Contents

Monthly focus: Seasonal update for the ...... 4 General background ...... 4 Important figures ...... 4 Evolving threat ...... 7 Summary ...... 8 West Africa ...... 9 Incidents ...... 9 Assessment ...... 10 Nigeria / Niger Delta ...... 10 Gulf of Guinea (Côte d'Ivoire to Gabon) / West Africa (Senegal to Angola) ...... 12 Western Indian ...... 14 Incidents ...... 14 Assessment ...... 15 – ...... 15 Somali Basin – ...... 16 Southern Red ...... 18 South East Asia ...... 19 Incidents ...... 19 Assessment ...... 20 Singapore and Malacca Straits, , Indonesian archipelago ...... 20 Sulu / Celebes ...... 22 Definitions ...... 23 Threat levels ...... 23 Incident types ...... 23

Monthly Intelligence Report

This report includes an overview of attacks against merchant vessels over the past month in three focus regions (West Africa, the western part of the and South East Asia) as well as assessments of different types of threats in these regions. These areas are currently considered to be the global regions where the threat of such attacks is most significant.

Advice given and recommendations made do not constitute a warranty of future results by Risk Intelligence or an assurance against risk. Recommendations made are based on information provided by the client and other information available at the time of writing. No express or implied warranty is given in respect of any judgment made or to changes or any unforeseen escalation of any factors affecting any such judgment.

Documents are for the benefit of the client only and may not be disclosed to any third parties without the prior written consent of Risk Intelligence; such consent not to be withheld unreasonably. The client agrees to indemnify Risk Intelligence against any claims and any resulting damages that may be caused by any unauthorised disclosure of such documents.

Page 3 of 23

Monthly focus: Seasonal update for the Gulf of Guinea

General background

The security situation in the Gulf of Guinea, the waters off countries between Côte d'Ivoire and Gabon, has long been a cause of concern for the shipping industry. The threat level has been highlighted by several high-profile attacks in late 2019 and early 2020. The current Covid-19 crisis is unlikely to have a significant effect on the threat level for merchant ships in the Gulf of Guinea, particularly off the Nigerian coastline.

Overall, a significant change of the current threat is unlikely in 2020. At the same time, the situation should be seen in context.

There is no doubt that violent attacks with the aim to kidnap seafarers are a major concern for crews and vessel operators. Despite many claims in the media, however, security in the Gulf of Guinea has not deteriorated in 2019 or 2020. The sections below provide a broader perspective and highlight factors that are particularly important for merchant ships operating in this area.

Important figures

Based on a broad range of sources, Risk Intelligence has collected information for about 80 to 140 maritime security incidents per year in West Africa since 2007. In 2019, the overall number was within this long-term average, even showing a slight drop compared to the previous year.

These figures include all types of incidents, ranging from petty thefts from vessels at anchor to violent kidnap-for-ransom attacks. However, the number of kidnap-for-ransom attacks in 2019, both failed and successful, was also close to the average over the past ten years.

In 2020 to date, a similar trend has emerged, shown in the figure below.

14

12

10

8

6

4

2

0 Jan Feb Mar Apr

2016 2017 2018 2019 2020

Number of attempted and successful kidnap-for-ransom attacks against merchant ships per month in the Gulf of Guinea between 2016 and 2020 (Source: Risk Intelligence System)

Page 4 of 23

In both January and February, three failed or successful kidnap-for-ransom attacks against merchant vessel traffic in the Gulf of Guinea were recorded by Risk Intelligence. In March, six attacks were recorded, yet even this figure is – unfortunately – not particularly high compared to previous years.

Predictions for April are complicated, underlined by the differences in previous years. In 2016 and 2017, there were 13 and eight attacks respectively while only two attacks were recorded in April 2018 and April 2019 respectively. For this year, one important aspect is the upcoming rainy season in the Niger Delta. Weather conditions during this period – which usually starts in late April – are likely to limit opportunities for attacks at significant distances from the Niger Delta coastline.

Another important aspect is the success rate of attacks aimed at kidnapping seafarers from merchant ships, shown in the figure below.

50

40

30

20

10

0 2016 2017 2018 2019 2020 (to 31 March)

Percentage of successful kidnap-for-ransom attacks against merchant ships in the Gulf of Guinea between 2016 and 2020 (Source: Risk Intelligence System)

Between 2016 and 2018, less than one third of all kidnap-for-ransom attacks recorded by Risk Intelligence were successful. In 2019, the percentage increased significantly, due to successful attacks outside of Nigeria's maritime domain where vessels were less protected by additional security measures.

In the first three months of 2020, the success rate of attackers has dropped again towards the long-term average. While it is too early for a definitive assessment, two factors seem to have changed:

• Countries around the Gulf of Guinea have increased security measures for vessels at anchor, highlighted by one attack at the Douala anchorage in March which was deterred by military personnel acting as armed guards. • Crews are now particularly vigilant, highlighted by several reports about 'suspicious activity' since January which – at least in some cases – were likely to be a misinterpretation of general patterns for life in the region.

