Introduction

Integrated Air and Missile Defence Systems (IAMDS) have drastically improved the way militaries conduct ground based air defence, by providing enhanced accuracy and speed of engagements against airborne threats. Despite this, tragic accidents such as the USS Vincennes incident on 3 July 1988 and the shooting down of the Ukrainian Air Flight 752 on 08 Jan 2020 still occur. The circumstances surrounding both incidents are different; however, both incidents occurred during a Multi-Domain Operation, resulting in the destruction of civilian aircraft and tragic loss of life. There was no single cause to either incident; rather there were multiple factors that lead to the incorrect targeting of the civilian aircraft. Specifically, the level of automation set on the Aegis and Tor-M1 IAMDS in both incidents was incorrect due to the assessment of whether they were in conflict or competition.

The aim of this paper is to provide a critical analysis of the fundamental failures that occurred in both incidents under the context of automation in order to draw out lessons learnt. The author does not intend to discredit any persons involved, but rather to learn from past mistakes. This is especially important for Army and 16 Regiment, Royal Australian Artillery, with the introduction into service of National Advanced Surface to Air Missile System (NASAMS). To achieve its aim, this paper will critically analyse the USS Vincennes and Ukrainian Air incidents in relation to automation, then draw out 10 key lessons to assist with the introduction into service for NASAMS and to harness the potential of its automation.

IAMDS Context

IAMDS are complex systems that require different operating parameters and operating modes in order to operate effectively. At the core of the IAMDS is its operating parameters; specific data developed to govern the behaviour of the radar and strike weapons. The operating parameters utilise assessments developed by the Air Operations Centre (AOC), including rules of engagement, hostile target criteria and information such as target identification systems (Identification, Friend or Foe - IFF)[1]. These assessments determine the operating parameters, which are the prerequisites that determine the threshold for target engagement. Supporting the operating parameters are the operational modes. There are three broad modes, namely; manual, semi-automatic, and automatic. 

Manual mode relies on the operator to manipulate the IAMDS, including developing a manual assessment of the threat. Semi-automatic mode relies on automation of the IAMDS to generate a firing solution that have met the operating parameters; however, the final authority is held with the operator. Automatic will automatically generate a firing solution and fire against threats that have met the operating parameters. The operator can intervene to stop the engagement; however, no further authorization is required.

There are advantages and disadvantages to each; however, the purpose behind the different operating parameters and operating modes is to enable the commander to tailor the IAMDS against different threat environments and maximize its effectiveness. For example, one operating parameter might use semi-automatic mode to engage aircraft in an information-saturated environment. Another operating parameter might use automatic mode to engage cruise missiles, for which there might be less warning. NASAMS has been developed to operate in the same fashion, utilising specified operating parameters and utilising operating modes (manual, semi-automatic, automatic) which can be tailored to specific threat environments.

USS Vincennes Incident

During the Iran-Iraq War the USS Vincennes was deployed to the Strait of Hormuz, in the Persian Gulf to secure international shipping lanes that were being threatened by both countries. The USS Vincennes was a Ticondergoa Class guided missile cruiser, fitted with the Aegis IAMDS and SM-2MR medium range surface to air missiles. The USS Vincennes was part of Joint Task Force protecting civilian shipping that had become increasingly under attack by Iranian (Islamic Revolutionary Guard Corps – IRGC) and Iraqi gunboats and fighter aircraft. The continued indiscriminate attacks against civilian and JTF assets resulted in broad rules of engagement, giving commanders the authority to take positive protective measures when hostile intent was manifested.

On 3 July 1988 the USS Vincennes came under direct attack by multiple IRGC gunboats whilst escorting a civilian vessel. The USS Vincennes, supported by other JTF vessels, were granted permission to pursue the IRGC gunboats as the threshold for hostile intent had been met. Whilst the USS Vincennes was engaged in contact at close range, Iran Air Flight 655 took off on a scheduled civilian flight from Bandar Abbas Airport for Dubai. Bandar Abbas Airport was a joint military/civilian airfield and previous theatre reporting had assessed IRGC F-14s as utilising Bandas Abbas Airport as an operating base. Flight 655 was transiting in an approved civilian air corridor transmitting friendly IFF codes; however, in the information-saturated environment on board the USS Vincennes the IAMDS operators manually correlated Flight 655 as a hostile air track. Supporting JTF IAMDS operating in the area automatically correlated Flight 655 as a friendly aircraft; however, without a single integrated air picture, this information was not used by the USS Vincennes. As a result, the USS Vincennes engaged Flight 655 with two surface to air missiles destroying the Airbus 300 aircraft and killing 290 people.

USS Vincennes Analysis

It is almost certain the IAMDS operators were in a combat mindset due to the direct threat from the IRGC gunboats, influencing their interpretation of information. There was not a lack of information available to the USS Vincennes, but rather, in the information-saturated environment there was no correlation to confirm the validity of the information. Stress, target fixation[2], and unconscious distortion of information[3] were all contributing factors to the incorrect manual correlation of Flight 655. It is possible that if the automatic operating mode was used on the USS Vincennes, then the Aegis IAMDS would have correlated Flight 655 as friendly air track. The USS Vincennes did not purposely engage a civilian aircraft. Rather, the Commanding Officer engaged an assessed threat based on incorrect information.

