaf’s. Reducing his record to the years in which he wore a uniform would miss much of what followed. Treating every later crackdown as though he still commanded the police would be equally misleading. The more consequential story lies between those two errors: how a security commander moved into civilian power without abandoning the assumptions about order, information and political control that had shaped his earlier career.
The record begins in July 1999. Ghalibaf was then commander of the IRGC Air Force and part of a senior military establishment confronting a political crisis in the streets of Tehran. What he did during that episode, what he later claimed to have done, and the way he subsequently used 1999 as part of his own political history offer the first clear view of the security politician he was becoming.
Chapter 1: From the IRGC to the Street
The Formation of a Security Politician
When Ali Khamenei appointed Mohammad Bagher Ghalibaf commander of the Islamic Revolutionary Guard Corps Air Force in October 1997, Ghalibaf entered one of the most senior military posts of his career to that point. Less than two years later, the July 1999 student uprising confronted the Islamic regime with its most serious domestic political crisis since the early revolutionary period. The episode would remain part of Ghalibaf’s political identity for years afterwards, although his role has often been blurred by partisan retellings, his own retrospective claims and accounts that collapse several security institutions into a single chain of command.
The immediate crisis began after the closure of the reformist newspaper Salam. A peaceful protest at Tehran University was followed in the early hours of 9 July by a violent assault on the university dormitories involving police and plain-clothes forces. Students were beaten and detained, and at least one death was documented. Contemporary scrutiny focused particularly on Tehran police commander Hedayat Lotfian and the police and vigilante forces that entered the dormitory complex. The Interior Ministry said it had not authorised the raid, while the Supreme National Security Council later ordered an investigation.
No credible evidence reviewed for this investigation places Ghalibaf in command of the initial dormitory assault. He led the IRGC Air Force, not Tehran’s police, and his senior position within the security establishment does not establish responsibility for an operation conducted through another command structure. His documented relevance becomes clearer after the raid, as demonstrations spread beyond the university and senior military and security officials increasingly treated the unrest as a threat to the survival and authority of the political order.
Ghalibaf later described his own involvement in unusually direct terms. In a recording that surfaced during the 2013 presidential election, Human Rights Watch reported that he told a Basij audience there were photographs of him riding a motorcycle during the 1999 unrest and that he had personally used a baton against protesters. He was not recounting the episode to distance himself from violence or minimise his presence on the streets. He presented it as part of his security record, evidence that he had been willing to act personally when the regime faced a domestic challenge.
His role in a broader political intervention is documented more clearly. As the crisis continued, twenty-four senior IRGC commanders signed a letter to President Mohammad Khatami warning that their patience was running out and that continued failure to restore order could produce consequences beyond repair. Ghalibaf was among the signatories, alongside Qassem Soleimani, Mohammad Ali Jafari, Gholam-Ali Rashid, Ahmad Kazemi and other senior officers who would later occupy central positions across the regime’s military and security establishment. The letter was an overt intervention by serving commanders into a domestic political crisis, placing direct pressure on an elected president over his handling of unrest.
Ghalibaf later claimed that he had written the letter himself. The surviving document confirms his signature and participation but does not identify its author, so his claim cannot be treated as independently established. Its political significance lies elsewhere. Ghalibaf repeatedly returned to 1999, 2003 and 2009 when speaking before conservative and security audiences. He did not build his political résumé by concealing his proximity to coercive responses against unrest. At important moments, he advertised that proximity.
The group of commanders behind the 1999 letter also offers an early view of the environment in which Ghalibaf operated. IranSTO’s first investigation into the Mohammad Bagher Ghalibaf power network traced relationships that survived his later movement through the IRGC, national police, Tehran Municipality and Parliament. The letter should not be read as proof that its signatories formed a permanent faction, but it does show Ghalibaf embedded among officers who regarded domestic political instability as a legitimate concern of the military-security establishment and believed senior commanders were entitled to intervene politically when civilian authorities failed to contain it.
Qassem Soleimani became particularly prominent in Ghalibaf’s later reconstruction of those years. Ghalibaf repeatedly described the two men as working together during moments of domestic crisis and later made a more explicit claim about their behind-the-scenes activity during the 2009 post-election uprising. Nothing in the available record shows that Ghalibaf and Soleimani jointly directed operations against students in 1999. What matters here is how Ghalibaf himself described the relationship. In his account, their connection extended beyond the ordinary association of two senior IRGC officers and into the management of threats to the regime at home.
The repression that followed the dormitory attack involved several institutions with separate responsibilities. Police and plain-clothes forces were implicated in the initial violence. Security and judicial bodies pursued organisers and detainees as the protests expanded. Human Rights Watch later reported, citing the head of Tehran’s Revolutionary Court, that approximately 1,500 students had been detained in the aftermath. Meanwhile, senior IRGC commanders were placing political pressure on Khatami’s government to impose order. Ghalibaf’s documented position is clearest in that senior military-political layer, accompanied by his own later account of physically confronting protesters in the streets.
By the end of the crisis, an important feature of Ghalibaf’s political identity was already visible. He was comfortable treating domestic political unrest as part of his professional security terrain. In his later telling of 1999, military authority, policing, intelligence and political intervention belonged to the same broader problem of maintaining control when civilian politics could no longer contain a confrontation.
That experience soon acquired far greater institutional weight. In June 2000, less than a year after the student uprising, Khamenei appointed Ghalibaf commander of the national police. The officer who had emerged from 1999 presenting himself as both a senior military participant and a hands-on defender of the regime would now control the institution responsible for policing the country.
Chapter 2: The Police Commander
Authority, Control and Calibrated Coercion
On 27 June 2000, Ali Khamenei appointed Mohammad Bagher Ghalibaf commander of the national police, then formally known as NAJA. The appointment put him at the head of the institution responsible for policing the country, maintaining public order and responding directly to domestic unrest. His position was now fundamentally different from July 1999. Then, he had been a senior IRGC commander operating within a wider security establishment. As commander of NAJA, the national police hierarchy answered to him.
Khamenei’s appointment decree emphasised management, revolutionary commitment, military experience, public security and decisive action against insecurity. Those qualities would later become central to Ghalibaf’s political self-presentation. He was moving from a military organisation into an institution that operated every day at the point where regime authority met ordinary society. Political unrest was only part of the job. Ghalibaf also inherited a police force whose public image had been badly damaged by the violence at Tehran University in 1999 and began a programme of institutional modernisation intended to make it more effective, more accessible and more professionally managed.
Several reforms associated with his tenure reflected that effort. Police 110 expanded centralised emergency response and rapid dispatch. Police+10 offices moved routine administrative services into standardised public-facing centres. The 197 system created a channel for complaints and monitoring police performance. Ghalibaf also promoted investment in communications, equipment and technology while attempting to rebuild relations with sections of society that regarded the police as politically aggressive and administratively dysfunctional.
These reforms were not cosmetic. They improved the organisation’s administrative capacity and changed how citizens interacted with it. They also developed inside a police institution whose coercive powers remained intact. Faster communications, better information systems, clearer chains of responsibility and more effective coordination could improve routine policing while also strengthening the organisation’s ability to respond when the regime classified a political confrontation as a security problem.
The student unrest of 2003 provides the clearest view of how Ghalibaf approached that responsibility. The protests began around opposition to proposed changes in university policy and developed into a broader political confrontation in Tehran. Security forces, plain-clothes groups and senior regime officials became involved as the unrest continued. Unlike 1999, there is no ambiguity about Ghalibaf’s formal position during this crisis. He commanded the national police, and his own later account described how he sought authority to intervene.
In a recording reviewed by Human Rights Watch during the 2013 presidential election, Ghalibaf recounted a meeting at the Interior Ministry in which he pressed officials to give the police written permission to enter Tehran University. According to Human Rights Watch, he said he insisted on obtaining authority broad enough to include the use of live ammunition if circumstances required it. He was describing a command decision made from the top of the police hierarchy: ensuring that the legal and political authorisation for a potentially violent intervention existed before he might need to use it.
The available account does not establish that Ghalibaf subsequently ordered live ammunition to be fired. He himself claimed that the authority he obtained did not have to be exercised in its most extreme form. Protesters were nevertheless beaten, harassed and arrested during the unrest by security forces and pro-regime groups, and the crisis unfolded while he held national command of the police.
Mortaza Talaei, then commander of Greater Tehran Police, later gave an account that helps explain how the authority was handled in practice. Talaei said permission had been granted for police to enter the university dormitory area, but that Ghalibaf left the Tehran command room to judge whether entry was necessary. According to Talaei, police refrained from entering at a particularly sensitive moment despite having permission to do so.
The two accounts together suggest a command style more revealing than the familiar argument over whether Ghalibaf should be described as hard-line or pragmatic. He wanted coercive options formally available before a crisis escaped police control, but possession of that authority did not mean that its most violent form had to be used automatically. The decision could be adjusted according to the situation on the ground. What mattered was that the police retained the capacity and permission to escalate if command judged escalation necessary.
This approach also helps explain Ghalibaf’s later interest in controlled protest. During and after his police years, he spoke favourably about directing demonstrations into defined locations where they could be authorised, monitored and contained. Such arrangements can be defended as a mechanism for protecting the right to demonstrate, but they also make protest more administratively legible. A gathering whose location, boundaries and participants can be anticipated is easier for the state to supervise than mobilisation that develops unpredictably across a city.
The connection to Ghalibaf’s wider police reforms should be made carefully. Police 110, electronic service delivery and performance-monitoring systems were not programmes of political repression. They did, however, reflect the same institutional preference for centralised information, rapid reporting, defined responsibility and measurable response. Under Ghalibaf, administrative modernisation and coercive command were being developed within the same organisation.
His police years therefore provide the strongest evidence for the behavioural foundations of what would later become a much broader governing method. When Ghalibaf believed public order was threatened, he was prepared to seek extensive coercive authority. The account provided by Talaei shows that he did not necessarily equate effective command with immediate use of maximum force. The underlying concern was control over the decision itself: knowing what the institution could do, securing the necessary authority in advance and preserving the ability to calibrate implementation.
