Indian Defence Review

Scorpene Submarine

The genre of the information leaked, as can be gleaned by the few pages published indicates that the information pertains to the ‘as designed’ capabilities of the platform, as was known in 2011, rather than the ‘as built’ and ‘as achieved ‘capabilities, which are yet to be established, in our likely operating environment . The fact that Scorpene is a late 1990’s design of a widely exported submarine further reduces the ‘novelty’ factor as far as the tactical significance is concerned. While the commercial impact of the leak may be damaging to DCNS, its tactical significance to our adversaries, is limited.

A large volume of data and information pertaining to the yet-to-be operationalised Scorpene submarine of the Indian Navy is now available in the public domain. What is currently known is that the 22,000-odd pages of ‘Classified Data’ pertaining to the submarine were leaked in 2011, probably from a source external to India. Now, five years later, ‘The Australian’, a newspaper belonging to the Rupert Murdoch group, has claimed it is in possession of these 22,000 pages of ‘ten types of secret information’ which, as per them, compromises the Indian programme. The Australian, over the last three weeks, published a few pages and indicated that it would continue the process. An Australian court, however, has now granted temporary injunction against the further publication of documents.

The few pages published, marked ‘Restricted Scorpene India’, are of 2011 vintage and provide details of the submarine. While some may argue that the information is predominantly generic, certain details published do fall in the category of ‘sensitive’. The fact, that the newspaper redacted some of the data and that an Australian court, has granted temporary injunction against further publication, provides only temporary solace. Our concern is firstly the number of eyes and hands these 22,000 pages have passed through in the last five years, will never be known. Secondly, our analysis of the impact, is currently based only the few pages ‘published’ by The Australian. The fact that the published information is dated, considered generic and may have already be available to the discerning, is no guarantee that the remaining pages, yet to be published, can, similarly be considered benign.

Investigation of the source of leak and the legal redressal available to the government would certainly be undertaken by the appropriate agencies and, is therefore, beyond the purview of this article. What is being attempted is to, firstly undertake an analysis to identify the issues to be addressed at the macro level, so as to reduce the probability of re-occurrence of such information leaks. Secondly, we need to evaluate the content and assess the tactical significance of the leaked information. Reactions such as ‘these submarines are now sitting ducks’ and the crew is now ‘doomed to die’, need to be dispelled, before they cloud the decision making process at the highest level.

As a prelude, it may be prudent to put in perspective the background and current status of Project 75, the Scorpene project, as is available in the public domain.

The Scorpene class of submarines were first considered in 1998 as the follow-on for the four in-service SSK submarines. The contract for building six of these at Mazagon Dock Ltd (MDL), Mumbai, under Project 75 was signed in 2005, and construction commenced in 2009. The combat system package though finalised then, was contracted for only in 2012. The primary weapon, the torpedo, is yet to be selected. While there has been a delay of four years in the delivery of the first submarine, the delivery schedule of subsequent platforms has been compressed to one every six months. This, coupled with the fact that there is a delay in finalising the followons under Project 75 (I), the facilities at MDL in the interim, may be utilised to build an additional three Scorpene class submarines.

The Scorpene design is of the late 1990’s vintage and a follow-on of the Agosta 90 B, operated by Pakistan. India and Pakistan both, were justifiably worried when DCNS offered the Scorpene to India. Similarly, in light of the current leak, Australia is now worried about security compromise of its short-fin Barracuda Class submarines. The justification given by DCNS to the three navies is that the three classes of submarines are quite different from each other. This, at best, is only partially true. The DNA of the three classes cannot be substantially different. While customisation of weapon and sensor packages, vintage of the equipment and propulsion technologies does provide improvements, these are predominantly incremental and rarely transformational especially in terms of overall platform performance and stealth characteristics. However, retro fitment of an Air Independent Propulsion (AIP) is a game-changer in terms of operating profile and radiated noise parameters.

Cyber Security Organisation and Protocols

In today’s age of data digitisation and instant connectivity, public disclosure of sensitive information is just a click away. Hacking, whistle-blowing and information leaks are here to stay. It is a matter of ‘when’ rather than ‘if’ such a leak would occur. We can, at best, can reduce the probability of occurrence and increase the cost to the adversaries to obtain the information. We, therefore, need to acquire world class cyber security capabilities. This capability needs to be acquired and deployed enterprise-wide, at the appropriate scale and speed. For this, the current multiplicity of organisations and ‘silos of knowledge’ would have to be replaced by an umbrella Cyber Security Organisation. Such an organisation would need to be supported with adequate resources and manned with multi-disciplinary professionals. Its mandate must include constant scanning of the environment to detect potential threats and develop protocols which are then applied universally across defence acquisition projects; foreign or indigenous.