Ukraine Airlines Incident

In late 2019, tension between the US and Iran began to escalate over international shipping in the Strait of Hormuz. On 3 January 2020, IRGC IAMDS units commenced short range ballistic missile attacks against US installations in Iraq. This was in retaliation to the US MQ-9 Reaper strike that killed IRGC Commander MAJGEN Qassem Soleimani. As a precaution for any further US attacks, the IRGC deployed Tor-M1 (SA-15 Gaunlet) IAMDS units IVO key infrastructure surrounding the Iranian capital, Tehran. On 8 January, Ukraine International Flight 752 took off from Tehran Airport bound for Kiev. Flight 752 was transiting in an approved civilian air corridor transmitting friendly IFF codes; however, a Tor-M1 IAMDS unit manually correlated Flight 752 as a hostile cruise missile and engaged with two 9K331 surface to air missiles destroying the Boeing 737 killing 176 people. Iran denied any part in the destruction of Flight 752 for three days, before the IRGC accepted blame, stating that they mistakenly identified the aircraft as a hostile cruise missile attacking a sensitive IRGC military centre.

Ukraine Airlines Analysis

Historically, IRGC IAMDS technical and tactical training is held at the highest command level. Operators receive minimal training and are expected to blindly follow orders, with severe consequences for not doing so. Therefore, it is highly unlikely that any information or threat assessments were given to the Tor-M1 IAMDS units, creating an information-starved environment. This is likely to have resulted in the operating parameters and operating modes on the Tor-M1 IAMDS being extremely broad with corresponding low risk thresholds. The IRGC were in a combat mindset, with IAMDS units being placed on high alert and deployed to protect key infrastructure. This influenced the interpretation of data in an information-starved environment. Stress, bias for action for fear of failure, and lack of training all contributed to the incorrect manual correlation of Flight 752. It is possible that if the automatic operating mode was used by Tor-M1 IAMDS, then Flight 752 would have been correlated as a friendly air track rather than a cruise missile. The IRGC engagement was a miscalculation largely based on a lack of information, inadequate training and knowledge of the IAMDS, and fear of failure.

10 Lessons learnt for the introduction into service for NASAMS

It is through the critical analysis of USS Vincennes and Ukraine Airlines incidents that the following lessons have been developed for the introduction into service for NASAMS.

Lesson 1: Requirement to have good technical knowledge of the operating system.

This is a general requirement across all levels of Defence, having good technical knowledge of operating systems. However, in the NASAMS context operators need to have further understanding and knowledge of the intent behind why different operating parameters and modes are determined for each for each mission and the technical requirements for that mode. As seen with both incidents, aircraft track data was incorrectly correlated that resulted in the destruction of civilian aircraft. The selection of a different operating mode within the IAMDS may have led to different outcomes. For instance, in the information-saturated environment of the USS Vincennes, using automatic mode may have produced a different result. Similarly, in the information starved environment of the Ukraine Airlines incident, using automatic mode may correctly correlated Flight 752.

Lesson 2: Requirement to conduct specific training for various levels of responsibility.

Training at all levels of command is essential to ensure appropriate depth of knowledge in how to effectively operate and employ the system. This enables all persons within the operating cycle to know exactly what their roles and responsibilities are, and what their superiors are. This facilitates greater knowledge of the system, enhancing effectiveness. In the NASAMS context, this would include training on who has the authority to change the operating parameters and modes. The Ukraine Airlines incident is a perfect example of where not conducting specific and continual training can have dire results.

Lesson 3: Requirement to conduct mission specific training to improve operator proficiency (Qualified verses Competent).

Similar to having good technical knowledge of the system, conducting specific training, further enhancing the operator’s ability to manipulate the system within the specific operating environment. This then enables the operator to think about tactical employment, and the risks associated with firing the weapon. In the NASAMS context, this would include training on manipulating the operating parameters and modes to suit the operating environment. This can be achieved through detailed simulations, where commanders and operators are run through a series of mock engagements. A positive outcome would be that the conscious decision to fire the weapon would not eliminate potential for accidents, but rather the preoccupation of accidents would help them prevent incidents, enhancing capability.

Lesson 4: Requirement to train how we fight (Battle Inoculation).

To achieve high reliability, there needs to be significant investment into providing training that is robust and realistic. This not only develops our operators from being qualified to being competent, but also trains our personnel in the psychological factors of warfare such as stress, task fixation, and the unconscious distortion of data. In the NASAMS context, this could include conducting training in information-saturated or information-starved environments, similar to the USS Vincennes and Ukraine Airlines incident.

Lesson 5: Requirement for redundancy (Systems/Communications/Verification).

