The Headband
The photograph circulated on encrypted channels before the internet blackout sealed Iran from the outside world. It showed a commander standing atop a dark armored personnel carrier in a Tehran intersection. The vehicle type was not standard to Iran’s Law Enforcement Command. The commander wore a green headband — the iconic insignia of Iraq’s Hashd al-Shaabi, specifically Kataib Hezbollah. In the background, smoke rose from barricades. The street was empty of civilians.
The image was officially denied by the regime. But it was not the only evidence. It was not even the most damning evidence. It was simply the first piece in a forensic chain that, taken together, documents the largest deployment of foreign proxy forces against a domestic civilian population in modern Middle Eastern history.
The chain of evidence matters for a specific reason: courts will need it. Not today’s courts — today there is no functioning international mechanism to prosecute these crimes. But the precedent of Syria’s Commission for International Justice and Accountability, which spent years collecting evidence that eventually produced convictions in European courts under universal jurisdiction, shows that documentation gathered now can serve justice later.1 Every photograph, every audio recording, every eyewitness account preserved today is a brick in the wall of a prosecution that may take years to build.
The Language
In Tehran and Karaj, protesters reported hearing security forces communicate in Arabic — not Farsi, not the Turkic or Kurdish languages of Iran’s ethnic minorities, but Arabic spoken with distinctive Iraqi accents. The Baghdadi dialect is unmistakable to anyone who speaks Arabic: the heavy use of the ich sound, the characteristic elongation of vowels, the vocabulary borrowed from Iraqi street culture. In a country where the security forces speak Farsi, the sound of Iraqi Arabic on the radio frequencies of the men shooting at you is not ambiguous.
In Karaj, the evidence became visceral. Arabic-speaking militia members were photographed taking selfies with the corpses of protesters they had killed. The images show men posing with bodies — grinning, gesturing — in a city whose name they could not pronounce, next to people whose language they did not speak. Human rights monitors described the behavior as “the complete absence of social identification with the victims” — the behavioral signature not of a security force maintaining order in its own country but of an occupation army operating in foreign territory.
The selfies were not isolated incidents. They reflected a pattern documented in other theaters where these same militias have operated. In Syria, Fatemiyoun and PMF fighters routinely photographed themselves with enemy dead — a practice rooted in the culture of sectarian warfare, where the dead are not fellow citizens fallen in a national tragedy but enemies of the faith whose elimination is celebrated. The same psychic framework that produced trophy photographs in Aleppo produced trophy photographs in Karaj.
The Courthouse
In Sanandaj — the capital of Kurdistan Province and one of the most fiercely resistant cities during the uprising — the evidence was architectural. Residents identified that Hashd al-Shaabi fighters had taken over the old courthouse building in Azadi Square as their operational base. The IRGC troops who had been stationed there were replaced for night patrols by fighters who spoke broken or no Persian.
The significance is layered. Sanandaj is a Kurdish city. The IRGC is already viewed by Kurds as an occupying force — a Persian-dominated institution enforcing the authority of a government that has systematically marginalized Kurdish language, culture, and political rights. But the IRGC at least speaks Persian, at least shares a national framework, however unjust, with the population it polices. The replacement of IRGC troops with Iraqi Arab fighters — men who spoke neither Persian nor Kurdish, who had no cultural connection to the city, who had been flown in from a foreign country to patrol streets they had never seen — represented an escalation from oppression to occupation.
Kurdish social media documented the transition in real time before the blackout descended. Videos showed patrol vehicles with unfamiliar markings. Audio recorded conversations in Iraqi Arabic between fighters who did not know they were being recorded. Photographs showed the courthouse — a building associated in local memory with the era of Kurdish self-governance during the brief Mahabad Republic of 1946 — flying no flag at all, its identity as an Iranian institution erased.
The Weapons
The weaponry deployed during the peak massacre of January 8-9 provided its own forensic signature.
DShK heavy machine guns — Soviet-designed, 12.7mm anti-aircraft weapons typically mounted on armored vehicles or fixed positions for use against aircraft and light vehicles — were deployed against pedestrian crowds in residential neighborhoods.2
Kermanshah, January 8-9: DShK fire killed approximately three hundred people arriving at hospitals in a single night. The weapons were mounted on Toyota pickup trucks — the “technicals” that are the signature vehicle of civil wars across the Middle East, from Libya to Yemen to Syria. Their appearance on the streets of western Tehran was documented by residents who recognized the configuration from years of watching footage from regional conflicts.
The DShK is a battlefield weapon — designed to punch through engine blocks and light armor at a range of two kilometers. It belongs on a frontline between armies. Its deployment against unarmed civilians in residential streets is a war crime by any legal standard — and it is a weapon associated with the PMF and other irregular militias, a forensic signature distinct from the standard equipment of Iran’s domestic security forces.
Hospital evidence provided the most forensic proof of systematic execution. Morgue photographs documented a pattern that medical professionals described as unprecedented: victims with fatal head wounds who still had cardiac monitoring electrodes and IV tubes attached to their bodies.3 The forensic interpretation is unambiguous — these individuals were receiving medical care, were alive under treatment, and then received a fatal wound. They were executed in hospitals.
In western Tehran, security forces used ambulances to transport troops and to abduct wounded protesters from the streets. In one documented case, agents executed a semi-conscious patient inside an ambulance in front of the medical crew. The violation of medical neutrality — a crime under the Geneva Conventions — was not an aberration. It was operational doctrine.
The Graves
The disposal of bodies followed a pattern designed to obscure the scale of the killing.
