How national agencies translate strategic doctrine into joint responses and joint operations — day by day, watch by watch.
Duration: 1 minute — opening of Session 1B
Welcome back. Before the coffee break we built the strategic frame — the political authority, the doctrine, the lead-agency matrix, trust as infrastructure. That is the architecture above the line agencies.
Now we move down into the architecture. For the next forty minutes we look at the operational level — how the agencies in this room translate that strategic frame into joint operations on the water, day by day, watch by watch.
You will see one image repeatedly today: the operational hub at the centre, with the line agencies on the rim. Keep it in mind. Everything we discuss is a question of how the spokes connect to the hub, and what flows through the hub.
Let me start with the bridge from strategy to operations.
Whatever the strategic level decides — one authority, one doctrine, one classification tier — ultimately someone sits at a desk at 03:00 and has to act on it.
The operational level is where the doctrine becomes a phone tree, a shared screen, a tasking message, a debriefing log.
Most countries that have failed at coordination did not lack doctrine. They lacked the operational machinery to make the doctrine real.
Duration: 4 minutes
Quick recap. In Session 1A we built the strategic architecture: a single empowered authority, a signed national doctrine, a lead-agency matrix, classification tier, and the political will to renew it. That is the slow-moving, stable layer.
Now we cross the bridge to the operational level. And the message of this slide is very simple: doctrine designs, operations deliver.
Whatever the strategic level decides, eventually someone at 03:00 has to act on it. The doctrine becomes a phone tree. The classification becomes a tagging rule on a real document. The lead-agency matrix becomes the sentence the duty officer says when picking up the line: “This is the lead. We are activating the cell.”
If you only have the strategic layer — you have a beautiful policy document and no response. If you only have the operational layer — you have officers improvising under pressure with no political cover. Neither works alone.
And here is the recurring observation across the European studies: most countries that fail at coordination did not lack doctrine. They had doctrines — sometimes excellent ones. What they lacked was the operational machinery underneath: the standing centre, the common SOPs, the joint exercises, the platforms. That is what we will spend the rest of the session on.
The single most important architectural choice. Get it wrong and you lose your civilian partners on day one.
Duration: 6–7 minutes
This slide carries the most important architectural choice you will make at the operational level. Get it wrong and the whole system collapses.
The coordination hub federates, shares and animates. It does not produce intelligence.
Let me walk through the left column. The hub cross-references — takes inputs from every agency and looks for patterns no single agency would see. It maintains the shared situational picture — one screen, one truth. It pushes alerts — weak signals, anomalies — back out to the network so others can act. It animates thematic working groups: CBRN at sea, cyber on vessels, trafficking patterns. It operates 24/7, with a published phone tree — not because crises happen at 9 AM, but because they don't. And it owns the joint exercise calendar, which we will come to.
Now the right column. The hub does not:
It does not draft classified intelligence assessments. It does not run human sources. It does not task collection. It does not command agency assets — tasking remains within each agency's chain. And critically, it does not arbitrate disputes between agencies — that is what the strategic level is for. The hub is not a court.
Why is this distinction so important? European practice is unambiguous: a coordination cell is not, and must never become, an intelligence body. The moment a hub crosses into intelligence production, two things happen.
One: the established intelligence services see it as a competitor in their own domain and stop sharing.
Two: the civilian partners — port authorities, shipowners, customs — see it as an intelligence service and refuse to engage. They are happy to share with a coordination cell. They will not share with what they perceive as a spy office.
So the architectural rule is absolute: keep the hub clean of intelligence production. If your country needs a maritime intelligence service — and many do — create it elsewhere, with its own mandate. The hub does coordination. Period.
The realistic architecture is federated, not unified. A single national maritime database has been tried and failed in every country. The virtual data lake — data stays where it is, accessed via a common standard — is the pragmatic alternative.
CISE · OBSERVED PRACTICEDuration: 5 minutes
How does information actually flow? The answer is on this slide, in two halves.
