Category Archives: Capability Analysis

Analyzing Specific Naval and Maritime Platforms

Warfare Tactics Instructor: A Unique Opportunity for Junior Officers

By Rear Adm. John Wade and Cmdr. Jeff Heames

Rapid technological advancements and the re-emergence of near peer competition require that we continue to invest in high end tools – platforms, weaponry, and sensors. Equally important are the tactics to employ them and the associated training investment we must make in today’s warfighters and future leaders in the Surface Warfare Officer (SWO) cadre. The centerpiece of an amped-up warfighting culture in surface warfare is the Warfare Tactics Instructor (WTI) program, available to all division officers, department heads eligible for shore duty, and a small number of limited duty and chief warrant officers.

The ideal onramp into the WTI community is during the first shore tour following completion of at-sea division officer assignments. This timing allows the WTI program to fit neatly in a career pipeline. Three attributes set the WTI program apart: the opportunity to develop expertise in areas the Navy needs, exposure to exclusive professional development opportunities during the readiness production tour and throughout a career, and the empowerment to make significant contributions at a very junior level.

Expertise

The ability to develop confidence through professional expertise early in a career has a profound accelerating effect on an officer’s development, and directly contributes to a sense of purpose and fulfillment. WTIs are afforded the time, resources, and experience-building opportunities they need to learn while making substantive contributions to tactics and warfighting proficiency.

The WTI program offers a gateway for young officers to develop deep tactical expertise in the fields of Integrated Air and Missile Defense (IAMD), Anti-Submarine/Surface Warfare (ASW/SUW), and Amphibious Warfare (AMW). Each field begins with a two week Instructor and Tactics Course (ITC) followed by a tailored, 14-16 week course of instruction. During this instruction period, prospective WTIs are mentored and coached to develop their skills at leveraging the Plan, Brief, Execute, and Debrief (PBED) methodology for rapid learning. Following this training, WTIs complete a 24-month “readiness production tour” at SMWDC headquarters or one of four SMWDC Divisions – focused on Sea Combat, IAMD, AMW, or Mine Warfare – or selected training commands (CSG-4/15, TTGP/L, ATG, CSCS, or SWOS, to name a few). During this tour, WTI skills are matured both in the classroom – and at sea – during Surface Warfare Advanced Tactical Training (SWATT) and other fleet training events.

Learning by Teaching

The emphasis on teaching as a basis for learning is based on an idea espoused by the Roman philosopher Seneca, who declared, “docendo discimus” or, “by teaching, we learn.” This model of learning is also used to develop WTI candidates, which is why instructor skills are a main focus of ITC. Quality of lesson delivery is established through a rigorous standardization process that must be completed for each lecture delivered by a WTI. It’s not uncommon for a WTI to invest weeks or months of research, as well as conduct numerous “murder boards” with fellow WTIs, technical experts, and senior officers, before presenting at the podium. The process is meant to maintain a high standard of instruction where WTIs have established mastery of content and exhibit confidence in delivery.

Focused Specialty Areas

During initial WTI training, students are assigned relevant tactical projects that match critical fleet needs and account for student interests. Projects often involve new technology or capability that must be thoughtfully and effectively integrated into maritime warfare doctrine. Other projects center on updating existing doctrine or repurposing existing systems in new and innovative ways. Specialty areas and projects are assigned based on WTI preference and crosscut broadly, from high-end tactics to training systems and learning science.

Focus area research often extends past initial WTI training, into subsequent readiness production tours, and beyond. SMWDC provides mentorship, applies resources, and opens doors to connect WTIs to thought leaders, technical community experts, industry partners, and community leaders to develop their specialty area work.

Coaching and Training Skills

WTIs are the core workforce of SMWDC’s advanced tactical training at sea. They rely on replay tools that include systems data, voice, and other information to rapidly build ground truth and facilitate debrief sessions. Equipped with irrefutable data on what really happened, the “I thought” and “I felt” ambiguities are driven out of the debrief process, enabling shipboard watch teams to learn and grow together more rapidly.

The combination of WTI knowledge, replay-assisted PBED, and specialized training focused on team dynamics and coaching skills offers a powerful method for improving learning across the fleet. The aim is to create an environment of transparency and mutual trust among watch team members, where Sailors enter debrief sessions eager to identify their own shortfalls in order to improve team and unit performance.