The need of such an Integrated Cyber Security Command, though conceptualised by military planners, has not found favour with the bureaucratic and political decision makers. Therefore, the Scorpene leaks must not be seen as a one of kind ‘security incident’ which needs ‘fixing’, but a ‘vulnerability gap’ which exists and will be exploited again, not only in acquisition projects, but across the entire spectrum of defence preparedness. This vulnerability needs to be addressed immediately and comprehensively. The irony is that, as a nation, we have world class cyber security capability in the private sector, which remains untapped and ignored by the government.

Documentation of a Weapon Platform

Documentation of any weapon platform including submarines is normally categorised into Design, Contractual, Exploitation (User or Operating & Maintenance documents), Trials and Combat Exploitation documents. In fact, the above is also the broad sequence in which documents are generated. Of these, the Exploitation Documents are voluminous, frequently referred to and most widely distributed. Their content, scope and classification, therefore, need to be deliberated upon, customised and standardised in the early stages of the project and must thereafter form part of the contract. The Trial Documents are generated much later in the project life. Since the results of trials are extremely sensitive, they are appropriately classified and have limited circulation. The Combat Exploitation Documents are an amalgamation of information from various documents and evolved over a period of time. Since they discuss operational strengths and limitations, these, along with the Trial Documents, are by far, the most secretive documents, with extremely limited accessibility.

To understand the documentation philosophy, it may be prudent to illustrate the treatment to say, radiated noise parameters, across various documents. Based on design parameters and certain mathematical models, the designers would arrive at a broad band of radiated noise figures during a particular operational profile, say the dived transit of the submarine. These would be contained in the design documents and also available in open literature, for purposes of marketing. Once the contract is finalised, the vendor would water-down these radiated noise claims as these values now need to be demonstrated as guaranteed performance during trials. The Exploitation Documents must, therefore, mention the radiated noise parameters in the most generic terms, preferably as mentioned in open literature for submarines of similar class and vintage. Next, when the radiated noise trials are conducted, as part of advanced sea trial, the actual radiated noise figures would emerge. These, in all probability, would be substantially lower than the figures guaranteed in the contract. These figures would then be recorded in the Trial Documents. Finally, based on these trial inputs and other operating parameters and considerations, the Combat Exploitation Document would, for example, recommend the machinery operating regime of the submarine during dived transit. Therefore, the value of the same parameter, radiated noise in this case, will have different values in different documents. Documents containing values of ‘tactical significance’ will have the highest security classification and least circulation.

Indigenous and Comprehensive Standard for Defence Documentation

The broad framework for documentation as well as the scope, content and format for each of these documents, should ideally be standardised, across the three services, in the form of a ‘Joint Specification for Generation of Documentation for Defence Systems and Platforms’. These specifications form the basis for generation of all categories of documents, by all Original Equipment Manufacturers (OEM), indigenous or foreign, across the defence services. No such joint specifications exist in the Indian context. Each service follows its own standards and in fact, there is limited standardisation even within each service. Further, in most cases, standards being used are ‘legacy specifications’ which have, at best, been only superficially updated. In nearly all cases, these do not holistically address issues such as format of e–documents, cyber security, precautions against data theft, hacking and phishing. In case of foreign vendors, documents supplied are often based on their own standards, further diluted for export purposes.

In the absence of such a formalised, comprehensive and technically ‘au fait’ specifications, it is likely that the contract for Scorpene submarines, with DCNS or other vendors/OEMs may not have addressed all aspects of documentation. Aspects which may have had insufficient focus or no mention in the contract, are the content and scope of each type of document, guidelines for assigning security classification, control of data and information, wetting of group of authors, premises (DCNS or MDL) where documents are to be generated, security protocols (physical and informational) and aspects of cyber security.

Outsourcing Generation of Exploitation Documents to Foreign Collaborator

Exploitation documents are primarily generated for the crew and maintenance teams, to operate and maintain the systems and the platform. These documents are a synthesis of data and information of individual components and equipment, which constitute the ‘system’ or ‘system of systems’. The process of generating exploitation documents is an involved and multi-disciplinary activity, undertaken by a ‘group of authors’ who have experience of operating and maintaining similar platforms, possess good writing and language skills and understand the operating and maintenance philosophy of the client navy. Subsequently, this group becomes the core group to undertake other downstream activities such as preparing training aids and simulators, designing and imparting training, preparing spare parts list and drawing maintenance schedules.