This period also matters for understanding the movement of personnel and expertise that followed him into civilian government. NAJA was the stage of his career in which personnel management, communications, information systems, public administration and coercive command all operated under his direct authority.
When Ghalibaf left the national police in 2005, that authority ended. He could no longer order deployments or control the police chain of command. The next phase of his career is important precisely because Tehran Municipality was not a police institution. What moved into City Hall was something less obvious: personnel, technical expertise and organisational habits developed inside institutions built around command, information and security. That transfer marks the beginning of the civilian phase of the story.
Chapter 3: When Security Logic Entered City Hall
Tehran Municipality as a Civilian Institution with Security Interfaces
When Mohammad Bagher Ghalibaf became mayor of Tehran in 2005, he moved into an institution that possessed none of the formal coercive authority he had exercised as national police commander. Tehran Municipality could not order police deployments, set rules of engagement, or command the IRGC and Basij. Its responsibilities were civilian: transport, construction, licensing, public space, municipal services and the administration of one of the largest cities in the region. The significance of Ghalibaf’s mayoralty lies precisely in what developed within those limits.
Over the next twelve years, personnel from his military and police career entered senior municipal positions, often in roles that drew directly on expertise they had acquired inside the security apparatus. At the same time, City Hall expanded information systems, protection structures, territorial coordination and crisis-management capacity while maintaining formal working relationships with police and Basij organisations. It never became a substitute security service. It did, however, become a civilian administration with increasingly sophisticated interfaces to institutions responsible for coercion and domestic control.
IranSTO’s investigation into the Mohammad Bagher Ghalibaf power network examined this personnel movement more broadly. For this article, the important question is not how many former commanders received municipal appointments, but whether their previous expertise remained relevant to the functions they later performed.
Naser Amani had worked under Ghalibaf in police human resources before moving into senior municipal administration, where his responsibilities included administrative, financial and planning functions. Jafar Tashakkori Hashemi, whose background included both the IRGC and police, became deputy mayor for transport and traffic and remained in that sector for roughly a decade. Transport was one of the areas in which municipal administration and policing necessarily intersected: roads, traffic management, control systems and a growing camera network required permanent cooperation between City Hall and traffic police.
Ali-Asghar Ghaemi provides an even clearer example of technical continuity. His earlier career included work in IRGC computing and leadership of the police information and communications centre, where he was associated with the development of Police 110. Under Ghalibaf, he entered senior positions across Tehran’s municipal technology infrastructure, including bodies responsible for computing, traffic control and the municipality’s Information and Communications Technology Organisation. The institution had changed, but the value of his expertise had not. Experience built around communications and centralised information was redirected from a national police organisation into the technical administration of the capital.
Mostafa Ajorlou followed a less direct route. An IRGC officer who later entered the police system under Ghalibaf, he had managed PAS, the police-affiliated football club. After Ghalibaf became mayor, Ajorlou entered Tehran Municipality’s reorganised sports administration and headed its sports organisation. Municipal sport was not a security function, and his appointment should not be treated as evidence that it became one. Its relevance is more limited: it shows how officials developed inside the IRGC and police environment could be repurposed as civilian executives within Ghalibaf’s administration.
Isa Sharifi occupied a far more consequential position. The former IRGC officer became Ghalibaf’s most powerful deputy and remained close to the centre of the municipal administration for most of the mayoralty. His authority extended across executive coordination and Tehran’s districts, and he effectively managed City Hall during periods when Ghalibaf was occupied with presidential campaigns. Sharifi’s later financial prosecution belongs to another investigation. Here, his importance is structural. A former IRGC officer sat at the centre of one of the country’s most powerful civilian administrations for more than a decade.
These appointments do not establish a concealed IRGC command inside Tehran Municipality, and no public evidence reviewed here shows that former military or police officials remained operationally subordinate to their previous organisations after entering City Hall. What the record does show is a repeated willingness to transfer security-state personnel into civilian government and, in several important cases, to place them in positions where their existing managerial or technical expertise remained useful.
The same pattern appeared in the municipality’s development of information capacity. In 2016, while defending his administration during the controversy over municipal property transfers, Ghalibaf described an internal reporting mechanism he called a shabakeh-ye oyoun, a “network of eyes”. According to his own account, the system supplied him directly with information about municipal managers and conditions across Tehran’s neighbourhoods. The public record does not identify who belonged to this network, how information was collected or whether the system performed anything resembling an intelligence function. There is no basis for describing it as a clandestine security service.
Its significance is more limited and more defensible. Ghalibaf had created or maintained an additional reporting channel that could bypass ordinary administrative hierarchy and deliver information directly to the mayor. In an administration already investing heavily in electronic services, urban databases, traffic-control systems and digital management, the arrangement fitted his wider preference for centralised information and rapid supervisory access.
The expansion of municipal camera and data infrastructure requires the same caution. Traffic cameras, geographic information systems and municipal databases have obvious civilian purposes. Their existence does not make them instruments of political repression. They nevertheless increased the municipality’s ability to observe movement, administer public space and integrate information across Tehran. Some of those systems operated precisely where municipal management and policing overlapped, especially in traffic control and the regulation of public space.
Other institutional developments had a more explicit enforcement dimension. During Ghalibaf’s mayoralty, Tehran established a municipal protection unit, Yegan-e Hefazat, within the national framework governing protection units in executive institutions. The force began operating in 2011 and was later formalised following approval by the Armed Forces General Staff. Its stated responsibilities included protecting municipal property and facilities, maintaining order within areas under municipal authority and cooperating with law enforcement. Contemporary accounts of its mandate also referred to the implementation of police programmes concerning “moral security” and social discipline.
Ghalibaf did not create the national protection-unit system, and the existence of a municipal protective force cannot itself be treated as evidence of political repression. What changed was the institutional capacity available to City Hall. The municipality now possessed a uniformed protection structure with preventive and enforcement functions and a formal basis for cooperation with NAJA.
Ideological regulation was also embedded elsewhere in municipal administration. In 2010, Tehran’s social and cultural administration reported the creation of 157 councils for amr be ma’ruf va nahi az monkar across municipal institutions and affiliated bodies. Their stated activities included monitoring employee conduct and enforcing compulsory-hijab requirements, and officials described the programme as systematic and intended to become institutionalised. These councils were not morality-police patrols. They show, however, that behavioural and ideological regulation had become an organised function within the municipality itself rather than something entirely external to City Hall.
Basij structures created another point of contact. The Basij operated within the municipality while the territorial organisation of the Greater Tehran Basij increasingly mirrored the city’s twenty-two municipal districts. The two systems remained legally and operationally separate. Municipal districts answered to City Hall; Basij districts belonged to the IRGC and Basij hierarchy. Yet both were organising the same city through broadly comparable territorial units, increasing the number of practical interfaces through which civilian administration and security organisations could coordinate when required.
Crisis management brought these elements together most clearly. Tehran’s municipal structures linked urban services, emergency infrastructure, local facilities, information systems and cooperation with police and other public bodies during major incidents. Their primary purpose was civilian, particularly earthquakes, disasters and other emergencies. Their relevance here lies in the form of administration they created: institutions could preserve separate legal chains of command while sharing information, resources and coordination mechanisms during a crisis.
The movement of Azizollah Rajabzadeh after the 2009 uprising makes that institutional portability unusually visible. Rajabzadeh had commanded Greater Tehran Police during the crackdown. Soon afterwards, he entered Ghalibaf’s administration as head of Tehran’s crisis-management organisation. Ghalibaf reportedly justified the appointment by citing Rajabzadeh’s knowledge of the capital and his experience managing crises. The transfer did not turn municipal crisis management into a police structure. It did show how recent experience commanding the capital’s police during a major political-security emergency could be translated almost immediately into civilian managerial value.
By the end of Ghalibaf’s mayoralty, Tehran Municipality remained legally separate from the police and IRGC, but the administration had accumulated a distinctive combination of personnel and capabilities. Police and IRGC veterans occupied senior executive positions. Communications and information expertise migrated into municipal technology. Police experience entered transport and crisis management. City Hall developed its own protection force, extensive reporting and data systems, organised mechanisms for ideological regulation and multiple points of cooperation with security institutions operating across the same urban territory.
Much of this infrastructure had legitimate civilian purposes. That is not incidental to the argument. The importance of Tehran Municipality under Ghalibaf lies in the coexistence of ordinary metropolitan administration with capacities that could also become useful during a political-security crisis.
In 2009, that possibility ceased to be theoretical. Ghalibaf no longer commanded Tehran’s police, yet he would later claim that Tharallah Headquarters had evaluated the municipality he controlled alongside the main security institutions responding to the post-election uprising. The issue is therefore not whether City Hall had become a security organisation, but what a civilian institution with these personnel, systems and interfaces actually contributed when the regime confronted mass unrest across Tehran.
Chapter 4: 2009: The Municipality Inside the Security Response
Responsibility Without Police Command
The post-election uprising of 2009 placed Tehran at the centre of the most serious domestic political crisis the Islamic regime had faced in decades. Mohammad Bagher Ghalibaf had been mayor for almost four years. He no longer commanded the national police, held no command position in the IRGC, did not lead Tharallah Headquarters and was not Interior Minister. The forces suppressing the uprising did not answer to him through the chain of command he had once controlled at NAJA. Any assessment of his role has to begin there.
Greater Tehran Police was commanded by Azizollah Rajabzadeh. The IRGC and Basij operated through their own security hierarchies, while Tharallah Headquarters held a central role in the regime’s response across the capital. Kahrizak detention centre belonged to the Greater Tehran Police structure, not Tehran Municipality. The military prosecutor’s indictment later identified Rajabzadeh as the relevant police commander and treated the detention facility as falling within the inspection structure of his command. Nothing reviewed for this investigation establishes that Ghalibaf ordered detainees sent to Kahrizak, controlled the facility or directed the abuses committed there.
That does not remove Tehran Municipality from the history of the crackdown. Ghalibaf’s own later account suggests that the civilian institution he controlled was involved in the wider response to the crisis in ways that have never been fully documented.
