Introduction

Regional states have built an impressive surveillance grid over the past decade. The harder question is what to do once a suspicious vessel has been spotted, and who has the standing to say what it was really doing. In August 2022, the Chinese vessel Yuan Wang 5 sailed towards Sri Lanka’s Hambantota port, a facility that Colombo had leased to a Chinese state-owned firm for 99 years after it could not service the loans taken to build it. Officially, the ship was on a replenishment visit. Indian commentary described it as a spy ship. It is a satellite and missile tracking vessel operated by China’s military, carries a crew of over 400, and has supported Shenzhou crewed missions and lunar probes. Sri Lanka first asked Beijing to defer the call under Indian and American pressure, then relented within days and let the ship dock, on the condition that it conduct no research in Sri Lankan waters. In January 2024, Colombo imposed a one-year moratorium on Chinese research vessels docking at its ports or operating in its exclusive economic zone. In September 2025, Yuan Wang 5 was tracked near Indonesia while India had issued airspace restrictions over the Bay of Bengal for a suspected long-range missile test.

The episode contains the whole problem in miniature. Everyone could see the ship. Nobody could say, in terms that would satisfy a court, a diplomat or a sceptical neighbour, what it was there to do, or convince the coastal states that had to decide whether to let it in that refusing was worth the friction with its owner. That gap between seeing and explaining is the subject of a growing debate in Indian Ocean security circles, and it is the reason the concept of attribution has begun to move from the vocabulary of cyber policy into maritime strategy.

A Crowded, Quiet Ocean

The Indian Ocean has become a busy operating area for vessels whose purpose is difficult to pin down. Over the last decade, Chinese research ships such as Yuan Wang, Shi Yan 6 and Xiang Yang Hong 3 have become a routine presence, alongside Chinese-origin underwater gliders and autonomous underwater vehicles, and distant-water fishing fleets. They have been reported off the east coast of Africa, in the Arabian Sea, in the Bay of Bengal and in the waters west of Indonesia. On occasion, some have switched off their Automatic Identification System transponders, the equipment that lets other ships and coastal authorities see who and where they are.

Take Xiang Yang Hong 3. It was scheduled to conduct deep-water research in the southern Indian Ocean in early 2024, and China had also sought permission for a survey off the Maldivian capital, Malé. Or take Shi Yan 6, which Chinese state media describes as an oceanography and marine ecology vessel with a crew of about 60, and which Sri Lanka allowed to operate in its waters in late 2023 despite Indian objections. In each case the official description is scientific. In each case, hydrographic and seabed data, of the kind that supports both fisheries science and submarine operations, could serve either purpose. That is what “dual-use” means in practice, and it is why the ambiguity is not a bug of the situation but its central feature. For littoral states such as India, Sri Lanka and Indonesia, this creates what might be called a response dilemma. Reacting forcefully to an activity that may turn out to be benign risks diplomatic damage, and in Sri Lanka’s case, economic exposure to a creditor that holds roughly half of its bilateral debt. Not reacting risks the slow erosion of sovereignty, the loss of intelligence advantage, and the normalisation of behaviour that could matter enormously in a crisis. Grey-zone activity works precisely because it lives in this space, below the threshold of armed conflict, exploiting the blurred lines between military and civilian, and between war and peace.

What the Existing Architecture Can and Cannot Do

It would be unfair to say the region has done little. The past decade has seen a real investment in what security planners call maritime domain awareness, or MDA: the ability to detect, track and identify what is moving on and under the water. India has built coastal radar networks across Seychelles, Mauritius, Sri Lanka and the Maldives. Indonesia, South Africa and Australia have launched satellites to watch their maritime zones. East African states including Kenya, Tanzania and Mozambique are actively monitoring foreign distant-water fishing fleets. India and Indonesia have written below-threshold activity into their maritime and defence strategies.

On top of these national efforts sits a dense layer of regional information-sharing bodies. The Information Fusion Centre-Indian Ocean Region, hosted by the Indian Navy in Gurugram, the Regional Maritime Information Fusion Centre in Madagascar, the Regional Coordination Operations Centre in the Seychelles, the Combined Maritime Forces’ Joint Maritime Information Centre, and the Quad’s Indo-Pacific Maritime Surveillance Collaboration are all designed to help partners see more and share what they see. But every one of these systems answers the same question: what is out there? Almost none answers the follow-up questions that decide whether governments can act. What exactly is that vessel doing? Who is responsible? Is the behaviour deliberate, and is it directed or supported by a state? Detection tells a coastal state that a research ship has gone dark for eleven hours over a subsea cable route. It does not tell that state whether the ship crew was conducting a survey, whether the state that owns it ordered the survey, or whether the same pattern has appeared in three other countries’ waters. Without those answers, governments hesitate, and hesitation is what grey-zone operators count on.