Page 5 of 23

While protection measures for anchored merchant ships are relatively simple, vessels at sea remain vulnerable. Among other things, navies in the region suffer from a lack of available assets, highlighted by the kidnapping of seven crew members from a container ship off Gabon in March.

Crew vigilance therefore remains particularly important. Given enough time, the crew may be able to assemble in the citadel and wait for assistance, even if a ship is successfully boarded by attackers. While assistance by a naval vessel is not guaranteed and dependent on the location of an attack, navies across the region have significantly improved their response rate in recent years.

At the same time, statistics from recent years suggest that crew vigilance is higher during daytime than at night, highlighted by a significant difference in the success rate of attacks which are shown in the figures below.

Daytime attacks Nighttime attacks

Successful Attempted Successful Attempted

Successful and attempted kidnap-for-ransom attacks against merchant ships in the Gulf of Guinea between 2016 and 2019 during daytime (left) and nighttime (right) (Source: Risk Intelligence System)

Since 2016, only one in three attacks carried out during daytime resulted in the kidnapping of seafarers. Over the same period, the success rate for nighttime attacks is 74%, underlining the need for crews to remain vigilant at all times.

This may be difficult to put into practice, given the broad range of tasks that crews have to carry out. However, operators should consider all appropriate actions to allow for a high level of vigilance even during hours of darkness. In combination with technical measures to make it harder for attackers to board a vessel, an alert bridge team can be the difference between a successful and a failed attack.

Page 6 of 23

Evolving threat

Seasonal variations between the rainy season in the Niger Delta – which roughly lasts from April to September – and the dry season are one important aspect that influences the threat level for merchant vessel operations in the Gulf of Guinea. The impact of these variations is highlighted in the figure below.

30

25

20

15

10

5

0 2016 2017 2018 2019

Jan-Mar & Oct-Dec (Dry season) Apr-Sep (Rainy season)

Number of attempted and successful kidnap-for-ransom attacks against merchant ships in the Gulf of Guinea during the Niger Delta dry season (grey) and the rainy season (red) between 2016 and 2019 (Source: Risk Intelligence System)

In general, the number of attacks against merchant ships during the dry season – between October and March – is much higher than during the rainy season in the Niger Delta. In the recent past, the only exception was 2016, yet this was due to a large number of incidents in April which were recorded before the actual onset of the rainy season.

Other factors further complicate the situation, for example traffic patterns or naval operations. The security situation on land across the Niger Delta also has a major impact on the threat level in the maritime environment.

Overall, the situation is particularly challenging from ship operators because hot spots and attack patterns are constantly shifting. In the coming months, it will also be important to monitor the impact of the Covid-19 pandemic on criminal patterns on land and at sea.

The recent drop in oil prices is also likely to have a significant impact on the Nigerian government's budget, potentially leading to a renewed militant campaign across the Niger Delta. It is too early to assess the actual impact of these developments but the number of demonstrations organised by various groups across the Niger Delta region seems to have picked up already in recent weeks.

Page 7 of 23

Summary

All types of merchant ships may be targeted by Niger Delta-based attackers trying to kidnap crew members for the purpose of collecting ransoms. Even LNG tankers in ballast have come under attack off Nigeria in recent years, underlining the significant threat level that ship operators have to mitigate.

Countries across the region have improved cooperation and started various efforts on the national level to improve the situation. The most notable example of these efforts is the Deep Blue project in Nigeria, expected to be fully operational later this year. However, all these efforts are hampered by a lack of – financial and human – resources. The overall threat level for merchant ships is therefore unlikely to decrease significantly in the coming months while attack patterns will continue to evolve.

Mitigating the threat remains particularly important. That includes the implementation of all relevant BMP measures to decrease the chance that attackers are able to board a ship. Additional measures, such as the use of dedicated escort vessels for transits to and from Nigerian ports and terminals, should also be considered. Any measures should be based on a thorough risk assessment that includes the current threat level for a specific voyage or port call, the vulnerability of a particular vessel and the potential consequences of a successful attack.

Finally, companies should evaluate and adjust their contingency plans, instructions for masters and emergency guidelines on an ongoing basis. While this will not fully mitigate the threat of seafarers being kidnapped, it reduces the overall risk to crews, ships and cargoes as much as possible. Constant monitoring of the situation is also important to note emerging trends or hotspots for attacks.

Additional services

The Risk Intelligence System provides clients with real-time intelligence and situational awareness that will assist in avoidance of threats in the Gulf of Guinea as well as in other parts of the world. Moreover, the Risk Intelligence Marketplace offers ship operators the possibility to purchase security intelligence for individual ports and terminals throughout the entire region. Bespoke services such as vessel-specific or voyage-specific risk assessments can also help to mitigate current threats in the Gulf of Guinea.

