The Urgent Need for Improved Maritime Cybersecurity Measures

The U.S. Maritime Transportation System (MTS), responsible for handling over $5.4 trillion in annual goods and services, is facing significant cybersecurity vulnerabilities in the face of increasing threats from foreign actors and criminal organizations.

A recent Government Accountability Office (GAO) report has shed light on substantial gaps in the Coast Guard’s ability to protect critical maritime infrastructure from cyber threats. The report highlights the challenges faced by the Coast Guard in accessing complete information on cybersecurity-related inspection results, indicating a significant oversight challenge.

The investigation identified China, Iran, North Korea, Russia, and transnational criminal organizations as the primary cyber threats to the MTS. With the growing reliance on technology in maritime facilities and vessels, new vulnerabilities to cyberattacks have emerged.

Recent developments in maritime security, including the issuance of MARSEC Directive 105-5 by the Coast Guard, specifically addressing cybersecurity concerns related to Chinese-manufactured ship-to-shore cranes, have raised alarms. The directive was prompted by concerning findings related to Chinese-manufactured cranes dominating U.S. port infrastructure, with security concerns heightened by the discovery of intelligence collection devices on ZPMC cranes at the Port of Baltimore.

In response to these challenges, the GAO has issued five key recommendations aimed at enhancing maritime cybersecurity measures. These recommendations include improving cybersecurity incident tracking, enhancing access to deficiency data, strengthening cybersecurity strategy, and developing comprehensive workforce competency requirements.

Despite the Coast Guard’s efforts in developing a cyber strategy, the GAO’s findings suggest that it falls short of meeting all key characteristics needed for an effective national strategy. Additionally, competency requirements for the Coast Guard’s cyber workforce have not been fully developed, leaving existing competency gaps unaddressed.

As cyber threats continue to evolve, it is imperative to prioritize and implement improved maritime cybersecurity measures to safeguard one of America’s most critical infrastructure sectors.