Was it an Iranian plot to blow up a political rally near Paris where the U.S. president's lawyer and a former speaker of the House were scheduled to speak? Or was it a "false flag" operation set up by an Iranian dissident group to damage Iran's reputation?

While the roots of the plot remain uncertain, some particulars are clear: Belgian authorities arrested a young couple Saturday in a Brussels suburb. The man and the woman are both Belgian citizens of Iranian descent. A search of their Mercedes turned up 500 grams of TATP, a powerful explosive used by terrorists, and a detonator hidden in a small toiletry kit. Belgian authorities were so concerned they brought in a bomb squad to blow it up.

In addition, an alleged accomplice was taken into custody in France and an Iranian diplomat assigned to Tehran's embassy in Vienna was arrested in Germany, his diplomatic immunity stripped by the Austrians.

A spokesman for the Belgian federal prosecutor said Wednesday that the intended target was the annual convention of the National Council of Resistance of Iran, the political affiliate of MEK, the Mojahedin-e Khalq or "Peoples' Mujahedin of Iran," a well-financed dissident group that formed in the 1960s. MEK was accused by the State Department of assassinating six Americans in Iran prior to the 1979 Iranian revolution and assassinating Iranian diplomats after it.

This undated photo distributed Tuesday, July 3, 2018 by the Iranian Foreign Ministry purports to show a man the Ministry says is Amir Soudani, right, next to a man they say is Mehdi Abrishamchi, center, a top MEK official in Europe. The face of the person on the left has been blotted out by the Ministry for what they say are security reasons. Iranian Foreign Ministry

The spokesman said the couple had picked up the TATP in Luxembourg from the Iranian diplomat and "were fully aware of the risk involved of using this unstable explosive; they had every intention of using it. … They were not naïve."

When asked if the Iranian diplomat was an agent of any of Iran's security services, a Belgian judicial source replied, "Practically all employees of Iranian embassies are part of the Iranian Secret Service."

Among those who spoke at the MEK rally Saturday, which drew a crowd of thousands: Rudolph Giuliani, one of President Donald Trump's lawyers; Louis Freeh, director of the FBI from 1993 to 2001; and former House Speaker Newt Gingrich — three of the many prominent Americans of different political stripes who have publicly supported MEK.

But who were the would-be bombers working for? Both U.S. officials and Iran experts have been left scratching their heads.

"There are no simple stories in this patch," said Daniel Benjamin, the State Department's coordinator for counterterrorism during the Obama administration.

There are three competing theories circulating in the media and the corridors of power:

It was a state-sponsored operation by Iran's Islamic Revolutionary Guard (IRGC) or its overseas branch, the Quds Force, mounted with the blessing of Supreme Leader Ali Khamenei.

It was a rogue operation by the IRGC or the Quds force, mounted without the knowledge of Iran's elected government.

It was a false flag operation devised by the MEK, intended to embarrass Iran while Iran's president was in Europe seeking to shore up backing for the Iran nuclear deal after the American withdrawal.

The Iranians are pointing the finger at MEK itself. Foreign Minister Javad Zarif used his Twitter account to raise the possibility of a false flag operation. "How convenient," he tweeted Monday. "Just as we embark on a presidential visit to Europe, an alleged Iranian operation and its 'plotters' arrested …"

A spokesman for Iran's Ministry of Foreign Affairs said the Iranian diplomat arrested by Belgian authorities was wrongly accused and had nothing to do with the plot. "The claims against the Iranian diplomat are baseless and we categorically reject them," said the spokesman, Bahram Ghassemi. "The other individuals arrested are known members of the so-called Mojahedin-e Khalq terrorist group. The group is an oppressive cult with a long history of terrorist activity and targeting innocent civilians going back decades, and the ties of the mentioned individuals with it have long been established."

Specifically, Ghassemi pointed to Amir Sadouni, the male half of the couple arrested Saturday. Ghassemi claimed Sadouni had long been a member of MEK and produced a photograph purportedly of Sadouni with a senior MEK official.