Page 8 of 23

West Africa

Events included in this report occurred between 1 and 31 March 2020.

Incidents

04 March – General cargo ship ENDURANCE, general cargo ship UAL LOBITO, product tanker VENLO boarded Theft / failed theft Takoradi anchorage Ghana Between 03:00 and 04:00 LT/UTC

05 March – Product tanker STI BOSPHORUS reports suspicious activity Suspicious approach 05:21N 001:31E 49 NM S of Lomé Togo 07:45 LT/UTC

05 March – Product tanker MINERVA VIRGO attacked Kidnap/ransom 05:36N 002:20E 45 nm S of Cotonou Benin 14:00 LT (13:00 UTC)

05 March – General cargo vessel HUANGHAI GLORY attacked Failed kidnap/ransom 05:02N 003:28E 80 nm S of Lagos Nigeria 19:27 LT (18:27 UTC)

07 March – Offshore supply vessel INGRID K boarded Theft Abidjan anchorage Côte d’Ivoire 01:50 LT/UTC

15 March – Offshore supply vessel BOURBON HORUS reports suspicious activity Suspicious approach Kwanda anchorage Angola 17:05 LT (16:05 UTC)

19 March – Container ship MAERSK TAASINGE boarded Theft Pointe-Noire anchorage Republic of Congo Nighttime

Page 9 of 23

19 March – Product tanker ARCHON boarded Theft Lagos anchorage Nigeria 01:45 LT (00:45 UTC)

20 March – Product tanker STENA IMPORTANT attacked Failed kidnap/ransom Douala anchorage Cameroon 00:45 LT (23:45 UTC on 19 March)

20 March – Passenger vessel ELOBEY VI attacked Hijacking 22 nm off Port-Gentil Gabon 06:00 LT (05:00 UTC)

22 March – Container ship MSC TALIA F. attacked Kidnap/ransom 00:33N 008:25W 60 nm W of Libreville Gabon 08:26 LT (07:26 UTC)

25 March – Bulk carrier SCARABE attacked Failed kidnap/ransom 03:08N 005:35E 75 nm SW of Brass Nigeria 11:45 LT (10:45 UTC)

25 March – Crude oil tanker CAP DIAMANT reports suspicious activity Suspicious approach 02:30N 004:04E 155 nm SW of Brass Nigeria 17:00 LT (16:00 UTC)

27 March – Bulk carrier ANASA boarded Armed robbery Conakry anchorage Guinea 02:30 LT/UTC

27 March – Container ship LANA attacked Failed kidnap/ransom 02:45N 006:55E 94 nm S of Bonny Island Nigeria 17:00 LT (16:00 UTC)

Assessment

Nigeria / Niger Delta

The most significant threats in West Africa continue to be posed by attackers off the southern and eastern Niger Delta. All types of vessels may be targeted in this area, yet successful attacks are more likely when 'low and slow' vessels are attacked. Bulk carriers, small product tankers and offshore supply vessels are particularly at risk of being boarded.

In March, a general cargo vessel, a bulk carrier and a container ship were attacked, highlighting the threat level off the Niger Delta coastline. Moreover, a suspicious approach was reported by the crew on a crude oil tanker at a distance of more than 150 nm from the coast.

Available details in the latter case are limited, meaning that it is possible that it was a misidentification of general patterns of life in the region. Overall, however, perpetrators remain capable of carrying out long-range attacks which may be supported by mother ships. Such attacks deep offshore are significantly more likely during the current dry season in the Niger Delta.

During the rainy season between April and September, conditions are less suitable for speedboat operations at sea. Spells of good weather are possible during this period, however, meaning that crews on merchant vessels should remain vigilant at all times.

Page 10 of 23

Overall, incidents in March have highlighted the current trend of attacks taking place deep offshore, both inside and outside Nigeria's maritime domain. Nevertheless, the threat level increases closer to the Niger Delta coastline. In the eastern part of this area, limited willingness for cooperation between Nigeria and Cameroon further complicates law enforcement at sea, underlined by frequent incidents on the Calabar river and off the Bakassi peninsula.

At the same time, many incidents off Nigeria – as well as in neighbouring countries – are linked to other illicit activities at sea, namely smuggling of various goods to and from Nigeria or human trafficking from Nigeria towards countries in Central Africa. Close links between groups based in the Niger Delta and in the Bakassi area in Cameroon's anglophone part are very likely.

Attackers with ladder during the attempt to board the bulk carrier SCARABE off Nigeria in March 2020

Responding to ongoing attacks may be complicated for the Nigerian Navy due to a lack of assets at sea. Furthermore, the Interregional Coordination Centre in Yaoundé has noted that reporting to centres located outside the region may lead to a delayed response. After some attacks in 2019, authorities in coastal states were only informed several hours after the incident, giving them no opportunity to provide a timely response.