The Scorpene is a ‘Build in India’ project, with substantial involvement of the design teams of MDL and the Indian Navy. As it finally transpired, DCNS hired retired French naval personnel to generate these documents. It is now known that some of these personnel were the source of the leak.

Click to Buy: IDR Oct-Dec 2016

The Indian Navy has nearly 50 years of experience in operating, maintaining and refitting four classes of submarines including a nuclear submarine. We are probably the only Navy which operates submarines of both, Eastern and Western origin. We have designed albeit with limited assistance from a collaborator and built a nuclear submarine. English is our first language. Yet the decision makers felt that retired French submariners are better equipped, more competent, trustworthy and possess better professional acumen than our own retired submarine fraternity to undertake this ‘sensitive task’ at, positively, an exorbitant fee. We could have considered generating exploitation documents utilising our own veteran fraternity. As a quality assurance measure, this indigenous group could have been assisted by a consultant from DCNS. This group could then have formed the core team to undertake other down-stream operationalising tasks mentioned above. This approach would not only have contributed towards our indigenisation effort, but would have also substantially reduced the information security vulnerabilities.

Classification of Information – The Official Secrets Act (OSA) 1923

While enough has been said about the vintage and incongruity of the Official Secrets Act 1923, some observations merit mention. The Act was brought into force in India in 1889, post the Mutiny of 1857. As with many other Acts enacted during that period, (IPC, Army Act), these legislations had been drafted by the British to deal with the ongoing ‘Home Rule Movement’ in Ireland. The OSA, 1889, has only been superficially amended in 1904, 1923 and 1967. The reluctance to replace these Acts with more contemporary legislations is driven more by the convenience of ‘selective application’ they offer to the political and bureaucratic establishment rather than mere organisational inertia.

In fact, the Right to Information Act of 2005, which enables any citizen to obtain information from official records, is contradictory to Clause 6 of the OSC, which stipulated that information obtained from any government office is to be considered ‘official’ and will be governed by the OSA. Certain court verdicts have further added to the confusion and in some cases, reduced the power of the Act. In the State vs Ifilikhar Gilani case of 2002, the court ruled that ‘a document marked Secret, will remain Secret, despite being publically available. In another case, (State vs Santana Saikia) the Delhi High Court reduced the power of the Act by its ruling that “publication of a document merely labelled Secret shall not render the accused liable under law.”

In addition to these incongruities of the OSA, the Act does not address contemporary issues such as marking a document ‘Cleared for Internet Transmission’ or stipulating restrictions on it storage on a Networked System. Such instructions, even if issued as official memos, neither have any legal jurisdiction nor pan organisational applicability.

Therefore, there is an urgent need to replace the present Official Secrets Act, 1923, with an unambiguous, comprehensive and contemporary legislation which is understood by all and is universal in its implementation.

Content and Tactical Significance of Published Information

There is no doubt that, as mentioned by a number of analysts, the Scorpene leak is ‘no small matter’. The fact that the leak originated from France and only a few of the 22,000 odd pages have been published until now is also of little solace. This is the kind of information for which nations allocate substantial resources, at times, wait for years and yet not be sure of its authenticity and correctness. The fact that this is now available to all is a matter of deep concern. We ought to be perturbed about our vulnerabilities; our vulnerabilities in term of information securities. The horse has bolted and we are looking at reducing the impact of our loss. Loss it sure is.

Having said that, we now need to examine the extent to which the leaked information impacts our platform capabilities. We must then analyse measures to reduce the impact of the leak.

Impact on Operational Capabilities

Of the claimed 22,000 pages ‘stolen’ and now available with The Australian, only a minuscule few have been published to date. While it would be statistically incorrect to presume that the published pages are a true sample of the 22,000 odd leaked pages, it may however be prudent to make certain generic assumptions and analyse what is currently available, rather than wait for more pages to be published, which hopefully does not happen!

Prima facia, the leak, its volume and timing, is more to embarrass DCNS and hurt its commercial interests, rather than part of a deliberate military espionage. The content being generic and predominantly indicative has limited tactical significance to an adversary. Certain other inferences drawn from the content are enumerated below.

•  Documents Leaked. Based on the time of the leak (2011) and volume of the leaked documents, it is assumed that most of the leaked pages are part of the Exploitation Documents which may have been prepared by DCNS to impart training to the Indian crew and maintenance teams.

