The Rime of the gobsmacked mariner

One begins to seriously question the competence of professionals that get gobsmacked too easily, which is what I did when I read the story- first carried on Fox news and faithfully reproduced by large sections of the maritime press without comment- saying that a ‘frightening new study’ showed that terrorists could spoof GPS signals to ‘hijack ships’, run them aground and ‘shut down ports’- and presumably do other mentionable things with these guided missiles. All this, with navigators aboard the target vessel absolutely unaware of what was happening. 

“Using a laptop, a small antenna and an electronic GPS “spoofer” built for $3,000, GPS expert Todd Humphreys and his team at the University of Texas took control of the sophisticated navigation system aboard an $80 million, 210-foot super-yacht in the Mediterranean Sea,” Fox tells us.

“We injected our spoofing signals into its GPS antennas and we’re basically able to control its navigation system with our spoofing signals,” Humphreys told Fox News. 

Now spoofing of GPS signals is not a new development; I had written about it myself last year, pointing to the potential threat of spoofing- creating fake GPS signals that change user perceptions of time or location, essentially feeding false coordinates to a GPS. Of course the potential for mischief is tremendous, especially with the newer ECDIS systems and what I see as a modern navigator’s dangerous overreliance on electronics and simultaneous disregard for common sense. But spoofing is a far cry from taking control of a ship without its navigator’s knowledge. 

So I was not impressed that Humphreys and his gang were able to spoof the yacht’s GPS and steer the yacht off course with the GPS showing, all the while, that the vessel was on her intended course. 

And I was certainly not impressed with the yacht’s Capt. Andrew Schofield, who was gobsmacked by it all. “We on the bridge were absolutely unaware of any difference,” Schofield said. “I was gobsmacked -- but my entire deck team was similarly gobsmacked,” he told Fox News.

Spoofing GPS signals is not enough; to control vessels, one must be able to take over- on ships steering on autopilot- electronic navigation systems, provided they are set to control the autopilot (If they are not, you can’t do it). Large alterations of course- open sea or not- will be easily noticed by the navigator; forget the changing positions of the sun or the stars, most will notice even the change in vibration as the rudder is applied.

I admit it may be theoretically possible to make regular small alterations of course and slide a ship on a parallel course without triggering the off-course alarm or otherwise alerting the navigator- the end result similar to a ship that has drifted far from her intended position in strong wind or current even as she maintains her intended course. Given that hardly anybody uses the sextant any longer to confirm GPS positions, this may work in the open sea. 

But, unless the navigator is sufficiently substandard, such a surreptitious attempt to take over or terrorise a ship will never work close to land, if the horizon includes a single visible rock, or with other ships around. Only the most useless navigator will fail to notice- visually or on radar- the changes in relative bearings that he sees as a ship turns. A navigator relying completely on instruments like the ECDIS or the GPS and disregarding what the radar or his senses are telling him is not worth the salt he tastes on his lips. Only a substandard navigator will fail to confirm electronic positions with visual bearings or radar positions, parallel indexing and the like. Corollary: only a substandard mariner will be gobsmacked if his ship’s steering system is taken over without his knowledge.  

In any case, I wonder how many terrorists will be inclined to take all that trouble to take over a ship - including, presumably, taking the trouble to install clandestinely hacking equipment aboard the target vessel- if the eventual ‘hijack’ can be so easily detected or can be successful only in the open sea, miles from anywhere. And if a hijack attempt can be checkmated by just one navigator using two fingers to switch the system from autopilot to manual steering. 

A terrorist, like the University of Texas, should not hope for substandard navigators to make a point.

Meanwhile, Humphreys berates the US Department of Homeland Security for not taking him and his GPS terrorism threats seriously enough. Methinks the University of Texas wants a few million dollars from the US Government to ‘study’ the highly overstated GPS terrorist threat problem. Old story, this: first cry overrated wolf and then rake in the moolah studying the animal to death. 

.

.

GPS and ECDIS- two warnings and a funeral.

Two stark warnings caught my attention recently. These were not new, but there are new reasons why we should take them seriously.

The first came from Bob Cockshott of the British ICT Knowledge Transfer Network, which is a setup funded by the UK's national innovation agency. Referring to the spoofing of GPS signals at a London conference, Mr Cockshott said that there were now serious concerns "that we are going to see a disaster" in the English Channel within the next decade. "We have moved on from a potentially threatening situation to a real danger that we must address now," Cockshott said.