Regarding mitigation measures, the Nigerian Navy issued the most recent version of its memorandum of understanding (MoU) to 30 companies in March 2019. These are the only companies authorised to provide escort vessels for merchant ships which can operate within Nigeria's territorial waters and EEZ. All escort vessels have to be inspected by the Nigerian Navy and are partly manned by naval personnel, while MoU holders have to fulfil several specific requirements.

There is no legal background to employ security forces personnel directly as armed guards on merchant ships. Such arrangements are widespread in practice, highlighted by several incidents in recent months, yet vessels or even masters and other crew members may be detained if armed guards are embarked. In case of an attack, the ship may also be damaged when attackers and armed guards exchange fire. During some incidents in the past, crew members have even been injured or killed when they were caught in the crossfire.

Threat levels off the southern and eastern Niger Delta are somewhat higher than off Warri and Lagos. In the immediate vicinity of Lagos, main threats for berthed or anchored product tankers are thefts of cargo, highlighted by one incident in March after three similar cases were reported in February. Perpetrators often use simple means to transfer fuel products into canoes and are

Page 11 of 23

likely to escape upon discovery. Other types of ships are also targeted on occasion, yet violence against crew members is very rare.

Forecast

The general threat level in the coming month remains severe off the Niger Delta, especially off Bayelsa and Rivers states. During the current dry season in the region, attacks at distances of more than 150 nm from the Niger Delta coastline are possible, yet weather conditions will make such long-range attacks less likely in the coming weeks. All types of vessels may come under attack, but successful boardings are more likely on 'low and slow' ships.

Inshore attacks against local passenger and cargo vessels as well as against military detachments are a threat across the Niger Delta, particularly in Delta, Bayelsa and Rivers states. While such attacks will not be a major concern for merchant vessels in the coming month, they underline the overall security challenges in this part of Nigeria and crews should be particularly vigilant during river transits to and from ports in the Niger Delta.

Low oil prices and the current Covid-19 pandemic are unlikely to have an impact on the security situation in the coming month. However, the situation should be monitored carefully as a deteriorating economic situation is likely to lead to demonstrations and militancy in Nigeria, particularly across the Niger Delta.

Gulf of Guinea (Côte d'Ivoire to Gabon) / West Africa (Senegal to Angola)

Several attacks in the wider Gulf of Guinea – outside the Nigerian EEZ – have been reported in November and December, two additional incidents occurred in February. In early March, the product tanker MINERVA VIRGO was attacked around 40 nm south of Cotonou in Benin's EEZ. One crew member – who was not able to reach the citadel in time – was kidnapped from the ship. The perpetrators were able to escape before a naval vessel reached the tanker to provide assistance.

Benin Navy patrol boats in the naval base in the port of Cotonou (Photo: Dirk Siebels/Risk Intelligence)

Page 12 of 23

On 22 March, the container ship MSC TALIA F. was attacked en route to Libreville in Gabon's EEZ, around 60 nm offshore. Seven crew members were kidnapped from the 957 TEU vessel and the perpetrators were also able to escape before a Portuguese naval vessel was able to reach the area and provide assistance.

Both incidents highlight that a naval response to such incidents is complicated because perpetrators only have to spend very little time on the ship when they are successful in kidnapping at least some crew members. Vigilant watchkeeping and regular security drills are therefore important, further highlighted by figures in the monthly focus section of this report.

Furthermore, the attack against the MSC TALIA F. highlights the links between piracy attacks against merchant vessels and other illicit activities at sea across the region. It was very likely carried out by the same group that had hijacked a small passenger vessel off Port-Gentil earlier. While both incidents are currently under investigation, it is likely that this group was involved in smuggling or human trafficking activities between Nigeria and Gabon. Overall, such links highlight the need to address maritime security challenges on a broad scale, not limited to piracy.

Several thefts or attempted thefts from vessels at anchor off different ports across West Africa were also reported in March. With the exception of an incident off Conakry in Guinea, these incidents did not involve violence against crew members. If perpetrators were discovered, they tried to escape immediately when the crew sounded the alarm.

Forecast

Throughout the Gulf of Guinea, the threat of kidnap-for-ransom attacks remains low to elevated for the coming month, depending on the distance from the Niger Delta coastline where perpetrators have access to infrastructure to hold hostages and conduct ransom negotiations. Several attacks at significant distances from the Niger Delta in recent months have underlined the threat level, most recently the kidnappings of crew from the MINERVA VIRGO and the MSC TALIA F. described above.

The threat level for hijackings for the purpose of cargo theft is assessed as low for the coming month in this area. Moreover, this specific type of threat is almost exclusively directed against product tankers in laden condition. Small product tankers – up to 10,000 dwt – would be the most likely targets. Tugs, offshore supply vessels and similar vessel types may be hijacked to be used as mother ships, but other merchant vessels are very unlikely to be affected. Moreover, some hijackings which have been reported in 2019 – as well as the hijacking of a small passenger vessel off Gabon in March – do not signify an increased threat level for merchant ships in general. Thorough analysis of these incidents shows that they are likely connected with fuel smuggling or other illicit activities in the maritime environment.