To ensure any air engagements are prosecuted effectively, doubt needs to be removed from the equation as much as possible. Operating in an environment of doubt can create either decision paralyses or incorrect correlation of air track data, similar to USS Vincennes and Ukraine Airlines incidents. Therefore, having integrated systems to interrogate air track data is vital to ensure the interpretation of the information is correct. In the NASAMS context, this can be achieved through layering. This could consist of either deploying multiple IAMDS units in the operating area or utilising multiple tactical networks such as Link 16. The layering of these systems will increase the level of redundancy available to the IAMDS unit, ensuring the right effect is achieved at the right time, accurately.

Lesson 6: Requirements for a Single Integrated Air Picture in the AO.

There is an inherent risk that all IAMDS will interrogate air track data differently. This can be due to physical location in the area of operations or differences in operating parameters and modes. Therefore, having a single source of truth reduces doubt in the validity of air track data. Having a single integrated air picture, that corroborates and correlates multiple systems, reduces information-saturation for operators and commanders. The USS Vincennes incident is an example of where incorrect correlation of data in an information-saturated environment can inform command decisions that may have dire consequences. In the NASAMS context, the single integrated air picture and would be coordinated at the AOC and be promulgated to all airspace users.

Lesson 7: Requirement to have a clear understanding of the threat environment.

Having a clear understanding of the rules of engagement and threat environment allows operators and commanders the ability to manipulate the IAMDS to suit the mission. Classification of hostile criteria is dependent on the rules of engagement and guidance from the Formation Legal Officer and direction from the AOC in the form of the OPTASK ID supplementation. IAMDS Commanders need to consider their mission and assessments, in order to determine operating parameters and modes. Initially this would be conducted prior to entering an area of operations. However, it would need to be continually updated as the situation changes. In the NASAMS context, the operating parameters and modes would be established prior to commencing operations, then continually refined depending on the situation. Hostile criteria classification would be promulgated from the AOC to the IAMDS units. To further enhance hostile criteria classification, operators would utilise aids to hostile criteria classification. As an example, these aids would include; identifying whether an air track has originated from a known threat location, identifying whether the air track is operating in a promulgated ACM. The Ukraine Airlines incident is an example of where utilising aids to the hostile criteria classification would of identified Flight 752 operating in a civilian air corridor.

Lesson 8: Requirement to have an understanding of friendly force operations.

Having an understanding of friendly force operations provides situational awareness to all commanders enabling more effective decision making process. This is common to all levels of defence. To facilitate understanding, lines of communication and integration needs to be established prior to commencing operations and continually maintained during operations. This has traditionally been conducted by providing Liaison Officers (LO) to Headquarter elements. The Ukraine Airlines incident is an example of where if military integration was established at the Tehran Airport, civilian air corridors might have been promulgated to IAMDS units resulting in a different outcome for Fight 752. In the NASAMS context, along with LO positions, integration could be further enhanced by promulgating and displaying ACMs to all supporting units. This would enable IAMDS commanders greater flexibility with the ability to adjust rules of engagement and weapon control orders dependant to the threat.

Lesson 9: Requirement to provide accurate information verses speed of response.

In an information-saturated or information-starved environment, time must be allocated to check and verify the validity of information. The speed of responsiveness needs to be commensurate to the threat. The Ukraine Airlines incident is an example of where the speed of responsiveness did not match the threat. Whereas, the USS Vincennes speed of responsiveness corresponded to the perceived threat; however, the decision to engage was based on incorrect information. The NASAMS beyond line of sight capability is significant. Therefore, commanders must allocated time to check and verify the validity of information, including a human check on all modes of automation. This will not be done in isolation, but in conjunction with lessons 5 and 6. 

Lesson 10: Requirement to have an all informed network IOT expedite the decision making process.

We are taught to never plan in isolation. Having an informed network provides greater flexibility to commanders at all levels. It enables the corroboration of multiple systems and multiple information providers, thus allowing for greater situational awareness for all involved. This is important with the introduction into service of NASAMs, as Commander’s will need to be aware of the operating parameters and modes in which the system will be operating. However, there needs to be a single source of truth to all the information being shared, as discussed in lesson 6.

Conclusion

The USS Vincennes and Ukraine Airlines incidents highlight how different operating parameters and operating modes effect how data is correlated on IAMDS. Whether in an information-saturated or information-starved environment, having knowledge and trust in the system will enable the operators ability to correctly correlate and engage hostile threats. The purpose behind different operating parameters and modes (automation) within IAMDS is not to remove the operator from the equation, but to enhance the accuracy and timeliness of engagement. The ‘human in the loop’ will always remain with IAMDS regardless of what operating mode is selected, as the operating parameters are determined through human intent. 

The introduction of NASAMS is an exciting capability enhancement for the ADF, with its beyond line of sight fires and levels of automation. Through examining past IAMDS failures, such as the USS Vincennes and Ukraine Airlines incidents, we can attempt to avoid systemic problems and incorporate solutions into the initial employment of NASAMS.