Lt. Cmdr. Katie Whitman, left, provides advanced training during an event at sea during her readiness production tour at Naval Surface and Mine Warfighting Development Center headquarters on Dec. 15, 2016. (U.S. Navy photo)

At-sea training allows WTIs to observe multiple ships and teams across a variety of training and operational circumstances. The WTIs gain practical insight into how doctrine plays out on the deckplates, as well as hone their ability to identify team performance issues during at-sea training. While the immediate objective is to improve tactical proficiency and unit performance, the skills WTIs gain are extraordinarily useful in future roles as department heads.

Performance Analysis

The final link in WTI expertise development leverages the strong partnership between SMWDC and the technical community. Our ability to measure and analyze performance among units is a challenge due to complex weapons systems, ship configuration variance, and the number of watchstanders distributed in different controlling stations. To build a clear picture of how tactics, training, and systems converge into warfighting capability, a detailed event reconstruction must take place that considers system actions, operator actions, and tactics.

Naval Surface Warfare Center (NSWC) Corona, Naval Undersea Warfare Center (NUWC) Keyport, and SMWDC have developed a Data Analysis Working Group (DAWG) to conduct performance analysis of SMWDC training events. The intent is to extract empirical, data-driven insights from the careful analysis of systems, operators, and tactical performance.

The process is laborious, but straightforward. Following at-sea training, event data is extracted from unit combat systems and sensors and then brought to NSWC for detailed analysis. Following initial analysis from the technical community, WTIs and SMWDC leaders stand up a 1-2 week DAWG event.

By examining system performance, operator performance, and tactics as a consolidated effort, the process can lead to discoveries not captured by direct observation – system anomalies, operator actions, and flaws in tactics. Findings and lessons learned can be very useful because they are underpinned by empirical data and technical analysis. To date, more than 40 weapons system performance anomaly reports have been generated from DAWG events. Systems issues have been identified and funneled to the appropriate technical community to resolve, tactics have been updated, and numerous operator performance issues have been provided to the training community as opportunities to grow or strengthen curriculum. This allows SMWDC to advocate for tactical updates among partner warfighting development centers and provide feedback to the TYCOM and Surface Warfare training enterprise.

For the WTI, immersion in performance analysis activity with civilian technical experts offers a unique lens into how weapons systems, operator performance, and tactics are all linked to create combat potential.

Professional Development

Because the program is highly sought after by driven, focused professionals, the majority of WTIs are on track to return to sea as department heads. Notably, WTI cadre retention is double historical averages in the Surface Warfare community at roughly 70 percent. WTIs heading back to sea have a notable advantage given the training they receive and the experiences they gain at a formative stage of their career that others simply do not.

Assignment Consideration

Similar to officers with other subspecialty skills – Nuclear Program, Financial Management, Operations Analysis, and Space Systems – WTIs have unique skillsets based on their focus areas. For example, IAMD WTIs in readiness production tour billets at the Naval Air Warfare Development Center in Fallon, Nev., have completed the Carrier Airborne Early Warning Weapons School, becoming dual-patched WTIs. These officers are among very few in the Navy with expertise in Integrated Fire Control (IFC) from both the Aviation and Surface perspectives.

To maximize the return on investment for these unique WTI skills, SMWDC is closely aligned with PERS-41 in the distribution process, ensuring future assignments leverage these strengths (e.g., assigning a WTI with IFC expertise to IFC-capable units). While assignments will always consider many variables, this close relationship ensures WTI experience and skills are considered during the assignments process. 

Continuing Education

WTI training and readiness production tours leave less time to complete graduate education between division officer and department head assignments. To mitigate this challenge, WTIs are awarded priority for graduate degree programs at service colleges as well as the Naval Postgraduate School distance learning programs.

Additionally, WTIs are afforded unique and exclusive professional development opportunities that extend throughout their careers. Annual “Re-Blue” events held at SMWDC Divisions are a venue for WTIs, both in-and-out of readiness production tours to attend week-long immersive workshops where information is exchanged and re-distributed into the fleet. Funded travel to Re-Blue events keeps WTIs connected to the sharp edge of the operational Fleet during their readiness production tours and beyond. Re-Blue events are an example of SMWDC’s commitment to maintaining excellence within the WTI cadre.

Empowerment

SMWDC is unlocking the potential of our junior officers and post-department heads, empowering them to swarm and solve difficult problems. While experience will always have a place at the table, this new generation of naval officers holds several key advantages. Unencumbered by “the way things have always been,” these officers are better suited to envision a future that leverages trends in technology, communication, and learning. This is an area where fresh perspective is an asymmetric advantage. WTIs bring their creativity, ingenuity, and initiative to developing the next generation of cutting-edge tactics, techniques, and procedures.