In remarks that became public during the 2013 presidential election, Ghalibaf defended his record in 2009 by referring to an assessment attributed to Tharallah Headquarters. According to reproductions of his comments, Tehran Municipality had been evaluated alongside the security and law-enforcement institutions responding to the unrest and had ranked third, behind the Basij and IRGC. Other versions of the same remarks quote him describing City Hall as having performed “at the level” of security bodies.
The importance of the claim comes partly from its source. This was not an accusation made by an opponent attempting to associate Ghalibaf with repression. He invoked the comparison himself, before a conservative audience, as evidence of competence and loyalty during the crisis. An institution responsible for governing the capital had apparently performed some function significant enough for Ghalibaf to boast that Tharallah Headquarters had measured it against organisations whose central responsibilities included domestic coercion.
The unresolved question is what that performance actually consisted of. Tehran Municipality had no arrest powers and did not command riot police, but by 2009 it controlled a large territorial and administrative system encompassing twenty-two districts, the Metro and other public transport, roads, municipal facilities, public-space management, urban services, crisis-response infrastructure and growing information capacity. Former police and IRGC personnel already occupied senior positions across the administration, while municipal structures worked with law enforcement and Basij organisations in several areas. None of these capacities demonstrates participation in repression on its own. Together, they meant that City Hall possessed resources that could become relevant when the regime confronted a political crisis across the capital.
Ghalibaf also portrayed his personal involvement as extending beyond routine municipal administration. In the same body of leaked remarks, he said that he and Qassem Soleimani had undertaken extensive behind-the-scenes activity during the first days after the disputed presidential election. He described their role in terms translated or transcribed as lobbying intended to prevent the crisis from escalating. He did not identify whom they contacted, which decisions they tried to influence or under what formal authority they acted.
His account cannot support a claim that either man directed security forces in the streets. It does, however, place Ghalibaf inside the regime’s political management of the crisis by his own telling. He did not describe himself as a mayor watching events from outside the security response. He described working with one of the country’s most powerful IRGC commanders while Tehran was becoming the principal arena of the crackdown.
In 2009, the public record therefore supports political-security involvement around the crisis without establishing that Ghalibaf exercised operational command over the forces suppressing it. His influence during this period appears to have depended partly on relationships and institutional access that survived changes in formal office.
What happened to Azizollah Rajabzadeh afterwards provides a more tangible institutional bridge. Rajabzadeh had commanded Greater Tehran Police throughout the post-election crisis and therefore sat inside the coercive chain from which Ghalibaf was formally absent. In February 2010, only months after the most intense phase of the repression, Ghalibaf appointed him to head Tehran’s Organisation for Disaster Mitigation and Management. Ghalibaf reportedly explained that he had asked the national police commander to release Rajabzadeh for municipal service because of his knowledge of Tehran and his experience managing crises.
There is no evidence that the appointment was a reward for Rajabzadeh’s role in the crackdown. Its significance is institutional. A police commander whose most recent experience included managing the capital during an extraordinary political-security emergency moved directly into the civilian organisation responsible for crisis management across the same city. Recent security experience had been translated into municipal managerial value.
City Hall did not need to absorb the police or IRGC for that experience to become useful. It already controlled transport systems, municipal facilities, district administrations, logistical resources, emergency infrastructure and extensive knowledge of Tehran. In a city where demonstrations could move rapidly between neighbourhoods, universities, squares and transport hubs, those capabilities had obvious relevance to crisis management even when the legal authority to arrest or use force remained elsewhere.
The public record still does not reveal which of those municipal capacities were activated during the uprising. There is no documented basis at present for claiming that City Hall supplied vehicles, facilities, transport data, communications assistance or other logistical support to police, Basij or IRGC units. Nor has evidence emerged showing that Ghalibaf issued municipal instructions intended to facilitate arrests or violence against protesters. The principal gap is the document Ghalibaf himself cited.
The Missing Assessment
According to Ghalibaf, Tharallah Headquarters evaluated Tehran Municipality’s performance during the 2009 crisis and placed it immediately behind the Basij and IRGC. No copy of that assessment has been located in the material reviewed by IranSTO.
Without it, the ranking cannot be reconstructed. We do not know which municipal departments were assessed, what criteria Tharallah used, which period of the uprising the evaluation covered or what forms of performance were being measured. The comparison may have concerned logistics, continuity of urban services, transport, information flows, coordination with security organisations, crisis management, restoration of public spaces or some combination of these functions. The surviving public record does not allow a reliable conclusion.
The absence of the assessment does not erase the municipal role Ghalibaf claimed. It sets the limit of what can presently be established. He did not command the forces carrying out the crackdown, and no evidence reviewed here links him personally to Kahrizak or to operational orders directing violence in the streets. Yet his own account places him in behind-the-scenes political activity with Qassem Soleimani and places Tehran Municipality inside a Tharallah evaluation that he cited as evidence of its performance during the crisis. Within months, the commander of Greater Tehran Police during that same uprising was transferred into Ghalibaf’s municipal crisis-management structure.
By 2009, direct police command was no longer necessary for an institution controlled by Ghalibaf to become relevant to the management of domestic political crisis. He claimed that Tehran Municipality had mattered enough to be ranked alongside the regime’s principal security organisations.
The missing Tharallah assessment is the document that could show why.
Chapter 5: After Command
2017–2019 and the Limits of Responsibility
By the time nationwide protests returned in December 2017, Mohammad Bagher Ghalibaf had lost even the civilian executive authority he had exercised as mayor of Tehran. He left City Hall that summer and was appointed by Ali Khamenei to the Expediency Council in August. The appointment kept him inside the senior political establishment, but it did not return him to the institutions responsible for operational domestic security. Responsibility during this period therefore cannot be assessed through the command authority Ghalibaf had exercised earlier in his career.
The protests that began in late December 2017 were driven initially by economic hardship and soon developed into a wider challenge to the political order. Ghalibaf acknowledged much of the anger behind them. He spoke about accumulated economic and social problems, corruption, rent-seeking and discrimination as sources of public dissatisfaction. At the same time, he argued that legitimate protest had been exploited by enemies of the Islamic regime and redirected towards disorder and insecurity.
The framework was familiar. Grievances could be real, and the state could even be responsible for producing them, but once mobilisation was classified as a security problem, the immediate priority became restoration of order. Reform, accountability and economic correction could follow afterwards. Ghalibaf was not publicly demanding indiscriminate violence. He was drawing a political boundary between protest the state could recognise and mobilisation it could legitimately suppress.
He continued to use similar language as labour, economic and political protests recurred through 2018. What does not appear in the available record is evidence that he was involved in directing the security response. IranSTO has found no credible basis for placing Ghalibaf inside a command structure responsible for arrests, police deployments, crowd-control operations or the use of force during these protest waves. His continuing relationships with police and IRGC figures did not preserve the authority he had once exercised as national police commander.
That limitation becomes particularly important in November 2019. The sudden increase in petrol prices on 15 November triggered protests across the country. Within days, security forces were using lethal force against demonstrators while the regime imposed an almost complete shutdown of access to the global internet. The institutions carrying out that repression were not under Ghalibaf’s command. He did not lead NAJA, the IRGC or Tharallah Headquarters, was not Interior Minister, and was not a member of the Supreme National Security Council when the national response and communications restrictions were decided.
There is therefore no evidentiary basis for attributing the November 2019 internet shutdown, nationwide live-fire decisions or operational management of the crackdown to Ghalibaf. His previous police command, municipal networks and later political prominence cannot substitute for evidence showing that he possessed authority he did not in fact hold at the time.
His response to the uprising is relevant for a different reason. Ghalibaf did not primarily attack the coercive response itself. His criticism focused on how the Rouhani government had created and managed the crisis. He accused officials of failing to understand even the “alphabet of security”, arguing that the petrol-price decision had been introduced without adequate explanation and that the political consequences had been badly handled. His parliamentary campaign declaration later that year made a similar case, presenting the episode as evidence of weak management and an executive system incapable of anticipating the security consequences of its own decisions.
This was a managerial critique of the state response rather than a rejection of coercion as a legitimate tool once unrest became a security confrontation. For Ghalibaf, the principal failure lay upstream: poor decision-making had generated avoidable instability, after which, in his account, the state was forced into a crisis that should have been managed more competently.
That position is revealing precisely because his operational responsibility from 2017 to 2019 was so limited. Ghalibaf cannot credibly be assigned responsibility for these crackdowns based on reputation, former office or continuing relationships inside the security establishment. What survived was a way of interpreting domestic unrest. Social and economic grievances could be acknowledged, but when political mobilisation crossed the boundary into what he classified as insecurity, the restoration of control took precedence.
By 2019, Ghalibaf had been outside the police chain of command for fourteen years. The institutional power to direct repression had moved elsewhere. The security framework through which he understood political crisis had not.
Chapter 6: Woman, Life, Freedom
Return to the National Security Decision Layer
The killing of Jina Mahsa Amini in September 2022 confronted Mohammad Bagher Ghalibaf with a domestic crisis from a position he had not occupied during the protest waves of 2017 to 2019. He was now Speaker of Parliament and, under Article 176 of the constitution, a permanent member of the Supreme National Security Council. More than seventeen years after leaving national police command, he had returned to the senior institutional layer where political, intelligence and security policy could be coordinated.
He still did not command the police, Basij or IRGC units confronting protesters, and SNSC membership alone does not reveal how any individual member voted on a particular decision. But his institutional position had changed substantially. In November 2019, Ghalibaf had stood outside the national-security decision structure. In 2022, he was inside it, while also presiding over the legislature that became one of the principal forums through which the uprising was investigated, classified and publicly interpreted.
The Parliamentary Inquiry
Jina Mahsa Amini was killed by the morality police on 16 September 2022 after being detained for allegedly violating compulsory hijab rules. That same day, Ghalibaf instructed Parliament’s Internal Affairs and Councils Commission to investigate both the circumstances of her death and the procedures used by FARAJA’s morality-security patrols. His initial response left open the possibility of institutional wrongdoing. He said negligence or misconduct should be pursued if established and indicated that morality-police procedures themselves required review.
