The increase of digitalisation and automation of operations channels emphasis into cybersecurity and preparedness for security threats. Cybersecurity generally refers to the protection of sensitive information (such as personal data), data components, networks, and systems from unauthorised parties. Precautions against cyber-attacks are well-acknowledged theme also in maritime logistics.
The International Maritime Organization (IMO), a specialized agency of the United Nations responsible for measures to improve the safety and security of international shipping, has taken a position on maritime cybersecurity. The IMO refers maritime cyber risk to ‘a measure of the extent to which a technology asset could be threatened by a potential circumstance or event, which may result in shipping-related operational, safety or security failures as a consequence of information or systems being corrupted, lost or compromised’ [1]. Cyber risk management aims to support and achieve secure operational resilience.
Cyber security and threat preparedness have gained resources. However, not every sector or application is equally attractive to attackers. The likelihood of being the target of a cyber-attack due to the attractiveness of data is not very high throughout the whole maritime logistics transport chain.
– It is true that the more data is shared, the higher the risk of an attack. But in the timber logistics chain in the region of Satakunta, other risks to logistics operations are more significant than, for example, the crash of a single application, says Janne Lahtinen, an expert in a SAMK-led ÄlyMeri project, which is developing a risk management model for timber logistics chain.
Damage can still be caused and, according to a news report by Yle, attempts have been made to hack the largest container warehouses during the pandemic. The worst known cyber-attack was on the Maersk shipping company, which had to rebuild its entire IT infrastructure: a 10-day delay in operations and remedial measures cost $300 million. [2]
The threat of a cyber-attack depends on the scale of the IT infrastructure
Marko Löytökorpi, a sea captain and lecturer in maritime studies, believes that cyber-attacks on individual ships are less likely than attacks on port and shore-based operations, for example, and the impact would not necessarily be as significant.
– Even if a cyber-attack were to hit a ship and bring its systems down, the ship is in a way such a ‘simple piece’ that an attack might only slow down processes, but not stop them completely, Löytökorpi states.
To take an example from BIMCO’s ”The Guidelines on Cyber Security Onboard Ships” on the IMO website, an unknown virus found its way into the Electronic Chart Display and Information System, i.e. ECDIS, causing delays for the company, as the ship was not designed for paperless navigation. The system was eventually recovered. [4]
More serious disruptions would occur on the ground operation, for example if port systems fail: ships cannot unload or load cargo, port processes would slow down causing delays and costs throughout the logistics chain. Reputational damage is also a significant factor.
Preparing for cyber threats is important for Finland
The consequences of cyber-attacks are limited only by the imagination, but in the worst-case scenario, they include loss of vessel and staff safety, and environmental damage. Hiding, deleting, or frozen position data can cause physical damage and so-called ‘ghost ships’, messing up schedules, and unnecessary waiting times. Today, and especially in Finland, cybersecurity preparedness is particularly relevant as around 90% of imports and 80% of exports are by sea [5].
Text: Aku Suomi, SAMK, student trainee and Hanna Kajander, SAMK, Project Manager
Photo: Pixabay
[1] Maritime cyber risk, IMO. Available: https://www.imo.org/en/OurWork/Security/Pages/Cyber-security.aspx, retrieved on 2023-03-24.
[2] Tuomaala, Erja. (2021), Kyberhyökkäyksen uhka kasvaa merillä ja satamissa – kaikkia suurimpia konttivarustamoja on jo yritetty hakkeroida. Yle. Available in Finnish: https://yle.fi/a/3-11894409, retrieved on 2023-03-24.
[3] “The Guidelines on Cyber Security Onboard Ships”, BIMCO, p. 23. Available: https://wwwcdn.imo.org/localresources/en/OurWork/Security/Documents/ANNEX%20Guidelines%20on%20Cyber%20Security%20Onboard%20Ships%20v.4.pdf, retrieved 2023-03-28.
[4] “The Guidelines on Cyber Security Onboard Ships”, BIMCO, p. 14. Available: https://wwwcdn.imo.org/localresources/en/OurWork/Security/Documents/ANNEX%20Guidelines%20on%20Cyber%20Security%20Onboard%20Ships%20v.4.pdf, retrieved 2023-03-28.
[5] “Merenkulun avainluvut”, Suomen Varustamot. Available in Finnish: https://shipowners.fi/kilpailukyky/merenkulun-avainluvut/, retrieved on 2023-03-24.