PACIFIC OCEAN (Sept. 26, 2016) — Lt. Serg Samardzic and Lt. Aaron Jochimsen, Warfare Tactics Instructors (WTI) of the Naval Surface and Mine Warfighting Development Center (SMWDC) coordinate missile exercise rehearsals on the USS Princeton during an anti-submarine exercise in the Southern California operating area Sept. 26, 2016. (U.S. Navy photo by Petty Officer 1st Class Trevor Andersen/Released)

WTI’s are creating a positive impact in the Fleet. From immersion in their focused specialty areas to tactical projects, and deckplate innovations, WTIs have built an impressive list of contributions since SMWDC’s formal establishment in June 2015. Consider the below examples of projects inspired, developed, and built by WTIs, while being supported by SMWDC leadership.

  • Lt. Cmdr. Katie Whitman was the lead action officer developing the SWATT in port and underway curriculum from the ground-up, using best-of-breed practices culled from aviation and other communities. She developed replay-assisted PBED for rapid learning and crafted the SWATT performance analysis strategy, which are now distinctive features of the exercise.
  • Lt. Ben Graybosch partnered with NUWC Keyport to revise the VISTA replay tool to include A/V-15 sonar system data, enabling the detailed “ground truth” ASW replay for unit sonar teams within 4 hours of completing ASW events. Graybosch’s effort moved the needle on ASW ground truth replay availability from days or weeks down to hours after an event. With replay tools that offer ground truth much earlier, we can increase the velocity of learning within surface ASW teams dramatically. VISTA is now employed in every ASW event supported by SMWDC and other fleet training events.
  • Lt. Brandon Naddel was the lead author for the Naval Surface Gunnery Publication released in 2017. Naddel and his team revised a 15-year-old document laden with technical jargon and dated systems into an information-packed and easily understood tactical publication relevant to all surface ships.
  • Lt. Tyson Eberhardt authored tactical guidance for the emerging Continuous Active Sonar (CAS) capability. Eberhardt leveraged at-sea training and experimentation events to rapidly refine tactical guidance in 2017. Based on his work, the CAS capability was used to great success in the operational fleet later that year.
  • Lt. Matt Clark designed and built a Target Motion Analysis (TMA) training tool accessible on any classified terminal with built-in performance analytics. Clark’s tool has potential to provide insight on the rate of individual skills decay in TMA. This type of information could then be used to inform currency thresholds for future training requirements.
  • Lt. Aaron Jochimsen was the lead author for the SM-6 TACMEMO. He conducted extensive research on SM-6 that included production site visits, participation in wargaming and experimentation, as well as involvement in fleet missile firings.
  • Chief Warrant Officer Troy Woods completed a readiness production tour with the Center for Surface Combat Systems, where he was involved in training individuals and teams on IAMD skills. Woods was subsequently assigned to USS BUNKER HILL (CG 52), where his skills are being put to use as lead IAMD planner within the Theodore Roosevelt Carrier Strike Group. Woods attended the IAMD WTI Re-Blue event in Dahlgren, Va., to share the operational perspective with his fellow IAMD WTIs and receive the latest tactical information from SMWDC IAMD Division leadership.

The WTI Program is a career opportunity that values our officers and empowers them to solve complex and challenging problems. SMWDC WTIs naturally have an eye toward innovation, are re-building the surface warfare library of tactical guidance, are shepherding new capability from delivery to operational success, and challenging the status quo in surface warfare training. Lt. Jochimsen, the lead author of the SM-6 TACMEMO, said it best:

“The opportunity to develop deep knowledge – Subject Matter Expertise – is a game-changing confidence builder as a junior officer. I feel much more prepared for the challenges of an at-sea department head assignment after completing a WTI readiness production tour.”

Conclusion 

The WTI cadre of warriors, thinkers, and teachers are uniquely equipped with the experience and knowledge to make significant contributions during their readiness production tours and throughout their careers. It is no coincidence that the same skills involved in developing tactical mastery are extraordinarily useful in subsequent assignments at sea – department head, XO, CO, and major command.

While statistically significant trend data does not yet exist for WTI selection for career milestone billets, members of the WTI cadre performed very well during recent administrative boards.

For those looking to increase their confidence and competitiveness for future at-sea assignments, the WTI program offers a unique opportunity to strengthen their professional attributes and shape the Navy for years to come.

Rear Admiral John Wade is Commander, Naval Surface and Mine Warfighting Development Center. 

Commander Jeff Heames serves as the assistant chief of staff for operations, training, and readiness for Naval Surface and Mine Warfighting Development Center.

