Michael Knights is the Jill and Jay Bernstein Senior Fellow at The Washington Institute and cofounder of the Militia Spotlight platform, which offers in-depth analysis of developments related to Iran-backed militias.
Brief Analysis
Two enigmatic drone incidents in Saudi Arabia point to gaps in U.S. intelligence coverage and increasingly sophisticated deception tactics by Iran’s integrated militia networks in Iraq and Yemen.
Most of the details surrounding the two most recent drone penetrations into Saudi airspace have yet to be cleared up, which is both perplexing and unusual. Yet one aspect of the incidents is unambiguous—the coordinated reactions of Iran-backed propaganda networks in their immediate aftermath. This and other factors point to an intensified Iranian and militia focus on the Gulf states, a desire to carefully probe U.S.-Saudi solidarity, and the increasingly multidirectional nature of the drone and missile threat against U.S. facilities and partners in the Middle East.
Reported Intercepts Over the Capital
On January 23 and January 26, Riyadh’s airspace was penetrated, and interceptor missiles were fired at aerial targets. Given their late detection and lack of radar or visual signatures, the interlopers were probably semi-stealthy drones. Both interceptions occurred in daylight, which is very rare for attacks on Riyadh and could suggest a long-range, relatively slow drone that launched under cover of darkness and took hours to arrive over the capital. The target type, altitude, interceptor type, interception result, and ground damage (if any) remain unclear, though the Wall Street Journal reported that the Royal Court at al-Yamamah Palace was struck.
The points of origin for each penetration are equally enigmatic. Iran boasts a family of long-range drone systems with the range to reach Riyadh with lightweight explosive or sensor payloads, whether launched from its own territory, Yemen, or Iraq. Iran-backed militias have twice assisted the Islamic Revolutionary Guard Corps (IRGC) in launching small explosive-laden delta-wing drones from Iraq into Saudi Arabia at ranges of 600-700 kilometers—first in May 2019 against the East-West oil pipeline, and again that September against the Abqaiq oil processing plant. Houthi-held territory in Yemen has also been used to launch long-range Sammad-2 and Sammad-3 explosive-laden drones against Riyadh and targets even further away (e.g., see the July 2018 strike against Abu Dhabi International Airport in the United Arab Emirates).
The lack of publicized weapons wreckage or other information makes it impossible to pinpoint where the January 23 and 26 incidents originated, but indications are privately emerging that at least one of the strikes came out of Iraq. The most likely scenario is that the perpetrators launched a semi-stealthy drone from a site near Baghdad—perhaps the Jurf al-Sakhar base used by U.S.-designated terrorist militia Kataib Hezbollah, which also launched the May and September 2019 attacks from this location.
Coordinated Propaganda
Given the apparent lack of substantial damage, another potential purpose for the penetrations may have been to advance the propaganda aims of Iran and its proxies. Houthi drone and missile attacks on Riyadh since 2017 have focused on grabbing headlines, not causing material damage, which would be difficult anyway due to the small payload and limited accuracy of Houthi systems capable of reaching a city 1,000 kilometers away. In the current case, there is ever more evidence to suggest a primarily symbolic motive.
On January 23, a previously unknown group calling itself Alwiyat al-Waad al-Haq (True Pledge Brigades) claimed responsibility just after Riyadh’s airspace was breached. The group then revealed a professional-looking logo, and its emergence was rapidly greeted with support from the five main Iran-backed muqawama (resistance) propaganda channels in Iraq. This level of cohesion is unusual and suggests that they were instructed to do so by the IRGC, the only senior partner with the connections and sway to direct all of them at once.
Alwiyat al-Waad al-Haq’s claim also coincides with a rise in the Iranian threat network’s anti-Gulf propaganda. Iraqi militia channels blamed Saudi Arabia for the January 21 Islamic State bombing in Baghdad, while al-Wad al-Haq’s January 23 communique included a threat to Dubai. And on January 27, the group sent out an image of that city’s Burj al-Khalifa skyscraper being struck by Iranian-type drones—a post that was immediately rebroadcast by all five major muqawama networks. This slick and coordinated reaction suggests four things about the current mindset of Tehran and its proxies:
Iran-backed militias may be turning their focus toward Saudi Arabia and the UAE, perhaps playing into Gulf fears that the new leadership in the U.S. executive and legislative branches will not rally energetically to their defense, particularly in the case of nonlethal attacks.