The parliamentary process eventually produced a conclusion close to the regime’s official account. When the findings were presented in October, the committee reported that Amini had not been physically assaulted during her arrest, transfer or detention and that her death had not resulted from a blow or other physical violence. It identified shortcomings in emergency assistance and recommended procedural changes, but rejected the allegation that violence in custody had caused her death.
There is no evidence that Ghalibaf dictated the committee’s medical findings. His role was institutional: he ordered the inquiry as Speaker, and the parliament he led subsequently became part of the official machinery rejecting physical violence against Amini.
The United Nations Independent International Fact-Finding Mission later reached the opposite conclusion. After examining medical material, official records, audiovisual evidence and witness testimony, the Mission concluded that Amini had been subjected to physical violence while in state custody and that the violence led to her unlawful death. The parliamentary inquiry initiated under Ghalibaf’s speakership had supported the regime’s exculpatory version of events; the later international investigation found the state responsible for her unlawful death.
From Protest to Security Threat
As demonstrations spread across the country, Ghalibaf increasingly separated protest he regarded as legitimate from mobilisation he classified as a threat to the political order. He described some forms of protest as useful or necessary for improving governance and pointed to earlier demonstrations by teachers and pensioners as examples of demands that could be recognised. The limits were clear. Protest lost that status once it became associated, in his account, with violence, regime change, separatism or foreign enemies.
During Woman, Life, Freedom, that classification became central to his political response. Ghalibaf argued that security had to be restored before grievances could be addressed. By early November, he was describing the confrontation as a hybrid war and calling for what he termed intelligent or smart authority. Economic and social discontent could still be acknowledged, but parts of the uprising were moved into a security category where coercive action could be presented as defence of the state.
Zahedan showed the consequences of that broader securitisation with particular brutality. On 30 September, security forces opened fire during what became known as Bloody Friday. The UN Fact-Finding Mission later concluded that more than one hundred people were killed in Sistan and Baluchestan, the highest single-day death toll it documented during the uprising.
Nothing reviewed by IranSTO establishes that Ghalibaf ordered the shootings. His public framing is relevant for a different reason. He warned repeatedly of foreign efforts to fragment Iran and described separatist and foreign-linked groups as operating within the unrest. Political mobilisation associated with those categories was no longer being discussed primarily as protest. It had been placed inside the regime’s national-security narrative.
The Firearms Claim
On 6 November, Ghalibaf went beyond political interpretation and made a specific factual claim about the conduct of security forces. Speaking in Parliament, he accused the CIA, Mossad and other foreign actors of attempting to turn protest into unrest and unrest into what he described as a new form of ISIS. He then said that forces maintaining order were using specialised anti-riot equipment and were not using firearms because they wished to avoid harming the public.
The available evidence contradicted that claim. Firearm use by state forces had already been reported, and later investigations documented it extensively. The UN Fact-Finding Mission established that security forces fired on protesters and bystanders, including at short range, causing deaths and serious injuries. Iranian MPs from affected regions had also publicly referred to live ammunition, including in Sistan and Baluchestan.
Ghalibaf had therefore made a falsifiable statement about state conduct while protesters and bystanders were being shot. The available material cannot establish whether he knowingly repeated information he understood to be false, but that is a separate question from whether the statement itself was accurate. It was not.
His position makes the episode more consequential. Ghalibaf was no longer a former commander commenting on events from outside the national-security system. He was Speaker of Parliament and a permanent SNSC member, publicly defending the conduct of security forces with a claim contradicted by evidence from the uprising itself.
Parliament and Punishment
The same parliamentary session also produced one of the most widely misreported episodes of the uprising.
A statement supported by 227 MPs called on the judiciary to deal rapidly and severely with people it classified as moharebs, a term in the Islamic regime’s criminal law associated with moharebeh, or “waging war against God”, an offence that can carry the death penalty. The statement demanded exemplary treatment, application of the relevant religious ruling and qisas, the Islamic-law principle of retributive punishment that can include execution in cases of intentional killing. It was read in Parliament after Ghalibaf’s speech portraying violent elements of the uprising as comparable with ISIS.
International reporting and social media subsequently transformed the statement into a supposed parliamentary vote demanding the execution of approximately 15,000 detained protesters. That did not happen. Parliament did not vote to execute 15,000 people, and the statement itself did not demand the execution of every detainee. The number came from estimates then circulating about how many people had been arrested.
Correcting that false version should not sanitise what Parliament actually said. The 227 MPs demanded severe and exemplary punishment for an undefined category of alleged moharebs during a nationwide uprising and explicitly invoked legal concepts capable of producing death sentences.
Ghalibaf’s individual relationship to the statement is less certain. The names of the 227 authentic signatories were not officially published, while a later document circulated as a list of signatures was not genuine. IranSTO therefore cannot establish from the available record that Ghalibaf personally signed it.
His political proximity to the statement is much easier to document. His speech immediately before it was read used similar security language, portraying parts of the uprising as foreign-directed and terrorist in character. When international controversy developed, Ghalibaf correctly rejected the claim that Parliament had demanded 15,000 executions. He then presented the original statement more narrowly, arguing that its references to severe punishment and qisas concerned violent offenders responsible for killing others.
The first correction was factual. The second interpretation was more selective. The parliamentary text did not demand execution for every detainee, but neither was it simply a neutral request to prosecute identified murderers. It demanded exemplary punishment for a politically defined and unspecified category of alleged moharebs while mass arrests were taking place across the country.
Internet Control
Communications restrictions provide the clearest institutional contrast with November 2019. Instagram and WhatsApp were restricted as the uprising expanded, and regime officials repeatedly justified limitations on communications through national-security arguments. The Communications Ministry denied that it alone controlled the decision, while officials acknowledged the role of security institutions in determining whether restrictions would continue.
Ghalibaf was no longer peripheral to that process. Communications Minister Issa Zarepour later stated that the decision concerning restrictions on major platforms had been taken through the Secretariat of the Supreme National Security Council in a meeting attended by the heads of the three branches, including Ghalibaf. His presence inside the senior decision layer is therefore documented, even though the public record does not establish how he personally voted. IranSTO’s investigation into the Supreme National Security Council examines why attendance, institutional authority and individual responsibility for a specific decision have to be assessed separately.
A more direct allegation surfaced during the 2024 presidential campaign. Former communications minister Mohammad-Javad Azari Jahromi said that Ghalibaf and Saeed Jalili had voted in favour of the 2022 filtering decision. Jahromi had served at the highest levels of the communications system, making the allegation relevant, but no published SNSC minutes or voting record independently confirms Ghalibaf’s vote. It should remain an attributed claim unless further documentation emerges.
By the end of 2022, Ghalibaf’s relationship to domestic repression was therefore markedly different from the period examined in the previous chapter. He did not command the forces firing in the streets, and no evidence reviewed here shows him selecting targets, directing arrests or issuing shooting orders. His role had moved upward into political classification, parliamentary legitimation and participation in the senior national-security decision system.
As Speaker, he initiated an inquiry that ultimately supported the regime’s denial that violence caused Amini’s death. He reproduced the security framing used against the uprising and made a false factual claim about the use of firearms. Parliament under his speakership became the platform for a statement demanding severe punishment of alleged moharebs. As an SNSC member and head of one of the three branches of government, he was also present inside the structure involved in restricting the information environment.
Ghalibaf had returned to the national-security decision layer without returning to police command. The political catastrophe produced by the morality police did not lead him to question the state’s right to impose compulsory hijab. It led him instead to reconsider how that coercion could be organised with less confrontation and lower political cost.
Chapter 7: Redesigning Coercion
What Ghalibaf Learned from the Failure of the Morality Police
Woman, Life, Freedom exposed more than the brutality of compulsory hijab enforcement. It exposed the political weakness of a particular method. The morality police depended on direct encounters between state agents and women in public space. Those encounters could be filmed, resisted and circulated within minutes. The killing of Jina Mahsa Amini transformed one such encounter into the catalyst for a nationwide uprising and made the patrol model itself politically toxic.
Mohammad Bagher Ghalibaf did not respond by questioning the state’s right to impose compulsory hijab. In April 2023, he criticised the previous enforcement model as costly and ineffective while continuing to support deterrent measures against women he classified as deliberately defying the law. He distinguished those cases from women whose compliance he regarded as incomplete or inadequate. The state objective remained intact. What he questioned was the wisdom of forcing the police into repeated physical confrontations to achieve it.
He returned to the argument during the 2024 presidential campaign. Hijab, in his account, remained both a legal and social obligation, but responsibility for enforcing it had been placed too heavily on FARAJA. Ghalibaf argued that other state institutions had failed to carry their share of the burden, leaving the police to confront women directly in the streets and absorb the political consequences. He favoured spreading enforcement across more institutions and using methods that depended less often on a patrol van and a physical arrest.
The legislation developed after the uprising moved in that direction. Parliament used Article 85 of the constitution to send detailed consideration of the Hijab and Chastity legislation into a specialised parliamentary process rather than debating every provision openly on the floor. Ghalibaf defended the procedure and later supported the legislation that emerged from it. The resulting system expanded enforcement across numerous institutions and relied heavily on identification, fines, restrictions on businesses and other administrative penalties alongside criminal sanctions.
That structure reduced the need for every violation to produce a face-to-face confrontation. Cameras and technical systems could assist identification. Notices and fines could be generated administratively. Vehicles and businesses could become pressure points. Repeated non-compliance could produce escalating consequences without requiring a morality-police patrol to arrest in public. Coercion was being distributed through databases, service systems, commercial regulation and ordinary state administration.
None of this amounted to liberalisation. The legislation approved by regime institutions remained exceptionally punitive. Amnesty International documented provisions involving heavy fines, imprisonment, flogging, restrictions on employment and education, travel bans and, under specified circumstances, potential exposure to the death penalty. A system capable of imposing those penalties cannot reasonably be described as a retreat from compulsory control simply because some routine enforcement was moved away from police vans.