Before. Every agency has built its own fusion centre over the years. The Navy has one. The Coast Guard has one. Customs has one. Intelligence has one. They produce parallel analyses — sometimes conflicting. In a crisis, the duty officer of agency A picks up the phone to agency B, then C, then D. Bilateral phone calls in every crisis. And anything sensitive sits frozen behind classification walls because there is no shared marking.
This is not hypothetical. This pattern is widely documented across maritime administrations.
After. The architectural answer is not to demolish each agency's systems and build a single national database. That has been tried in many countries — including France. It has never worked. It is too expensive, too slow, and the agencies sabotage it.
The realistic answer is federated: each agency keeps its own system and its own data. Sovereignty is preserved. But two things connect them.
One: a common data model — in Europe, the CISE standard, Common Information Sharing Environment. A shared way of describing a vessel, a position, an event. So when agency A's system talks to agency B's system, they understand each other.
Two: a virtual data lake. Federated access, not central copy. The hub queries each agency's data in place, with appropriate authorisation. No giant national database to maintain. No physical movement of sensitive data.
Add to that: the hub cross-references and pushes back alerts to the network — bidirectional. And the industry door is the single channel for private-sector feeds.
This architecture costs much less than the unified-database fantasy, and it actually ships.
Duration: 5–6 minutes
If we now zoom in on the operational machinery itself, the European experience converges on three pillars. They are not optional alternatives. They advance together — or coordination decays.
Pillar one — organisational. Common SOPs for the most common crisis scenarios. Designated points of contact in every agency — named, with a backup, published on a directory the duty officer can pull up at 03:00. Cross-participation in each other's meetings. A collaborative working space — physical for liaison officers, virtual for everyone else. And standing thematic working groups for the priority threats.
Pillar two — technical. Data standardisation — the CISE-style common data model. The virtual data lake architecture we just discussed. Secure exchange protocols — encryption, VPN, hardened endpoints. The shared classification tier we discussed in the strategic session — here it becomes a tagging rule on actual documents. And audit logs, so you can detect leaks and prove integrity.
Pillar three — human. This is the pillar most often under-funded. Common qualifying training — an online qualifying module for all cell personnel is now considered standard European practice. Permanent liaison officers across agencies. Immersion programmes — sending a Coast Guard officer to spend two months inside Customs. Continuous training to keep up with new tools and threats. And the soft work of building a professional community — people who feel they belong to a shared inter-agency cadre, not just to their parent agency.
And here is the rule the bottom banner makes explicit: technology without organisational and human change is expensive failure. Many countries have spent fortunes on platforms that nobody uses, because the SOPs were not written and the people were not trained. Don't be that country.
Designed to break coordination — not to flatter it. All agencies at the table from the outset.
Procedures, communications, escalation — rehearsed before the real night comes.
No blame. The most valuable hour of the whole exercise — if the culture allows it.
Update SOPs, retrain, patch gaps. Then plan the next one. The cycle has no end.
Duration: 5 minutes
I want to spend a moment on the exercise cycle, because in operational coordination it is not optional. It is the single most reliable mechanism for building real interoperability.
Look at the four phases on the left.
Plan. Realistic scenarios — designed to break coordination, not to flatter it. The temptation is always to design exercises that everyone wins. That teaches you nothing. Design the scenario to expose the seams between agencies, the weak points in the SOPs, the moments where someone hesitates. And critically — all agencies at the table from the planning stage. Not invited at the last minute.
Exercise. Test under stress. Procedures, communications, escalation — the things that fail at 03:00 on a real night.
Debrief. No blame. The most valuable hour of the whole exercise — if your culture allows it. If your debrief turns into agencies defending their reputation, you have wasted the exercise. The hot debrief must be honest, structured, and protected from political consequences. The lessons are the value, not the verdict.
