Maritime shipping moves 90–94 percent of world trade. Any significant disruptions have global impacts. The maritime transportation system is composed of not only the ships but also the seaports and cargo terminals within them. The cyber threat to all of these nodes is here now!
From ship operations to terminals, maritime-industry operations are becoming more integrated through automation to reduce costs and improve efficiency. Multiple automated systems can be freestanding or integrated to work together. Increasingly, their operations are not continuously controlled by persons on site. Some automated systems even communicate directly with shore activities. For example, a vessel’s engines may “talk” to the manufacturer as a means to monitor their health. And the host ship or company may not be involved in that “conversation.”
Modern automation depends heavily on the global positioning system (GPS) or its precision navigation and timing equivalent. This dependence increases drastically as systems become more automated, complex, and interconnected.
GPS is susceptible to spoofing, and its weak signals can be interfered with by relatively low power-jammers. This is a potential “happy hunting ground” for criminal and terrorist elements to wreak enormous damage on the maritime industry. To counter cyber threats, cyber-security actions must attempt to quickly identify potential threats, detect them, and then remedy the situation as quickly as possible.
Already criminals have “hijacked” containers at terminals and then misdirected them to other recipients. Through cyber means, they can locate illegal containers holding contraband such as drugs, weapons, or even terrorists to get them cleared and forwarded without any physical inspection by port authorities.
Far more serious is when ship operations are compromised by terrorist groups. Hacking into highly automated ship control systems can affect navigation safety and operation of other highly automated systems on board. In 2013, a research team demonstrated that it was able to maneuver a ship without the bridge personnel controlling it. They spoofed the GPS system that controlled the autopilot with a “black box” that cost about $3,000—easily affordable for a terrorist group.
While bridge personnel would soon realize there was a ship control problem, this might not be the case in the high workload environment when operating near or within a port. So a hard-over-rudder command when going through a breakwater or near a dock could result in a major incident.
Another example of systemic weakness is the Automatic Identification System (AIS). This global ship-tracking system provides visualization of virtually all vessels over 300 gross registered tons, both at sea and in port. The displayed information shows ship location, name, and flag state as well as navigational data. While very necessary for the shipping industry, the AIS has also been hacked in the past. Ships’ identities can be changed, as can their locations. This provides an ideal situation for terrorist actions to be undetected.
In container terminals, there have been incidents of uncommanded movements of cranes. But this has resulted from a non-criminal activity. Occasionally, truck drivers who move containers in and out of port terminals use GPS jammers so their companies cannot track their exact movements. Since the GPS signals are very weak, the truckers’ $200 jammers can affect nearby pieces of equipment that depend on GPS for their movements. The result can be a container crane that shuts down or moves without the operator’s commands. Personal safety, damage to cargoes, and operational shutdowns (to find and fix the problem) have resulted from this non-malicious use of GPS.
GPS and related satellite-based systems have been a boon to navigation for everything from cell phones to the world’s largest ships. In addition, while often overlooked, the reliance on GPS’s precision-timing signal by a wide array of industries within our country is of strategic significance. With regard to shipping, a Plan B is needed in case the ubiquitous but vulnerable GPS signal is compromised. The solution appears to be Enhanced Loran, or eLoran. Developed from the now-decommissioned Loran C, but at a much lower cost thanks to today’s automation technologies, it can provide the robust navigational system needed to back up GPS. While not as accurate as GPS, eLoran can provide position accuracy to within 22 yards. Also, it is much less susceptible to interference due to its signal being much stronger than GPS.
While physical security in the maritime industry is important, cyber security needs to receive the same degree of attention.