Navy Collisions: Competence, Overload and Cyber Factors
[By Chris Demchak, Keith Patton, and Sam J. Tangredi]
These are exclusively the personal views of the authors and do not necessarily reflect the views of the U.S. Naval War College or the Department of Defense.
Security researchers do not believe in coincidences. In the past few weeks, a very rare event – a U.S. Navy destroyer colliding fatally with a huge commercial vessel – happened twice in a short period of time. These incidents followed a collision involving a cruiser off Korea and the grounding of a minesweeper off the Philippines, and have now resulted in the relief of a senior Seventh Fleet admiral. Surface warfare officers (SWOs) look to weather, sensors, watchstanders, training requirements, leadership and regulations (COLREGS) as possible contributing factors to the collisions.
Cyber security scholars, in contrast, first look to the underlying complex technologies trusted by the crew to determine the proper course of action. With the advancements in navigational technology, computer-aided decision making and digital connectivity, it is human nature that seafarers become more dependent on, as well as electronic aids for navigation and trusting the data the systems provide. While the U.S. Navy emphasizes verification of this data by visual and traditional navigation means, the reality is the social acceptance of the validity of electronic data is a feature of modern culture. The U.S. Navy, with an average age in the early 20s for sea-going sailors, is not immune from this effect. But what if the data is invalid or, as an extreme possibility, subject to outside manipulation?
In directing a pause for all warship crews (not currently conducting vital missions) during which to conduct assessments and additional training, the Chief of Naval Operations – Admiral John Richardson – was asked whether the Navy was considering cyber intrusion as a possible cause. The CNO responded that concerning cyberattack or intrusion, “the review will consider all possibilities.”
The truth could be that only mundane factors contributed to the accident, but as an intellectual thought experiment, what follows are explanations following the logic of open-source information. The first set of explanations will focus on the human in the loop to argue that the fundamental cause is likely human miscalculation rather than intentional distortion of data. The second explanation will focus on the criticality of accurate data provided to humans or their technologies. The pattern suggests a lack of ‘normalness’ as the ‘normal accidents’ of complex systems deeply integrated with cyber technologies – in frequency, locations, and effects. In the case of the destroyers, a credible case—based on analysis of land-based systems–could be made for a witting or unwitting insider introduction of malicious software into critical military navigation and steering systems. The conclusion will offer motivations for timing and targets, and some recommendations for the future.
Similarities in the Scenarios
There are similarities in the recent collisions. Both happened in darkness or semi-darkness. Both happened in shipping lanes in which literally hundreds of major ships pass per day, to say nothing of smaller ships and fishing vessels. Crew manning of both vessels approach 300 sailors, with approximately one-eighth of the crew on watch involved in controlling/steering, navigating, as lookouts, and operating propulsion machinery when the ship is at its lowest states of alertness, known as peacetime steaming. It is logical that both ships were at peacetime steaming at the time since they were not conducting military exercises. In contrast, when USS JOHN S. McCAIN conducted a freedom of navigation operation (FONOP) in the vicinity of the artificial islands China has created to buttress its territorial claims to the South China Sea on August 9, her crew was likely at high alert.
In looking for possible explanations, we have downloaded and examined readily available open-source data concerning the two recent collisions, including identified locations of the incidents, vessel characteristics, crew manning, weather, proximity to land, automatic identification system (AIS) ship tracks, and shipping density data. We have consulted with naval experts on ship handling and on the Sea of Japan and Strait of Malacca.
Collision avoidance on Navy vessels can be roughly cast into four elements, three technical and one human. On the bridge, the watchstanders have (1) the AIS system which relies on tracking ships that broadcast their identities, (2) the military radar systems linked into the ships combat systems, (3) the civilian radar and contact management systems, and (4) the eyes of sailors standing watch on lookout normally posted port, starboard, and aft on the vessel. All these systems are complementary and overlapping, but not exactly delivering the same information.
The AIS system – in which merchant vessels transmit their identities and location data – is an open and voluntary system relying on GPS. In principle, keeping the AIS on is required for the 50,000-plus commercial vessels over 500 GRT (gross registered tons). As of 2016, 87 percent of merchant shipping uses satellite navigation and 90 percent of the world’s trade is carried by sea. Nonetheless, ship captains can turn it off and travel without identifying themselves (at least until detected by other means). U.S. Navy vessels do not routinely transmit AIS but each bridge monitors the AIS of ships around them in addition to the military and civilian radar systems and the eyes of the sailors.
