The maritime sector might be a long way behind airlines and integrators when it comes to embracing the digital world. But it is catching up quickly as new satellite systems enable the real-time networking of fleets.
And, according to former naval personnel and security experts speaking at London International Shipping Week, as shipping embraces digitalization, criminal hackers and hostile nation state actors will step up efforts to target the weakest links in the supply chain, threatening the national security of the U.S. and other countries.
Tipping his hat to UPS and its vast fleets of integrated and digitally transparent delivery vans fitted with advanced telematics and operated as a network, Dr Martin Stopford, Clarksons Platou, said Silicon Valley had made plug and play logistics possible on land. “The shipping industry is a very long way behind that,” he told delegates at a cybersecurity seminar hosted by law firm Hill Dickinson on September 10.
But with the shipping industry on the verge of a very big step forward, mainly triggered by a digital satellite communications revolution, the dangers are increasing.
“In the last 40 years it has not been easy to keep in touch with a fleet of ships around the world,” he said. “But a new generation of satellites are now making it technically possible to manage fleet of ships as a single business in a way that wasn’t possible previously.
“But the more you do this, the more you are vulnerable to cyber-attacks because your business becomes transparent.”
And those attacks can come from a wide range of sources including nation states and well-organized criminal gangs operating for profit and often also on behalf of nation states, said former U.S. Navy captain John M. Sanford, who now leads the U.S. Maritime Security Department (MSD) within the National Maritime Intelligence Integration Office (NMIO).
He said the shipping and supply chain sectors had multiple weak spots, illustrated by attacks which have hurt major players in recent years. Illustrating his point, he said the NotPetya virus, which cost FedEx $300 million and hobbled Maersk in 2017, sent infections across Europe and the U.S., inflicting economic damage of $10 billion. He said Russian military intelligence agency GRU was behind hacker group APT28 (also called Fancy Bear) which spread NotPetya in a bid – which proved successful – to damage Ukraine’s economy.
“Maersk wasn’t a target, just a bystander in a conflict between Ukraine and Russia,” added captain Sanford.
Delegates heard that supply chains, ports and ships could be shut down by hostile state actors through, for example, GPS (Global Positioning System) and ECDIS (Electronic Chart Display and Information System] systems onboard ships, or even via the office printer if it was WiFi-connected. Cyber terrorism could also access ship networks via personal seafarer devices.
Pirates working with hackers could potentially access a ship’s bridge controls remotely, take control of the rudder and steer it toward a chosen location, avoiding the expense and danger of attacking a vessel on the high seas.
Other actions could include a hostile state actor refusing to send spare parts or updates for equipment critical to port or ship operations. “Many ports buy a particular crane from China that no one else sells,” said Captain Sanford. “If a part breaks, imagine if you then can’t get the part. Imagine the impact on supply chains if the biggest cranes at ports in the U.S. can’t unload the biggest ship.”
Captain Sanford called for more cooperation between governments, operators and academics, stressing that information shared must not be made public or companies would be discouraged from reporting breaches.
“The Russians are trying to destroy us, and the Chinese are trying to own us,” he said.
“We need a way of protecting companies when they share information about attacks.”