Cyber crimes

10th February 2020 Scott Edwards Crimes against mobility No Comments

Introduction

Maritime cyber-crimes are illegal actions undertaken against ships or critical infrastructures through computer channels. Attacks can have a wide variety of purposes, including to damage, destroy or hijack IT (Information Technology) or OT (Operations Technology) systems.¹

Multiple different targets, forms of attacks, motivations, and perpetrators can be involved in cyber-crimes.

Port, by Bill Dickinson Attribution-NonCommercial-NoDerivs 2.0 Generic (CC BY-NC-ND 2.0)

Characteristics

Targets

Not all cyber-crimes discussed in this entry specifically target the maritime sector, but may instead aim to infect as many systems as possible.² As such, there is a distinction between targeted and untargeted attacks.³ Even so, cyber-crimes pose an increasing risk to the maritime sector, even when untargeted. This is due to the specific dynamics of the sector’s critical infrastructure.⁴

For example, the movement of ships across international boundaries exposes their systems to a larger number of unknown IT networks.⁵ Because many ships are relatively old (the average age of ships is over 20 years),⁶ they often have a mix of old and new systems, some of which may be obsolete. Many ships (including naval vessels) cannot upgrade these easily due to outdated hardware.⁷ Tam and Jones argue that the design cycle of newer ships is of a duration that means this problem will likely continue to exist.⁸

Other reasons ships are particularly vulnerable to cyber-attacks are their differing systems, the duration of their voyages which create large windows of opportunity for cyber-attacks, a nominally low bandwidth while at sea, and alternating between extreme isolation and global connectivity at international ports.⁹ Because ships often change crews, it can be difficult to ensure that all crews are aware of cyber-vulnerability, meaning human failure can also be significant risk factor for ships.

Ships are increasingly connected to networks through very-small-aperture terminals (VSAT), and their bandwidth capacity is increasing. This means they can access networks with greater regularity and share more information, making them more susceptible to cyber-attack.¹⁰

Shipping is also increasingly reliant on networked systems for its operation.¹¹ Navigation depends on electronic systems such as ECDIS, GNSS, VDR and Radar/ARPA, as well as the un-encrypted Automatic Identification System (AIS) network.¹² In some cases, ships are unable to sail without these systems; many are designed to be paper-less and are therefore dependent on digital means of navigation.¹³ Propulsion too is increasingly automated, especially power control systems, and is often networked through integration with navigation.¹⁴

Ports are also at risk of being targeted. Computer systems undergird the global flow of maritime commerce. Ports incorporate a variety of networked OT systems, including modern gantry cranes, and scanning systems.¹⁵ The advent of ‘smart ports’ means more of the day-to-day operations are automated, increasing vulnerability.¹⁶ Port operators and agents also rely on IT for their management, such as freight management, operations data, traffic control communications, financial data, and corporate systems.¹⁷

These infrastructures are often connected, with data flowing between a large number of actors from across the globe.¹⁸ This means that a cyber-attack targeting or impacting on one actor can quickly spread to other actors and different infrastructures.¹⁹

Types of attack

Cyber-attacks can take multiple different forms.²⁰ In order to provide a simplified overview, these will be explored through the effects they have – firstly, those that impact directly on operations, and secondly, those that are used to facilitate other forms of criminality.

The first type of cybercrime stops or limits operations, generally through a direct attack that damages systems or makes them either inaccessible or limited in such a way that continuing operations in ports or onboard ships and offshore infrastructure would be impossible or unsafe. Autonomous shipping, port services, navigation aid systems, offshore platforms and marine traffic control centres are all potential targets for these kinds of crimes.

Cyberattacks of this type can include mechanisms such as malware, software designed to damage systems, ransomware, software that blocks access to systems or publishes data unless a ransom is paid, and Distributed Denial of Service (DDoS – the flooding of a network with data to make it inaccessible). The Baltic and International Maritime Council (BIMCO) report a case where a shipowner opened an infected email attachment sent from two unwitting ship agents which made systems inaccessible until a ransom had been paid.²¹ Similarly, a large-scale destructive malware attack was targeted at the Maersk line in 2017.²² This saw malware spread across up to 76 ports causing widespread system outages. Both of these examples shut down operations by making information systems inaccessible.

