Batten the Hatches: Cybersecurity with Military Mariners

1 Introduction

• Military cybersecurity remains understudied at the operator level, even as cyber-physical failures can degrade missions, threaten lives, and carry strategic consequences.Prior military research has emphasized doctrine, strategy, and system design, leaving limited insight into frontline decisions under operational constraints.Source: §1 · p. 1
• The study uses an unclassified qualitative design to examine how 20 Navy and Coast Guard mariners understand cyber risk and respond to three cyber-physical scenarios.The scenarios were used to investigate operational reasoning and the study’s research questions.Source: §1 · pp. 1–2
• Mariners’ threat models often emphasize navigation disruption, while integrity breaches pose more severe military risks and may evade timely response.Cybersecurity is organizationally abstract, with unclear responsibility and little grounding in doctrine; mariners draw on informal experience and situational cues.Source: §1 · p. 2
• The authors derive a model of mariners’ detection, interpretation, and response, and offer recommendations informed by comparisons with civilian mariner perspectives.Their recommendations aim to enhance maritime safety and identify lessons for the broader maritime ecosystem.Source: §1 · p. 2

2.1 Background

• Military vessels integrate navigation, power, propulsion, life support, weapons, and communications, with classified subsystems complicating system integration and incident response.Cyber and electronic attacks can degrade or falsify navigation, impair propulsion and steering, disrupt communications or sensors, and compromise fire and life-safety systems.Source: §2.1 · p. 2

2.2 Related Work

• Existing military cybersecurity research offers little unclassified evidence about frontline operator perceptions and decisions, while maritime human-factor research remains sparse.Prior work includes technical maritime vulnerabilities and defenses, shore-side operators, policy experts, and hybrid civilian-military mariner perspectives.Source: §2.2 · pp. 2–3
• This study focuses on Navy and Coast Guard personnel and uses scenarios to examine military-specific decision-making and responses to cyber incidents at sea.The authors describe it as one of the first unclassified, military-focused investigations of how mariners perceive, interpret, and respond to such incidents.Source: §2.2 · p. 3

3 Methodology

• The researchers conducted qualitative interviews with 20 participants, using a pilot study, screening survey, iterative codebook development, coder reliability checks, and saturation-based stopping criteria.These methods were intended to identify recurring themes while preserving individual experience nuance.Source: §3 · p. 3

3.1 Interview Design

• Interview questions covered background, training, military culture, mission impact, and command influence, with ordering adjusted to avoid leading participants.The interview design was informed by prior research and refined through a pilot study.Source: §3.1 · p. 3, §3.1.1 · p. 3

3.1.1 Interview Questions.

• Questions examined participants’ backgrounds, cyber identification, training, military culture, mission context, and views of organizational cybersecurity responsibility.Training questions also addressed mission influences and preparedness in GPS-denied environments.Source: §3.1.1 · p. 3

3.1.2 Scenario-Based Questions.

• Three scenarios covered GPS spoofing, propulsion-control loss, and ENAV failure, targeting positional certainty, situational awareness, and vessel control.Participants described immediate actions and diagnostic indicators; a notional ship configuration gave them a shared operational baseline without seeking sensitive disclosures.Source: §3.1.2 · p. 4

3.2 Recruitment, Surveys, and Interviews

• Recruitment used professional connections, snowball sampling, and LinkedIn; 20 of 26 invited mariners completed interviews after 30 completed the eligibility survey.No subordinates were recruited through professional connections to avoid perceived participation pressure.Source: §3.2 · p. 4

3.3 Participant Demographics

• Participants included 17 officers, one enlisted mariner, and two federal civilian employees; 15 were affiliated with the Coast Guard and four with the Navy.Sixteen held ship-driving roles as Officers of the Deck; the service distribution reflected recruitment barriers.Source: §3.3 · p. 4

3.4 Data Collection and Analysis

• Two researchers iteratively coded transcripts and refined themes; the final codebook covered 383 unique codes, with Krippendorff’s α = 0.883.No new code groups emerged after interview 18; two further interviews were conducted, and the new-code proportion averaged 10.2% over the final six interviews.Source: §3.4 · p. 5

3.5 Limitations

• The 20-person sample limits prevalence and generalization claims; self-report, hypothetical scenarios, unclassified access, U.S.-only scope, and network-heavy recruitment further bound interpretation.Unclassified interviews could not cover exact protocols, configurations, vulnerabilities, or classified threat intelligence, and recruitment may favor more engaged participants.Source: §3.5 · p. 5

4.1 Fragmented Learning Pathways

• 17 of 20 mariners received annual online training, but 13 of 20 called it largely irrelevant to shipboard duties, 18 of 20 said it failed to distinguish IT from OT, and only 6 of 20 reported mission-tailored training.Participants contrasted cyber training with hands-on physical-threat programs that were treated as operational requirements; some still valued baseline habits reinforced by standard training.Source: §4.1.1 · p. 6
• Only 2 of 20 cited formal online training as a major influence; mariners instead drew on diverse informal experiences, while relevant ship-specific backgrounds and unit-led learning remained exceptions.Informal influences included military experience for 14 of 20 participants and factors outside military training for 8 of 20; 6 of 20 still viewed standard training as useful for basic computer-use habits.Source: §4.1.2 · p. 6, §4.1.1 · p. 6