The second caution was on the implementation of the ECDIS regime, but it was no less blunt, coming as it did from somebody who  helped design the ECDIS back in the 80's and early 90's. Saying that ECDIS implementation was suffering from "political interests", this is what Master Mariner and computer scientist Gert B. Büttgenbach is quoted in Marine Cafe as saying: “Tear it down to the fundamentals and start fresh before it causes chaos", adding, “The sclerotic organisations ruling international shipping dislike reviewing the standards that I once helped to establish.”

I think that the spoofing of GPS signals- creating fake GPS signals that change user perceptions of time or location- has resurfaced now because an Iranian engineer claimed last December that he had spoofed a US drone into landing in Iran. The engineer said that false coordinates had been fed to the drone that fooled it into thinking it was close to 'home.' in Afghanistan instead of over Iran. It is immaterial to civilian maritime navigation that many scoffed at this claim, pointing out that military hardware- including GPS guided missile systems or smart bombs- use robust encryption code. The fact is that civilian GPS systems do not; they are supposed to be freely accessible by all users in the coverage area.

Spoofing a GPS signal is an insidious step ahead of jamming the signal, of course, and that is bad enough. In 2010, an experiment with low-level jamming in the English Channel saw ships going off course without operator's knowledge, sending out false AIS signals and communications systems failures. Jamming is akin to a virus on your computer shutting it down; your GPS receiver just stops working. Spoofing is akin to somebody hijacking your computer and feeding you compromised data without your knowledge. Your position- in time and date- is whatever the spoofer wants it to be. "It looks exactly like a real GPS signal," says one expert. "Everything looks completely normal, but the spoofer is controlling your position in time and space." 

Satellite navigation systems have been at risk from criminals, terrorists, criminals or even bored teenagers for a long while, but any incidents have involved jammers that are available even off the internet at sixty dollars apiece, give or take. Criminals have hijacked vans carrying high value goods after jamming their GPS and cell phone systems. Signals at traffic intersections have been jammed in the US. However, jamming is old news; spoofers are the new kids on the block.

Although built and tested by researchers three years ago, spoofers were hitherto bulky and expensive to assemble. That has changed;  Todd Humphreys, a specialist in GPS technology from the University of Texas, told Reuters not long ago that he had developed the first GPS civilian spoofer, a "very powerful" device that cost under $1,000 to assemble. "It's not outside the capability of any other smart graduate student in GPS or GNSS across the world," he said. "And it's not outside the capability of any kind of sophisticated terrorist organisation." 

I think we are going to see a serious spoofing attack on GPS systems eventually. It may happen in a seemingly unrelated space. Perhaps in a stock market trading platform, where experts warn that a criminal can, by spoofing the displayed time by a few microseconds, make a killing in a trade. Perhaps it will be a terrorist attack instead. Life, especially in the West, is dependent on GPS systems to an extent not even dreamt of by ordinary  folk, medical, power and water infrastructure included. The future easy availability of GPS spoofers- and their illegal use- is a foregone conclusion. 

Ships, ports, coastlines and congested waterways will face extreme risk. This is not the turn of the century, when the Y2K scare (or the Y2K fraud, depending on your point of view) could be tackled with thoughtless drills and other nonsense. (Aside, my humour remained unappreciated in the office when I suggested on a ship that the drill involve only one step- switching off the damn GPS for a month) Today, however, we are in an era of integrated systems. The GPS feeds, amongst others, the ARPA, the AIS, the GMDSS and other communication systems- and the new rabbit out of the old hat- the ECDIS. 

Which brings me to Büttgenbach again. Unfortunately but expectedly, the rollout of this game changing and vital equipment has been chaotic, to put it mildly. He has many workable suggestions on how to fix this- for a start, he says, make electronic charts free, standardise equipment and user interfaces, purge IHO/IMO standards that stifle innovation- even one that says we should put the ECDIS on an IPad and make it intuitive.  

Equally unfortunately, I have zero faith that any of this will happen. The implementation and training of ECDIS has long degraded- again expectedly- into a confused and ill-calibrated commercial exercise; safer or more useful suggestions be damned because less money will be made. Nonetheless, I am aghast at the degradation. 

Also degraded in the new generation of mariners: basic position fixing and collision avoidance skills, thanks to a culture- both ashore and afloat- that promotes almost complete reliance on electronics during watchkeeping. We continue to go down this slippery slope with new proposals on COC examinations that, if implemented, will require lower skills from future navigators, especially lower celestial navigation skills. I disagree with this philosophy- the sextant is not the DF. 