Ghalibaf nevertheless emphasised those less confrontational elements when defending the law. He highlighted warnings, financial penalties and the removal of morality-police vans from ordinary enforcement. The patrol model had become associated with Amini’s killing and the uprising that followed. Moving routine coercion into administrative channels reduced the number of visible encounters capable of generating the same kind of confrontation.
There is much less evidence that Ghalibaf personally opposed the law’s harsher provisions. Political portrayals of him as a moderating force inside the process go further than the available record supports. He publicly promoted fines, warnings and reduced reliance on direct street enforcement, but the legislation he supported retained severe punitive mechanisms. The narrower conclusion is more defensible: Ghalibaf favoured reducing forms of enforcement that imposed high political costs while preserving both compulsory hijab and the state’s capacity to punish serious or repeated non-compliance.
The later dispute over promulgation shows how closely enforcement had become connected to calculations of political risk. By late 2024, the legislation was sufficiently contentious that implementation was delayed. Ghalibaf subsequently disclosed that the Secretariat of the Supreme National Security Council had sent Parliament a written instruction not to promulgate the law for the time being. He did not present the law itself as illegitimate or argue that compulsory enforcement should end. The timing had become the issue.
The episode offers a concrete example of how security policy can be adjusted while the coercive framework itself remains intact. Implementation could be postponed because senior officials judged the political environment unsuitable without abandoning the instrument or the objective behind it.
Ghalibaf’s later criticism of internet filtering followed a similar logic. He complained about the economic and social costs created by prolonged restrictions and widespread VPN dependence after the 2022 uprising. He did not argue that emergency restrictions imposed during the crisis had been illegitimate from the outset. His position was that a measure he considered defensible under exceptional security conditions had become counterproductive once those conditions changed.
Taken together, these episodes show a consistent concern with the cost and effectiveness of coercion rather than a principled objection to coercion itself. A measure can be justified while it helps restore control and criticised later when its economic, social or political costs begin to outweigh its security value. Removing or suspending an instrument under those conditions need not represent a concession on the underlying objective. It can simply mean that another method has become more useful.
At this point in Ghalibaf’s record, calibrated coercion becomes more than a description of police tactics. During his national police command, he sought broad authority while leaving room to decide how far that authority needed to be used. In Tehran Municipality, centralised information, protection structures and inter-institutional coordination allowed administrative systems to operate alongside coercive bodies without becoming police institutions themselves. After Woman, Life, Freedom, the same preference appeared at the national level: retain the state’s ability to compel while shifting routine enforcement towards methods that generate less immediate political friction where possible.
Administrative coercion also has an advantage that street violence does not. It can become ordinary. An arrest by morality police is visibly coercive. A database match, automated warning, financial penalty, vehicle restriction or pressure on a business can look like routine bureaucracy even when each is being used to force compliance with a political or ideological rule. The coercive function does not disappear. It becomes embedded in systems that citizens encounter as part of everyday administration.
For Ghalibaf, the failure of the morality-police model therefore produced a lesson about machinery rather than objective. The regime’s claim over women’s clothing survived. What needed redesign was the method through which that claim could be enforced without repeatedly creating the kind of public confrontation that had helped ignite the 2022 uprising.
There was, however, a limit to what administrative enforcement could achieve. Fines, surveillance, filtering and dispersed bureaucratic pressure remain useful only while the regime believes political mobilisation can still be contained through them. When that assessment changes, the logic of calibration can move in the opposite direction.
January 2026 would expose that limit. Faced with a nationwide uprising that the Islamic regime came to treat as an existential security threat, the state moved from administrative and controlled forms of coercion to mass lethal force. By then, Ghalibaf was no longer debating only the cost of morality patrols, fines or filtering. He was sitting inside the senior national-security structure surrounding the decision to send armed coercive institutions into the streets.
Chapter 8: January 2026
Inside the Decision Layer of Mass Killing
By January 2026, Mohammad Bagher Ghalibaf occupied a position unlike the one he had held during any protest cycle since leaving the national police. He no longer commanded FARAJA, the IRGC or Tehran’s operational security structures. He was Speaker of Parliament and a permanent constitutional member of the Supreme National Security Council, with more than two decades of experience spanning military command, national policing, municipal administration and national politics. When the regime’s response to nationwide protests escalated into mass lethal repression, Ghalibaf stood outside the field command but inside the senior political-security structure surrounding the crisis.
January 2026 presents the most serious accountability question of his post-police career. He knew that a major security crisis was developing, held a permanent seat on the body later identified by a senior regime figure as responsible for authorising armed intervention, and publicly defended the institutions that restored control after the killings. Separate multi-source reporting has alleged that Ghalibaf and the other heads of the three branches knew of and approved the lethal response. The internal record needed to determine his individual role has never been released: minutes of the relevant SNSC deliberations, attendance records for the decisive session, any formal vote or written approval, rules of engagement and internal communications surrounding the escalation all remain hidden.
His accountability in January 2026 therefore begins with his documented position inside the decision architecture and develops through what was known before the escalation, what is publicly known about the SNSC’s role, and what he chose to defend afterwards. It does not depend on attributing to him an operational order that has not surfaced.
Before the Escalation
The protests began on 28 December 2025 amid severe economic pressure, the collapse of the rial and widening public anger. During the first days, Ghalibaf used the same political division that had appeared in previous crises. Economic grievances could be acknowledged as legitimate, while other actors were accused of attempting to redirect those grievances towards violence and disorder on behalf of foreign intelligence services.
By 5 January, his language had become markedly more security-driven. Ghalibaf argued that legitimate economic protest had to be separated from people he described as connected directly or indirectly to hostile foreign services and seeking to push the country towards chaos. The classification was familiar from 2017, 2022 and earlier episodes of unrest. Once mobilisation was moved from the category of grievance into foreign-directed subversion or a threat to the political order, coercive intervention could be presented as a security necessity.
Lethal violence had already begun before the principal escalation of 8 and 9 January. Amnesty International and Human Rights Watch documented unlawful firearm use by IRGC and FARAJA forces and at least twenty-eight deaths across eight provinces between 31 December and 3 January. The later mass killing was therefore not the first moment at which the regime’s response became violent. Security forces were already shooting protesters and bystanders as the national political-security system confronted the expanding uprising.
On 7 January, one day before the principal escalation, Ghalibaf chaired a closed parliamentary session in Tehran. The meeting included economic briefings, but MPs were also addressed by FARAJA commander Ahmad-Reza Radan and a deputy intelligence minister on the latest security and field situation. Because the session was closed, the substance of those briefings has not been released.
Ghalibaf was therefore receiving senior police and intelligence reporting immediately before the worst phase of the repression. He was not learning about the crisis retrospectively through public reports. He chaired the parliamentary meeting at which the country’s police commander and a senior intelligence official briefed MPs while the security situation was rapidly deteriorating. Nothing in the available record shows that Radan or the intelligence official told Ghalibaf that protesters were about to be killed on the scale that followed. The 7 January meeting establishes contemporary knowledge of an escalating domestic-security emergency, not advance knowledge of the magnitude of the killing that began the following evening.
Inside the SNSC Decision Layer
From the evening of 8 January, the scale of repression changed dramatically. Security forces used firearms against protesters and bystanders across multiple cities while communications restrictions obstructed documentation and the movement of information. IranSTO has examined the scale of the killings and the institutions involved in its investigation into the January 2026 mass killings. The narrower issue here is Ghalibaf’s position inside the authority structure surrounding that escalation.
Unlike in November 2019, his membership of the Supreme National Security Council is undisputed. As Speaker of Parliament, Ghalibaf held a permanent constitutional seat on the body responsible for major national-security policy and for coordinating political, intelligence, military and other institutions involved in its implementation. IranSTO’s dossier on the Supreme National Security Council explains why membership alone cannot establish an individual member’s approval of a particular decision. January 2026 is more consequential because public evidence places the Council itself inside the decision to escalate armed intervention.
On 3 February, MP and former IRGC general Esmail Kousari publicly described a change in the rules governing the forces confronting protesters. According to Kousari, FARAJA had initially entered the confrontation without firearms, after which the Supreme National Security Council decided that the police, Basij and IRGC should operate armed.
Kousari’s account does not disclose the language of the decision, identify everyone present or show whether the authorisation amounted to a general permission to carry weapons, a broader authorisation to use them, or an unrestricted order to fire. Its significance is nevertheless considerable. A senior regime figure publicly attributed the decision that the principal coercive institutions should operate armed to the SNSC, a body on which Ghalibaf held a permanent seat.
Reporting during the crisis went further. Iran International, citing sources close to the SNSC, the presidential office and the IRGC, reported that the lethal response proceeded with the explicit knowledge and approval of President Masoud Pezeshkian, Judiciary Chief Gholam-Hossein Mohseni-Ejei and Ghalibaf, alongside an order attributed ultimately to Ali Khamenei. The same reporting alleged an SNSC decision permitting live fire.
Those allegations belong in an accountability investigation because they concern the individual role of one of the three branch heads during a mass-killing operation. They have not, however, been independently proven through released state records. No authenticated SNSC minutes reviewed by IranSTO show Ghalibaf personally approving the measure. No public voting record identifies his position, and no written authorisation carrying his signature has surfaced. The allegation remains serious, sourced and unresolved.
Coordination and Operational Command
The documented role of Ali Larijani helps locate Ghalibaf more precisely within the institutional hierarchy. On 15 January, the United States Treasury identified Larijani, in his capacity as secretary of the Supreme National Security Council, as responsible for coordinating the response to the protests on behalf of the Supreme Leader. Treasury also stated that Larijani had publicly called for security forces to use force against peaceful protesters.
That finding places high-level coordination inside the SNSC Secretariat. Operational command still ran through the coercive institutions themselves. FARAJA units operated through the police hierarchy. The Basij remained within the IRGC-Basij structure. IRGC formations retained their own commanders, while Tehran’s security architecture continued to involve Tharallah Headquarters and Greater Tehran IRGC structures.
No evidence reviewed for this investigation places Ghalibaf inside those field chains. There is no basis at present for claiming that he selected units, chose targets, instructed commanders tactically or personally determined when individual forces should fire. His position was politically higher and functionally different. He sat within the senior layer where the crisis could be classified, national policy authorised, institutions mobilised and the overall coercive response politically approved.