Iran may be testing its capacity to undertake multidirectional attacks on Saudi Arabia from different territories, and gauging the U.S. reaction to such strikes. On January 26, for instance, the Kataib Hezbollah-linked Telegram channel Kawthariyoun showed a map in which attacks against Saudi Arabia are depicted coming out of Saada (in Houthi-held Yemen), Abu Kamal (a Syrian locale controlled by Iran-backed militias), Jurf al-Sakhar (the aforementioned Kataib Hezbollah base), Lebanon, and Iran.
Tehran is seemingly testing its ability to confuse the international community with coordinated militia messaging. For instance, Iraqi groups appeared to champion the Riyadh penetrations and link them to militia grievances, while the Houthis quickly denied responsibility. The Houthi denial may stem from a desire to reduce tensions with the United States and secure relief from recent sanctions. Whatever the case, Iran and its proxies now seem more adept at controlling the narrative about where their strikes originate, apparently learning from their less effective efforts after the May 2019 Saudi pipeline attack (when the Houthis pretended they launched drones that actually came from Iraq) and the September 2019 Abqaiq attack (when the Houthis launched short-range drones at the same time that missiles entered the kingdom from Iran and Iraq).
Actions against one member of Iran’s threat network—whether those actions are real, perceived, or purposefully misattributed—may be answered by Tehran directly or by other members. This mindset is an inversion of Washington’s approach under former secretary of state Mike Pompeo, where U.S. retaliation could be launched against any arm of the threat network regardless of which one attacked U.S. interests. In the current case, Iraqi militia factions exploited the January 21 Islamic State bombing in Baghdad as an excuse to retaliate against the “Zionist-American-Saudi plot” against the muqawama. This is not entirely new: in November 2013, for instance, the Iraqi Shia militia Jaish al-Mukhtar fired rockets into Saudi Arabia in apparent retaliation for a bombing at Iran’s embassy in Beirut. Yet this “all for one” strategy may now be maturing and escalating.
Implications for U.S. Policy
U.S. officials are right not to overreact to what may have been a probe of Riyadh’s airspace, and the Saudis may have their own reasons to save face and downplay the penetrations. If left unchecked, however, such probes may become bolder, especially if Tehran’s motive is to splinter the U.S.-Saudi and U.S.-Emirati relationships and coerce Washington into providing sanctions relief more quickly. The Biden administration should therefore take appropriate and measured steps in response:
Closer monitoring of Iranian affiliates. The White House should task the intelligence community with disentangling the web of “facade” groups like Alwiyat al-Wad al-Haq. This includes clarifying their connections to the IRGC and designated terrorist groups such as Kataib Hezbollah and the Houthis’ Ansar Allah. These networks are being used in an increasingly coordinated effort to blur Iranian accountability for attacks on U.S. facilities in the Middle East and targets in Bahrain, Israel, Saudi Arabia, and the UAE.
Expose more information on drone, missile, and naval attacks. The United States should strengthen its surveillance capability to quickly determine the launch points of low-visibility drone and cruise missile attacks, particularly along the Iraqi-Saudi border. It should also continue seeking access to weapons intelligence on drone, missile, and mine fragments related to operations emanating from Iran, Iraq, and Yemen. Tehran values the ability to portray itself as a law-abiding member of the international community, so the United States should transparently release such data to ensure that Congress, the UN, and the wider public are under no illusions about the regime’s true face. And if the Riyadh drone incidents did emanate from Iraq, Washington should privately encourage Baghdad to develop a ground presence at militia bases such as Jurf al-Sakhar in order to prevent further launches.
Encourage rapid missile defense coordination between Israel, Saudi Arabia, and the UAE. These are the states most threatened by Iran’s missiles and drones, and they cannot hope to develop effective defenses unless they cooperate more closely with each other and the United States. Washington should work behind closed doors to develop a consortium for accelerating the development of next-generation air defenses, including high-energy laser, hypervelocity, and high-power microwave weapons.
Michael Knights is the Bernstein Fellow with The Washington Institute.