In Mashhad, where the Afghan Fatemiyoun brigade was deployed extensively around the Imam Reza shrine, mass graves were discovered at Behesht-e Rezvan Cemetery. The cemetery — already large enough to accommodate a major city’s normal mortality — received an influx of bodies that overwhelmed its capacity. Fatemiyoun fighters, drawn from the large Afghan refugee population in Mashhad, used their demographic blending to avoid identification while carrying out the suppression — and then disposed of evidence in the same cemetery where the city buries its ordinary dead.
In Karaj, bulldozers were used to move bodies. Eyewitnesses reported the indiscriminate loading of dead and wounded into trucks — the wounded alongside the dead, the distinction between the two apparently irrelevant to the operation. The Kahrizak morgue in Tehran overflowed.
Think about what it means to bury someone you love in a country like this. Families who attempted to recover their dead were confronted with a final cruelty: the regime demanded payment of “bullet fees” — charges for the ammunition used to kill their relatives — before releasing bodies.4 The practice, documented by Iran Human Rights and HRANA, served a dual function: it generated revenue and it deterred families from claiming the dead, reducing the number of documented casualties.
The Chain
The question for future accountability proceedings is not whether these things happened — the evidence is overwhelming. The question is whether the evidence can survive the regime’s systematic destruction campaign long enough to reach a courtroom.
The challenge is what investigators call “linkage evidence” — connecting the physical act of killing to the command authority that ordered it. A photograph of an Iraqi militia member in Tehran proves presence. Intercepted communications prove coordination. But proving that Ali Khamenei’s January 9 directive to the Supreme National Security Council to “crush the protests by any means necessary” was transmitted through the Crisis Headquarters5 to the specific field commanders who ordered the specific shooters to fire — that requires a chain of documentation that spans the entire hierarchy.
The Regime’s Own Numbers
Leaked IRGC report (Jan 11): ~12,000 dead reported to SNSC | Interior Ministry update (Jan 24): 36,500+ | Regime’s public figure: 3,117 (excluding those classified as “rioters”)
The leaked IRGC report is one crucial piece of linkage evidence. It proves state knowledge of the scale at the highest levels — knowledge that makes the continued killing that followed an informed decision, not an operational failure.
The Evidence Chain
Type Example Forensic Value Visual Green headband photograph; Karaj selfies Proves foreign fighter presence Linguistic Iraqi Arabic accents; broken/no Persian Confirms non-Iranian identity Architectural Sanandaj courthouse takeover Documents territorial control by foreign force Medical Electrodes/IV on executed patients Proves execution in hospitals Weaponry DShK on technicals; non-standard APCs Links to PMF/militia equipment Documentary Leaked IRGC reports; SNSC communications Linkage evidence for command responsibility
HRANA’s methodology — verified biographical data for each documented victim, with name, age, location, and circumstances of death — mirrors the Commission for International Justice and Accountability model used in Syria. Each verified profile is not just a statistic. It is a legal document — a specific victim whose death can be attributed to specific circumstances in a specific location, building the foundation for a prosecution that does not yet exist but will.
The regime’s internet blackout, its confiscation of bodies, its “bullet fees” that discourage families from claiming the dead, its destruction of hospital records — all serve a single strategic purpose: evidence destruction. Every piece of evidence preserved despite these measures is an act of resistance as significant as any barricade.
The Honest Ledger
Not all evidence is equally reliable. Eyewitness testimony, while abundant, is subject to the distortions of trauma, confusion, and the fog of urban violence. The strength estimates for foreign militias vary between sources — the combined figure of eight thousand to twelve thousand represents a range, not a precise count. Some photographic evidence has been shared without full authentication, and the regime’s internet blackout means that the most intense period of violence is also the most poorly documented.
The death toll itself remains a range — from the forensic floor of nearly seven thousand verified identities to the bureaucratic ceiling of 36,500 from leaked internal documents.6 The regime’s acknowledged figure of 3,117 is widely understood to exclude those it classified as “rioters” — a category that, in the regime’s framework, includes anyone who protested.
What is documented beyond reasonable dispute: foreign fighters who did not speak the language were deployed in Iranian cities. They used military-grade weapons against unarmed civilians. They executed wounded people in hospitals. They photographed themselves with the dead. And the regime that ordered their deployment has systematically attempted to destroy the evidence.
The documentation effort is not academic. It is the difference between a crime that is remembered and a crime that is prosecuted. Every verified name, every preserved photograph, every authenticated audio recording is a down payment on accountability — evidence gathered in darkness for courts that will operate in light.
Footnotes
-
Commission for International Justice and Accountability, Syria war crimes documentation model; European universal jurisdiction convictions, 2020-2025 ↩
-
Iran HRM, “Evidence-Based Report and Documentation: Targeted Killings, Summary Executions,” February 4, 2026 ↩
-
Iran HRM, “Deadly Crackdown on Popular Protests in Iran (January 2026),” January 21, 2026; Iran International, “Who Was Behind Iran’s Deadly Crackdown?,” January 16, 2026 ↩
-
Amnesty International, “What Happened at the Protests in Iran?,” January 2026; Iran HRM Monthly Report, January 2026 ↩
-
Iran International, “Over 36,500 Killed in Iran’s Deadliest Massacre, Documents Reveal,” January 25, 2026 ↩
-
Iran International, “Over 36,500 Killed in Iran’s Deadliest Massacre, Documents Reveal,” January 25, 2026; HRANA verified identity database, ongoing ↩