Companies and private individuals are a common target for cyber-criminals and terrorists where a variety of acts such as identity theft, hacking and even ransomware attacks where the entire system is encrypted and the owner is forced to pay ransom for de-cryption. However, this happens not only on land but also in maritime as it grows in prominence and therefore creating a target in the form of profitability and impact on business of a certain nation or company.
Maritime terrorism, according to Institute for Analysis of Global Security/IAGS (2007) was a long-time historical focus of The Saudi Arabian arm of Al Qaeda where oil and natural gas sources and logistics, including ships, were main targets in order to “cripple U.S/Western economy.” Therefore, with the prominence of shipping and the growing demand for import an export goods cases of terrorism will always rise to gain attention and make waves in the business sphere.
However, as physical terrorism is relatively easier to stop with more conventional means such as armed guards and escorts; cyber-terrorism is an entirely different story where targets are different along with the actual impact and consequence of failure. Another aspect of modern maritime which may attract more terrorism is the prominence of LNG/eco-friendly shipping which, as predicted by US Energy experts, will increase by year 2030; as LNG shipping facilities are easier to detect and arguably more dangerous in terms of explosion scenarios.
Starting with cyber-terrorism it is worth mentioning that targets have to be found and determined first therefore presenting the fact that Al Qaeda and possibly other terrorist cells operate using databases which contain collected intelligence on possible targets; critical economic nodes, structural weaknesses and possible failsafes. This is also relevant due to all ships being computerised and thus give cyber terrorists more control over the vessels upon hacking.
Whether its a drilling, oil rig or a tanker the consequences of hacking can disable a vessel as well as steal cargo and delete records. According to Professional Liability Insurance Group, (2014) hacking attacks against oil an gas infrastructures costs energy companies 2$ billion in losses by 2018 while British experts believe that such attacks cost the UK 672$ million yearly; concluding that such threats grow in prominence and seriousness.
Firstly, containing any threat always starts from gathering and handling data thus making a reporting mechanism an important part in counter-terrorist operations. However, with cyber-terrorism this is especially hard due to numerous factors ranging from the threat itself to impact on inner relations of the casualties themselves; the shipping companies. Starting from the ambiguity of reporting cyber terrorism where most attacks go unreported; primarily to avoid jeopardising investor, insurer and regulator relations. Upon reporting a cyber-crime there also can be other challenges such as misunderstanding of this new threat as the nature itself is relatively vague; hard to control and contain as well as trace.
The solution, therefore would be controlling the vessel itself in terms of the major vulnerabilities aboard. As ships grow in size and capacity they also decrease in crew requirement therefore increasing automation and computerisation which makes the vessel more prone to hacking. Considering the variables above, most modern vessels are connected to the Internet through unprotected serial ports; introducing one of the main vulnerabilities. Along with this, other main vulnerabilities lie within GPS, Electronic Chart Display and Information Systems/ ECDIS along with Marine Automatic Identification Systems/AIS. All those vulnerabilities can be exploited with relative ease.
According to Trend Micro, an antivirus vendor (2014) an AIS system can be easily exploited with a VHF radio which will cause the ship to impersonate a port authority communications with a vessel or shut down ship communication entirely. Another vulnerability lies within ECDIS which was discovered by NCC Group, a British Cyber-Security firm where the consequence was the free modification of a vessel’s records, files and charts.
However, vessels are not the only targets at sea as ports are vulnerable to a cyber-terrorist attack. Ports themselves, if shutdown can bring economic problems such as supply chain shutdowns which have their own consequences that relate to the geographical location it is in. However, this time around the problem lies not only in invasive hacking methods but loose information which pirates and terrorist take advantage of. An example of this are hackers contacting port authorities under disguise of security or any other personnel; obtaining vital credentials to access the infrastructure, vessels, banking and cargo details.
Finally, the conclusion here is that loose information and exploitable vulnerabilities create security problems on a cyber level for all aspects of the maritime industry. However, the main problem is the lack of knowledge and failure to understand the magnitude of the problem as most important equipment is easily exploitable with cheap equipment. The solution will be efficient study and analysis of vulnerable spots, report and address of issues accordingly.