Which is why nine out of ten navigators today will run and fuss over the GPS if there is a generator trip and a temporary loss in power; to hell with the immediate threat of a swinging ship in a busy lane that has temporarily lost its steering and gyro input. Which is why taking a visual bearing or using parallel indexing is a monthly event on many ships. Why double checking of the GPS position while coasting is non-existent. Why the course and speed of a target, and even its CPA , are sometimes read off the AIS. Meanwhile, paper charts are disappearing, encouraging a further disconnect with traditional navigation, so guess what will happen if somebody spoofs a modern navigator's GPS and the ECDIS becomes- unknown to him or her- an expensive piece of junk giving his ship's spoofed position in colour. 

What happens is this: In the absence of the habit of constantly double checking electronic positions with traditional means, today's navigator does not have the tools, temperament, experience or situational awareness to realise that something is wrong. He does not have the instinct to switch instinctively and comprehensively to non-electronic basics even after such a realisation. His basics are rusty in any case; some of them are even a mystery. 

You know, if I was a terrorist, I would load- on a foggy winter day - a briefcase sized spoofer on a fishing boat and take it near, say, off Texel in the North Sea.  I would prefer bad weather- there are enough days with near gale force winds and rough seas out there. On a busy day there would be close to a hundred vessels- ships and boats- in a six mile radius there. Many will be crossing or joining the many traffic lanes- fishing vessels too, heading for business in the many TSS' around.  The crews of most of these ships would be fatigued; coasters and others alike- Europe can be a killer run. Regardless of the COLREGS, ISM, and stuff, most will be proceeding at maximum speed in zero visibility; many will not have even doubled watches. In a few, the Captain will not even have taken the trouble to stay on the bridge.

So, if I were a terrorist, I would take my spoofer there. And I would switch it on. And- right up to the time disaster struck- most of those vessels would never even know what hit them. And this would happen because the pursuit of obscene profits has long overtaken any considerations for safety.

Basic Instinct

Any navigator worth more than a pinch of salt should know that GPS uses the WGS84 Datum, which often requires GPS positions to be corrected before they can be plotted on charts in use. All paper charts so effected will have printed, in the General Notes, something like “Positions obtained from satellite navigation systems are referred to the WGS datum; such positions should be movedx.09 minutes SOUTHWARD and 0.06 minutes WESTWARD to agree with this chart”. Pretty simple, right?


Then why is it that in my experience, few watchkeepers actually make this correction? Some assume it is small, and some simply do not know that it exists. I remember a Second Mate being flummoxed, a few miles off Kaohsiung breakwater in Taiwan a few years ago, at the almost half mile difference between his GPS position and my radar fix. He was, pardon the sarcasm, completely at sea about the correction.

The London P & I Club said last week that an unnamed containership on a regular schedule ran aground because the officer on watch “commenced a significant alteration of course about half a mile before it was due.” The reason he did so was that he was “wholly unaware” that a significant correction had to be applied before GPS positions could be plotted on the chart. The Club appears to recommend that proper passage planning would have eliminated this dangerous navigational illiteracy.

I beg to differ with the passage-planning bit. It is the responsibility of maritime schools and examination systems – not a ship Captain’s- to ensure that an officer is educated in the basics. ‘Proper passage planning’ should not have to include a course for certified officers in basics of chart reading, limitations of equipment or accurate position fixing. But then, we seem to have become terribly fond of finding complex reasons- after often uselessly elaborate risk analysis- for tardy watchkeeping: the fact is that sometimes an officer’s certificate is not worth the paper it is written on, and no amount of on-board training will change that. If one cannot put down even a GPS position accurately- something I could teach a ten year old to do in an hour or less-then one has no business being a navigational watchkeeper at sea.

Equally worrying is the fact that the industry seems to have accepted as fait accompli the notion that electronic navigational instruments (and, with ECDIS and Integrated Bridge consoles, entire navigational systems) should replace traditional navigation, and even overcome such navigational blunders as shown in the incident above. Witness reports of the main reasons for the Shen Neng 1 grounding in the Great Barrier Reef earlier this year: besides fatigue, the fact that a changed waypoint was not entered in the GPS (which meant that alarms did not sound on the GPS or the Radar when the ship was off course) is seen as material. Of course, it is, but overstressing this fact also tells me that many seem to have accepted that traditional navigation was superfluous; are we determined to navigate only if an alarm sounds somewhere? If so, it is another dangerous sign. Old fashioned navigation- visual or radar fixes, being aware of and monitoring electronic aids to navigation (not for nothing are they called navaids, you know), being aware of the limitations of equipment, parallel indexing, following the COLREGS, and simply looking out of the bridge porthole for quick situational awareness- are enough to avert many accidents. Do we even need to say this?

Overreliance on navigational aids is a long held and universally acknowledged bad practice. Why are we then promoting this? My uncharitable view, not fully formed yet, is that the industry is also using these gizmos to justify lower manning levels. I therefore wonder: are electronic systems like the ECDIS being mandated at least partly for the wrong reasons?