The Belgian prosecutor's spokesman, however, said Wednesday the MEK is not suspected in the plot at this stage of the investigation.

How convenient: Just as we embark on a presidential visit to Europe, an alleged Iranian operation and its “plotters” arrested. Iran unequivocally condemns all violence & terror anywhere, and is ready to work with all concerned to uncover what is a sinister false flag ploy. — Javad Zarif (@JZarif) July 2, 2018

A U.S. intelligence official suggested that he would not be surprised by any of the possibilities, or others, but he and others noted that if it was directed by the Iranian government, it would be an "extraordinary operation, not what we are used to seeing … but it is consistent with their aggressiveness of late."

In a speech to the Heritage Foundation in May, Secretary of State Mike Pompeo said, providing no details, that "today, the Iranian Quds Force conducts covert assassination operations in the heart of Europe." The State Department declined comment on the statement.

But the timing of the attack would've been odd for the Iranian government or the IRGC, since it came just before Iranian President Hassan Rouhani arrived in Vienna on Tuesday for the beginning of a European diplomatic swing.

Hooman Majd, an Iranian-American author and contributor to NBC News, also points to the location of the target, Paris, as odd. French President Emmanuel Macron has been the chief European advocate of holding the Iran nuclear deal, the JCPOA, together.

"The MEK does this every year," said Majd, referring to their convention. "Suddenly, you decide to blow it up? That doesn't ring true. It would have been devastating for Iran and the JCPOA."

But Majd and Benjamin also said they can't eliminate the possibility that this could be a rogue operation planned by Iranian security services — or by radical elements within the Iranian security services — aimed at embarrassing the Rouhani government and perhaps even putting them in charge of an embattled Iran. The IRGC has been a big winner during the time Iran has been under sanctions, facilitating backdoor deals and reaping profits along the way.

Bomb disposal experts searches a car in the Brussels suburb of Woluwe St Pierre on June 30, 2018. Yves herman / Reuters

"The Iranian government is a very complicated operation, not nearly as easily diagrammed as ours is, even given the chaos of the moment," said Benjamin, now the director of the John Sloan Dickey Center for International Understanding at Dartmouth. "There are different groups with different agendas. I could well imagine the IRGC thinking this was a moment to do something extreme even though it would appear to carry significant risk from the West, the U.S. in particular."

Moreover, said Benjamin, "we can't think of Iranians being careful about the use of force and terror. We make them out to be sharper than they are." He said the "tradecraft" of Iranian security services — the manner and skill with which they operate — has "shown some rustiness" in recent years.

If it does turn out the Iranian government played any role in a plot against the MEK, he suggested that the Trump administration would seize on it, since the MEK has friends in high places. The president's new national security adviser, John Bolton, has long been an advocate of the MEK — "a devout shill," in Benjamin's words. NBC News has reported that Bolton and Giuliani have received thousands of dollars in speaking fees from the group over the years.

A Washington spokesman for the NCRI, MEK's political affiliate, called the Iranian regime's accusation that MEK was involved in the plot a "totally bogus claim."

In a statement, the spokesman said, "The preposterous claim by the Iranian regime, the world’s leading state sponsor of terrorism, that the arrest of two terrorists in Belgium and an Iranian diplomat in Germany was a 'false flag operation' is an absurd lie."

"The ridiculous attempt to blame the People’s Mojahedin Organization of Iran (MEK) for this criminal and terrorist operation is thinly-veiled attempt to cover up the direct and undeniable role of the Iranian regime and its diplomat-terrorists, caught red-handed. … Belgian investigators unequivocally rejected the claim that the MEK was in any way involved." The spokesman said the arrested couple had pretended to support MEK.

Giuliani said that all participants at the rally were grateful to law enforcement in Belgium and France for stopping an attack on a "gathering supporting freedom from the theocratic oppressive regime in Iran."