What Attribution Means

In international law, attribution is the process of establishing that a wrongful act can be assigned to a particular actor, ordinarily a state. In practice, it means building a case: examining behavioural patterns, ownership structures, technical capabilities, operational links, location, timing and connections to state agencies, then drawing a reasoned conclusion about intent. Done well, attribution does several things at once. It raises the cost of future misbehaviour by removing plausible deniability, it lets governments calibrate a proportionate response instead of a panicked or timid one, and it creates a documentary record that can support diplomatic, legal or economic measures.

The difficulty is that a single country attributing a grey-zone act by a much larger power takes on political and legal risk alone. It may be accused of overreach, exposed to retaliation, or left without corroboration when its evidence is challenged. This is where collective attribution becomes attractive. When several states pool information and agree, in advance, on the standards of proof they will apply, any single conclusion carries the weight of shared judgement, and the political exposure is spread rather than concentrated.

Lessons from Europe and the Question of IORA

Two institutions elsewhere in the world show how this can work. The European Union’s Hybrid Fusion Cell and NATO’s Joint Intelligence and Security Division both pool national intelligence, declassify material where appropriate, and produce assessments of hybrid threats against agreed guidelines. Their outputs are not decisions; member states retain control of what they do with the findings. But the shared assessment gives each government the institutional legitimacy to act, as happened in the coordinated European response to Russian hybrid activity. NATO has gone a step further by creating Counter-Hybrid Support Teams that can be deployed to help member states facing such pressure.

An Indian Ocean analogue would need an institutional home, and the most plausible candidate is the Indian Ocean Rim Association, or IORA. Its membership of 23 littoral states and 12 dialogue partners makes it the only genuinely region-wide body in the space. That distinguishes it from sub-regional arrangements like the Regional Coordination Operations Centre, from nationally anchored hubs such as the Information Fusion Centre-IOR, and from coalition groupings like the Combined Maritime Forces or the Quad’s surveillance initiative, which by design include only some of the relevant states. Maritime Safety and Security is already one of IORA’s priority areas, covering domain awareness, information exchange and standardised processes. It would not be a stretch to add a technical attribution function to that portfolio: a small team that assembles and assesses evidence, while leaving the political decision on whether to publicise or respond to the member governments, exactly as the EU cell does.

The Politics That No Mechanism Can Engineer Away

It would be a mistake to treat this as a technical fix. Attribution is a political decision as much as an analytical one, because naming a state carries consequences, and different governments weigh those consequences differently. IORA’s members do not share a single threat perception. Something India regards as coercive or hostile may look to a fellow member like a routine fisheries matter, a sovereignty question or simply an economic relationship. Many Indian Ocean states depend heavily on Chinese trade, finance and infrastructure, and that dependence shapes how willing they are to be seen criticising Chinese conduct at sea. Sri Lanka’s own oscillation on the Yuan Wang 5 visit, and its later moratorium, is a case study in a small state trying to satisfy two powerful neighbours.

There is also a structural limit. IORA operates on consensus. A single member with strong economic ties to the country under discussion can slow or block a collective conclusion, and when the subject is a Chinese activity affecting several IORA members, that is not a hypothetical risk. Any realistic proposal has to accept this. A consensus body will rarely produce a bold public accusation on short notice. That said, the alternatives are not obviously better. Coalition groupings can move faster but lack legitimacy in the eyes of states outside them, and a purely Indian or Quad-led attribution risks being dismissed as partisan. An IORA process, even a slow and cautious one, offers something the faster options cannot: the region’s own voice. Even a modest outcome, such as an agreed methodology for assessing suspicious activity, common indicators of concern, and shared protocols for response, would improve on the status quo. Standards agreed in advance are more likely to hold when a crisis arrives than positions improvised under pressure.

Conclusion

The Indian Ocean has spent a decade getting better at seeing. Coastal radars, satellites and fusion centres have made it harder for a vessel to move unobserved through the region’s busiest waters. That investment has been worthwhile, but it has also exposed the limits of surveillance as a security strategy. Knowing that a research ship has switched off its transponder or that a glider has surfaced near a cable landing is only the first step; the real difficulty lies in deciding what it means and what to do about it.

Collective attribution is not a substitute for naval presence, capacity-building or bilateral diplomacy, and it will not resolve the underlying strategic competition. What it can do is narrow the space in which ambiguity operates, and give smaller littoral states a way to respond that does not require them to stand alone against a much larger neighbour. The path runs through IORA or something like it, and it will be slow, contested and dependent on consensus. But the alternative is to keep watching, in ever finer detail, activity that no one is willing or able to explain. For an ocean that carries a large share of the world’s trade and energy, and where the seabed is increasingly threaded with cables and sensors, that is not a sustainable position.

Consulting Editor