Stating the obvious, electronic navigational systems are not a panacea. They are excellent tools provided one understands their limitations and verifies what they are telling you periodically. They will, however, not be able- or should be expected to- cover up for inadequate education and training, poor certification or, simply, lousy watchkeeping. Before asking navigators to be aware of GPS corrections, we should be asking them to use basic watchkeeping skills.

Another grounding a few years ago saw a ship equipped with ECDIS and two GPS receivers go off course after the GPS connected to the ECDIS malfunctioned and switched to Dead Reckoning mode soon after an alteration of course. An alarm sounded when this happened, but was switched off by the OOW; no action was taken. Amazingly, the ship sailed this way for over thirty hours before running aground, often coming close enough to land for navigators on the bridge to have noticed that fact visually or on the radar. Twice in this thirty-hour period, positions were ‘checked’ by navigators with radar fixes and nothing found awry. A thirty-hour period would have seen the entire navigating team on watch at one point or another- none of them realised that the ship was sailing on DR and drifting to danger. Nobody verified position with the other GPS, which, given the bridge team’s incomprehensibly awkward proficiency with radar fixes, should have been mandatory. When, finally, islands were seen on the radar fine on the bow where they should not have been seen, the OOW thought they were bands of rain. Inevitably, the ship ran over some rocks thereafter.

By the way, North Korea is rumoured to have developed the ability to block GPS receivers, with South Korea saying that signals were intermittently jammed over many days in August this year. The possibility of countries blocking GPS signals- or feeding errors into them- have always has been a risk to navigation. With the advent of the ECDIS, however, the consequences of GPS failure have escalated. So have the chances that a downloaded virus will play sudden havoc with IBS or ECDIS systems that are run by inexperienced or incompetent officers. (I get livid when, in the event of a sudden and short blackout at sea, many officers run to the GPS to see if it is working when they should be switching over to manual steering and more concerned about the gyrocompass instead. Their actions tell me that GPS is their God; they also tell me that these officers are somewhat less than competent.)

Therefore, training, situational awareness, basic watchkeeping and position fixing skills must be strengthened and refreshed, not weakened and cast aside. If we do not do this, we will go the sextant way- we know that a large majority of present day watchkeepers are not proficient in either taking or working out sights. This is a sign of professional incompetence born out of lack of practice, besides being a pity. A ten-year-old schoolchild can read a GPS readout; navigators should be able to do more. Will we see, in the future, officers at sea who cannot fix a position, either visually or by radar, if the GPS or ECDIS malfunctions? What about a Gyro malfunction, which will obviously throw all synchronised displays out of whack? Will we see industry still looking at solving these issues using jargon and tools of risk analysis, examining root causes and auditing elaborate systems when the truth is much simpler?

The projected shortage of officers will, inevitably, translate to quicker promotions and relatively inexperienced watchkeepers at sea. ECDIS systems will soon be everywhere. Elaborate courses will be designed, mandated and undertaken across the world; many already are. Generic and equipment specific training will be given to people, some of whom display unshakeable faith in anything showing a Lat/Long readout. ISM and SMS systems will continue to be hammered into officers, many of whom will continue to have problems even understanding the language in which their manuals are written. ECDIS systems will probably be used as tools in what the experts will call, pompously and ominously, fatigue management.

Hold on to that jargon and that training for a bit, is my opinion. Address basic competency skills first, before it is too late. Make existing navigating officers prove their basic watchkeeping instincts are correct. or mandate training that ensures this.

Walk before you try to run.
.


.

Of ECDIS and that

It is quite likely that when the sextant was invented a few hundred years ago, a purist Captain on the bridge of a galleon somewhere wrinkled his nose and declared that the astrolabe was better. He may have even commented, Cassandra like, that there would be now a torrent of ‘sextant aided collisions’ at sea. In the last thirty years or so, every technological advancement in navigation I have seen at sea has resulted in similar doomsday prophecies. The imminence at sea of the Electronic Chart Display and Information System, ECDIS, is the latest now causing apprehension amongst some of us.


First off, the ECDIS is not all that imminent. Anybody who reads the IMO schedule for phasing in of the system sees this quite clearly. Timelines for installation will undoubtedly vary, but the window is large and the ECDIS is hardly likely to be ubiquitous on ships for quite some time. Which gives us in the industry a unique opportunity to set things up properly this time.