Featured Image: PACIFIC OCEAN (May 9, 2017) – Warfare Tactics Instructor (WTI), Lt. Lisa Malone of the Naval Surface and Mine Warfighting Development Canter (SMWDC), provides tactical training to officers aboard the aircraft carrier USS Theodore Roosevelt (CVN 71) during a Group Sail training unit exercise (GRUSL) with the Theodore Roosevelt Carrier strike Group (TRCSG). (U.S. Navy Photo by Mass Communication Specialist Seaman Bill M. Sanders/Released)

General Quarters: Evolving Combat Casualty Care at Sea

By Alan Cummings

Medicine is a continuously evolving field, constantly learning from previous experience and improving. This is all the more true in the wartime trauma environment where resources are limited, conditions are austere, and time is either too short or too long. Our brothers and sisters ashore learned through Viet Nam and the early days of Iraq and Afghanistan that combat injuries will become combat fatalities unless personnel on the scene can stabilize the wounded for treatment by a higher echelon of care. As we consider a return to great power conflict and war at sea, our maritime forces should avail themselves of these lessons in order to prevent unnecessary losses of life in future combat.

A Revolution in Combat First Aid

Some wounds are almost always unrecoverable – penetrating head traumas, catastrophic injury to the thoracic cavity, or incapacitation of the central nervous system for instance. However, 20th century conflicts demonstrated that there are significant numbers of preventable battlefield deaths caused by two easily stabilized conditions: bleeding out (exsanguination) and sucking chest wounds (tension pneumothorax). Within one oft-cited research category (infantry casualties in Viet Nam), nearly 60 percent of preventable casualties were from exsanguination due to extremity bleeding and about 33 percent from tension pneumothorax.1

Fast-forward to the mid-1990s when special operation forces (SOF) medical providers began implementing a program known as “Tactical Combat Casualty Care” (TCCC). Their objective was to increase survivability amongst SOF elements by improving the trauma intervention capability and equipment of several, if not all, team members. Specifically, a greater emphasis was placed on controlling bleeding through properly employed tourniquets or hemostatic agents and alleviation of tension pneumothorax through needle decompression. As OIF and OEF repeatedly validated the effectiveness of TCCC in the SOF community, the training proliferated to conventional forces, becoming a cornerstone of modern deployment readiness. Consequently (and alongside other field medicine advances), the rate of service members being killed in action or ultimately dying of wounds is a fraction of previous conflicts.

Combat at sea will be somewhat different. For instance, penetrating trauma from discrete projectiles (e.g., bullets) will not be as prevalent as in land warfare, but similar wounds resulting from shrapnel or fragmentation will likely be common. Numerous additional and relevant mechanisms of injury are also possible during a surface combat scenario. Consider detonation of an anti-ship cruise missile close aboard or within the skin of the ship resulting in primary and secondary blast injuries, burns, blunt force trauma, as well as neurologic injuries without other outward signs of injury – all conditions similar to those seen aboard USS Cole.2 Individual crewmembers’ ability to intervene and stabilize some of these cases will no doubt improve survival rates as well as assist in maintaining combat effectiveness.

Behind the Times

While large deck warships (e.g. CVN, LHD) deploy with embarked top-of-the-line medical teams, the majority of the U.S. fleet does not. Cruisers and destroyers routinely put to sea with a well-trained independent duty corpsman (IDC, aka “Doc”) as the primary provider assisted by 1-2 junior corpsmen and a cadre of stretcher-bearers. LCS medical manning is even more constrained, usually a single IDC aided by a smaller number of stretcher-bearers. This has been an adequate arrangement for steady state surface operations (and the inspection-centric training cycles) of the past 30 years, but will not be sufficient if the fleet finds itself once again in a shooting war.

Outside of in-rate training for Corpsmen­ – which has already incorporated trauma lessons from Iraq, Afghanistan, etc.– first aid training aboard surface vessels has yet to advance much beyond U.S. civilian standards of care (basic first aid, CPR, and BLS). These standards do not account for the priority of combat operations over medical treatment, the increased lethality of combat and the shipboard environment, or extended timelines from point of injury to definitive care facilities (factors that led to TCCC’s inception). According to one Chief with extensive expeditionary experience and who has facilitated antiterrorism/ force protection (AT/FP) assessments of East Coast warships over the past three years, “Concepts of direct pressure, pressure points, and proper use of tourniquets are just not a thing out there.” Another Chief was told separately that pressure point manipulation for arterial bleeding was too advanced for shipboard use.