In most countries throughout the Gulf of Guinea and West Africa as a whole, perpetrators may try to board berthed or anchored vessels. Around most anchorages, the amount of small boat traffic is virtually impossible to control for security agencies. Threat levels vary between different ports, but perpetrators will generally escape upon discovery. Confrontations with the crew are very rare, although Conakry in Guinea is an exception as perpetrators there are often armed and violent.

Page 13 of 23

Western Indian Ocean

Events included in this report occurred between 1 and 31 March 2020.

Incidents

01 March – Product tanker LADY SARAH reports suspicious activity Suspicious approach 24:43N 057:38E Gulf of Oman 11:06 LT (08:06 UTC)

03 March – Crude oil tanker GLADIOLUS reports incident with unmanned skiffs Other maritime risk 14:20N 052:35E Gulf of Aden 13:30 LT (10:30 UTC)

07 March – Saudi forces disrupt suspected Houthi operation Military operation Saleef area Yemen Unknown time

11 March – Missiles fired at US-Iraqi base Military operation North of Baghdad Iraq Unknown time

12 March – Merchant vessel challenged on VHF Other maritime risk 24:21N 058:32E Gulf of Oman 22:15 LT (19:15 UTC)

13 March – US launches airstrikes in Iraq Military operation Central and southern Iraq 01:30 LT (22:30 UTC on 12 March)

25 March – Jack-up platform in tow boarded Failed theft 21:24N 72:20E Off Alang India 20:20 LT (14:50 UTC)

Page 14 of 23

Assessment

Gulf of Oman – Persian Gulf

The security situation continues to be driven by tensions between Iran and the US, as well as Iran and its regional competitors such as Saudi Arabia. The US has recently imposed additional sanctions on companies and individuals in Iran but also in third countries, including China, under its policy of ‘maximum pressure’. The main focus remains on Iran’s oil exports and on arms exports to proxy groups in the region.

Iran has been hit hard by the Covid-19 pandemic. The domestic political situation in Iran is fragile but this does not mean that the government is unable to continue advancing its strategic interests in the region. As an additional factor, oil prices plunged in March due to the price war started by Saudi Arabia and Russia. This will affect Iran, but perhaps not significantly as its economy has already adjusted to sanctions. There are, however, some incentives for Iran to disrupt Saudi Arabia’s increase in production, although it is not yet clear if Iran will pursue this course or stay focused on other goals in Iraq and Syria.

IRGC Navy exercise (Photo: Yeyed Shahaboddin Vajedi)

Overall dynamics remain in play and it is assessed that Iran will continue to look for ways to increase the cost of the US sanctions policy for the international community. The country has already increased production of low-enriched uranium to return the international focus to its nuclear programme. It is also expected that there will be asymmetric attacks against US interests or the interests of competitor states (especially Saudi Arabia) in the region. These attacks could include bombings or similar strikes, perhaps undertaken by proxy forces to allow deniability by the Iranian government. US-linked assets, military or otherwise – including diplomatic and oil & gas – might be targeted. Related oil & gas infrastructure among allied countries might also be targeted, such as in previous cases in 2019 where Saudi and UAE assets were attacked.

The Persian Gulf and the Gulf of Oman – including the Strait of Hormuz – remain a high-risk area as designated by Risk Intelligence. Attacks against tanker vessels in May and June 2019 showed that Iran can put pressure on the international community, specifically oil markets, as well as cause splits in relations between the US and Saudi Arabia and the UAE. It was able to conduct these attacks without significant consequences and provide a template for similar attacks that

Page 15 of 23

Iran might consider. The primary threat is still to tanker vessels, particularly those with links to Saudi Arabia and the UAE such as ownership/flag or cargo, but other ships might become targets of opportunity.

Routine harassment and aggressive enforcement by Iran of its waters is expected to continue. There was an incident on 12 March where vessels in the Gulf of Oman were hailed over VHF, which is likely to have been conducted by Iranian forces. Small boats circled a vessel on 1 March in the same area, although in this case the identity was not confirmed. Iranian forces use small speedboats, but there is also a volume of small local craft in the area, often engaged in smuggling activities and there have been reports of such craft shadowing merchant vessels.

Forecast

Despite domestic difficulties, Iran faces the same situation as in previous months. The country remains under pressure from US sanctions and needs to find mechanisms to change the status quo in its favour. While its regional influence in countries such as Iraq, Syria, Lebanon and (to a lesser degree) Yemen remains central, it also needs to respond to hardline US policies.

Although Iran’s response to the oil price war is not clear, this development adds another dimension to the regional situation. Any maritime actions that Iran takes might serve two purposes: increasing the costs of Saudi Arabia’s oil policies and refocusing the international community on Iran’s predicament.

