2. Creating an Analytical Framework: Maritime Security, Risk and Vulnerability

The term ‘securitization’ was originally coined by the ‘Copenhagen School’ of security studies, a group of scholars who were variously associated with the Copenhagen Peace Research Institute circa 1983, and after that included Barry Buzan, Ole Wæver and Jaap de Wilde as prominent members.

Critical security studies are often associated with ‘the Frankfurt School’s Critical Theory’. The ‘Frankfurt School’ is a term used to describe what originally started as the Institute for Social Research, set up by a group of neo-Marxist intellectuals in Germany in 1923, affiliated to Goethe University in Frankfurt and independently of the Communist Party, which has been influential in the development of Marxist theory ever since.

Mainly naval forces but also involving air and land forces, and abilities to command, control, communicate and the effectiveness of surveillance, reconnaissance and intelligence, along with cyber and space.

For example, merchant and fishing fleets, port infrastructure, ship building and repair industries.

For example, the International Maritime Organization—IMO.

For example, the Regional Cooperation Agreement on Combating Piracy and Armed Robbery against Ships in Asia (ReCAAP) and the Code of Conduct concerning the Repression of Piracy and Armed Robbery against Ships in the Western Indian Ocean and the Gulf of Aden (Djibouti Code of Conduct).

Gareth Evans argued: “The virtue, and utility, of the expression ‘cooperative security’ is that the language itself encourages an open and constructive mindset, one less likely to be inhibited by familiar disciplinary boundaries and traditional state-centered security thinking. The term tends to connote consultation rather than confrontation, reassurance rather than deterrence, transparency rather than secrecy, prevention rather than correction, and interdependence rather than unilateralism.”

Sea control is defined as that condition which exists when one has freedom of action to use an area of sea for one’s own purposes for a period of time and, if required, to deny its use to an opponent.

Sea assertion involves asserting control or dominance of an area of sea for a period of time.

Sea denial is defined as that condition which exists when an adversary is denied the ability to use an area of sea for his own purposes for a period of time.

Maritime power projection involves the delivery of force from the sea and can take the form of amphibious or Special Forces landings or the delivery of bombardment, guided or unguided weapons, and military aircraft from seaborne platforms.

The inaugural ASEAN Regional Forum (ARF) meeting on 25 July 1994 directed that comprehensive security be studied, and at its second meeting on 1 August 1995, the notion of “comprehensive security” was specifically referred to. The Chairman’s statement noted: “[T]he ARF recognises that the concept of comprehensive security includes not only military aspects but also political, economic, social and other issues.”

Threats such as civil war, transnational crime, terrorism, infectious diseases, and the proliferation of small arms are now included. To this could be added piracy; illegal immigration; trafficking of drugs, weapons and people; illegal, unreported and unregulated fishing; and marine resource exploitation and pollution.

Non-governmental organizations (NGOs), private security companies and international regimes are now providers of security in some contexts.

Sam Bateman provided the following statement about defining maritime security to the 2nd ARF Inter-Sessional Meeting on Maritime Security held in Auckland, 29–30 March 2010: “The situation is complicated by the lack of agreement among regional countries both on a definition of maritime security and on the priority to be accorded different threats. Some countries include non-traditional security threats within their definition, but others are uncomfortable with including environmental threats and illegal fishing. The concept of maritime security is now much wider and more diverse than the traditional one of defence against military threats and the protection of national interests and sovereignty at sea. With the notion of comprehensive security, the concept now includes non-traditional security issues, such as piracy, terrorism, natural disasters, climate change, illegal fishing, marine pollution, maritime safety and the smuggling of drugs, arms and people.”

The meanings of the words in the definition of risk are explained: “Effect is a deviation from the expected – positive and/or negative”; “Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process)” and “Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood”. The definition notes state: “Risk is often characterized by reference to potential events … and consequences or a combination of these” and is “often expressed in terms of a combination of the consequence of an event … and the associated likelihood … of occurrence”. The associated term “risk management” is defined as “coordination activities to direct and control an organization with regard to risk” (ISO 2009, 2).

Risk management includes the “overall governance, strategy and planning, management, reporting processes, policies, values and culture” (AS/NZS 2009, iv–v).

HB 158-2010 (ISO 2010, 13–19) provides extensive guidance on the implementation of holistic risk management in organizations and expounds upon the practice and benefits of instituting risk controls and risk assurance mechanisms.

ISO Guide 73 defines risk tolerance as the “organization’s or stakeholder’s readiness to bear the risk after risk treatment in order to achieve objectives”.

ISO Guide 73 defines risk appetite as the “amount and type of risk that an organization is willing to pursue or retain”.

HB 158-2010 (ISO 2010, 21–22) asserts that risk management “is fundamental to organizational control and a critical part of providing sound corporate governance. It touches all aspects of … activities … many organizations have moved to adopt Enterprise Risk Management (ERM)”.

There are several definitions of enterprise risk management (ERM) in use, with the official international risk management literature offering a US-derived definition (ISO 2010, 6). The (US) Committee of Sponsoring Organizations of the Treadway Commission (COSO) defines ERM as: “A process effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across an enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.” A definition used by the (US) Actuarial Society, Enterprise Risk Management Committee, May 2003, is as follows: “ERM is the discipline by which an organisation in any industry assesses, controls, exploits, finances, and monitors risks from all sources for the purpose of increasing the organization’s short- and long-term value to its stakeholders.” HM Treasury (UK) defines ERM as: “All the processes involved in identifying, assessing and judging risks, assigning ownership, taking actions to mitigate or anticipate them and monitoring and reviewing progress.” Implicit in these ERM definitions is recognition that it presents a strategic decision support framework for management designed to improve the quality of decision-making at all levels of the organization.

Political risk assessments are particularly important in forecasting the long-term situation in a specific geopolitical context. The risk identification process is important, as it sets the political risk context. Political risk calculation is invariably a measure of judgement by the analyst and entity leadership. Evaluations of political stability and security, over a 20- to 30-year time frame, in parts of the developing world where, for example, major natural resources are available for exploitation will often be difficult.

How risks combine and potentially magnify due to cumulative and/or aggregated factors, which often appear to be discrete and diverse but in fact impact on each other, presents challenges to risk management at national and organizational levels. Evaluations of aggregated and accumulated risk at larger organizational levels that involve complex interactions require access to good data and the application of experienced judgement employing a largely qualitative approach. Effective quantitative assessment of aggregated and accumulated risk in organizations has generally proven elusive. Various approaches, models and technology-driven systems have been tried. The results have been useful for calculating aggregated risk at a tactical level where largely technical, routinized processes are employed. Reasonable confidence in qualitative judgements in assessing aggregated and accumulated risk at the enterprise or organizational level requires sound organizational constructs, good risk and safety management processes, systems and information, and the engagement of suitably experienced and responsible management oversight.

Although “vulnerability” is defined as “intrinsic properties of something resulting in susceptibility to a risk source that can lead to an event with consequences” in ISO (2009, 8).

Witness the unintended outcomes of the US-led ‘War on Terror’.