Iran's Spy Ship Activity Extends Beyond the Red Sea

 

Two U.S. Treasury-sanctioned ships have been the focus of attention for the maritime community interested in Iranian spy ship activity.  But these are not the only Iranian ships involved in intelligence activity contributing to attacks on merchant shipping.

Firstly the MV Saviz, and then the MV Behshad, maintained a picket position, stationary off the Dahlak Bank just inside Eritrean territorial waters in the Red Sea, from late 2016 until January 2024.  Both ships are controlled by the state-owned Islamic Republic of Iran Shipping Line Group (IRISL).  But their unusual patterns of activity, reporting in the Israeli press and the observed presence on-board of uniformed personnel, strongly suggested that the vessels were being operated by the Islamic Revolutionary Guard Corps (IRGC) Navy (Nesda). 

This designation was effectively confirmed when the Saviz was damaged by limpet mines on April 6, 2021, an attack subsequently acknowledged by Israel.  Saviz limped home to Bandar Abbas, and was replaced on station by her sister ship, the Behshad.  The Behshad too was forced from this position in January 2024, and took up station instead in the Gulf of Aden.  According to U.S. official speaking to ABC News the U.S. subsequently conducted a cyberattack against the Behshad, which abandoned its post off Djibouti and returned to Bandar Abbas in April 2024.

Both the Saviz and the Behshad will have played an important role in the collection of intelligence and its dissemination to Iran’s Houthi allies, in support of Houthi attacks on merchant shipping. Both vessels are equipped with standard maritime radars, one mounted forward atop a mast, a second mounted aft with a complex aerial array unusually high above the bridge, with a third radar or antenna protected by a radome on a second bridge mast. A detection range of 50 nm could be expected from such an array. 

Through a satellite receiver, the ships could also receive one-meter resolution imagery, with a less than 24-hour time delay, from Iran’s own Khayyam satellite (and probably also from the Russian Kanopus-V imagery satellite constellation). Both ships could also communicate with the Houthis’ fleet of fishing boat intelligence collectors, or launch its own small boats for scouting purposes. 

Fusing this all-source intelligence with data from aggregated Automatic Identification System (AIS) information, gathered from those ships traveling with their AIS systems turned on, both ships would be able to maintain an accurate maritime area activity plot, albeit not sufficiently timely to be used directly for target engagement by missiles or drones without closing approach target acquisition systems.

With the Saviz and Behshad now effectively chased away from the Red Sea and Gulf of Aden area, the same intelligence collection role has now likely been passed to Iran’s regular Navy (Nedaja), whose grey paint provides a degree of sovereign protection, although not necessarily from the limpet mine threat.  Currently, the Nedaja presence in the area is being maintained by the 100th Flotilla, consisting of the frigate IRINS Dena (F75) and logistics supply ship IRINS Bushehr (L422), due rotation shortly.

Saviz and Behshad, valuable assets still, have now been redeployed to safer waters.  Behshad now appears to be operating in the Straits of Hormuz area, usually off Qeshm, giving greater depth to Iran’s coastal defenses in this sensitive area.  Saviz is believed to still be on station in the northern Arabian Sea, where she was implicated in the attack by an Iranian Shahed-136 drone on the Indian-crewed chemical tanker MV Chem Pluto off Porbandar on December 23, 2023.  In the follow-up to the attack, the Indian Navy announced that they had boarded the Saviz in international waters but found nothing incriminating, a bold and resolute action for which no supporting evidence was provided and which was not accompanied by any complaint from Iran – but which appears to have brought similar such attacks to an end.

Also boarded and searched in the Indian follow-up was the IRISL container ship MV Artenos, suggesting that the Indian authorities believed this Iranian ship also had a role in the attack.  MV Artenos is an active merchantman and made 27 port calls in 2024, sailing normally between the Gulf and India.  It was also spotted in suspicious circumstances in the same month southeast of Socotra, and may therefore be acting in a covert intelligence auxiliary role.

Another Iranian container ship, the MV Shiba, also IRISL-owned and US-sanctioned, was tracked by UK commercial intelligence firm MariTrace behaving suspiciously in January 2024.  En route from Jebel Ali towards the Suez Canal, Shiba paused for 8 hours off Bandar-e Jask on January 10.  Resuming her voyage, her path would have crossed that of the tanker Suez Rajan, which was seized by the Nedaja the next day before being diverted to Jask. 

MV Shiba left from her normal commercial routing again several days later, leaving the Internationally Recommended Transit Corridor, sailing southwards to sail in close company with the Behshad for several days off Djibouti. The two ships were joined by IRINS Alborz (F-72) and IRINS Bushehr (422).  Again MV Shiba is active commercially, having made 43 port calls in 2024, but on tenuous evidence also appears to have an auxiliary intelligence role, well disguised by her legitimate commercial activity.  Other Iranian-owned merchantmen are likely to have a similar reporting role.

Much of Iran’s prosecution of asymmetric warfare makes an assumption that, whatever its own behaviors, its adversaries will be loath to break international conventions and the International Law of the Sea.  However, when those adversaries do take resolute action to protect their interests, the Iranians are exposed as defenseless and are deterred.  In this context the Nesda has not yet deployed its drone carriers Shahid Mahdavi (C110-3) and Shahid Bagheri (C110-4);  with their drone and missile arsenals, these highly vulnerable converted merchant ships pose a substantial threat – but only when they are not robustly challenged.