200438 VTS/ISPS Conflicts
VTS/ISPS Conflicts
MARS Report 200438
My report/comments are not exactly what usually appears in your excellent publication. However as it is difficult for serving seafarers to get their concerns debated, I thought I would forward it to you in the hope that you publish and open up a debate on a subject, which I and my colleagues think has not been given enough thought. The subject is the conflicts which exist between the reports which have to be made to the various VTS and Port Authorities throughout the world and the need for Information Security as required by the ISPS. We recently received on board an Advisory Note from the Company referring to one of our company's ships being censured for failing to report to a VTS as required. This has reopened the debate concerning information that has to be passed to VTS schemes and the need for security which has been discussed many times onboard over past few months.
There is undoubtedly a serious conflict of interest which has never been debated, most probably because the IMO, PSC authorities, USCG etc do not even realise that it exists. The information required from the ship by the various VTS throughout the World varies but is extensive enough in all cases to be of great use to potential terrorists and pirates everywhere in the World. VTS Reporting requirements are in effect a free information service for those who would use ships for illegal purposes. All they need to do is buy a Marine VHF and park themselves on the White Cliffs of Dover or the leafy beaches of Malaysia and the local VTS will find out most of the information they need to help them attack a ship in their area absolutely free of charge.
One of the main points emphasised in the training for ISPS was information security and the need not to discuss ships business in pubs, restaurants and other public places. Yet on a daily basis all over the World information is being given out freely on open channels to which everyone and his brother can listen. Of course with the introduction of ISPS code every potential anti-ship terrorist and every pirate from Rio Haina to Vladivostock must have jumped with joy and given eternal thanks to whichever God he purports to worship. Why? Because now every ship was to be fitted with an AIS machine to give its exact position. Now not only do they have detailed information concerning the ship but they no longer have to search to find it, they have a machine to show them. Previously, when in known dangerous ports in West Africa and South America, I used give VTS/Port Authorities deliberately false positions and the ship would be many miles from where I said it was. Now there is no point, the local pirates can track my ship without problem after having received all information about the ship from my call to the VTS.
That, however, is not the worst of it. Not only can an AIS be used for tracking a ship, it can easily be programmed to "impersonate" a ship which greatly increases its potential as a terrorist weapon. I cannot buy an AIS from a duty free shop in an airport yet, but within a year or so they will be available. However, I bet that the terrorist groups already have access to a supply. It is a ludicrous situation and one that needs a much wider debate and efforts to find more secure ways, if it is really necessary, of relaying information to VTS reporting points, port authorities and the coastguard.
Since receiving the Company Advisory Note, I have obtained a recent edition of "Fairplay Solutions" and an obscure, but very interesting publication called "Digital Ship" which I admit I had never seen before. Nothing I read in either makes me feel any easier. Indeed in "Fairplay" the head of the IMO Navigation & Security department is advising owners to prepare to fit a Long Range Tracking & Identification system by July 1st 2006. So not only will potential terrorists and pirates have all the information they need, we will be forced to carry a machine that will give them this information much more in advance so they can prepare their schedule much more efficiently.
Whoever creates these schemes may think that they will be secure but of course they will not. In my 24 years as Master, my ship has been subject to "pirate attack" on quite a few occasions in West Africa, South America and the Far East. On every occasion the thieves new exactly which container to open, they never had to search, they knew the contents, I did not.
The only way for real security is to shut up, physically and electronically, until such time as we have guaranteed secure communications.
Following last months ISPS/safety conflict (MARS 200429), how do we overcome this important issue? Please address all feedback to mars@nautinst.org or fax me on +44 1394 276534.
Readers' Feedback
1
I applaud those taking the time and trouble to highlight the sheer stupidity behind the conflicting requirements of AIS/VTS and the ISPS. That is, on the one hand to broadcast, quite literally, your type, cargo, position and movement saying to the world "here I am, come and get me" and on the other, to protect yourself from potential terrorist interception. Let's face it, that is what ISPS is or should be about.
I want to add briefly to the MARS 200438 report. AIS is available at home on the internet! I've seen it in use at my pilot station looking for inward vessels with doubtful ETAs. That is no security at all. Action is required NOW to shut down that website. Then we can progress.
Security starts with being discrete, keeping quiet, going unnoticed etc. The 'need to know' principle must be applied. As a practising pilot in a large district I can happily and confidently report that I do not 'need to know' 100% of information gratuitously issued on AIS and about 75% of that emanating from VTS. If I were a master, I would give serious consideration to upgrading my vessel's security state and incorporate within that the shutting down of AIS and the transmission of mandatory administrative information to shore/VTS by other means. In the "grey funnel line" we used to call this the EMCON or emission control policy. There is an irony here. The introduction of ISPS has increased the demand for information exchange and I am just thinking how a terrorist would think!!
2
The following happened during the summer of 2003, when on passage through the Gulf of Aden towards the Suez Canal. The passage plan was prepared with full regard to the piracy threat in this area to as far as possible reduce the risks and the section regarding limiting VHF transmissions was duly noted. You can imagine that I was very surprised and concerned when an "Alliance warship" (who's Alliance?) interrogated every merchant vessel passing through the area on Channel 16 requiring all the usual information - destination, cargo, crew etc. After having interrogated all merchant vessels near us, the warship disappeared from the area and was later seen further up the Red Sea doing the same thing. Given the obvious and very real risks to vessels and their crews from piracy in this area (1 month before, 2 vessels were attacked in the very same area), this sort of behaviour is nothing short of negligence giving the pirates a helping hand. An interesting question arises now, following the introduction of the ISPS code under which the control of sensitive information is greatly stressed. Numerous vessels are stopped and interrogated throughout the world via VHF by various Navies every day. Are merchant vessels now in a position where they can refuse to co-operate on the basis of giving out important security information over open channels and what will the response of these Naval Forces be if we withhold information on these grounds in international waters?