In quiet or tense times, the bridge watch and the Combat Information Center (CIC) teams of naval warships must synthesize this information and make sound decisions to avoid putting the ship into extremis. This is a continuous, round-the-clock requirement and a tough task for even the most skilled.
In contrast, merchant ships such as the Alnic MC, a chemical tanker (which hit JOHN S. McCAIN) have tiny crews with great reliance on autopilot. One of the indications that the ACX Crystal, the cargo vessel colliding with the USS FITZGERALD, was on autopilot was its behavior after the collision. Having been temporarily bumped off its course by the collision, it corrected and resumed steaming on the original course for about 15 minutes before stopping and turning to return to the collision location. While nothing is yet published about what was happening on either bridge in the June FITZGERALD collision, one can surmise that it took 15 minutes for the small crew to realize what had happened, to wrest control back of the behemoth, and turn it around.
Possible “Normal” Explanations
Flawed human decision-making
U.S. Navy warships maintain teams of watchstanders in order to mitigate the effects of a flawed decision being made by any one individual. Ultimately, one individual makes the final decision on what actions to take in an emergency—the Officer of the Deck (OOD) if the Commanding Officer is not available—but recommendations from the others are assumed to help in identifying flaws in precipitous decisions before they are actually made.
In contrast, in merchant ships with only two or three deck watchstanders, there is less of a possibility that flawed decision-making is identified before incorrect actions are taken. These actions can also be influenced by unrelated disorienting activities. Alcohol is not permitted on U.S. warships, abuse of drugs at any time is not countenanced, and U.S. naval personnel are subjected to random urinalysis as a means of enforcement. On a merchant ship these policies vary from owner to owner, and inebriation or decision-making under-the-influence has contributed to many past collisions.
Common tragedy from fatigue in an inherently dangerous environment
Collisions at sea happen. U.S. warships have collided with other warships, including aircraft carriers and with civilian vessels. USS FRANK EVANS was cut in half and sunk in 1969 when it turned the wrong way and crossed the bow of an Australian aircraft carrier. In 2012 the USS PORTER, a destroyer of the same class as the FITZGERALD and McCAIN, was transiting the Strait of Hormuz. The PORTER maneuvered to port (left) to attempt to get around contacts ahead of it, passing the bow of one freighter astern and then was hit by a supertanker it had not seen because it was screened behind the first freighter. Many of the previous collisions involved a loss of situational awareness by an at-least-partly fatigued crew. It is hard to avoid such conditions in an inherently dangerous, around-the-clock operating environment.
There has been no report of a problem with the FITZGERALD prior to her collision. The Navy, however, has acknowledged the MCCAIN suffered a steering casualty prior to the collision. While backup steering exists in the form of manual controls in aft steering or using differential propulsion to twist the ship in the absence of rudder control, such control methods are not as efficient as the normal controls. Additionally, there would be a brief delay in switching control unexpectedly or transmitting orders to aft steering. In normal conditions, this would not be serious. In a busy shipping lane, with the least hesitation due to shock at the unexpected requirement, the brief delay could be catastrophic.
Quality of training for ship handling by young Surface Warfare Officers (SWOs)
One can look at the U.S. Navy Institute Proceedings (the premier independent naval journal) and other literature to see signs these incidents may be symptoms of a larger issue involving the training of watchstanders. In March 2017, LT Brendan Cordial had a Proceedings article entitled “Too Many SWOs per Ship” that questioned both the quality and quantity of the ship handling experience that surface warfare officers (SWOs) received during their first tours. Later in a SWO’s career track, the focus of new department heads (DH) is tactical and technical knowledge of the ship’s weapons systems and ship’s combat capabilities, not necessarily basic ship handling. Ship handling skill are assumed. But such skills can atrophy while these officers are deployed on land or elsewhere, and individual ships have unique handling characteristics that must be learned anew.