4.2 Organizational Responsibility

• 18 of 20 mariners said commands encouraged compliance, but 15 of 20 viewed cybersecurity as primarily an individual or shared responsibility, and some described absent or reactionary onboard practices.Seven of 20 said policy-driven military structures supported cybersecurity through strict policies, resources, and remedial training; four described absent or reactionary onboard culture.Source: §4.2.1 · p. 7
• Participants rarely treated rank as a proxy for cyber expertise and cited varied expertise indicators, including education, job experience, certifications, and demonstrated skill.Ten of 20 said rank did not affect their assessment of cybersecurity credibility, while the study identified 17 unique signs of expertise and no consensus on how to gauge it.Source: §4.2.2 · p. 7, §4.2.3 · p. 7
• Cyber responsibility was inconsistently assigned across billets and IT support, while participants described dedicated Cyber Officer roles as making cybersecurity more actionable.Eight of 20 said their billet was not responsible for cybersecurity, and nine of 20 reported poor distinction between IT assistance and cybersecurity support.Source: §4.2.4 · pp. 7–8

4.3 Context-Dependent Risk Perception

• 13 of 20 participants identified military vessels’ structural security advantages, while military cyberattacks were associated with distinctive risks including weapon-system hijacking and geopolitical escalation.Seven of 20 cited weapon-system hijacking and seven cited geopolitical escalation; participants also described how compromised positioning or targeting integrity could produce dangerous outcomes.Source: §4.3.1 · p. 8
• Cyber readiness shifted with operational context: 12 of 20 described mission demands conflicting with cybersecurity, and 10 of 20 viewed ashore units as more secure than afloat units.Readiness rose with adversary sophistication or OPSEC for 9 of 20 and EMCON for 4 of 20; lower-threat missions could permit reduced security practices.Source: §4.3.3 · pp. 8–9, §4.3.2 · p. 8, §4.3 · p. 8

5 Military Mariners’ Operational Response

• Mariners’ incident response prioritizes safe vessel control before diagnosing an anomaly, then transitions to identifying and attributing its cause.The model follows participants’ navigational actions first and cyber-specific identification and attribution second.Source: §5 · p. 9, §5.1 · p. 9, §5.2 · p. 10

5.1 Respond: Safely Navigate

• Nearly all participants described immediate safe-navigation actions, including slowing down, clearing hazards, and preparing an anchor; 9 of 16 would warn nearby vessels.10 of 16 would prepare the anchor, and 10 of 16 would add personnel to the navigation team.Source: §5.1.1 · p. 9, §5.1.2 · p. 9
• 12 of 16 participants described switching to redundant navigation systems, while 5 of 16 used “seaman’s eye” during an ENAV outage.Five of 16 were uncomfortable operating without GPS; participants also rarely troubleshot affected systems until navigation or propulsion was restored.Source: §5.1.3 · p. 9

5.2 Recognize: Identify & Attribute

• Participants used routine seamanship checks to diagnose anomalies, including physical inspection (15 of 16) and rebooting systems (10 of 16), rather than cyber-specific techniques.For possible GPS spoofing, 6 of 16 described checking satellite count, signal strength, or position-estimate dilution of precision.Source: §5.2.1 · p. 10

5.2.2 Cyber Attribution

• Participants’ assumptions about cyber causes varied, and suspected attacks led them to contact off-ship cyber support for investigation.Two of 16 initially assumed non-cyber causes, while another two noted difficulty troubleshooting compromised integrity; scenario-based counts are of 16 participants.Source: §5 · p. 9, §5.2.2 · p. 10

5.2 Recognize: Identify & Attribute

• 18 of 20 participants relied on obvious, observable failures to detect attacks, while only 6 emphasized formal cross-checking and sensor validation.The comparison of vulnerability and detection frequencies shows navigation systems and interconnected devices prominent in threat models, while detection leaned on visible operational failures or difficult-to-observe IT-centric signals; vulnerability counts cover N=20.Source: §5.2.2 · pp. 10–11, Figure 3 · p. 11

6 Concluding Discussion

• Mariners follow structured anomaly-response steps, yet focus on navigation disruptions and overt failures rather than integrity compromise, a greater military risk.The conclusion also reports extensive platform hardening, baseline cybersecurity understanding, and recurring training gaps.Source: §6 · p. 11

6.1.1 Clarify Tangible Cyber Risk.

• Credible explanations of possible manipulations, consequences, and benign-versus-adversarial failures could align cyber-risk models with shipboard operations.The recommendations suggest sanitized assessment processes and common threat vectors without disclosing sensitive vulnerabilities.Source: §6.1.1 · p. 11

6.1.2 Establish Initial Cyber Actions.

• Initial cyber actions should complement casualty responses with simple containment and input-verification steps, since physical diagnosis may delay attribution and leave attackers in control.The existing response sequence prioritizes ship safety, gathering people, and relying on redundancies before diagnosis; integrity breaches can leave systems available but untrustworthy.Source: §6.1.2 · p. 11, §6.1.3 · p. 11