3
It would take too long to explain why, nor does it really matter but the point needs to be made to your members that the specific AIS technology mandated by IMO de facto established an unequivocal and inviolate policy that, hereinafter, ships must continuously broadcast, unencrypted details relating to their identity, precise location, cargo carried etc. for use by anyone at anytime for whatever purpose, benign or non-benign. "In other words, the IMO has accepted that the divulging of vessel sensitive information outweighs any additional (security) risks this might bring to seafarers."
As indicated, I personally think there is little point debating the 'dangers' of requiring ships' masters continuously divulge sensitive information to any Tom, Dick or Osama using AIS. That there was probably no debate on the issue prior to the adoption of the IMO AIS mandate, at least none that I'm aware of, does not alter the reality: This horse has well and truly bolted. However, an issue I think is still very much up for grabs is 'when and where' masters are obliged to use AIS - much like the debate on GMDSS. That is, when can masters switch off AIS without sanction. It is accepted that IMO has produced some guidelines but typical of the Organization, they're as clear as mud. Here are my own.
As the law presently stands, masters are only obliged to ensure AIS is operational in areas subject to (IMO adopted) mandatory reporting. Nevertheless, even within these areas, masters may isolate AIS whenever they consider information disclosure presents a prescient danger to the ship subject to notifying the competent authority that they have done so. Beyond mandatory reporting areas, fundamentally a ship's master can do what he (or she) considers best in terms of leaving AIS on or off. Now this opinion will deeply upset the 'purists' who view AIS to be primarily an aid to collision avoidance. It is now also not for the limited role of coastal state security as the UK initially proposed be the (sole) purpose of AIS long before the subject was in vogue! That is, AIS must be on at all times on all ships to deliver greatest value in Collision Avoidance. This view, drawn from US inland waterways collision regulations (Bridge-to-Bridge Communications Act), is based on a philosophy that if all ships broadcast information to one another, notably identification, they can readily communicate (on VHF) to agree 'collision avoidance contracts', thus removing all doubt about intended manoeuvres. How this squares with the International Collision Regulations has always bemused this author but existing IMO standards and guidelines make clear AIS is to be used for this purpose, so it must. As things presently stand, ships' masters could find themselves in a difficult (legal) position if involved in a collision having disabled their AIS notwithstanding:
a) The ship was not in a mandatory reporting area;
b) The master considered use of AIS presented a real risk to the ship's security in this area.
If ships' masters are to be given greater flexibility in their decision-making apropos use of AIS, IMO has to be pressed to make clear AIS is only specifically required in areas subject to mandatory reporting, and that any collision avoidance function is secondary to security considerations. Moreover, beyond mandatory reporting areas, and to comply with the ISPS Code, IMO needs to be of the opinion that masters would normally be expected to isolate AIS. Further, and again in line with ISPS, within mandatory reporting areas, IMO should encourage authorities to primarily use passive surveillance techniques (radar), relying on AIS only to the extent necessary for positive identification, ships being encouraged to isolate AIS once the authorities have positively established identification. The 'purists' would hate that!. However, even they have to accept that the world has moved on since AIS was first mandated and these grand collision avoidance schemes were hatched.
I think the IMO Secretary General is now positively seeking an AIS exit strategy to get himself out of what is proving to be 'yet another fine mess' left by the MSC in recent years. In other words, while the benefits of a policy requiring masters to divulge information (using AIS) continue to outweigh the dangers in mandatory reporting zones, beyond these zones the risk balance (good Formal Safety Assessment term!) has now clearly swung the other way. Thus IMO policy should be predicated on the basis that a master is not to be penalised in any way, shape or form - removing the defence in the Admiralty Court - if a ship's AIS is non-operational, other than in mandatory reporting areas. (Some of your members may actually like the idea of using AIS to negotiate and agree 'collision avoidance contracts' with other ships (that's their prerogative, as it is to defend their actions in the Admiralty Court.)
The adoption of this policy would also bring to an end development on the 'long-range AIS'. No one is permitted to exercise jurisdiction over the high seas thus you cannot have mandatory reporting ergo there can be no need for AIS, long range or otherwise.
4
I currently sail on a large and easily identified (by the colour scheme) Chemical Tanker and our voyages are often into 'risk' areas. With our cargoes and our USA connections, I guess we can be perceived as a pretty obvious target. We are often hailed on VHF 16 by "coalition warship" (by latitude and longitude, speed and bearing). Most ships thus hailed, answer and on shifting to another channel, seem quite happy to provide all the sensitive information asked by the warship (on an open VHF channel). I have made it a point NOT to answer their hailing and have discovered that nine out of ten times they will eventually give up calling and try another target.
On one occasion, when sailing south from the Straits of Hormuz, I was "chased" for over three hours by a warship I refused to answer. When the warship got close enough to see (it was night-time), I switched on the funnel and name-board lights to identify the ship. They called me again and I politely declined to answer their questions on the VHF but instead gave them the ship's Sat phone number. They called via satellite and I answered their questions. They said they appreciated my concern and accepted, without problem, having to operate by sat phone.
We are currently returning from another trip up through the Indian Ocean, Arabian Gulf, Red Sea area, and yet again we have been plagued by calls from "coalition warships" My crew are instructed NOT to answer, and again nine times out of ten the warship gave up calling. On one occasion an American warship came close enough (during daytime) to read the ships name and started calling us by name. I answered and switched to their working frequency where I told them that to give out sensitive information over an open VHF channel in a risk area was in contravention of our Ship Security Plan. There was a long pause, and then there was a very curt OK and they signed off. So it seems it is NOT mandatory to give out the vessel's most intimate secrets over VHF to any passing warship.