The Scorpene leak should, therefore, be viewed as a wake-up call about our information security vulnerabilities rather than as a national security disaster…

•  Vintage of Data Leaked. Since the leaked data is of pre-2011 vintage, all platform-related information (stealth, radiated noise, sensor performance) would be generic or at best a ‘mathematical estimation’. No class or platform-specific data was even available at that stage.

•  Passive Sensors. As brought out by a senior veteran submariner, submarines are passive predators and rely mainly on their passive sensors to detect, classify and attack targets. Knowing the operational parameters and capabilities of these passive sensors is of little significance to the adversaries as there is very little they can tactically do to degrade their performance.

•  Active Transmitters. Active transmissions from a submarine, both acoustic and electronic, are infrequent, deliberate, controlled and much later in the encounter; when it no longer beneficial for the submarine to conceal its presence. They are used only in the final stages of the encounter when the submarine commander decides to shed its cloak of secrecy and go for the kill. So being aware of the parameters of the active sensors does not in any significant manner, tilt the balance in the favour of the enemy platform.

•  Navigation System. The radar used for surface navigation is normally a commercial radar and therefore negates platform-emitter correlation. Operating parameters of other navigation equipment would pertain to their individual ‘stand-alone’ configuration, based on Factory Acceptance Tests. For example, the accuracy of the individual gyro may now be known; but the accuracy of the navigation complex of the submarine, of which the gyro is one component, would only be known after sea trials.

•  Communication Systems. Submarines are almost always only in the listening mode for shore-to-ship communication. When ship-to-shore communication is unavoidable, high speed, encrypted, burst transmissions are made using buoyant antenna. The operationalisation of own satellite tilts the entire communication and the data link paradigm in our favour. Therefore, knowing the parameters of the communication suite, does not in any way increase the vulnerability of the submarine.

•  ESM System. ESM is a passive sensor which detects and identifies enemy EW transmissions. By knowing our ESM capabilities, all an enemy platform can do is stop transmission in that particular spectrum, thereby degrading its own war-fighting capabilities.

•  Depth, Range and Endurance. Diving depths, operating range and endurance of all commercially available submarines, can easily be obtained from open literature. Operating depths are predominantly determined by the type of steel used, design philosophy, single or double hull and certain other design parameters. Most submarines the world over, operate in a similar depth envelop. Also, the safety margin between normal operating and crushing depths is so wide that submarine commanders are known to have taken submarines during combat, to depths well beyond normal operating depths and lived to tell the story! So most submarines operate in ‘depths in excess of 250 to 300 metres’. Endurance is a function of the fuel carried and most modern conventional submarines have endurance between 45 to 60 days. There is, therefore, very little tactical advantage of knowing the exact values of these. Generic diving depth, range and endurance data available in the open domain is adequate for tactical purposes.

•  Weapon Parameters. The Indian Navy is yet to decide the heavy weight torpedo the Scorpene will carry. Details of the torpedo, if available in the leaked documents, are irrelevant. As far as the Exocet missile is concerned, it is a widely exported missile and used world over, including by the Pakistan Navy. There is very little that is not known about the weapon operating envelope. The parameters pertaining to the seeker radar are ‘customer modifiable’ and are therefore dynamic.

•  Combat System. The Combat System is programmable ‘calculator’ and an integrator of various sensors. In simple terms, its output is a statistical estimation of the target course, speed and range, based on which, it recommends the course the ‘chosen’ weapon must run to impact the target. The programme is in the form of the source code which is proprietary and belongs to DCNS. It, therefore, is of commercial rather than tactical significance. The system accuracy, being a statistical estimation, dependent entirely on the attack geometry, sensor accuracy, hydrological conditions and the duration for which the algorithm has run. So knowing its performance under ‘standard testing conditions’ (which is a design and contractual parameter) does not in any manner help the adversary tactically. The actual capability of the Combat System, which is in fact a system of systems, will only be established after the Indian Navy conducts numerous environmental trials and firings; many more than what is stipulated in the acceptance protocols. Only the analysis of this trial data will define the true ‘capability of the combat system’.

