Three Incidents, One Coastline: Reading a Grey-Zone Campaign
A western coastal state with 310 km of shoreline has recorded three incidents in six weeks.
First, marine police at a fishing harbour found 22 unregistered boats fitted with satellite phones and carrying no fishing gear; the crews' identity documents were inconclusive.
Second, unauthorised access to a port's terminal operating system halted container handling for nine hours, costing an estimated ₹40 crore. The entry point appears to have been a contractor's remote-maintenance account.
Third, a coordinated campaign across three languages alleges that naval personnel assaulted fishermen at sea. Two local bodies have called a bandh, and a video is circulating that the Navy says is from a different coastline and three years old.
The Coast Guard has two offshore patrol vessels and four interceptor boats for the entire coastline; the state police marine wing has 60 trained personnel. The Navy's information fusion centre has flagged a pattern of unlit vessel movement but holds no peacetime jurisdiction inside state waters. The Chief Secretary convenes a meeting in 72 hours.
1. Are these three separate law-and-order events or one campaign? Set out the analytical framework you would use and what it implies for the response.
Read the worked answer
Treating them separately is the campaign's intended effect. The analytic frame is hybrid or grey-zone activity: the simultaneous use of non-military instruments - informational, cyber, legal, economic - below the threshold of armed conflict, with deliberate ambiguity of attribution, designed to impose decision paralysis and erode public trust in state institutions rather than to seize terrain.
What unites the three incidents is a single seam: India's coastal civil-military interface, where jurisdiction is fragmented. State police operate in state waters, the Coast Guard in the contiguous zone and EEZ, the Navy beyond, while ports sit under port authorities with customs and CISF presence. Boat registration is a state subject and leaks; critical port systems are privately operated and thinly audited; and the information space around fishermen is emotive and under-served by official communication.
Each incident probes a different layer of the same seam. The unregistered boats test maritime domain awareness and could be intelligence collection, smuggling or a rehearsal. The cyber intrusion is an attack on notified critical information infrastructure. The disinformation tests whether the state can shape a narrative faster than it can be attacked.
The implication is that a police-only, incident-by-incident response will always be one step behind. The counter-hybrid logic is to harden the seam - registration, contracting, communications - rather than to chase each event.
2. Recommend a lead agency and command arrangement for the next 90 days, and defend it against the two obvious alternatives.
Read the worked answer
Recommendation: police lead, with a standing joint coastal security operations cell chaired by the state Chief Secretary and co-chaired by the Coast Guard's regional commander, with Navy and port-authority liaison officers embedded. Unity of effort, not unity of command.
Against the Navy taking charge: the Navy lacks police powers, cannot investigate or prosecute, and its involvement in harbour policing would militarise a civil problem and hand the disinformation campaign its central claim. It also misreads the threat - this is a sub-threshold campaign where legal authority, not firepower, is the binding constraint.
Against the police acting alone: the marine wing has 60 personnel for 310 km, no offshore platform and no maritime domain picture. Police alone cannot see the problem, let alone interdict it.
Concretely, for 90 days: a single maritime picture fed to the cell from Coast Guard and Navy sensors, with agreed thresholds for escalation; an immediate audit of all 22 boats and their handlers, run as an intelligence investigation rather than a registration drive; mandatory security audits of port operational technology with the contractor accounts terminated and re-issued; a pre-agreed media protocol under which the state and the Navy issue a joint factual statement within two hours of any allegation, with the district collector and fisher associations briefed first.
Authority follows function: investigation to the police, interdiction at sea to the Coast Guard, intelligence to the Navy, and political coordination to the Chief Secretary.
3. Design one confidence-building measure for the fishing community and state the indicator that would tell you whether it is working.
Read the worked answer
The disinformation only worked because there was a real gap in the relationship. Fisher communities are the state's primary sensor network along the coast; alienating them costs more maritime domain awareness than any sensor purchase can replace.
Measure: a jointly run fishing-vessel registration and identity scheme, co-designed with the fisher associations rather than imposed on them, delivered at the harbour rather than at a police station. It combines biometric identity cards for crews, a subsidised transponder or beacon for vessels, a single toll-free number for reporting harassment or sighting suspicious activity, and a monthly open house at each harbour attended by the Coast Guard commander and the Superintendent of Police.
Indicators, in order of diagnostic value: the percentage of active fishing vessels registered and transponder-fitted, audited quarterly; the number of 'dark' vessel alerts resolved within six hours; the number of actionable tips received from fisher associations per month, which measures trust rather than compliance; and complaints of harassment per 1,000 sea sorties, verified by an independent panel.
The trap to avoid is measuring only registration, because coercion can produce that number while destroying the relationship. Tips received is the honest indicator: people do not inform on behalf of institutions they believe assault them.