For any future assessment of individual criminal responsibility, the hidden SNSC record is critical. The relevant documents could establish what proposal was presented, who attended the decisive deliberations, what level of armed force was authorised and what position Ghalibaf personally took. Until that material emerges, his documented institutional participation and any individual authorisation attributed to him cannot be treated as the same finding.
After the Killing
Ghalibaf’s conduct after the principal escalation is considerably clearer. On 12 January, he framed the uprising as a continuation of the previous conflict with Israel and the United States and portrayed its most violent participants as armed, ISIS-like terrorists. He then praised FARAJA, the Basij and the IRGC for entering the field and carrying out what he described as the mission of “pacification”. His account presented the security operation as the successful defeat of an externally directed terrorist campaign rather than a mass lethal state response requiring investigation.
He continued that defence as evidence of mass killing accumulated. On 24 January, Ghalibaf said the hands of Basij, IRGC and FARAJA personnel who had confronted the uprising should be kissed and credited them with defeating the operation in less than forty-eight hours. By then, reports of deaths on a massive scale were already circulating, and the regime’s own public narrative had begun acknowledging that thousands of people had been killed.
The institutions Ghalibaf praised were the same institutions identified by human-rights organisations and international authorities as central participants in the lethal suppression. The political significance of his statements does not depend on proving that he knew the exact death toll when he made them. He knew that the regime had deployed its coercive apparatus against a nationwide uprising and chose to celebrate those forces after their intervention had produced mass casualties.
As official accounts evolved, Ghalibaf also acknowledged that the dead were not limited to security personnel or people the regime accused of organised armed violence. He recognised that protesters and innocent civilians had been killed while continuing to explain their deaths through the regime’s narrative of an externally engineered operation intended to create casualties and destabilise the country. Responsibility was displaced towards terrorists, foreign governments and armed rioters even as the scale of the state response became impossible to obscure.
Before the principal escalation, Ghalibaf chaired a closed meeting in which the national police commander and a senior intelligence official briefed Parliament on the worsening security situation. During the crisis, he remained a permanent SNSC member, and Kousari later identified that Council as the body responsible for the decision that FARAJA, the Basij and IRGC should operate armed. Separate reporting alleged that Ghalibaf and the other branch heads personally knew of and approved the lethal response, although the state records required to prove that allegation remain secret. Afterwards, Ghalibaf praised the institutions involved and continued defending their intervention as the death toll reached into the thousands.
The surviving evidence places Ghalibaf considerably closer to the January 2026 repression than he had been to the crackdowns of 2009 or 2019. He was inside the senior political-security structure surrounding the transition from nationwide unrest to armed state response, and after that response produced mass casualties, he publicly legitimised the institutions that carried it out.
What the evidence does not yet show is equally precise: no released record establishes that Mohammad Bagher Ghalibaf personally issued the order to kill.
Chapter 9: What the Record Proves
Responsibility, Accountability and the Remaining Gap
The record assembled across nearly three decades of Mohammad Bagher Ghalibaf’s career supports several different forms of involvement in domestic repression. They should not be collapsed into a single allegation. For this investigation, the categories below are analytical tools for separating command authority, institutional participation, political legitimation and potential individual liability. They are not, by themselves, findings of criminal responsibility under international law.
Direct Command Authority
The clearest period of direct coercive authority is Ghalibaf’s command of the national police between 2000 and 2005. He stood at the top of NAJA’s national hierarchy and possessed formal authority over the institution responsible for public order and domestic policing. His own later account of the 2003 student unrest shows him pressing for written permission to intervene at Tehran University, including authority broad enough to encompass live ammunition if circumstances required it.
The available evidence does not show that every coercive option he secured was ultimately used. Mortaza Talaei’s later account suggests that Tehran police retained room to refrain from entering the university even after permission had been obtained. That limitation matters, but it does not change Ghalibaf’s institutional position at the time. During these years, he was not merely endorsing decisions made elsewhere. He commanded the organisation expected to carry them out. Once he left NAJA, direct police command ceased to be the principal basis for assessing his role.
Institutional Participation
Tehran Municipality presents a different problem. Ghalibaf did not command the police, IRGC, Basij or Tharallah Headquarters during the 2009 post-election crackdown. Yet the civilian administration he controlled possessed extensive territorial, logistical, informational and crisis-management capacity, and Ghalibaf later claimed that Tharallah Headquarters had evaluated its performance during the crisis alongside the regime’s principal security institutions.
The missing Tharallah assessment prevents any reliable reconstruction of the municipality’s exact contribution. It remains unknown whether the evaluation concerned logistics, information, transport, urban services, coordination, crisis management or some combination of these functions. What is documented is Ghalibaf’s own decision to cite the comparison as evidence of City Hall’s performance.
His institutional position changed again after he became Speaker. Under Article 176 of the constitution, Ghalibaf became a permanent member of the Supreme National Security Council and entered the senior political-security structure in which national-security policy could be discussed and coordinated. Membership alone cannot establish an individual member’s approval of a specific measure, but it does place that individual inside the institution responsible for major national-security policy. By 2022, and far more seriously by January 2026, this institutional position had become central to the accountability question.
Political Legitimation
The most consistent feature of Ghalibaf’s post-police record is his political legitimation of coercion once unrest was classified as a security threat.
Across successive protest cycles, he acknowledged some grievances while drawing a boundary around mobilisation described as disorder, separatism, foreign interference, terrorism or an attack on the political order. Once protest crossed that boundary in his public language, coercive state action became easier to defend.
During Woman, Life, Freedom, Ghalibaf reproduced the regime’s security framing of the uprising and falsely stated that forces maintaining order were not using firearms. Parliament under his speakership became the platform for a statement by 227 MPs demanding severe punishment for alleged moharebs. After the January 2026 killings, his support became still more explicit. He praised FARAJA, the Basij and the IRGC for the “pacification” of the uprising and continued to defend the security response after mass casualties were already known.
Political endorsement does not establish tactical command. It remains an important part of the record because repression requires more than the forces that carry it out. It also requires senior officials willing to classify the target, justify the response and publicly defend the institutions involved.
Operational Responsibility
Operational responsibility has to be assessed period by period. In 2003, Ghalibaf commanded the national police. In 2009, the main operational chains ran through Greater Tehran Police, the IRGC, Basij and Tharallah Headquarters. In November 2019, he held no relevant domestic-security command and was not a member of the SNSC. By 2022 and January 2026, he had returned to the senior national-security decision system, while field command remained with other institutions.
No evidence reviewed for this investigation shows Ghalibaf selecting operational units, identifying targets, issuing tactical instructions or personally directing security forces to fire during the post-police crackdowns examined here.
January 2026 is harder to contain within those earlier boundaries. Esmail Kousari later attributed the decision that FARAJA, Basij and IRGC forces should operate armed to the SNSC. Separate multi-source reporting alleged that Ghalibaf and the other branch heads knew of and approved the lethal response. The unresolved issue is Ghalibaf’s personal position inside the decision that preceded the mass killing.
Criminal Responsibility
This investigation has not established that Ghalibaf bears individual criminal responsibility for crimes under international law.
The UN Independent International Fact-Finding Mission concluded that violations committed during the Woman, Life, Freedom repression included acts amounting to crimes against humanity and has preserved evidence for possible future proceedings. The existence of international crimes, however, does not automatically determine the liability of every senior official connected to the institutions involved. Individual responsibility requires evidence linking a particular person to the crimes through a recognised legal mode of liability.
As of September 2026, IranSTO has identified no verified foreign criminal indictment, international arrest warrant or public prosecution against Ghalibaf.
Canada has imposed personal sanctions on him under the Special Economic Measures (Iran) Regulations. In the regulatory record reviewed for this investigation, Ghalibaf is listed under Part 2 in connection with a grave breach of international peace and security rather than under the separate designation category dealing specifically with gross human-rights violations. The basis of that listing matters. A sanctions designation is an administrative measure and should not be presented as a criminal conviction.
Future exposure could change if stronger evidence emerges. Universal-jurisdiction proceedings and other forms of extraterritorial prosecution can depend on evidence that was unavailable when the underlying crimes occurred. The UN Fact-Finding Mission’s preservation work may contribute to such proceedings, but it does not create a case against Ghalibaf on its own. IranSTO has examined the broader institutional conditions protecting senior regime officials from accountability in its investigation into the architecture of impunity in Iran.
The Record Still Hidden
The most consequential unresolved evidence concerns January 2026. The internal SNSC record could establish who attended the decisive deliberations, what proposals were presented, what level of armed force was authorised, whether formal votes took place, how the heads of the three branches participated and what position Ghalibaf personally took. Rules of engagement, written directives, attendance records, minutes and internal communications could materially change the assessment of his individual role. Those records remain secret.
What can already be said is substantial. Ghalibaf exercised direct command authority during his police years. As mayor, he controlled a civilian institution that he later claimed had been evaluated by Tharallah Headquarters for its performance during the 2009 crisis. As Speaker and SNSC member, he returned to the senior political-security system and repeatedly legitimised coercive responses to unrest. In January 2026, he was inside the decision layer surrounding the regime’s transition to mass lethal repression and publicly defended the forces involved afterwards.
Whether his institutional participation in January 2026 extended to individual authorisation of the lethal response cannot yet be resolved from the public record. The evidence required to answer that question is still inside the Supreme National Security Council.
Conclusion: Managerial Repression
Mohammad Bagher Ghalibaf’s record of domestic repression cannot be understood simply by counting the years in which he commanded armed institutions. His direct authority over the national police ended in 2005, but the methods, personnel networks and organisational assumptions formed during his security career did not disappear with the uniform. They followed him into civilian administration and, eventually, back into the senior national-security system.
The continuity is visible in the way political disorder is classified and managed. Across different stages of his career, Ghalibaf has repeatedly accepted that social and economic grievances may be real while drawing a separate boundary around mobilisation that the regime defines as disorder, separatism, foreign interference, terrorism or a threat to the political order. Once that boundary is crossed, protest ceases to be treated primarily as a political demand and becomes a problem of security, control and institutional response.