Surface force equipage has seen some TCCC-based upgrades in the past few years – better chest seals, hemostatic agents, and cricothyrotomy kits were improvements cited by a current IDC. However, mass casualty stations and first aid boxes are often still filled with antiquated equipment: less effective elastic tourniquets, basic gauze, medical tape, etc. While still helpful, there are better and more efficient tools available in the joint inventory. Additionally, if one were to ask a first tour junior officer or Sailor about an Individual First Aid Kit (IFAK), one might well receive a description of the small boxes commonly found at commercial retailers rather than a vital piece of military kit. These life saving pouches are not a standard-issue item and are often only present aboard vessels whose 1) whose Doc has encountered them (and their importance) elsewhere, and 2) whose discretionary budgets have permitted some quantity of acquisition (e.g. for armed watch standers).

What is most beneficial to the surface force, however, is the fact that casualty management is already practiced as part of general quarters, main space fire, or dedicated mass casualty drills. Rest assured, medical providers and corpsmen are thinking about these matters even when the rest of us are not. Additionally, Doc already has that cadre of stretcher-bearers who have been given an introduction to treating injuries, and there is already a system of pre-staged equipment outside of sickbay. These factors provide a ready-made infrastructure for the surface force to improve on.

TCCC for Tomorrow

The current medical manning construct aboard small deck warships has been adequate for non-combat operations in the post-Cold War era. The force is well-positioned to stabilize the occasional industrial traumas that can occur aboard vessels, or to manage larger groups of minor injuries. Since the 1990s, true tests of our readiness to simultaneously manage trauma and combat have been blessedly few: Cole in 2000 and Firebolt in 2004. Even then, both events were instantaneous and permitted crews to address medical emergencies without having to continue combat operations. That is an unlikely luxury during a strait transit actively contested by small boat swarms, or an open ocean patrol under enemy missile, torpedo, or gun attacks. 

The most fundamental change brought by TCCC was the universal carriage of an IFAK along with the training to use its contents. The kit itself contains the basic material to control traumatic bleeding, decompress a tension pneumothorax, and otherwise stabilize the service member until better care arrives or they are medically evacuated. The training aspect of this cannot be emphasized enough: classroom introduction to principles and equipment followed by periodic drills under varying levels of stress. Every Sailor afloat should don an IFAK with their general quarters kit, and be practiced on its use under stressful circumstances – i.e., loud, difficult, and strenuous– as part of combat drills.

An IFAK kit. (Defensereview.com)

In addition to IFAKs and training for the entire crew, the fleet needs to upgrade stretcher-bearer training from basic first aid to contemporary TCCC standards. Numerous curricula are already available to the fleet as well as training aids that have been developed through years of preparing ground troops. Similarly, mass casualty boxes and aid stations should be standardized with contents that will enable these TCCC-trained stretcher-bearers to implement the training they received. In deference to the different wound mechanisms likely to be seen in maritime combat, burn care supplies (e.g., Waterjel) should figure prominently in these kits.

Conclusion

What if the missiles fired in the Red Sea at Mason, Nitze, and Ponce had found their mark? Those reported Silkworm variants carry 300-500kg warheads. Would we instead be discussing a case study in TCCC rather than a recommendation? A smaller successor, the C-802 (160-300kg warhead), had recently struck the Swift while in service with the Emirati Navy and although casualty reports were minimal to none, photos of the damage (note the destroyed pilot house) make that assertion unlikely. It took collisions aboard Fitzgerald and McCain to give traction to problems long known to surface warriors and re-order some priorities. We do not need to suffer another such tragedy in order to update our ability to manage combat trauma at sea.

HSV 2 SWIFT, chartered by the U.S. Military Sealift Command from 2008-2013 and the UAE since 2015, was struck in October 2016 by a suspected C-802 variant resulting in the damage shown above. (Emirates News Agency)

Time will always be in short supply, thus prioritization is paramount in preparing crews to go to war. If we are returning to an emphasis on maritime warfighting, then we must be competent at more than just navigation and engineering. Like damage control, TCCC and other individual combat skills should be regarded as fundamental aspects of modern naval service – one more way in which we equip the man (and woman) rather than just man the equipment. The training, tools, and resources for TCCC are already available through the Navy’s medical and logistics systems, the surface force need only take heed of it.

Alan Cummings graduated from Jacksonville University with a BS in Physics. He served previously as a surface warfare officer aboard a destroyer, embedded with a USMC infantry battalion, and as a Riverine Detachment OIC. He is currently stationed as an intelligence officer at U.S. Southern Command The views expressed here are his own and in no way reflect the official position of the U.S. Navy, Department of Defense, or any agency of the U.S. Government.

