Preventing "Fratricide"

In late March and early April of 2003, tragedy struck in the skies over Iraq. As the U.S.-led coalition marched toward Baghdad, two jet fighters – a British Royal Air Force Tornado and a U.S. Navy F/A-18 – were shot down, killing two British crew members, Lt. Kevin Main and Lt. David Williams, and a navy airman, Lt. Nathan White. These deaths weren’t caused by Saddam Hussein’s purported arsenal of missiles, or even by antiaircraft fire, but by U.S. Patriot missile systems – built by Waltham, MA, defense contractor Raytheon and operated by the U.S. Army – that had erroneously identified the friendly planes as enemy missiles. In a third incident, a U.S. jet fired on a Patriot radar unit that the jet believed was an enemy surface-to-air missile system. Luckily, this incident caused no injury in the air or on the ground.

For Raytheon and the army, it was deja vu with a deadly ending. During the Gulf War, the army claimed that Patriots were regularly shooting Iraqi Scud missiles out of the sky. In 1991, President George H. W. Bush even told cheering Raytheon employees that “Patriot is proof positive that missile defense works.” Bush added that the system had shot down 41 of 42 Scuds. An investigation by a U.S. Congressional panel, however, concluded in 1992 that Patriots downed no more than four out of 47 Scuds – less than 9 percent – and added that “the public and the Congress were misled” by Raytheon and the first Bush administration.

Between the Gulf War and the Iraq War, the Pentagon pumped some $3 billion into improving and expanding the Patriot system. It is, after all, the most advanced system in the world for countering threats from the air, including attack planes and a wide variety of missiles owned by more than two dozen nations. The Pentagon investment was intended to buy improvements to software and guidance systems, as well as an additional type of “interceptor” (read “missile”) built by a subcontractor, Lockheed Martin. The new interceptor, known as PAC-3, is designed to directly strike and destroy its target, whereas the older model, PAC-2, was designed to explode near it. A PAC-2 killed the British crew, and a pair of PAC-3s killed White.

Beyond assuring the safety of friendly troops and civilians, Raytheon has a great deal at stake in showing that the Patriot missile system can work reliably. It sells the system to Germany, Saudi Arabia, Kuwait, the Netherlands, Greece, Japan, Israel, and Taiwan in addition to the United States. And missile defense systems including Patriot are a core part of Raytheon’s Tewksbury, MA-based Integrated Defense Systems business, which had 2004 net sales of $3.5 billion.

Given the extensive Pentagon investment in upgrading the Patriot system in the 1990s and early 2000s, there was reason to believe that the Patriot was reliable. But disaster struck anyway. The events of those two tragic days in 2003 reveal three dangers that can lurk in any advanced weapons program. First, there can be purely technological problems with the system itself. Second, there can be problems – both human and technological – with how the system is used in the field. Finally, neither corporations nor militaries are generally known for their willingness to confess errors and bring serious problems to light.

Putting the Pieces Together
A Patriot battery has three basic pieces, all portable: launch platforms containing Patriot interceptor missiles, a radar station that scans the skies, and a manned control station. But its information systems are immensely complex. As its radar tracks objects in the air, the system’s computers calculate the objects’ altitudes, speeds, and trajectories to identify planes as friendly or hostile, and even to discriminate among various types of missiles and identify where they will land.

At the control station, the computers’ conclusions are displayed as a variety of icons on a screen. The system also exchanges coded signals with friendly planes that effectively demand, “Identify: friend or foe” (these are known as IFF codes). Each interceptor carries its own radar and guidance system; as it rockets skyward at supersonic speed, it tracks its target and adjusts its course as necessary.

So what went wrong in 2003? In the most recent official postmortem, in January, the Defense Science Board – an investigative task force appointed by the U.S. Department of Defense – gave some summary answers. While concluding that the Patriot was a “substantial success” because it had shot down eight Iraqi missiles and possibly a ninth, it also offered three criticisms. First, it suggested that the Patriot system was overdeployed, which was the logical result of flawed intelligence about the strength of Hussein’s military. U.S. forces deployed 40 Patriot batteries, and coalition nations contributed another 22 batteries. This problem was magnified by another: the 40 U.S. batteries were set to function with a high degree of automation, paving the way for identification errors to produce fatal results. “The operating protocol was largely automatic, and the operators were trained to trust the system’s software…a design that would be needed for heavy missile attacks,” the task force wrote.

