Preparing for the threat from hybrid warfare

In addition to the presentations one usually expects at the AMM – focusing on regulation, technical issues and safety – was one by Robert Diver, head of risk and resilience at Integrity HSE UK.

Mr Diver had a distinguished career in the UK military, before founding Integrity HSE. His presentation, ‘Hybrid Warfare in the North Sea,’ focused on the growing threat to energy infrastructure. Hybrid warfare, he explained, is designed to create pressure without open conflict. It remains below the threshold for conventional response by military forces. In the maritime space, it means that everything looks routine, until it doesn’t. Mr Diver told the AMM that typical signs of hybrid warfare include surveillance, loitering and unusual vessel behaviour. Its purpose, he explained, is to test response, create uncertainty, and undermine confidence. “Offshore teams will usually feel it before they can define it,” he said.

Describing the North Sea as a “critical operating space”, Mr Diver said the threat is not just direct attack, but sustained hybrid activity, to test the response of any country against which it is directed. That being the case, he said, resilience, reporting and communication are now as important as physical security measures. “The North Sea is central to UK energy security and economic resilience, and critical to NATO’s northern flank,” said Mr Diver.

So what might offshore what operators notice, should hybrid warfare of some sort be directed against offshore energy infrastructure? It might take the form of unusual behaviour at sea, not necessarily hostile action, he explained. It could involve close approaches, loitering, AIS irregularity or poor compliance. Other activity that might indicate a hybrid attack might take the form of suspicious drones, unusual lights or repeated odd behaviour. “These may be the clearest warning signs,” Mr Diver told delegates. They might be accompanied by confusion, distraction and increased collision or operating risk. A hybrid attack on the UK or another country might be a marine safety problem before it becomes a wider security problem.

So how should offshore operators respond? Early reporting of unusual behaviour, safety-zone issues and suspicious marine activity, is important, Mr Diver suggested, as are clear watchkeeping, identification, escalation and evidence-capture routines. Screenshots, tracks, timings, positions and photographs are all potentially useful evidence, and calm control is critical, the aim being to support safety, resilience and decision-making without fuelling unnecessary alarm. And as to what the future might look like, Mr Diver foresees increased activity, as the North Sea becomes more strategically important as the need for energy security intensifies. Hostile activity will probably remain deniable and ambiguous, to test response rather than trigger conflict. Operators may face more disruption, more reporting demands and more close-call events, so preparedness, coordination and resilience will matter more than ever.