Ghalibaf’s record does not suggest an automatic preference for maximum violence. It shows something more adaptable. As police commander, he sought broad coercive authority while leaving room to decide how far that authority needed to be used. As mayor, he presided over a civilian administration that absorbed former police and IRGC personnel, expanded information and crisis-management capacity, developed formal interfaces with coercive institutions and increasingly treated centralised information as a tool of administration. After Woman, Life, Freedom exposed the political cost of direct morality-police enforcement, he continued to defend compulsory hijab while supporting a system that could disperse enforcement through identification, fines, businesses, vehicles and administrative penalties. Control remained the objective even when the instrument changed.
IranSTO uses managerial repression to describe this recurring method. The term is not a doctrine attributed to Ghalibaf himself and does not imply that he designed a single clandestine system spanning every institution in which he served. It describes a pattern visible across his career: security expertise moves into civilian administration; information and monitoring acquire governing value; coercive tools are selected partly according to their political and administrative cost; and stronger forms of force remain available when the regime concludes that ordinary mechanisms of control are insufficient.
Coercion does not always arrive in the form of riot police or gunfire. A municipality can remain a civilian institution while possessing information systems, territorial structures, protection units and crisis-management capacity useful to a security response. A database can serve ordinary administrative purposes while also making identification and enforcement easier. Financial penalties, vehicle restrictions and pressure on businesses can compel behaviour without producing the visible confrontation of an arrest in the street. The legal boundaries between institutions remain real, but they do not prevent civilian systems from becoming part of a wider architecture of control.
Ghalibaf’s significance lies in how consistently he moved through those overlapping environments. He did not simply leave a military-security career behind and become a conventional civilian politician. His formal powers changed, but the emphasis on centralised information, defined authority, classification of disorder, institutional coordination and calibrated enforcement remained visible. In his political career, efficiency and coercion were rarely opposites. Effective governance could include both.
January 2026 exposed the limits of the less visible forms of that model. By then, Ghalibaf had been outside police command for more than twenty years. Yet as Speaker of Parliament and a permanent member of the Supreme National Security Council, he sat inside the senior political-security structure surrounding the regime’s response to the nationwide uprising. He was briefed by the national police commander and a senior intelligence official immediately before the principal escalation. A senior regime figure later attributed the decision that FARAJA, the Basij and IRGC should operate armed to the SNSC. Separate reporting alleged that Ghalibaf and the other heads of the three branches knew of and approved the lethal response. The secret internal record required to determine his personal role has not been released.
What followed is less ambiguous. After the regime’s response produced mass casualties, Ghalibaf publicly praised the institutions that carried it out and described their intervention as the successful “pacification” of the crisis. IranSTO’s investigation into the January 2026 mass killings documents the conduct of those institutions. Its Supreme National Security Council dossier explains why the missing internal decision record remains critical to determining individual responsibility.
The absence of that record prevents a finding that Ghalibaf personally issued an order to kill. It does not place him outside the political-security architecture of the repression. By January 2026, the former police commander occupied a position institutionally more powerful than a field command. National policy could be shaped at that level, political threats classified, security institutions legitimised and the use of coercive power defended before and after it reached the streets.
That trajectory is the central finding of this investigation. Ghalibaf’s security career did not survive because he secretly retained police command after 2005. Much of its governing logic proved portable. Direct coercion could give way to administration when administration was sufficient, to technology when technology carried a lower cost, to distributed enforcement when street confrontation became politically dangerous, and to armed force when the regime concluded that those mechanisms had failed.
Seen across nearly three decades, the pattern is difficult to dismiss as a series of unrelated episodes. Ghalibaf moved from commanding coercive institutions to governing through civilian ones and eventually back into the highest national-security decision layer. The institutions changed around him. The underlying logic of control did not.
References / Resources
The sources below include official records, primary statements, human-rights investigations, legal and regulatory material, and reporting used to reconstruct Mohammad Bagher Ghalibaf’s security career, institutional roles and relationship to successive episodes of domestic repression. Persian-language sources are marked [in Persian]; their titles have been translated into English for consistency.
- Constitutional, Official and Primary Records
Constitution of the Islamic Republic of Iran. Article 176, Supreme National Security Council.
https://www.servat.unibe.ch/icl/ir00000_.html
Iran Data Portal, Syracuse University. “IRGC Commanders’ Letter to Khatami.” Archival text of the July 1999 letter signed by senior Islamic Revolutionary Guard Corps commanders, including Mohammad Bagher Ghalibaf.
https://irandataportal.syr.edu/irgc-commanders-letter-to-khatami
Government of Canada. Special Economic Measures (Iran) Regulations, SOR/2010-165. Current consolidated regulations and schedules of designated persons.
https://www.laws-lois.justice.gc.ca/eng/regulations/SOR-2010-165/index.html
- IRGC Career, the 1999 Student Crisis and Police Command
Human Rights Watch. “Iran: Threats to Free, Fair Elections.” 24 May 2013.
Documented recordings attributed to Ghalibaf concerning his involvement in the July 1999 unrest and his account of seeking authority for police intervention, including possible use of live ammunition, during the 2003 student protests.
https://www.hrw.org/news/2013/05/24/iran-threats-free-fair-elections
IranWire. “Was Soleimani Involved in Suppressing Protests in Iran?”
Examines accounts concerning Qassem Soleimani, Ghalibaf and the security establishment during the 1999 and later protest crises.
https://iranwire.com/en/features/66701/
IranWire. “The Footprint of Qassem Soleimani in Repression: From the University Dormitory to the November Protests.” [in Persian]
https://iranwire.com/fa/features/36356/
Factnameh. “Reviewing Recent Claims about Qassem Soleimani’s ‘Moderate Positions’.” [in Persian] 16 February 2020.
Reviews documentary and recorded evidence concerning Soleimani, Ghalibaf, the 1999 commanders’ letter and later accounts of their roles during political crises.
https://factnameh.com/fa/fact-checks/2020-02-16-soleimani-facts
- Tehran Municipality and Security Interfaces
Radio Farda / Radio Free Europe–Radio Liberty. “Launch of a Security–Law-Enforcement Organisation in Tehran Municipality.” [in Persian]
Reporting on the municipality’s protection and enforcement structure and its relationship with law-enforcement authorities.
https://www.radiofarda.com/amp/f8-newspapers/26627102.html
Rooz. “Documents on an Armed Force under the Mayor’s Command.” [in Persian]
Archived reporting concerning the establishment, authority and institutional position of Tehran Municipality’s protection unit.
https://rooz.hilnu.com/persian/news/newsitem/article/-33302cc9cf/
Iran International. “Revolt in Tehran City Council: Ghalibaf’s Managers versus Zakani.” [in Persian] 19 July 2024.
Background on senior municipal officials associated with the Ghalibaf administration, including figures whose careers crossed police, IRGC and municipal institutions.
https://www.iranintl.com/fa/202407192921
Tasnim News Agency. “Thank God It Became Clear There Was No Corruption or Crime in These Transfers.” [in Persian] 1 November 2016.
Contains Ghalibaf’s description of an internal municipal reporting mechanism he called a “network of eyes”.
https://www.tasnimnews.ir/fa/news/1395/08/11/1228437/%D8%AE%D8%AF%D8%A7-%D8%B1%D8%A7-%D8%B4%DA%A9%D8%B1-%D9%85%D8%B9%D9%84%D9%88%D9%85-%D8%B4%D8%AF-%D9%81%D8%B3%D8%A7%D8%AF-%D9%88-%D8%AC%D8%B1%D9%85%DB%8C-%D8%AF%D8%B1-%D8%A7%DB%8C%D9%86-%D9%88%D8%A7%DA%AF%D8%B0%D8%A7%D8%B1%DB%8C-%D9%87%D8%A7-%D9%86%D8%A8%D9%88%D8%AF%D9%87-%D8%A7%D8%B3%D8%AA
- The 2009 Crackdown, Kahrizak and Tehran’s Security Structure
Justice for Iran. “Kahrizak Indictment.” [in Persian]
Documentary material concerning the Kahrizak detention-centre case, the Greater Tehran Police structure and command responsibility surrounding abuses following the 2009 election.
https://justice4iran.org/persian/documents/kahrizak-2/
Human Rights Watch. “Iran: Senior Official Should Be Punished for Human Rights Abuses.” [in Persian] 6 February 2013.
Addresses accountability for abuses connected to Kahrizak and senior Greater Tehran Police officials.
https://www.hrw.org/fa/news/2013/02/06/248861
Human Rights Watch. “Iran: Threats to Free, Fair Elections.” 24 May 2013.
Also used for Ghalibaf’s recorded retrospective claims concerning Tehran Municipality, the 2009 crisis and his security record.
https://www.hrw.org/news/2013/05/24/iran-threats-free-fair-elections
Factnameh. “Reviewing Recent Claims about Qassem Soleimani’s ‘Moderate Positions’.” [in Persian] 16 February 2020.
Used to assess later claims concerning Ghalibaf, Soleimani and behind-the-scenes activity during the 2009 post-election crisis.
https://factnameh.com/fa/fact-checks/2020-02-16-soleimani-facts
- Protest Politics and November 2019
Tasnim News Agency. “Ghalibaf in Kerman: They Still Do Not Know the Alphabet of Security; They Did Not Transparently Explain the Reason for the Petrol Price Increase.” [in Persian] 10 December 2019.