CIMSEC is committed to keeping our content FREE FOREVER. Please consider donating to our annual campaign now so we can continue to provide free content.

References

1. Champion et al; “A Profile of Combat Injury”, The Journal of TRAUMA Injury, Infection, and Critical Care; Volume 54, Number 5, May 2003

2. Davis et al; “Distribution and Care of Shipboard Blast Injuries (USS Cole DDG 67)”, The Journal of TRAUMA Injury, Infection, and Critical Care; Volume 55, Number 6, December 2003

Featured Image: Sailors aboard the hospital ship USNS Comfort (T-AH 20) participate in medical training as the ship got
underway in preparation to respond to potential tasking following the destruction caused by Hurricane Matthew in the
Caribbean and southern U.S. east coast. (U.S. Navy photograph by Petty Officer First Class Marcus L. Stanley)

Institute for Future Warfare Studies Wants Your Writing on Seabed Warfare Concepts

By Bill Glenney

Articles Due: March 5, 2018
Week Dates: March 12–March 16, 2018

Article Length: 1000-3000 Words
Submit to: Nextwar@cimsec.org

The U.S. Naval War College’s Institute for Future Warfare Studies is partnering with CIMSEC to solicit articles putting forth concepts for warfare on and from the seabed as part of the larger maritime battle.

While the broad matter of economics and sea lines of communications should drive a national and Navy interest in securing the seabed, the transformative nature of warfare on and from the seabed should capture the imagination and be of concern to the Navy.

Systems operating from the ocean seabed – to include unmanned systems, mini-submersibles, smart mines, special forces, and others – will one day be deployed against surface, air, and land systems and not just traditional undersea forces – adding yet another dimension to cross- or multi-domain warfare. Navies will be forced to consider not only the role of the seabed and undersea forces in seabed combat, but also how effects from the seabed can shape the behavior of forces on the surface, in the air, and on land.

At its heart, the assumption of U. S. undersea supremacy based on owning the top 1,000 feet of the water column will become invalid, ineffective, and wrong, just as aviators once assumed air supremacy was assured from owning airspace above 30,000 feet. Similarly, the Submarine Force will have to abandon its traditional assumptions about how operating within the undersea domain enhances survivability. Seabed threats may mean the U.S. Navy could have to fight its way out of CONUS home waters before it could project power abroad, and allow adversaries to persistently threaten the U.S. Navy’s flanks and rear support areas. Warfare under the sea may come to look more like tunnel warfare of World War One or suppression of enemy air defenses in Syria than ASW of the Cold War.

The seabed has already long suffered from neglect by the U. S. Navy. For example, modern sea mines can already project power from the seabed with little to no warning, but since the end of the Cold War the Navy and the Submarine Force “whistled past the graveyard” and routinely dismissed the threat from sea mines out of hand. This neglect was reflected in continual lack of substantive funding related to USN mine warfare capabilities and associated tactical development. This trend continued even as more U.S. warships were sunk or damaged in the aftermath of WWII by sea mines than by any other weapon while potential adversaries have tens of thousands of mines. Weapons on the seabed exacerbate the problem even more.

Illustration of how a CAPTOR smart mine functions. (via U.S. Militaria forum)

Nations and commercial entities can be expected to routinely map seabed terrain to support their interests and activities. Available seafloor bathymetry may become comparable to a typical topographic map available in hard copy. This level of detail will facilitate planning for and the placement of systems on the ocean floor, especially with a focus on ensuring they could not be readily detected or attacked. Weapons and supplies could be hidden in seabed caves, trenches, and other geographical features within the complicated seabed landscape.

The threat posed by systems operating from this part of the maritime environment will only grow with technological change and proliferation. The impending proliferation of commercially-developed undersea and seabed systems will make these systems readily available to anyone with even a modest amount of funding. These systems had long ago departed being a resource only for a rich nation-state or billionaires intent on finding the resting place of sunken ships.

Authors are invited to write on the tactical and operational challenges, and potential solutions, that may emerge as maritime warfare expands onto the seabed. How can the Navy’s future force adapt to this coming reality? Authors should send their submissions to Nextwar@cimsec.org.

Professor William G. Glenney, IV, is a researcher in the Institute for Future Warfare Studies at the U. S. Naval War College.

The views presented here are personal and do not reflect official positions of the Naval War College, DON or DOD.