Ships are also at risk from these forms of attack. In 2016 in South Korea 280 ships had to halt operations due to problems with their navigation systems.²³ Viruses and malware have been shown to contribute to these issues, causing stoppages in operations due to safety concerns and an inability to navigate effectively.²⁴ While these navigation systems were connected to the internet, even air-gapped systems (those not physically connected to an external network) have been shown to have dormant viruses.²⁵

Many of these attacks are likely to have been untargeted. However, analysis by BIMCO suggests that targeted attacks are more sophisticated, because specific tools and techniques will be created for targeting the company or ship. These might include the manipulation of insider individuals; brute force (where many passwords are tried); and DDoS attacks.²⁶

Spoofing is a targeted form of attack that has become a concern for ship navigation.²⁷. Spoofing involves convincing the positioning systems of the ship into believing a counterfeit signal in order to make unintentional course corrections.²⁸

One study conducted by Trend Micro demonstrated an ability to recreate a VHF frequency on AIS that could simulate a “ghost ship” in a nearby port, which would alert vessels they were on a collision course and change their path.²⁹ In a further study the University of Texas-Austin were able to effectively take remote control of a yacht in the Mediterranean by overpowering the onboard GPS.³⁰ Spoofing can also cause ships to misreport or lose their own position, as occurred in the Black Sea in 2017 in an incident that impacted over 20 vessels.³¹ The diversion of ships through spoofing impacts negatively on operations, requiring the them to right the course manually or halt altogether until the issue is resolved.³² Jamming can also cause such issues by causing failures in navigation systems.³³

Data loss and theft resulting from hacking can be a serious targeted cyber-crime. In a case against an Iranian Shipping Line, for example, data loss relating to delivery and locations of containers meant that cargo containers could not be identified or located, causing financial loss.³⁴ There have also been cases where companies have been extorted into paying hackers so that confidential business information is not released.³⁵

A second type of cybercrime aims to facilitate other maritime crimes such as drugs trafficking, piracy, and fraud though various forms of cyber-attack, for example by hacking port systems that control and track container movement in order to hide shipments of illicit goods. An indicative case was the hacking of the Port of Antwerp’s digital container tracking system in 2013.³⁶ Containers trafficking drugs could be released without port authorities becoming aware, and traffickers could reach containers before their legitimate owners.³⁷ Initially this was done through the cultivation of insiders in the port system, which then allowed hackers to re-enter electronic systems remotely. In other cases, traffickers have been able to discover which containers are under suspicion in order to avoid collection, as occurred in Australia in 2012 ³⁸

Robbery and piracy can be facilitated by cybercrimes. By hacking a system, attackers can browse cargo and container lists to identify the most valuable goods for black markets, to then be stolen in the port or targeted for future piracy attacks when the ship is at sea.³⁹ Between 2010 and 2011, for example, a Greek Shipping Company was targeted by pirates in the Gulf of Aden after hackers had gained access to route timetables and ship vulnerabilities.⁴⁰ It has been suggested that spoofing can also make piracy easier, by making the ships appear to be elsewhere – either leading them into more dangerous areas or making rescue difficult.⁴¹

Cyber-fraud, too, is an increasing problem. A number of maritime bunkering and fuel services have fallen victim to such frauds, including World Fuel Services, who were defrauded of $17.9 million by a faked order.⁴² Criminals were able to create a fake fuel supply tender, which led to a ship-to-ship transfer. When they attempted to bill the agency in the documents, however, there was no record of the transaction. Vulnerabilities are increased because many transactions occur over email.⁴³

Perpetrators

Some attacks are undertaken by independent individuals and are relatively minor in scale and effect. These may be carried out by hackers outside of the system or disgruntled employees.⁴⁴ The motivation for such attacks may be economic gain, but non-financial reasons such as a desire to cause vandalism, leak information, prove cyber skills and enhance reputation in the wider community, or even ideological motivations when wanting to damage operations to protest for an activist cause.⁴⁵ Within these relatively small activities some may be opportunistic rather than planned and be undertaken without specialist knowledge of techniques and tools.⁴⁶

Other cybercrimes are more organised. In the cases of trafficking facilitation above for example, there were links to South American organised criminal groups. Corrupt employees can also be implicated in such attacks. Attackers often need an in-depth knowledge of port systems and infrastructure, as well as expert knowledge of the techniques and tools for cyberattacks, both of which demand sophisticated organisational capacities.