Iran has a variety of options, including the use of proxy forces, throughout the region and on land as well as at sea. Forecasting specific actions therefore remains difficult. However, if Iran’s actions to date provide a reliable guide, oil tanker operations are likely to be the main focus of any maritime disruptions in the region.

Somali Basin – Gulf of Aden

There were no suspicious approaches by small craft reported in this area during March. This was despite an increase in reporting earlier in the year, and a concentration of fishing vessels in certain locations, notably in the Gulf of Aden. It is often the case that there is a surge in reporting of local craft when their movements change, but then merchant vessels become more familiar with the ‘pattern of life’ in the area. Probing operations to identify potentially vulnerable vessels cannot be ruled out.

The threat of Somali piracy in general remains elevated. It is mainly determined by current capabilities of Somali pirates, which are limited to the range of small craft without support from mother ships and is up to 500 nm from the Somali coast, but likely closer to 300 nm. This includes the Gulf of Aden, the western , and the Somali Basin. Fishing vessels were the primary targets in 2019, but merchant vessels remain targets of opportunity. Naval vessels and patrol craft continue to be active in the area, acting as an important deterrent.

The Saudi Arabia-flagged crude oil tanker GLADIOLUS reported an incident in the Gulf of Aden in the IRTC in the afternoon of 3 March. The tanker was approached by two unmanned skiffs, with a third, possibly manned, in the vicinity. The incident was reported as “an imminent terrorist attack" by the Saudi Press Agency, which also showed pictures – circulated in other media – of

Page 16 of 23

an unmanned skiff approaching the tanker on a collision course and then turning away before direct impact. Other reports noted that the skiff was apparently remote-controlled.

Houthi forces have used waterborne improvised explosive devices (WBIEDs), or drone boats, to attack coalition warships and Saudi-flagged tankers in the , although these were of a different configuration than the skiff in this incident, which was typical of local craft in the area.

It is unclear if this incident represents an increased threat to vessels in transit in the IRTC and a return of an increased terrorist threat – such as the incidents with the tankers GALICIA SPIRIT in October 2016 and MUSKIE in May 2017. It is assessed that if the tanker was indeed attacked by a drone boat that it was likely to have been specifically targeted because of its Saudi flag and that the incident was related to ongoing Saudi operations in the Yemeni civil war – and was either carried out by a terrorist or a militia group insurgency threat.

Unmanned skiff approaching the crude oil tanker GLADIOLUS in the Gulf of Aden (Photo: Saudi Press Agency)

Last month’s report noted that there is a low threat of attacks by Iranian-supported proxy forces in the northern Somali Basin or the Gulf of Aden, but that the distance from Iran increases the deniability for the Iranian government if it supports such attacks. It is possible that this attack was a failed attempt by Iran to attack a Saudi tanker or a demonstration of capability, intended to show that Iran has a capability to target vessels outside of the Gulf of Oman and the Persian Gulf.

Forecast

Capabilities of Somali pirates will likely continue to decline while their intentions shift elsewhere. Some 'subsistence' level of piracy is expected to continue. Approaches to identify vulnerable vessels are assessed as likely, even if the number of actual attacks remains low.

The exact nature of the GLADIOLUS incident is unclear. The incident may have been linked to Yemen or to wider regional tensions involving Iran. Similar incidents cannot be ruled out, particularly if linked to Yemen. If there was a link to Iran, however, Iran may now shift its focus elsewhere, having demonstrated a regional capability. Crude oil tankers are now being used to store oil while prices are low, and a number of these are expected to deploy to the northern Arabian Sea. While there have been no suggestions that they are likely targets of attack, their presence adds a new dimension to regional dynamics.

Page 17 of 23

Southern Red Sea

There were Saudi airstrikes against claimed Houthi installations in northern Yemen close to Saleef (Salif) port on 7 March. Saudi media published aerial photos on the installations and claimed that they were targeting waterborne improvised explosive device (WBIED) boats in the area to prevent attacks against Saudi shipping and ports in the Red Sea.

These airstrikes were consistent with previous statements from Saudi Arabia that the Houthis are increasing maritime operations again, as seen in the claim last month that a Houthi WBIED was destroyed in the vicinity of Jizan port. There has, however, been no significant increase in cross-border Houthi attacks and the focus of the fighting on land has been on the well-established frontlines.

The situation in Yemen is looking increasingly tenuous. International observers have warned that a breakdown of the fragile ceasefire and peace talks could be imminent. If this proves to be the case, an increase in Houthi attacks on Saudi interests – on land and at sea – is expected. This is an effective way for the Houthis to increase the costs of involvement in this conflict to Saudi Arabia.

There is still a threat to tanker vessels in transit, particularly those with links to Saudi Arabia and – to a lesser degree – the UAE such as ownership/flag or cargo. This threat would increase if the ceasefire breaks down. The main threat for other vessels is becoming targets of opportunity. There is also a threat of collateral damage to merchant ships due to proximity to coalition naval vessels during an attack. The Houthis have their own political goals, not explicitly linked to Iran, but the Red Sea remains an area of possible operations related to tensions in the wider region.

