On 9 November 2021, a call was made to MI5’s public hotline for reporting national security concerns. The man did not give his name but identified himself as a soldier in the British army – and the concern he was reporting was himself.
The anonymous caller told the UK’s domestic security service he had been in contact with Iran for more than two years but now wanted to help his country by becoming a double agent.
After receiving no response, he rang the line again two weeks later to offer his services to the British intelligence agencies once more. MI5 made nine attempts to return his calls, which were from an unregistered mobile phone, but ultimately decided to refer the case to counter-terror police.
Specialist investigators identified the caller as Daniel Abed Khalife, a then 20-year-old soldier based at Beacon Barracks in Staffordshire.
Last week, Khalife, now 23, was found guilty of passing on information to Iran, contrary to the Official Secrets Act 1911, and also of eliciting information that could be useful to a terrorist, in contravention of the Terrorism Act 2000.
The case has highlighted vulnerabilities in the systems for vetting members of the British armed forces and detecting potential “insider threats”, after previous infiltration by the neo-Nazi terrorist group National Action and the 2008 conviction of another soldier who offered his services to Iran.
Commander Dominic Murphy, head of the Metropolitan police’s counter-terrorism command, said last week: “Everyone is much more alive to the threat posed by insiders after Daniel Khalife, particularly in the Ministry of Defence [MoD]. Insider threats remain a really significant challenge for us all.”
On paper, Khalife was exemplary. After joining the army at 16, weeks after getting 10 GCSEs at his south-west London school, he became a signaller and was given the award for best junior soldier in his squadron in 2020. He received praise from both superiors and fellow soldiers, who mocked up an image of Khalife holding a falcon, in reference to his mastery of the Falcon military communications system.
In September 2021, Khalife was promoted to lance corporal and even expressed an interest in joining the special forces, before an officer advised him he was unlikely to pass vetting “because of where his parents were from” – Iran and Lebanon.
But the concerns only appeared to be about perception. Nobody Khalife served with is known to have flagged any concerns about his behaviour, and counter-terror police admitted that it was only the soldier’s own calls to MI5 that raised the alarm.
Murphy said: “That was the start of our investigation. That’s not to say that he wouldn’t have come to our attention by other means, but as it stands at the moment, his calls to MI5, his second call particularly, are what started this off.”
When police moved in to arrest Khalife on 6 January 2022, electronic devices and documents seized from his barracks revealed that he had been spying for Tehran for more than two and a half years. Since the age of just 17, he had been passing on information, including a list of special forces soldiers, details of military computer systems and classified documents concerning drones and surveillance.
In August 2020, Khalife flew to Istanbul in what his Iranian handlers appear to have planned as part of a journey to Tehran. He told one of his contacts he “delivered a package”, but it is unclear whether he made in-person contact with Iranian agents.
In messages to a handler, saved on his phone as “David Smith”, Khalife wrote: “I won’t leave the military until you tell me to. 25+ years.” The handler urged him to be careful, saying there was “no rush about our mission… We can work together a lot of years.”
Khalife used a 2021 deployment to the Fort Hood US army base in Texas to take photos and screenshots of sensitive equipment, but British police were never able to confirm how much was passed on to Iran.
Conversations with his Iranian handlers were conducted on the encrypted Telegram app – most of which were deleted – and Khalife also used the much older spycraft technique of dead drops to collect cash payments. At one point, he picked up £1,500 left in a dog waste bag in a north London park, and £1,000 was left under a flower pot at a cemetery.
“There’s no way of actually knowing everything that Daniel Khalife has passed on or recovered or got access to,” Murphy admitted. “We’ve got evidence of him collecting money but we don’t know if anything was left.”
Police also remain in the dark about Khalife’s true motivations. His defence at trial was that he aimed to be a double agent working for the good of the UK all along, and only initiated contact with Iranian agents in April 2019 to prove bosses wrong after being told his Iranian heritage could stop him being promoted.
Khalife told jurors that the TV series Homeland, which follows an American soldier acting as a double agent for al-Qaida, was the inspiration for his elaborate plot and that he emailed MI6 to offer his services in August 2019 but received no response.
Woolwich crown court heard that Khalife had faked some documents and edited others to make them seem more significant, including by changing “official” classifications to “secret” – or, as Khalife wrote, “secert”.
after newsletter promotion
But Murphy said he also passed on “genuine information” and that even faked documents could cause “additional damage” if the Iranians believed them to be real.
“The problem is he’s a Walter Mitty character who is having an extremely significant impact in the real world,” he added. “Only he will know why he was doing this, and I do believe that there is some of this that fitted into his own fantasies, but he caused a substantial amount of damage.”
Khalife was released on bail after his arrest, but shortly before he was due to be charged in January 2023, he was reported as missing by the Army.
He was found after three weeks on the run in a stolen van, which he had converted to live in and drove around the Staffordshire countryside while police scrambled to stop him leaving the UK or reaching the Iranian embassy.
It would not be his last escape. In September 2023, while awaiting trial, Khalife escaped from Wandsworth prison by hiding under a food delivery lorry, sparking a huge national manhunt involving hundreds of police officers.
After three days on the run, he was arrested by police as he was cycling along a canal towpath in London with a Waitrose bag containing a phone, receipts, a diary and about £200 in cash. He will be sentenced next year.
Dr Jessica White, acting director of terrorism and conflict studies at the Royal United Services Institute thinktank, who has researched infiltration by far-right groups in the British military, warned that there are “vulnerabilities” in the system. “The vetting process is lacking in a lot of ways. It was very much based on a personal declaration of political beliefs and affiliations. So if you’re not going to tick ‘yes’ in the box, there isn’t necessarily a secondary check – they take people’s word on it.”
She also said that after people pass vetting and enter into service, the burden to spot potential risks falls on fellow soldiers and superior officers, but that military operations “take priority”.
White added: “Khalife was seen to be doing well – the system falls down where everything relies on a command structure to sense problems.”
A spokesperson for the MoD said that the vetting process for people wanting to join the military was “strict and robust” and that potential threats arising from the information Khalife shared had been addressed.
They added: “We constantly monitor threats and provide specialist advice and security training to our personnel so that they understand how to respond appropriately to security incidents and protect information.”
White warned that, with the growth of encrypted online communications and online disinformation operations by hostile states, the opportunities for people to be radicalised and recruited for espionage are growing.
As Khalife told jurors at his trial: “I have always had a gift for exposing flaws in security.”
