Expediting Evidence of Iranian Attacks: The Aramco Case

In late December, U.S. officials presented the UN Security Council with preliminary findings from their investigation into the September 14 attacks on Saudi Aramco oil facilities at Abqaiq and Khurais. According to Reuters, the report contained images of weapon debris from the attack, revealing components that were identical to those in known Iranian weapon systems. Specifically, an engine and vertical gyroscope from an unmanned aerial vehicle used in the Aramco attack—designated in the report as an IRN-05 UAV—were visually identical to components recovered from an Iranian-manufactured Shahed-123 UAV, currently housed in the Iranian Materiel Display (IMD) at Joint Base Anacostia-Bolling. These same components have also been documented in Iranian UAVs recovered in Iraq, Israel, and Yemen.

Such findings raise questions about what Secretary-General Antonio Guterres told the Security Council days earlier. On December 10, he said the UN was “unable to independently corroborate that the cruise missiles and unmanned aerial vehicles used in [the Aramco] attacks are of Iranian origin”—a conclusion reached after the UN sent a team of investigators to Saudi Arabia to inspect the weapon debris. While the full details of the UN’s investigation will remain unclear until its final report is published, previous UN reports have found Iran complicit in the proliferation of military materiel in the region based on some of the same components recovered from the Aramco attacks.

THE CHALLENGES OF CERTAINTY

Iran is known to leave fingerprints behind when conducting unacknowledged attacks or illegally transferring weapons and other materiel to proxies in the region. Whether in the form of a factory logo, date plate, or Farsi handwriting on internal components, these identifiable features provide leads from which to build a case of attribution.

Although the known evidence seemingly supports the claim that Iranian-origin weapons were used in the Aramco attacks, the UN investigation may have been stymied somewhat by U.S. exploitation teams, who initially combed through and removed some of the weapon debris. This could lead the UN—which requires near-certain evidence before making such attributions—to sidestep controversial findings by invoking its methodological standards of “transparency and verification.” In fact, this mindset may already have been at work in its statement last month.

Regardless of the circumstances surrounding the investigation, the United States and its regional allies should do their utmost to ensure that the UN is fully integrated and unhindered in the exploitation process. Together with independent weapon technical intelligence (WTI) organizations, the UN has produced the best open-source information to date on illicit transfers of Iranian materiel. Their involvement not only provides important third-party verification, but often produces original findings that end up supporting U.S. assertions.

COMMON COMPONENTS ACROSS IRANIAN SYSTEMS

Internal components provide the best guidance in discerning point of origin. Operating under international sanctions for so many years has limited the range of dual-use components available to Iran. This constraint is reflected in the unique ecosystem of components found in materiel manufactured by Iran and fielded by its proxies, as revealed in numerous public reports since 2016.

UAVs and radio-controlled improvised explosive devices (RCIEDs) recovered from militants in Bahrain and the Houthis in Yemen contain several identical components that suggest a common point of manufacture, as do Iranian-manufactured UAVs recovered in Iraq and Israel. Most of these components also match materiel recovered from the Jihan 1, a ship interdicted in January 2013 and determined by the UN to have originated in Iran.

Specifically, the RCIEDs recovered in Bahrain and Yemen share several identical design and construction characteristics, as well as the following identical components:

• Brand-name microcontrollers, voltage regulators, and power relays
• Woer-branded heat shrink tubing
• Bahar-branded junction boxes
• Pink threaded electrical wire

As for the Qasef-1 UAVs recovered in Yemen­, the Houthis claimed they were manufactured domestically, but they are nearly identical in design to Iranian-manufactured Ababil-T UAVs and share the following components:

• Woer-branded heat shrink tubing
• Bahar-branded junction boxes
• Pink threaded electrical wire
• Hitec-branded servomotors
• V10 vertical gyroscopes

These same gyroscopes were also observed in an Iranian-manufactured Ababil-3 UAV that crashed in Iraq, as well as the IRN-05 UAV used in the Aramco attacks. Likewise, an Iranian-manufactured Saegheh stealth UAV shot down over Israel contained Hitec-branded servomotors, pink threaded electrical wire, and a wooden propeller with serial number patterning identical to the one recovered from the IRN-05.

This web of common components strongly suggests that these items were manufactured in a centralized location, or in separate locations that share a supply chain. The presence of quality-control stickers on many of the RCIEDs also suggests they were manufactured by a state with an industrial base as opposed to a nonstate group. And attempts to obliterate identifiable markings on many components indicates a desire to prevent tracing and attribution.

CONCLUSION

Although the United States has improved its presentation of evidence since establishing the IMD in 2017, Washington and its regional allies need to go further. Integrating the UN into the exploitation process should be standard in most instances; the same goes for independent WTI organizations, which are unconstrained by the semiannual reporting structure and politics of the UN. Other positive steps include expanding the IMD, establishing an open-source “component library,” increasing resources available to the UN Panel of Experts system that conducts these investigations, and providing proper exploitation training to UN investigators.

The United States should also encourage the integration and sharing of WTI among its regional allies. In 2015, the Saudi-led coalition partially justified its intervention in Yemen based on initially unsubstantiated claims of Iranian materiel support to the Houthis. It took almost two years’ worth of work by the UN and independent WTI organizations to piece together evidence from Bahrain, Israel, Saudi Arabia, the United Arab Emirates, and Yemen before these claims were proven to have merit.

Speeding this process up will require preemptive, purposeful sharing of information. If conducted properly, timely sharing and independent verification could offer a potent remedy to the trust deficit that often accompanies accusations issued by the United States and its regional allies.

Tim Michetti spent six years investigating illicit weapon transfers in Africa and the Middle East on projects funded by several Gulf states and the European Union, including as an investigator for Conflict Armament Research.