The second problem, said the board, was a communications failure. For one thing, the IFF system “performed very poorly.” But more significantly, the Patriot batteries had little or no contact with other military systems, such as the radar planes known as AWACS, which were tracking friendly planes and, in theory, could have told the Patriot batteries to hold their fire. “We tend to assume that data are routinely communicated from one system to the other,” the task force wrote. “The Task Force believes that we are a long way from that vision….[A] Patriot battery on the battlefield can be very much alone.”

But the Patriot itself was also fraught with problems, the board concluded. “The third shortfall was the Patriot system operating philosophy, protocols, displays, and software….The solution here will be more operator involvement and control in the functioning of a Patriot battery, which will necessitate changes in software, displays, and training.” But what does this mean, exactly?

“The unclassified stuff is pretty vague,” says John Pike, director of Globalsecurity.org, a Washington think tank. Raytheon and members of the Defense Science Board declined interviews for this story; the army and U.S. Central Command (the joint body that had overall command during the war) did not comment beyond their official reports. In a statement, the army said it was already repairing problems with the Patriot. “These corrective actions include combinations of hardware modifications, software changes, and updates to tactics, techniques, and procedures,” it says.

More-detailed explanations are left to experts such as Theodore Postol, professor of science, technology, and national security policy at MIT, whose analyses more than a decade ago were the first to expose the Patriot’s poor performance in the Gulf War. Postol postulates that part of the problem with the Patriots that shot down the friendly planes in 2003 was electronic interference from nearby batteries. Each battery was aiming radar beams at the sky and calculating the altitude and range of airborne objects based on radar “returns.” But because of their close proximity to each other, some batteries might have picked up radar signals originally sent by other batteries.

The result might have been the generation of false targets, and the correlation of those false targets with actual aircraft in the vicinity. The Patriot crews would then conclude they were looking not at a friendly plane but rather at a missile. Pike says the army failed to anticipate how multiple batteries could create such conflicts. “When [the U.S. Army] got into combat, they employed it in ways they had not trained for in peacetime. They had never planned on having this many Patriot batteries operating together in such close proximity with other radars,” he says. The second obvious technological problem, in Postol’s view, was the homing device in the Patriot interceptor itself. Once a missile was launched, it should have been searching for targets only in a limited area. But two of the missiles that targeted friendly planes made significant course corrections in order to reach the jets, he says. “So there is something wrong with the lock-on and homing of the missile,” Postol says, “because in two cases they locked on to targets that were on trajectories far different than the targets they thought they were shooting at.”

Philip Coyle, who during the Clinton administration was an assistant secretary of defense and director of operational test and evaluation, is now senior advisor to the Center for Defense Information, a think tank in Washington, DC. He believes that the Patriot’s Achilles’ heel is clearly its software. “One of the lessons is that the devil is in the details with respect to software,” he says. “You really have to understand how these computers and software work – and I don’t think that Raytheon has [done so].” He adds that, since military equipment grows more networked and automated every year, and thus more dependent on software, solving the Patriot’s problems could be crucial to the future of warfare.

While Raytheon would not provide interviews about the Patriot’s misidentification of friendly planes, in an e-mail, company spokesman Guy Shields emphasized problems outside Raytheon’s walls. “Two of the main shortfalls seen in [2003] transcend just the Patriot; they involve combat identification and situational awareness,” he wrote, citing the Defense Science Board report. “The Army has taken action, but only they can talk about it,” Shields added.

To Postol, though, what’s lacking is a critical examination of the continual failures that dog the Patriot program. “If the organization doesn’t set a goal of identifying and fixing problems, they don’t get fixed,” Postol says. But if he’s right about what happened in 2003, fixing problems with automated weapons systems will require more than openness. It will require those who design and implement the systems to worry more about what can go wrong in a combat zone.