Improve. Update SOPs, retrain, patch the gaps. Then plan the next one. The cycle has no end — coordination is a perishable capability.
And on the right, the three outcomes that no other mechanism can deliver as efficiently.
Procedures tested. You learn whether your SOPs survive contact.
Trust built. Officers from different agencies discover their counterparts as people, not as agency emblems. This is durable. It survives rotation.
Gaps named. Honest debriefs surface what nobody wants to write in a memo. That naming is the first step to fixing.
And I will leave you with the line at the top right: the agencies that coordinate best in a real crisis are always the ones that exercised together before it. Not the ones with the best doctrine. Not the ones with the best technology. The ones that practised.
Tomorrow and the day after — that is exactly what we will do together. CPX and TTX on IORIS.
Good coordination becomes excellent. Poor coordination becomes expensively poor.
Start with the people and the process — then scale with the platform.
Duration: 5 minutes
The technology slide. And let me state the rule first, in big letters: technology multiplies whatever coordination you already have.
If your coordination culture is good, technology makes it excellent. If your coordination culture is poor, technology makes it expensively poor. Buying a platform does not buy you coordination — it amplifies the coordination you already have.
The five priorities on the right are listed in order. Don't skip steps.
One: data standardisation. The CISE-style common data model. Without this, nothing else works. European practice points at this very explicitly: standardisation is the prerequisite, not a bonus. If your agencies cannot describe a vessel position the same way, your fancy platform is just a fancy translation problem.
Two: virtual data lake. Federated access. We covered this two slides ago.
Three: secure exchange. Encryption, hardened protocols, VPN. And cyber-resilient by design — because the moment your coordination platform becomes the spine of your maritime response, it becomes a target.
Four: AI and anomaly detection. Sovereign algorithms — European practice consistently insists on this point. National control of the targeting algorithms is a sovereignty question, not a technical one. Apply them on AIS, satellite, open-source feeds — let machines find the weak signals humans miss.
Five: coordination platforms — for example IORIS. The platform you will use over the next two days. It is a powerful tool. But it is a tool. It does not replace the SOPs, the trained personnel, the standardised data, or the trust between agencies. It amplifies them. If those four are weak, the platform will not save you.
So the rule, one more time: technology enables. People and processes deliver. Build the people and the processes first. Then scale with the platform.
Duration: 5 minutes — close + bridge to CPX/TTX
Let me close with the six things the agencies in this room must own together. The strategic level cannot do these for you. They are the operational layer.
One. Stand up — or empower — one operational hub. Whatever it is called in your system, there must be one centre, with one duty roster, that animates the inter-agency network 24/7. Hub, not intelligence cell.
Two. Federate, don't unify. Forget the dream of one giant national database. Each agency keeps its own system. CISE-style common data model. Virtual data lake. That is the realistic architecture.
Three. Advance the three pillars together. Organisational, technical, human. If you are tempted to fund just one — usually technical — stop. Coordinate the investment.
Four. Run the exercise cycle, on a calendar. Plan, exercise, debrief, improve. Schedule it. Don't wait for the budget cycle. Joint exercises are the cheapest readiness investment a country can make.
Five. Technology as multiplier, not substitute. Tools like IORIS amplify good coordination — they do not create it. Build the architecture first.
Six. And this one is so often missed: close the loop, downward, daily. If the cells only ever report up and never receive guidance, intelligence or directives back, the network goes silent within months. People stop reporting because nothing comes back. That feedback loop is the responsibility of the hub.
The bridge. Tomorrow and the day after, you will move from theory to practice. CPX and TTX on IORIS — cyber-induced incidents on day two morning, CBRN at sea on day two afternoon. Those exercises are the operational layer in action. Use them to test what we discussed today — the SOPs, the information flow, the role of the hub. Be honest in the debriefs. The whole architecture I described over these two sessions exists to be tested under stress.
Thank you. I look forward to working with all of you over the next two days. Questions are welcome.