Welcome back. Before the coffee break we built the strategic frame — the political authority, the doctrine, the lead-agency matrix, trust as infrastructure. That is the architecture above the line agencies.
Now we move down into the architecture. For the next forty minutes we look at the operational level — how the agencies in this room translate that strategic frame into joint operations on the water, day by day, watch by watch.
You will see one image repeatedly today: the operational hub at the centre, with the line agencies on the rim. Keep it in mind. Everything we discuss is a question of how the spokes connect to the hub, and what flows through the hub.
Quick recap. In Session 1A we built the strategic architecture: a single empowered authority, a signed national doctrine, a lead-agency matrix, classification tier, and the political will to renew it. That is the slow-moving, stable layer.
Now we cross the bridge to the operational level. And the message of this slide is very simple: doctrine designs, operations deliver.
Whatever the strategic level decides, eventually someone at 03:00 has to act on it. The doctrine becomes a phone tree. The classification becomes a tagging rule on a real document. The lead-agency matrix becomes the sentence the duty officer says when picking up the line: “This is the lead. We are activating the cell.”
If you only have the strategic layer — you have a beautiful policy document and no response. If you only have the operational layer — you have officers improvising under pressure with no political cover. Neither works alone.
And here is the recurring observation across the European studies: most countries that fail at coordination did not lack doctrine. They had doctrines — sometimes excellent ones. What they lacked was the operational machinery underneath.
This slide carries the most important architectural choice you will make at the operational level. Get it wrong and the whole system collapses.
The coordination hub federates, shares and animates. It does not produce intelligence.
Let me walk through the left column. The hub cross-references — takes inputs from every agency and looks for patterns no single agency would see. It maintains the shared situational picture — one screen, one truth. It pushes alerts — weak signals, anomalies — back out to the network. It animates thematic working groups: CBRN at sea, cyber on vessels, trafficking patterns. It operates 24/7. And it owns the joint exercise calendar.
The hub does not: draft classified intelligence assessments, run human sources, task collection, command agency assets, or arbitrate disputes between agencies (that is the strategic level). The hub is not a court.
Why is this distinction so important? European practice is unambiguous: a coordination cell is not, and must never become, an intelligence body. The moment a hub crosses into intelligence production, two things happen.
One: the established intelligence services see it as a competitor in their own domain and stop sharing.
Two: the civilian partners — industry, port authorities, customs — see it as an intelligence service and refuse to engage. They are happy to share with a coordination cell. They will not share with what they perceive as a spy office.
So the architectural rule is absolute: keep the hub clean of intelligence production. If your country needs a maritime intelligence service — and many do — create it elsewhere. The hub does coordination. Period.
How does information actually flow? The answer is on this slide, in two halves.
Before. Every agency has built its own fusion centre over the years. The Navy has one. The Coast Guard has one. Customs has one. Intelligence has one. They produce parallel analyses — sometimes conflicting. In a crisis, the duty officer of agency A picks up the phone to agency B, then C, then D. Bilateral phone calls in every crisis. And anything sensitive sits frozen behind classification walls because there is no shared marking.
This is not hypothetical. This pattern is widely documented across maritime administrations.
After. The architectural answer is not to demolish each agency's systems and build a single national database. That has been tried in many countries — including France. It has never worked. It is too expensive, too slow, and the agencies sabotage it.
The realistic answer is federated: each agency keeps its own system and its own data. Sovereignty is preserved. But two things connect them.
One: a common data model — in Europe, the CISE standard, Common Information Sharing Environment. A shared way of describing a vessel, a position, an event.
Two: a virtual data lake. Federated access, not central copy. The hub queries each agency's data in place, with appropriate authorisation. No giant national database to maintain. No physical movement of sensitive data.
Add to that: the hub cross-references and pushes back alerts to the network — bidirectional. And the industry door is the single channel for private-sector feeds.
If we now zoom in on the operational machinery itself, the European experience converges on three pillars. They are not optional alternatives. They advance together — or coordination decays.