There is only a low threat of piracy in this area. Somali pirates have not operated in the southern Red Sea for several years. Terrorist groups, including al-Qaeda in the Arabian Peninsula (AQAP) and Islamic State (IS), are operating in southern Yemen. They are primarily active on land but have access to coastal areas. The maritime threat level is currently low, given that AQAP and IS are largely preoccupied with operations in their respective areas of control in southern Yemen. It is possible that one of these groups was responsible for the GLADIOLUS incident, but their access to the coastline is more favourable in the Gulf of Aden.

Forecast

Security-related developments in this area will depend on the dynamics of the conflict in Yemen. The peace talks between Saudi Arabia and the Houthis will be of particular interest. A complete breakdown is likely to lead to more significant military operations by the Houthis.

Asymmetric means will be favoured, particularly drones, missiles and WBIEDs. These have proved to be effective for putting pressure on coalition countries and encourage them to strike political compromises. In the first instance, attacks on land would be favoured. Maritime operations could include the use of WBIEDs against port areas (likely) or tanker vessels linked to Saudi Arabia (less likely).

Page 18 of 23

South East Asia

Events included in this report occurred between 1 and 31 March 2020.

Incidents

09 March – Crude oil tanker ANNE reports suspicious activity Suspicious approach 01:14N 104:04E TSS 01:15 LT (17:15 UTC on 08 March)

12 March - Product tanker ENDAVOUR II boarded Failed theft General Santos City anchorage Philippines 01:57 LT (17:57 UTC on 11 March)

13 March - Container ship KOTA ANGGERIK boarded Failed robbery Belawan anchorage 20:20 LT (13:20 UTC)

16 March - Bulk carrier SAM JAGUAR boarded Failed robbery 01:08N 103:31E Singapore Strait TSS 05:40 LT (21:40 UTC on 15 March)

22 March - Product tanker AU LIBRA boarded Failed robbery Batangas port Philippines 18:55 LT (10:55 UTC)

Page 19 of 23

Assessment

Singapore and Malacca Straits, South China Sea, Indonesian archipelago

The three incidents and one suspicious activity during March in the Straits of Malacca and Singapore align with the typical modus operandi for this area. They underline the continued activity and increased frequency of boardings seen during 2019, in part due to operations of at least one local criminal group.

10

8

6

4

2

0 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

2019 2020

Number of maritime security incidents in the Singapore and Malacca Straits per month in 2019 and 2020 to date (Source: Risk Intelligence System)

Vessels passing the Straits of Malacca and Singapore can encounter boardings that generally pose minimal threat to the crew. The thirteen incidents in these straits in 2020 have involved one tanker and one container vessel (the KOTA ANGGERIK) boarded in the Malacca Strait, whilst in the Singapore Strait incidents have involved three tankers (including the AU LIBRA) four bulk carriers (including the SAM JAGUAR), one OSV, three barges and one suspicious approach (the ANNE). Most incidents have involved vessels underway in the Singapore Strait.

In 2019, the number of incidents in the Straits of Malacca and Singapore reached 50, with 13 in the Malacca Strait and 37 in the Singapore Strait. Of these, 19 involved tugs and their tows: 17 in the Singapore Strait and two in the Malacca Strait. A total of 16 involved bulk carriers and tankers underway, all within the Singapore Strait. The remaining incidents were boardings at anchorages and two vessels boarded at berth. As the borders of Indonesia, Malaysia and Singapore intersect in this area, perpetrators seem to take advantage of jurisdictional challenges, improving their ability to escape.

Boardings involving violent armed perpetrators are rare. However, incidents during the third quarter of 2019 and one incident in January that left two crew members injured serve as reminders that such activity can impact crew on vessels in the area. This also applies to the southern part of the South China Sea off the Malaysian peninsula, as well as farther south in the Natuna Sea. Crew alertness is essential due to the potential for violence that can result in injuries.

Page 20 of 23

Barges are particularly tempting targets because of their easy accessibility and the minimal risk of confrontation with crews. As coastal authorities have increased the number of patrols, a quick response is usually possible when incidents are reported. Perpetrators are often armed with knives or machetes, yet it is unlikely that they will attempt to attack the crew.

Ships are particularly vulnerable at anchorages. Areas of concern include the anchorages off Batam, the Cigading, Ciwandan, Merak, and Panjang anchorages along the , as well as anchorages at Batangas (where the ENDEAVOUR II was attacked in March), Belawan, Manilla and Tanjung Priok. Boardings can also take place at berth as seen at Dumai, Tanjung Priok and Batam. Perpetrators usually board vessels undetected at night and target supplies and engine stores while avoiding contact with the crew. However, incidents involving armed perpetrators at the Batam, Tanjung Priok and Taboneo anchorages show that the crew may be confronted.