Featured Image: Undersea submersible (Brian Skerry, National Geographic Creative)

Cyberphysical Forensics: Lessons from the USS John S. McCain Collision

By Zachary Staples and Maura Sullivan

The 2017 back-to-back collisions of two Navy destroyers led to much speculation about the role of cyberphysical interference in the disasters. As the senior officer representing the U.S. Navy engineering community during the USS McCain cyber assessment, it is clear that we do not yet have the basic tools to definitively answer the question, “were we hacked or did we break it?”

Cyberphysical systems are the backbone of the global infrastructure we rely on for transportation, power, and clean water, and are growing at an exponential rate. The deep integration of physical and software components is not without risks and most industries are technically and organizationally unprepared to conduct forensic examinations. The ability to trust cyberphysical systems is dependent on our ability to definitively identify and remedy cyber interference, which is dependent on our understanding of how data flows impact the physical world.

There are broad lessons from the USS McCain cyber assessment that highlight the type of forensics needed to build and sustain cyberphysical infrastructure around the globe. In order to prevent and respond to future cyberphysical events, whether malicious or accidental, the Navy and organizations dependent on cyberphysical systems must establish post-event procedures for cyber forensic investigations, develop trusted images, and integrate threat intelligence with engineering teams.

Post-event Procedures

Post-incident shipboard forensic examination is a unique activity that is separate and distinct from cybersecurity evaluations or responses to network intrusion or malware. Typically, when cybersecurity operations centers observe malicious communications or indications of compromise within their operating network, they have a clear map of the network and key pieces of information, such as an initiating IP address or malware signatures, from which to begin the forensic mission. They start by identifying and classifying malware on the offending endpoint and can take immediate actions to observe the adversary in their system and identify what is being targeted, while simultaneously acting to clean and quarantine the network.

In stark contrast, post-incident cyberphysical assessment requires an undirected baseline on a variety of media, including hard drives from voyage management systems, machinery control stations, and IT network endpoints. Greatly complicating post-incident response is the fact that many segments of the network will likely be shut off by design or physically destroyed by the casualty itself. The task of cyber forensic teams is essentially the equivalent of trying to determine why a building collapsed without blueprints, physical access to the structure, or any data on what happened immediately prior to the collapse.

The technical understanding and research required to define standard operating procedures for shipboard cyber forensic investigations do not currently exist. While the task of developing a comprehensive approach to shipboard cyber forensics is daunting, the military has experience developing specialty training paradigms, such as submarine navigation and tactical aviation. Hunting a cyber adversary in industrial control systems is a complex task requiring unique operational and tactical expertise. An achievable near-term milestone would be to create procedures for an attack surface assessment for a routine pre-planned mission, which could provide a test-bed for developing more comprehensive procedures, as well as a better understanding of capabilities and gaps.

Trusted Images

All ships operate three main networks: the voyage network that supports the safe navigation of the vessel, the engineering network that controls propulsion along with material handling and auxiliary systems, and the administrative network that supports business operations and crew welfare needs. U.S. Navy vessels also have a combat systems network. The interconnectedness of operational and information technology networks means that traditional information technology tools and perimeter-based security solutions are inadequate for cyberphysical systems. For example, the addition of even simple PKI security can overwhelm the processing power of installed cyberphysical processors and cause a system crash instead of preventing unauthorized access. Additionally, in order for systems like GPS to function, the system must allow access to all properly formatted traffic, rendering perimeter defense insufficient. Security for complex cyberphysical systems requires capturing data flows and developing contextually aware algorithms to understand the dynamics during shipboard operations.

To generate network situational awareness sophisticated enough to do cyber forensics, the team will need to search for electronic anomalies across a wide range of interconnected systems. A key component of anomaly detection is the availability of normal baseline operating data, or trusted images, that can be used for comparison. These critical datasets of trusted images do not currently exist. Trusted images must be generated to include a catalog of datasets of network traffic, disk images, embedded firmware, and in-memory processes.

1. Network Traffic: A common attack vector is to find a computer that has communications access over an unauthenticated network, which issues commands to another system connected to the network (i.e. malware in a water purification system issuing rudder commands). Cyberphysical forensics require network traffic analysis tools to accurately identify known hosts on the network and highlight anomalous traffic. If the trusted images repository contained traffic signatures for every authorized talker on the network, it would allow forensic teams to efficiently identify unauthorized hosts issuing malicious commands.

2. Disk Images: Every console on the ship has a disk that contains its operating system and key programs. These disks must be compared against trusted images to determine if the software loaded onto the hard drives contains malicious code that was not deployed with the original systems.