Pillar one — organisational. Common SOPs for the most common crisis scenarios. Designated points of contact in every agency — named, with a backup, published on a directory the duty officer can pull up at 03:00. Cross-participation in each other's meetings. A collaborative working space. And standing thematic working groups for the priority threats.
Pillar two — technical. Data standardisation — the CISE-style common data model. The virtual data lake architecture. Secure exchange protocols — encryption, VPN, hardened endpoints. The shared classification tier we discussed in the strategic session — here it becomes a tagging rule on actual documents. And audit logs, so you can detect leaks and prove integrity.
Pillar three — human. This is the pillar most often under-funded. Common qualifying training — an online qualifying module — now considered standard European practice — is widely recommended for all cell personnel. Permanent liaison officers across agencies. Immersion programmes — sending a Coast Guard officer to spend two months inside Customs. Continuous training to keep up with new tools and threats. And the soft work of building a professional community.
I want to spend a moment on the exercise cycle, because in operational coordination it is not optional. It is the single most reliable mechanism for building real interoperability.
Look at the four phases on the left.
Plan. Realistic scenarios — designed to break coordination, not to flatter it. The temptation is always to design exercises that everyone wins. That teaches you nothing. Design the scenario to expose the seams between agencies, the weak points in the SOPs, the moments where someone hesitates. And critically — all agencies at the table from the planning stage. Not invited at the last minute.
Exercise. Test under stress. Procedures, communications, escalation — the things that fail at 03:00 on a real night.
Debrief. No blame. The most valuable hour of the whole exercise — if your culture allows it. If your debrief turns into agencies defending their reputation, you have wasted the exercise. The hot debrief must be honest, structured, and protected from political consequences.
Improve. Update SOPs, retrain, patch the gaps. Then plan the next one. The cycle has no end — coordination is a perishable capability.
And on the right, the three outcomes that no other mechanism can deliver as efficiently. Procedures tested. Trust built — officers from different agencies discover their counterparts as people, not as agency emblems. Gaps named — honest debriefs surface what nobody wants to write in a memo.
The technology slide. And let me state the rule first, in big letters: technology multiplies whatever coordination you already have.
If your coordination culture is good, technology makes it excellent. If your coordination culture is poor, technology makes it expensively poor. Buying a platform does not buy you coordination — it amplifies the coordination you already have.
The five priorities on the right are listed in order. Don't skip steps.
One: data standardisation. The CISE-style common data model. Without this, nothing else works. European practice points at this very explicitly: standardisation is the prerequisite, not a bonus.
Two: virtual data lake. Federated access. We covered this two slides ago.
Three: secure exchange. Encryption, hardened protocols, VPN. And cyber-resilient by design — because the moment your coordination platform becomes the spine of your maritime response, it becomes a target.
Four: AI and anomaly detection. Sovereign algorithms — European practice consistently insists on this point. National control of the targeting algorithms is a sovereignty question, not a technical one. Apply them on AIS, satellite, open-source feeds — let machines find the weak signals humans miss.
Five: coordination platforms — for example IORIS. The platform you will use over the next two days. It is a powerful tool. But it is a tool. It does not replace the SOPs, the trained personnel, the standardised data, or the trust between agencies. It amplifies them.
Let me close with the six things the agencies in this room must own together. The strategic level cannot do these for you. They are the operational layer.
One. Stand up — or empower — one operational hub. Whatever it is called in your system, there must be one centre, with one duty roster, that animates the inter-agency network 24/7. Hub, not intelligence cell.
Two. Federate, don't unify. Forget the dream of one giant national database. Each agency keeps its own system. CISE-style common data model. Virtual data lake.
Three. Advance the three pillars together. Organisational, technical, human. If you are tempted to fund just one — usually technical — stop. Coordinate the investment.
Four. Run the exercise cycle, on a calendar. Plan, exercise, debrief, improve. Schedule it. Don't wait for the budget cycle. Joint exercises are the cheapest readiness investment a country can make.
Five. Technology as multiplier, not substitute. Tools like IORIS amplify good coordination — they do not create it.
Six. Close the loop, downward, daily. If the cells only ever report up and never receive guidance, intelligence or directives back, the network goes silent within months.