Other groups engage in corporate or industrial espionage. ⁴⁷ These can include corporations seeking to create competitive advantage .⁴⁸ They may act directly or through third parties with the aim of harming a rival by collecting business intelligence, stealing intellectual property, or disrupting operations to cause financial or reputational loss.⁴⁹

Not all organised cyber-crimes are targeted or have a financial motivation. For example, the Maersk case discussed above was well-orchestrated, but seems to have been aimed at disruption as much as financial gain. This has led to a recognition of a distinction between vandalism, which is relatively small scale and disorganised on the one hand, and well-organised and intentional sabotage on the other.⁵⁰

A final difficulty is distinguishing between acts undertaken by criminal groups or independent hackers, and those carried out by states. State-led cyber-crimes tend to be viewed as issues of national security. Cyber-attacks are increasingly difficult to attribute,⁵¹ especially if they are undertaken by perpetrators with less clear state-sponsorship. Some of these criminal acts are thought to be undertaken by states due to the targets involved and the sophistication of the attacks. In 2020 for example, a cyber-attack in Iran’s Shahid Rajaee port terminal – thought to have been conducted by Israel – halted operations.⁵² There are also increasing concerns that terrorist groups could engage in cyber-crimes.⁵³

Scope

There was initially criticism that the frequency and potential of cyber-attacks was been overestimated.⁵⁴ In response, sources such as CyberKeel and Maritime Cyber Emergency Response Team produce bulletins identifying maritime cyber attacks when they take place.⁵⁵ BIMCO also collect this information.⁵⁶

Despite these efforts, the scope of cybercrime in the maritime sphere is not well understood. There is no centralized reporting mechanism and there has been some degree of confusion whether channels for reporting emergencies include cybercrimes.⁵⁷ This has led to calls for an accessible and streamlined reporting process.⁵⁸ However, such systems are limited because cybercrimes are sometimes not disclosed by those targeted due to concerns over reputational loss the exposure of flaws in their IT infrastructure, or misclassification as technological error.⁵⁹

Even so, it is clear that cybercrimes in the maritime sector are on the rise and that many more attacks occur than are made public.⁶⁰ Cybersecurity consultancy Naval Dome for example reported a 400 per cent increase in their detected attempted attacks between February and May 2020.⁶¹ The COVID-19 pandemic is thought to have had an impact on this increase, because more systems are became digitally connected out of necessity.⁶² Overall, Safety at Sea and BIMCO report 31 per cent of companies surveyed reported an attempted cyber attack in 2020.⁶³

Impact

The kinds of attacks described above have a number of tangible impacts. There are also hypothetical impacts should some (so far unsuccessful) cybercrimes to be successful.

First, paying ransoms or dealing with operational shutdowns has an economic impact. The attack on Maersk for example, is argued to have cost as much as $300 million in lost revenue and costs associated with re-building compromised networks.⁶⁴ Systems may also be damaged or destroyed. Theft facilitated by cybercrimes also causes a significant economic impact.⁶⁵

Reputation damage, while negative in itself, might also have an economic impact by limiting future revenue.⁶⁶ There are concerns that if ports were disrupted by cyber-attacks, the zero-inventory just-in-time nature of many economies would see commerce severely disrupted.⁶⁷ This would have a severe economic impact for workers, business revenue and also the shipping lines themselves as goods would have to be diverted.

Cyber-crimes that facilitate drug trafficking undermine enforcement efforts and the rule of law. They also contribute to income for illicit organised groups. In the wake of the Antwerp case discussed above, over $365 million of drugs were seized – demonstrating just how profitable the operation was to the organised gangs.⁶⁸

Cyber-attacks may impact on the physical safety of ships, crews and others. Disrupting navigation could lead to ship-on-ship collisions or even cause ships to collide go aground.⁶⁹ As yet, this remains only a hypothesised outcome, but the growing reliance on automated shipping means it is a possibility based on the successful spoofing attacks that have occurred so far. Undetected attacks on Mobile Offshore Drilling Units have the potential to cause oil spills or loss of life through explosions.⁷⁰ If OT systems in ports were compromised, it could lead to injury or death due to the dangerous natures of the cranes and ship movement.⁷¹ There are also serious security and safety implications of having queues of ships outside of a port entrance in the case of a shutdown.⁷²

Finally, Kramek hypothesises that some cyber-crimes could also impact on military operations, and therefore have a significant national security dimension.⁷³ In his analysis of the Port of Beaumont, through which much of the US Army’s logistics run, he argues that any attack there could impact the military’s ability to respond to crisis or conflict.