6.1.3 Normalize Cross-Checking.

• Cross-checks across systems, supported by operator-friendly tools and retained analog components, could help detect integrity attacks without relying on obvious breakdowns.Participants most often cited observable failures as detection heuristics, while fewer mentioned the difficulty of identifying attacks.Source: §6.1.3 · p. 12

6.1.4 Formalize Responsibility.

• Shipboard cyber roles need clearer functions and authority aligned with operational decision-making, because participants disagreed about the role’s purpose and many did not know it existed.Rank was not viewed as a reliable indicator of expertise, and few positions were identified as responsible for cybersecurity.Source: §6.1.4 · p. 12

6.2 Broader Military Applications

• The recommendations draw on USN and USCG mariners; limited research in other military branches constrains assessment of how well they generalize.The authors expect broad applicability but note that implementation may vary with domain-specific constraints.Source: §6.2 · p. 12

6.3 Civilian Maritime Applications

• Military and civilian mariners both emphasized navigational threats, while many vulnerable systems and impacts are shared across sectors.Military hardening practices may help civilian operators prioritize limited resources; the discussion also recommends annual Cyber Awareness Challenge training where such training is absent.Source: §6.3 · pp. 12–13, Table 2 · p. 12

6.4 Future Work

• Future work could test the response model in other military branches and foreign militaries, and examine whether sanitized assessment processes bridge security work and operator understanding.The authors identify aviation as a useful comparison point.Source: §6.4 · p. 13

A Open Science

• The final codebook organizes all codes by question.It includes a definition for each code.Source: A Open Science · p. 15
• The codebook specifies inclusion and exclusion criteria used to code participant responses.Source: A Open Science · p. 15
• A separate themes file provides theme and sub-theme definitions, plus the positive and negative codes contributing to each theme.Source: A Open Science · p. 15

B Ethical Considerations

• Participants’ sensitive operational knowledge creates risks to careers, organizational security, and national defense if inadvertently disclosed.Findings could also be misread as identifying weaknesses or overgeneralized beyond their intended scope.Source: B Ethical Considerations · p. 15
• The study received institutional IRB approval, used informed consent, and allowed participants to decline questions or withdraw answers.Interviewers clarified that they were acting as academic researchers, not in a military context.Source: B Ethical Considerations · p. 15
• Researchers anonymized responses, generalized identifying and operational details, destroyed recordings after screening, and withheld one interview question from the repository.Source: B Ethical Considerations · p. 15
• The study omitted specific defenses, configurations, and procedures, framing findings at human, organizational, or training levels instead of as actionable technical weaknesses.The team judged the societal and scientific value to outweigh mitigated risks.Source: B Ethical Considerations · p. 15

C Military Background

• Military personnel are divided by rank and rate.Source: C Military Background · p. 15
• Officers are commissioned leaders responsible for command and operational decisions; enlisted personnel hold lower rank and more hands-on technical roles.Rates indicate operational specialties, such as Electronics Technician or IT.Source: C Military Background · p. 15
• Rank notation uses O or E followed by a number, with higher numbers denoting greater seniority.For example, O5 is senior to O2.Source: C Military Background · p. 15

• The survey asked about branch, rank, age, and gender, as well as current or recent shipboard service and total years aboard military vessels.Source: D Survey Questions · p. 15
• Respondents reported the size and crew complement of their last ship and the roles they had held.Source: D Survey Questions · p. 15
• The survey covered vessels’ operational missions, including defense, search and rescue, law enforcement, supply, and training.Source: D Survey Questions · p. 16
• Respondents were also asked which flag states they had sailed under.Source: D Survey Questions · p. 16

• Interviewers asked about career pathways, experiences shaping cybersecurity expertise, rank and reporting credibility, and how IT support differs from cybersecurity.Source: E Interview Questions · p. 16
• The guide asked about cyber understanding and attack indicators, military-specific training, training relevance and mission tailoring, and comparisons with physical-threat training.Source: E Interview Questions · p. 16
• Interviewers asked how billets and military life shape cybersecurity responsibilities, what indicators matter most, and whether navigation without GPS is manageable.Source: E Interview Questions · p. 16
• Questions explored cybersecurity culture across missions, afloat and ashore readiness, vessel resilience, vulnerabilities, attack consequences, encouraged practices, and organizational responsibility.Source: E Interview Questions · p. 16
• Three scenarios asked mariners how they would respond to incorrect GPS positioning, erratic propulsion control, or a complete loss of electronic navigation.Source: E Interview Questions · p. 16

• The example is an approximately 90-meter, 5,000-gross-ton auxiliary cargo or support vessel with twin-screw diesel propulsion and controllable-pitch propellers.Source: F Example Ship Handout · p. 16
• Propulsion and steering can be controlled from multiple locations, with redundant steering pumps and manual operation available.Source: F Example Ship Handout · p. 16
• The handout lists integrated bridge and machinery systems, independent ECDIS and GNSS units, dual radars, and VHF and HF communications.Source: F Example Ship Handout · pp. 16–17

• Figure 4 plots the proportion of new codes by interview.Source: Figure 4 · p. 17