Technological advancements have the capacity to improve navigational safety enormously. Those of us who remember the days of when all we had was a single and often unreliable non ARPA Radar will agree that modern Radars and ARPA systems have contributed hugely to safety, and so have VHF/DSC systems. This is irrespective of the fact that there have been more than a few ‘VHF aided collisions’ at sea. I daresay the VHF has saved many more lives than it has taken, and even when it has contributed to casualties, the reason has been the misuse of the VHF, usually in an attempt at collision avoidance, rather than the equipment itself.


I will ignore the unnatural resistance of many senior Officers at sea to new technology. I never did understand, back in the eighties, why many Master’s insisted on sights being taken regularly when a perfectly good satellite navigator was installed on board. In their place, I would have mandated a sight once a week to keep one’s hand in and left it at that.


Obviously, the biggest factor working against the correct use and the realisation of the full potential of any equipment is officer training; this is especially true of new equipment. Unfortunately, what usually happens is that training is lackluster and so officers who are poorly trained in vital ship specific equipment are placed in positions of critical responsibility. To add to this now systemic risk, poor practices are followed or the equipment is used for purposes it was not intended for (AIS in collision avoidance). In the absence of Company and Master oversight, such unsafe practices flourish. An accident then becomes a statistical probability. I draw your attention to all the issues we continue to have with the AIS, and fear that the introduction of the ECDIS will magnify these manifold.


What is required today is not a debate on the pros and cons of the ECDIS itself, not least because the time to do that is long past. What is required, instead, is for us to realise that there exist major systemic deficiencies and lacuna in our training and modify those accordingly. Many are not ECDIS specific, but I believe that the introduction of the ECDIS, the integration of systems and the distinct possibility of officers facing information overload requires that they be absolutely familiar with not just each equipment that is feeding into their ECDIS workstations but be also familiar with the integration system itself.


We must, therefore, correct the holes in our training, some of which are:
• Lack of stress on the normal and time tested practices of navigational seamanship. Chief amongst these: lookout and enhanced situational awareness in close quarters situations or in the proximity of hazards. Our present syllabus of training, heavily tilted in favour of equipment, assumes that common sense is common. It is not.
• Incomplete industry realisation, so far, that the present generation is generally overly reliant on electronics. Youngsters more used to sending SMS’ on mobile phones, for example, are more prone to sending short messages on the AIS to other ships in close quarters situations or relying absolutely on radar CPAs alone (regardless of stabilisation) when risk of collision exists. Training must counter this mindset at a basic level, and indeed at all stages of a navigator’s career.
• Incomplete industry realisation that some senior Masters are not technologically inclined, and tend to use modern equipment in a limited way, sticking to functions they are familiar with and no more. Whether it is the training that is inadequate or the attitude becomes moot. The fact is that technological advancement invariably results in reduced manpower, so not using a system to its full potential has escalating safety implications. Incomplete familiarity with equipment in use, and, critically, with its limitations, is not uncommon with junior officers either. Many seem to be more familiar with the gimmicks manufacturers install on systems rather than the hard core functions essential for navigational safety. Training must address this.


Two final thoughts. One, although I am against standardisation of human beings, I am all for standardisation of equipment. An example of how this standardisation makes my life easier (and more importantly, makes the ship safer) is the Radar/ARPA. On every ship, regardless of the manufacturer, a Radar will have standardised controls and displays. The controls for gain, clutter, tuning, range, rings, VRM, EBL et al will be usually intuitively placed, and in similar locations. The terminology used: CPA, TCPA, Head Up, True Motion, Trial maneuvers, Trails, Vectors etc., will be identical regardless of whether the Radar is Japanese or American or European. We must have a similar system for the ECDIS. The IMO must mandate, in detail, that the controls and terminology used in the ECDIS be standardised for ease of use and navigational safety, and that manuals be comprehensive. Some of the other existing navigational equipment does not follow this standardisation and we manage fine, but then much of this equipment is not as critical as the ECDIS is likely to be.


Two, at least some of the onus for ECDIS training should lie with the owners, who must be required to give their officers generic and type specific training in the equipment. I am sure that we are looking at an ECDIS STCW course in the future; an IMO approved course already exists. However, generic training is not enough. Regardless of the levels of standardisation, training must be specific to the equipment that the officer will be using when he takes over on board. I am a little apprehensive, given Owner practices of compliance with ‘ship specific training’ I have seen thus far, of how this will turn out.


The introduction of the ECDIS will give us an opportunity to start correcting the formal and informal practices in equipment use that have crept into our systems. The ECDIS’ potential for enhancement of safety can only be realised if we excise the additional risks unfamiliarity and poor training tend to generate. We must standardise equipment, and train officers in the complete and proper use of the ECDIS and its limitations. A failure to do this will only result in introducing new risks in the art and science of navigation at sea.

.


.

.