•  Frequency Discreet of the Submarine Radiated Noise. The most important and tactically significant data of a submarine is the information pertaining to the various ‘energy fields’ it produces while operating. These fields are unique to each platform and are referred to as its signature. The submarine therefore has an acoustic (noise) signature, an infra-red (heat) signature, a magnetic (metal) signature and an electromagnetic signature. Of these, the acoustic field is of tactical significance. All these signatures are platform-specific information and will be determined only during the yet-to-be conducted, signature trials of the submarine. This information is a closely guarded secret, known to a very few even within the Navy. Therefore, what is available in the leaked documents are not submarine signatures, but certain ‘mathematical estimates’, of a few ‘frequency discreet’, of radiated noise, duly downgraded so as to fulfil contractual guarantee.

•  Acoustic Signature of the Submarines. While it is the radiated noise levels that determine the range at which the enemy sensors will detect the submarine, the ‘acoustic signature’ is what helps the enemy identify the specific platform. Therefore, mere knowledge of a few frequencies or frequency band of the radiated noise, does not in any manner help the enemy detect the submarine earlier. Once detected, the radiated noise spectrum is analysed and compared to the acoustic signature, if available in the library of the enemy platform. If there is a match, then the identity of the submarine is established. Therefore, the basic challenge still remains for the enemy i.e. to first detect the submarine‘s radiated noise. The subsequent identification is only to confirm the type or class.

•  Inherent Range Advantage of Submarines. Because of the inherent quietness of a submarine, it will detect the enemy warship much earlier; the range advantage being in the order of ‘several times’. It, therefore, would have either attacked or evaded the ship, as per the submarine’s mission profile, well before entering the detection range of the warship’s sensors.

Containing the Impact of the Information Leak

While the steps, material or tactical, which the Indian Navy would take to negate or minimise the impact of the leak, are beyond the purview of this analysis, the three major indigenous developments which would enable this, are enumerated below.

•  Indigenous Weapons. As per reports, an indigenous heavy weight torpedo for launch from submarines, is under development and should commence trials soon. We already have other alternatives to the present tube-launched missile, the Exocet. Induction of these would render the leaked information of weapons redundant.

•  Indigenous AIP System. AIP systems are a game-changer in conventional submarines. They not only drastically modify the radiated noise parameters, but also impact the operational profile, speed, range and endurance. The last two boats of Project 75 are to be fitted with an AIP system and the same would be subsequently retrofitted in all boats. In addition to the system being offered by DCNS, as per open literature, an indigenous AIP system has already been developed and is ready for trials. The advantages of fitting the indigenous system on all six boats need no emphasis.

•  Dedicated Military Satellite. Operationalisation of the dedicated naval satellite, coupled with the existing VLF station, would render the leaked communication suite and data link related info, redundant.

Conclusion

The Scorpene project was intrinsically on a rising curve of vulnerability. It was vulnerable because of certain systemic lacuna. The major lacunae that need to be addressed are the absence of an ‘Integrated Cyber Security Organisation’, non-availability of a comprehensive ‘Standard for Generation of Documentation for Defence Systems and Platforms’, review the decision to outsource generation of exploitation document to the collaborator (instead consider utilising own veteran community) and a grossly deficient, outdated and incongruent legislature in the form of the Official Secrets Act, 1923. These vulnerabilities are in fact, intrinsically present in most of our defence project. These needed to be addressed yesterday!

Analysts feel that the ‘Made in India’ impetus to submarine design and construction would render information security more robust. While it most certainly will reduce the probability of an information leak in the future, it should not be considered as the panacea to the problem of information Security.

There can be no two views on the need to indigenously design and build conventional submarines in India. With the launch of the Arihant, the capability to do so has been amply demonstrated. However, this alone is not likely to address the issue of data and information security.

Therefore, there is an urgent need to catch the bull by the horn; identify and address the real causes of our vulnerabilities. To assume ‘Make in India’ is the panacea to all problems, would be foolhardy and over-simplifying the otherwise challenging task of protecting our security information.

The genre of the information leaked, as can be gleaned by the few pages published indicates that the information pertains to the ‘as designed’ capabilities of the platform, as was known in 2011, rather than the ‘as built’ and ‘as achieved ‘capabilities, which are yet to be established in the likely operating environment . The fact that Scorpene is a late 1990’s design of a widely exported submarine further reduces the ‘novelty’ factor as far as the tactical significance of the information leak is concerned. While the commercial impact of the leak may be damaging to DCNS, its tactical significance to our adversaries, is limited.

Therefore, in conclusion, what emerges is that while the Indian Navy ought to be perturbed that such a major lacunae in its information security weakness has been exploited, it need not be paranoid of the operational fallout of the leak. The Scorpene leak should, therefore, be viewed as a wake-up call about our information security vulnerabilities rather than as a national security disaster.