3. Embedded Firmware: Many local control units contain permanent software programmed into read-only memory that acts as the device’s complete software system, performing the full complement of control functions. These devices are typically part of larger mechanical systems and manufactured for specific real-time computing requirements with limited security controls. Firmware hacks give attackers control of systems that persist through updates. Forensic teams will need data about the firmware in the trusted image repository for comparison.

4. In-memory Processes: Finally, advanced malware can load itself into the memory of a computer and erase the artifacts of its existence from a drive. Identifying and isolating malware of this nature will require in-memory tools, training, and trusted images.

In addition to the known trusted images, future forensic analysis would benefit from representative datasets for malicious behavior. Similar to acoustic intelligence databases that allow the classification of adversary submarines, a database of malicious cyber patterns would allow categorization of anomalies that do not match the trusted images. This is a substantial task that will require constant updating as configurations change. However, there are near-term milestones, such as the development of shipboard network monitoring tools and the generation of reference datasets that would substantively improve shipboard cybersecurity.

Organizational Integration

As future shipboard assessment teams work to confirm or refute the presence of cyber interference, they will need the assistance of a cyber intel support team to validate assumptions about their findings aboard the vessel. The basic flow established in the USS McCain investigation was to look at the physical systems involved in causing the collision (i.e. propulsion, steering) and then begin looking for cyberattack vectors to those systems.

Ruling out cyber interference requires evidence of absence, which can be uniquely challenging. In order to refute a particular attack vector, coordination with a cyber intel support detachment is essential to understanding the range of possible cyberattack scenarios for a particular physical effect. For example, advanced cyber effects could be delivered over a radiofrequency pathway. Therefore, cyber investigators will need to understand the electromagnetic environment the ship is operating within, as recorded in national systems, and give access to analysts capable of identifying anomalies in the signal pathway.

Shipboard assessment and cyber intel support teams each have specific sets of expertise necessary to understand the full suite of cyberattack vectors and their potential impacts on shipboard systems. Cyberattack tactics are constantly changing and the highest levels of technical expertise and security clearance are required to keep abreast of the potential methods to penetrate networks and attack industrial control systems. Cyber intel teams will never have the engineering expertise to understand the full range of potential physical impacts on shipboard systems. As was demonstrated with Stuxnet and the attack on the Ukrainian power grid, the most successful cyberphysical attacks exploit the organizational gap between engineering and cyber teams.

Organizational constructs for cyberphysical systems will never be straightforward because cyber risk cuts horizontally across engineering systems and traditional intelligence activities. Organizational integration between the cyber and engineering communities must be practiced and continually refined in order to prevent and respond to cyberphysical interference. A near-term milestone would be to execute joint training exercises between the cyber intel and engineering communities in order to promote cross-disciplinary understanding and begin to build out the template for future organizational integration.

Conclusion

Network connectivity in industrial control systems has revolutionized the way humans interact with physical systems and ushered in a new era of capabilities from energy generation to manufacturing to warfighting. These advancements are not without risks, and to avoid cyberphysical catastrophe, the development of tools to ensure resilience, security, and safety must keep pace. Shipboard forensics provide a prime example of the current gaps in our ability to understand, monitor, and protect cyberphysical systems. The lessons learned from the forensic examination of the USS McCain can provide the foundation for the procedures, data, and organizational constructs required to create modern tools to monitor and protect cyberphysical systems.

Zac Staples had a 22-year career in the United States Navy as a surface warfare officer specializing in electronic warfare. His final tour was as the Director of the Center for Cyber Warfare at the Naval Postgraduate School, where he led inter-disciplinary research and development teams exploring cyber capability development. Zac holds a B.S. in engineering from the U.S. Naval Academy, a Masters in National Security Affairs from the Naval Postgraduate School, and is a distinguished graduate of the Naval War College.

Maura Sullivan specializes in systemic risks and data-driven emerging technologies. Maura was the Chief of Strategy and Innovation at the U.S. Department of the Navy, where she developed and implemented the strategic roadmap for emerging cyberphysical technologies. Previously, Maura led a start-up within the global catastrophe risk company, RMS, developing software and consulting solutions for managing systemic risks for financial and insurance markets. She was a White House Fellow, has a Ph.D. in epidemiology from Emory University and a B.S and M.S. in earth systems from Stanford University.

Zachary Staples (USN, Retired) and Maura Sullivan, PhD are the co-founders of Fathom5, a maritime cybersecurity company.

Featured Image: Operations Specialist 3rd Class Daniel Godwin, from Milton, Fla., stands watch in the Combat Information Center aboard the aircraft carrier USS Enterprise (CVN 65). (U.S. Navy photo)