Linkages & Synergies

Cybercrime is most often linked to illicit trafficking, given traffickers’ past usage of cyber to facilitate the movement of cargo through ports. It is also linked to piracy, as information gained through cyber-attacks has been used to inform pirate attacks in the past.

Responses

Responses to cybercrime in the maritime sector have been slow in coming, though there is a movement towards improved guidelines for maritime stakeholders.

Most evidence suggests that ports and shipping lines are under-prepared for cyber threats ⁷⁴ due to a lack of awareness about cyber-security among management and stakeholders, and a belief that the prospect of an attack is either unlikely or theoretical.⁷⁵. There may also be a confusion of responsibility for cyber security between port authorities and IT providers.⁷⁶ Kramek demonstrates that most ports in the US did not claim Port Security Grant Program funds (which could be used for any aspect of port security) for cybersecurity purposes.⁷⁷ Most did not have cyber incident response plans. These factors have led some to argue that the maritime industry is 10-20 years behind comparable industries in addressing cyber security challenges.⁷⁸

International

A number of international organisations have released guidelines for shipping companies and ports, including BIMCO, the International Maritime Organisation (IMO), the European Union Agency for Cybersecurity (ENISA), International Association of Ports and Harbors (IAPH),⁷⁹ and EUROPOL.

The expected outcome of these guidelines is a greater awareness amongst stakeholders of the issues, leading to better cyber security policies and training for staff.⁸⁰ Such training is important due to the ‘insider threat’, where employees may unwillingly contribute to cyber-attacks through their own lack of awareness.⁸¹

Insurance companies have played a role in raising awareness, especially as many exclude cyber-attacks from their policies and therefore increase risk (the Institute Cyber Attack Exclusion Clause).⁸²

International guidelines also suggest security audits and assessments,⁸³ penetration testing, network segmentation, regular network scans, multi-factor authentication, identification of stakeholders, the creation of a security operations centre with a dedicated cybersecurity officer, and physical security assessments.⁸⁴ Relatively basic guidelines include the need to employ antivirus and encryption measures, frequent password updates, and electronic data backup, as well as limiting the use of USB devices by employees.⁸⁵

In their Interim Guidelines in Maritime Security Cyber Risk Management, issued in 2017, the IMO proposes an approach based on five functional elements: identify, protect, detect, respond and recover. Shipping companies had to come into compliance on the 1st of January, 2021.⁸⁶

National

National guidelines have also been implemented. Examples include two sets of codes of practice from the UK’s Department for Transport (Cybersecurity for Ships, and the Cyber Security Code of Practice for Ports),⁸⁷, France’s Critical Infrastructures Information Protection Law,⁸⁸ and the German IT-Grundschutz.⁸⁹

While preventative guidelines to cyber-threats are increasingly common, strategies for actually responding to cyber-attacks are less well-developed. Reporting attacks to national jurisdictions when underway remains problematic, for example.

Some countries have delegated cyber-security to a specific agency or department in order to build stronger cyber resilience. In the US for example, the US Coast Guard is charged with protecting the maritime sector from cyber-crimes. They send out monthly notices to the maritime community in the United States with links to cybersecurity awareness bulletins, training, tools, and alerts.⁹⁰ However, coordination with other relevant agencies has sometimes been problematic.⁹¹ Coordination challenges have also been recognised within the EU. The European Union Agency for Cyber Security (ENISA) for example argues that ‘the fragmentation of European maritime policies brings difficulties for the clear definition of responsibilities and roles to be taken regarding cyber security matters in this sector.’⁹²

Coordination and information-sharing between state and private stakeholders such as shipping agents and port authorities can also be difficult. This is problematic when these stakeholders share access to the same systems and networks.⁹³ One port can incorporate up to 900 different stakeholders for example.⁹⁴ Some may use different IT systems with different technical support teams behind them. As ENISA argues, ‘this [port] ecosystem is built from companies of various sizes, with various levels of cybersecurity capabilities and can even be direct competitors among themselves’.⁹⁵ Efforts are underway to solve this problem – Port Information Sharing and Analysis centres, for example, aim to establish public-private partnerships and are predicated on trust-based networks that allow for secure information-exchange.⁹⁶

Blue Crime - The Evidence