Records Ghalibaf’s criticism of the Rouhani government’s handling of the November 2019 petrol-price crisis and his framing of the episode as a failure of security management.
https://www.tasnimnews.ir/fa/news/1398/09/19/2157265/%D9%82%D8%A7%D9%84%DB%8C%D8%A8%D8%A7%D9%81-%D8%AF%D8%B1-%DA%A9%D8%B1%D9%85%D8%A7%D9%86-%D8%A2%D9%82%D8%A7%DB%8C%D8%A7%D9%86-%D9%87%D9%86%D9%88%D8%B2-%D8%A7%D9%84%D9%81%D8%A8%D8%A7%DB%8C-%D8%A7%D9%85%D9%86%DB%8C%D8%AA-%D8%B1%D8%A7-%D9%86%D9%85%DB%8C-%D8%AF%D8%A7%D9%86%D9%86%D8%AF-%D8%AF%D9%84%DB%8C%D9%84-%D8%A7%D9%81%D8%B2%D8%A7%DB%8C%D8%B4-%D9%82%DB%8C%D9%85%D8%AA-%D8%A8%D9%86%D8%B2%DB%8C%D9%86-%D8%B1%D8%A7-%D8%B4%D9%81%D8%A7%D9%81-%D8%A8%D9%87-%D9%85%D8%B1%D8%AF%D9%85-%D9%86%DA%AF%D9%81%D8%AA%D9%87-%D8%A7%D9%86%D8%AF
- Woman, Life, Freedom and the 2022 Security Response
United Nations Independent International Fact-Finding Mission on the Islamic Republic of Iran. Report of the Independent International Fact-Finding Mission on the Islamic Republic of Iran, A/HRC/55/67. 2024.
Documents the circumstances of Jina Mahsa Amini’s death, unlawful killings, firearm use and other violations during the Woman, Life, Freedom uprising, and concludes that multiple violations amounted to crimes against humanity.
https://docs.un.org/en/A/HRC/55/67
United Nations Independent International Fact-Finding Mission on the Islamic Republic of Iran. Update of the Independent International Fact-Finding Mission on the Islamic Republic of Iran. 13 September 2024.
Reiterates findings concerning physical violence against Jina Mahsa Amini, lethal repression, accountability and preservation of evidence for future legal proceedings.
https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/ffmi-iran/FFM-Iran-Update-13-September-2024.pdf
Iran Human Rights. “Iran Human Rights Condemns MPs’ Death Penalty Demand for Protesters.” 8 November 2022.
Includes the substance of the statement supported by 227 MPs calling for severe and exemplary treatment of people classified as moharebs and invoking qisas and the relevant religious ruling.
https://www.iranhr.net/en/articles/5578/
Reuters / 7NEWS. “Iranian Politicians Demand Punishment for Protesters.” 7 November 2022.
Contemporary reporting on the statement by 227 members of Parliament calling for decisive judicial action against protesters.
https://7news.com.au/stories/iranian-politicians-demand-punishment-for-protesters/
Teyit. “Claim that the Iranian Parliament Approved the Execution of 15,000 People.” 10 November 2022.
Fact-check documenting why the widely circulated claim that Parliament voted to execute 15,000 detained protesters was false.
https://teyit.org/analiz/iran-meclisinin-15-bin-kisinin-idamina-onay-verdigi-iddiasi
Council of the European Union / EUR-Lex. Council Implementing Regulation (EU) 2023/379 of 20 February 2023.
Official EU record containing human-rights sanctions descriptions related to the repression of the 2022 uprising and the parliamentary demand for severe punishment of protesters.
https://eur-lex.europa.eu/eli/reg_impl/2023/379/oj/eng
Council of the European Union / EUR-Lex. Council Implementing Decision (CFSP) 2022/1956 of 17 October 2022.
Official EU record concerning officials involved in communications restrictions and repression during the 2022 uprising.
https://eur-lex.europa.eu/legal-content/EN/TXT/?toc=OJ%3AL%3A2022%3A269I%3AFULL&uri=uriserv%3AOJ.LI.2022.269.01.0009.01.ENG
- Compulsory Hijab and the Redesign of Enforcement
Amnesty International. “Iran: Draconian Campaign to Enforce Compulsory Veiling Laws through Surveillance and Mass Car Confiscations.” 6 March 2024.
Documents the increasing use of surveillance, vehicle confiscation and administrative mechanisms to enforce compulsory hijab.
https://www.amnesty.org/en/latest/news/2024/03/iran-draconian-campaign-to-enforce-compulsory-veiling-laws-through-surveillance-and-mass-car-confiscations/
Amnesty International. “Iran: Testimonies Provide a Frightening Glimpse into the Daily Reality of Women and Girls.” 6 March 2024.
Documents the practical operation of compulsory-veiling enforcement through surveillance, warnings, vehicle measures and other forms of administrative coercion.
https://www.amnesty.org/en/documents/mde13/7770/2024/en/
Amnesty International. “Iran: New Compulsory Veiling Law Intensifies Oppression of Women and Girls.” 10 December 2024.
Analysis of the Hijab and Chastity legislation, including heavy fines, imprisonment, flogging, restrictions on employment and education, travel bans and potential exposure to the death penalty. The organisation subsequently noted the temporary halt to the promulgation of the law.
https://www.amnesty.org/en/latest/news/2024/12/iran-new-compulsory-veiling-law-intensifies-oppression-of-women-and-girls/
- January 2026: Mass Repression and the Supreme National Security Council
Amnesty International. “Iran: Deaths and Injuries Rise amid Authorities’ Renewed Cycle of Protest Bloodshed.” 8 January 2026.
Jointly documented with Human Rights Watch the unlawful use of firearms by IRGC and FARAJA forces and at least 28 deaths in 13 cities across eight provinces between 31 December 2025 and 3 January 2026.
https://www.amnesty.org/en/latest/news/2026/01/iran-deaths-injuries-authorities-protest-bloodshed/
Human Rights Watch. “Iran: Authorities’ Renewed Cycle of Protest Bloodshed.” 8 January 2026.
Documents unlawful lethal force during the first phase of the uprising, before the principal escalation of 8–9 January.
https://www.hrw.org/news/2026/01/08/iran-authorities-renewed-cycle-of-protest-bloodshed
Amnesty International. “Iran Internet Shutdown Hides Violations in Escalating Protests.” January 2026.
Documents the communications blackout and the difficulty of independently recording the subsequent escalation in lethal repression.
https://www.amnesty.org/en/latest/news/2026/01/internet-shutdown-in-iran-hides-violations-in-escalating-protests/
Amnesty International. “What Happened at the Protests in Iran?” 26 January 2026.
Overview of the uprising, lethal repression, communications restrictions and documented abuses by state security forces.
https://www.amnesty.org/en/latest/campaigns/2026/01/what-happened-at-the-protests-in-iran/
Iran International. “Khamenei Ordered Killings with Approval of Top State Bodies, Sources Say.” 13 January 2026.
Multi-source reporting alleging that the lethal response was undertaken with the knowledge and approval of the heads of the three branches, including Ghalibaf. IranSTO treats this as a sourced allegation that has not been independently confirmed through released SNSC minutes, voting records or written authorisations.
https://www.iranintl.com/en/202601132979
Iran International. “At Least 12,000 Killed in Iran Crackdown during Internet Blackout.” 13 January 2026.
Contemporaneous reporting concerning the scale and command structure of the repression, including allegations about a Supreme National Security Council live-fire decision. The casualty estimate reflects the publication’s reporting at that date and should not be treated as a final death toll.
https://www.iranintl.com/en/202601130145
Iran International. “Security Forces Were Authorized to Use Weapons in Protests, Iran Lawmaker Says.” 3 February 2026.
Reports former IRGC commander and MP Esmail Kousari’s statement that the Supreme National Security Council decided that FARAJA, the Basij and the IRGC should enter the confrontation armed. Kousari did not disclose the resolution, individual votes or rules of engagement.
https://www.iranintl.com/en/202602039870
U.S. Department of the Treasury. “Secretary Bessent Announces Sanctions Against Architects of Iran’s Brutal Crackdown on Peaceful Protests.” 15 January 2026.
States that Supreme National Security Council Secretary Ali Larijani coordinated the response to the protests on behalf of the Supreme Leader and had publicly called for security forces to use force against peaceful protesters.
https://home.treasury.gov/news/press-releases/sb0364
- Sanctions, Accountability and International-Law Context
Government of Canada. Special Economic Measures (Iran) Regulations, SOR/2010-165.
Mohammad Bagher Ghalibaf is listed in Part 2, “Individuals — Grave Breach of International Peace and Security.” The regulations maintain a separate Part 2.1 for individuals designated in connection with gross human-rights violations. A sanctions designation is an administrative measure and is not a criminal conviction.
https://www.laws-lois.justice.gc.ca/eng/regulations/SOR-2010-165/index.html
United Nations Independent International Fact-Finding Mission on the Islamic Republic of Iran. Report of the Independent International Fact-Finding Mission on the Islamic Republic of Iran, A/HRC/55/67. 2024.
Used for findings that violations during the Woman, Life, Freedom repression included acts amounting to crimes against humanity and for the distinction between evidence of international crimes and the individual criminal responsibility of particular officials.
https://docs.un.org/en/A/HRC/55/67
United Nations Independent International Fact-Finding Mission on the Islamic Republic of Iran. Update of the Independent International Fact-Finding Mission on the Islamic Republic of Iran. 13 September 2024.
Used for the Mission’s evidence-preservation and accountability work and its potential relevance to future national or international proceedings.
https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/ffmi-iran/FFM-Iran-Update-13-September-2024.pdf
- Related IranSTO Research
IranSTO. “Mohammad Bagher Ghalibaf Power Network.”
The first investigation in this series, reconstructing the cross-institutional personnel, political, military and financial relationships surrounding Ghalibaf.
https://iransto.com/mohammad-bagher-ghalibaf-power-network/
IranSTO. “Supreme National Security Council: Iran’s Hidden Architecture of Strategic Power.”
Institutional investigation into the SNSC, its constitutional role, secretariat, decision-making structure and the evidentiary distinction between institutional membership and individual responsibility.
https://iransto.com/supreme-national-security-council-iran/
IranSTO. “Iran Mass Killings 2026 Report.”
Investigation into the January 2026 uprising, mass lethal repression, participating institutions and the unresolved chain of political-security decision-making.
https://iransto.com/iran-mass-killings-2026-report/
IranSTO. “The Architecture of Impunity in Iran.”
Investigation into the institutional mechanisms that shield senior officials of the Islamic regime from domestic and international accountability.
https://iransto.com/architecture-of-impunity-in-iran/