Pirates taking to the internet to plan raids

Julian Clark, head of global shipping at Hill Dickinson, explains to David Kaye why a ship raid by Somali pirates should make us all more aware of cybersecurity Q: A pirate attack in the Gulf of Aden might not attract many headlines these days – what made this case so different? A: On this occasion, the pirates had employed hackers to access the shipping company’s IT network, which managed the shipping routes of its fleet. The pirates were able to use the data to identify ships with the most valuable cargo. Armed with this information, they were able to board a specific ship, quickly locate specific containers holding high-value items, remove the contents and get away fast. Pirates could just as likely hack into the cargo manifests of local agents to see a ship’s schedule, when it is sailing, what boxes are loading, their contents and where they will be located on the vessel. They can cherry-pick particular vessels for high-value cargo – a container load of laptops or mobile phones is easy to steal and change into cash. Theft is one thing – but this is just one example of the huge cybersecurity risk across the shipping sector. Q: What can we learn from this attack? A: Everyone needs to be more aware of the risks, in all areas of the industry. And that includes, crucially, onboard. We find that there are two kinds of delusions in relation to cybersecurity in shipping. First, there is the ‘it will never happen to us’ attitude. Second, people think: ‘We are a ship, where is the data access? We have port security in place, how on earth can anyone get onboard the ship?’ They think ships have the odd computer on board and there is no way to access it. They are wrong on both counts. It is very easy to infiltrate an insecure system, and it doesn’t require a James Bond character to do it. Q: What should companies be aware of? A: All it takes is a memory stick put into the ship’s system or even into a laptop that a crew member brings onboard and plugs into the ship’s systems to recharge. Or perhaps the seafarer brings his mobile phone on board and decides to charge it by plugging it into the ship’s system. These are sophisticated hackers. To give you an idea, there is evidence that bugging devices have been fitted inside the power sockets that the public use at airports for their phones and laptops. That can provide a link for the hackers. But also, ships’ systems are increasingly communicating back to shore, for example in relation to ballast water systems, engine, systems and emissions checking or performance management systems. Today, it is easier getting live information on what is happening at sea and that allows anyone to hack into that system. Q: Worst-case scenario? A: There is evidence that people can even hack into ECDIS, to the extent that they can change charts and move obstacles on the charts. You could be moving down a channel and avoiding a shallow area or underwater obstruction, but actually you are going to run aground due to the change to the ECDIS system. And of course, there is huge concern in relation to the automation of vessels. Q: How widespread is the problem right now? A: The problem is far more widespread than people think, because there is a mass under-reporting of the issue. People don’t want to say, ‘guess what, all our systems have been hacked’. They want to keep it quiet. And yet a company as sophisticated as Maersk can be attacked – and its systems were down for several days at a cost of $200m–$300m. Q: What should be done? A: There are increasing guidelines from organisations such as the International Maritime Organisation and BIMCO, highlighting the risks of a cyberattack. The future drive is to create a culture where everyone is aware, and that goes right up to board level. Companies can make the mistake of thinking this is simply an IT department problem. But that is far from the truth, not least because what we are dealing with here are very different skillsets between an IT expert and an IT security expert. In fact, this is a new field of recruitment for the shipping industry – cybersecurity officers are being employed by shipping lines and ports, and they are often highly specialised people coming in from all sorts of security-related areas. Q: Should there be a ban on personal laptops and phones onboard? A: There is a balance to be drawn. The pressures at sea have increased immensely and crew welfare is hugely important. Companies are looking to take away stress levels and one way is to ensure crew members can be in touch with family and friends onshore. However, you could say the same about lawyers in terms of pressures and stress. At Hill Dickinson, we are not allowed to bring our own laptops into the office and it would be a disciplinary offence if you tried to plug one into the firm’s system. We never use any kind of memory stick or flash drive in any system unless it is checked by our IT department first. Staff are allocated a laptop by the firm, and you cannot download things onto it such as Facebook or apps. Q: Who are the hackers? A: Not always who you might expect. It could be an activist who wants to highlight an issue; it could be a terrorist who changes the manifest so that a box containing a chemical weapon is delivered into a major harbour; it could be a disgruntled former employee who decides they are going to ‘get their own back’; or it could be a teenager effectively playing a real-life video game. It is relatively simple for someone not that tech-savvy to hack into a vessel’s systems. Q: Are we all doomed? A: No! But we do need greater industry awareness; greater crew awareness and training; more active participation from operators and crew in relation to cybersecurity risks. Some companies use ‘professional hackers’ to test the security of their systems and that is a good move. Above all, we must get away from the belief that ‘it will never happen to me’.

Pirates taking to the internet to plan raids

Want to read this article?

Read Next

German SMEs record rise in cyberattacks, reveals HDI poll

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Climate change to cause ‘massive economic damage’

European bosses say half of supply chain will not comply with CSDDD

Risk management community mourns the death of former Ferma president Jorge Luzzi

German SMEs record rise in cyberattacks, reveals HDI poll

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Climate change to cause ‘massive economic damage’

European bosses say half of supply chain will not comply with CSDDD

Risk management community mourns the death of former Ferma president Jorge Luzzi

Want to read this article?

Read Next

German SMEs record rise in cyberattacks, reveals HDI poll

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Climate change to cause ‘massive economic damage’

European bosses say half of supply chain will not comply with CSDDD

Risk management community mourns the death of former Ferma president Jorge Luzzi

Related Articles