Indonesia Sea and Coast Guard vessel on patrol (Photo: Indonesian Ministry of Transportation)

No hijackings for cargo theft have taken place in South East Asia during 2019 or to date in 2020. In 2018, there was only one reported incident involving a product tanker (the LEE BO 25 nm off Mersing, Malaysia in the South China Sea). The immediate arrest of the gang leaders in Batam might have stymied intentions of Indonesian groups to conduct such operations.

Forecast

In the coming month, the threat of boardings of anchored vessels for the purposes of theft or armed robbery is severe. Higher threat locations include the Belawan, Batangas, Dumai, Manila, Merak and Panjang anchorages along and near the Sunda Strait, the Singapore Strait and in the southern part of the South China Sea off the Malaysian peninsula, as well as farther south in the Natuna Sea off Pulau Mapur, Indonesia, where vessels underway are also vulnerable. The threat of vessels underway being attacked in the Singapore Strait for the purposes of theft or armed robbery is high.

The threat that locally trading tankers will be hijacked for product theft is moderate. The frequency of these operations is very limited due to effective law enforcement. The threat that internationally-flagged tankers will be hijacked for cargo theft is low; these operations generally involve tankers trading and registered in the region.

Page 21 of 23

Sulu / Celebes Seas

There were no incidents recorded during March, although at the end of the month a warning was issued by the IMB regarding the sighting of a suspected ASG group positioning itself near the waters off eastern Sabah, Malaysia. Five fishermen kidnapped from the Malaysia-flagged fishing vessel SSK 00543 in January, the first and only kidnapping at sea in 2020, have not yet been released. There have been no kidnappings of crew from merchant vessels in this area since March 2017, and at this time the only seafarers held by the ASG are the five mentioned above.

Overall, small vessels remain vulnerable. Information from ReCAAP infers that the rescue and release of abducted seafarers is the result of military and law enforcement operations in the Philippines, undertaken to neutralise the ASG. The kidnap-for-ransom trend has been downward following military actions by Philippines security forces against the ASG, the main group involved in such attacks in this area. In 2019, anti-ASG operations intensified, resulting in the deaths of ASG leaders and militants in addition to the loss of speedboats, weapons and strongholds in Mindanao and the Sulu archipelago.

The closest that ASG militants have come towards a successful operation involving a merchant ship since the attack against the SUPER SHUTTLE TUG 1 in March 2017 was the failed attack against the general cargo vessel KUDOS 1 off Sibago Island in February 2018.

Regular multinational naval exercises have also contributed to the suppression of kidnap-for- ransom operations, as have maritime patrols involving Indonesia, Malaysia and the Philippines. Military and police actions have been intensified elsewhere, maintaining pressure on the ASG and other militants in Sabah (Malaysia) and North Kalimantan (Indonesia). Other factors include the establishment of a coastguard station on Tawi Tawi, the Philippines' programmes to reintegrate surrendering ASG militants, and Indonesia's land patrol training exercises.

The Philippines Coast Guard (PCG) has confirmed its presence in the Sibutu Channel and merchant vessels should expect to see PCG vessels and naval patrols. The PCG has also deployed some escort boats with sea marshals to protect merchant vessels in the .

Forecast

Small craft, tugs, local merchant vessels and in particular fishing trawlers remain most vulnerable to ASG operations, whilst international merchant vessels could be targeted. It remains to be seen whether the ASG or its affiliates maintain the capability to attack merchant ships. However, with an estimated force of about 400 ASG militants persisting, vigilance remains important.

The overall threat that international merchant vessels in the Sulu and Celebes Seas will be targeted for kidnap-for-ransom attacks is assessed as moderate, particularly for vessels within the designated transit corridors. The threat level for small craft, fishing vessels and local merchant vessels in the vicinity of the Sulu archipelago from the southern area off Sabah to Zamboanga to be targeted for kidnap-for-ransom operations is high.

Page 22 of 23

Definitions

Threat levels

The threat levels used in this report are as per the Risk Intelligence System and are assessed based on the likelihood and consequence of a particular threat type occurring. The threat levels are as follows:

• Low: Negligible impact on operations in the coming month due to the unlikely occurrence of threat-related activity. • Moderate: Some potential for minimal impact on operations in the coming month due to occurrence of low- level threat-related activity. • Elevated: Moderate impact on operations in the coming month is possible with some threat-related activity expected to occur. • High: Potential for major impact on operations in the coming month due to the occurrence of significant threat- related activity. • Severe: Potential for severe impact on operations in the coming month as significant threat-related activity is ongoing or expected to occur.

Incident types

The report covers the threats of piracy and armed robbery at sea in various forms, but does not include other threats to merchant vessel operations such as stowaways or smuggling. All possible contingencies cannot be covered by any assessment and this report only includes an assessment of the threat for merchant vessels in general and not specific vessel types.

Page 23 of 23