In January 2017, CAPT John Cordle (ret.) wrote an article for Proceedings titled “We Can Prevent Surface Mishaps” and called into question the modern SWO culture. Peacetime accident investigations rarely produce dramatic new lessons. They simply highlight past lessons. Errors in judgment, lapses in coordination, task saturation, fatigue, a small error cascading into a tragedy. Those who have stood the watch on the bridge or in the CIC read them, and frequently think, “There, but for the grace of God, go I.” However, unlike in the aviation community, near misses and accidents that almost happened were not publicly dissected and disseminated to other commands. Officers have always known how easy it is to be relieved for minor mishaps, but they do not have the community discussion of all those that nearly happened to learn vicariously from the experiences.
Pace of forward operations
Both destroyers are homeported in Yokosuka, Japan, the headquarters of the U.S. Seventh Fleet. While only the line of duty investigation has been released for the FITZGERALD collision, one can assume that the officers and crew of the McCAIN would have heard some of the inside details from their squadron mate. Logically the CO of McCAIN would be doubly focused on the safe operation of his ship as he approached the highly congested traffic separation scheme (TSS) in the straits of Malacca and approach to Singapore harbor. But the loss of one of only seven similar and critical ships in a highly contested environment would almost certainly increased the tempo and demands on the MCCAIN as it attempted to move into the Singapore harbor just before sunrise.
In this case, tempo should have been accommodated adequately. While technology is a key component of U.S. warships, it is only one of many tools. Lookouts scan the horizon and report contacts to the bridge and CIC watch teams. The officer of the deck (OOD) uses their professional skills and seaman’s eye to judge the situation. If in doubt, they can, and should, call the Captain. Indeed, close contacts are required to be reported to the Captain. The bridge and CIC have redundant feeds to display contacts detected by radar, sonar, or AIS. The computer can perform target motion analysis, but crews are still trained to manually calculate closest points of approach and recommend courses to avoid contacts via maneuvering boards (MOBOARDs). This is done both on the bridge and in the CIC so even if one watch misses something critical, the other can catch it. When ships enter densely trafficked areas, additional specially qualified watchstanders are called up to augment the standard watch teams. Yet, it is possible that—under the theory of “normal” accidents—somewhere in this multiply redundant sensor system, misread or misheard information led to the human equivalent of the “telephone game” and the wrong choice was dictated to the helm.
But along with the “normal” explanations, the possibility of cyber or other intentional distortion of critical data does remain a possibility.
Cyber Misleads and Mis-function
If one argues that neither the Navy nor commercial crews were inebriated or otherwise neglectful, accepts that the weather and visibility were good for the time of day with crew in less stressful routine sailing postures, finds serendipitous mechanical failure of severe navigational significance on both ships difficult to accept as merely normal accidents, and questions if tempo distraction alone could explain both events, then the impossible could be possible.
It is worth laying out using unclassified knowledge how cyber intrusions could have been used to cause warships to have collisions. This is not to say the collisions could not have multiple sources. But for the purposes of this thought experiment, however, this section will focus on cyber explanations.
Cyber affects outcomes because it is now a near universal substrate to all key societal and shipboard functions. Either cyber errors mislead humans, or its digitized operations malfunction in process, action, or effect, or both while buried inside the complex systems. To make this point, one of the two major classes of cyber assaults – the distributed denial of service (DDOS) – works by using what the computer wants to do anyway – answer queries – and simply massively overloads it into paralysis. It has been shown in a number of experiments that large mechanical systems integrated with electronics can be remotely made to overload, overheat, or vibrate erratically into breakdown by hackers or embedded malware. In several reports, the McCAIN may have suffered failures in both its main steering system (highly digitized) and its backup systems (more mechanical). Less information has been released on the earlier collision between the FITZGERALD and the ACX Crystal cargo ship so steering issues there cannot be known at this time.
However, that the two collisions involved large commercial ships with similar crews and technologies, and that two U.S. Navy vessels were sister ships close in age and technologies suggests commonalities that could be more easily exploited by adversaries using cyber means rather than humans. In particular, commonly shared logistics or non-weapon systems such as navigation are more likely to have vulnerabilities in their life cycles or embedded, routinized processes that are less sought by – or discernible to – the standard security reviews.
In a complex socio-technical-economic system like that involved in both circumstances, the one-off rogue event is likely the normal accident – i.e., the FITZGERALD incident. But too many common elements are present in the McCAIN event to suggest a second, simply rogue outcome. Hence, it is...
The opinions expressed herein are the author's and not necessarily those of The Maritime Executive.