Cyber Attacks Threaten Shipping & Dominate Maritime News

By William P. Doyle
The maritime industry must redouble its efforts to secure IT systems and data.
 
In June, Maersk Line A/S’s information systems were severely disrupted by the so-called Petya virus. FMC provided Maersk with relief to help them get through the difficult situation. In Mid-July, a researcher penetrated a ship’s internet system through its very small aperture system (VSAT). The ship was operating in the South America trade.
 
VSAT Vulnerability
An internet security researcher identified as “x0rz” discovered that many shipboard VSAT systems can be penetrated through the public internet, making the findings live in real time on Twitter. Thus, ships can be tracked and identified through services like Shodan. Shodan is a search engine that allows users to find electronic devices and computer systems connected to the internet, i.e., power plants, traffic signals and even ships. x0rz found that some ships’ systems are not securely configured thus allowing a remote attacker to gain access using default credentials.
 
According to TNW News, x0rz said “no ships were harmed during [his] experiments.” The system x0rz obtained access to allow a review of the call history from the VSAT phone, ability to change the system settings, and even upload new firmware. The researcher logged the username “admin” then the password “1234” thereby gaining access to the ship’s communication system.
 
I contacted x0rz through email connected to its Twitter account and asked for some tips and steps that shipping companies can take to make them more secure from cyberattacks. x0rz provided the following suggestions, all of which involve simple common sense and are easy to implement: 
  • Do not use default password(s) (change them immediately after installation);
  • Do not expose on the Internet the VSAT administration panel (keep it internal only);
  • Keep software up to date;
  • Have this tested by a cybersecurity firm (audit / penetration testing). Sometimes it is easy to think "it's now secure" when in fact there are ways to bypass security mechanisms.
 
Maersk Infected by the Petya Virus:
FMC issued an order on July 19, 2017 granting Maersk Line‘s petition for a temporary exemption of service contract filings as a result of the so-called Petya virus. The cyber attack interrupted Maersk’s ability to determine which shippers to contact in order to extend or renegotiate certain service contract rates. Further, even if Maersk were able to identify which contracts needed attention, the Petya virus prevented the company from electronically filing documents with the Commission.
 
By granting the petition, the FMC allowed Maersk some regulatory relief. For instance, Maersk would not require customers to pay the higher tariff rates to shipments tendered during the period of relief. Rather, FMC’s order permitted Maersk to apply service contract rates to shipments that were agreed upon and filed after the date of cargo receipt without violating the Shipping Act. More to the point, Maersk was able to provide service to its customers on the same commercial terms as it would have had it been able to conclude and file contacts and amendments.
 
These two cyber incidents can serve as teachable moments for the entire maritime and logistics transportation chain. We all need to redouble our efforts and secure the best available IT system protections and practices.
 
M&A Update:
In July, China Ocean Shipping Company (COSCO) and Overseas Orient International Ltd. (OOIL) announced plans to merge. China-owned COSCO’s move to absorb Hong Kong-based OOIL would create the world’s third largest container carrier. OOIL is controlled by the Tung family, which founded Orient Overseas Container Line (OOCL) in 1969. The Tung family has a long history in the shipping industry predating modern day OOCL. In addition, the Tung family’s Tung Chee-hwa was the first Chief Executive of Hong Kong. Tung Chee-hwa was elected in 1996 by the 400-member Selection Committee prior to the transfer of sovereignty over Hong Kong from the United Kingdom to China.
 
I had the opportunity to meet with the leadership of COSCO in Washington, DC in early August. According to COSCO executives, the parties have begun discussions with the U.S Department of Justice on the potential merger. The price tag for the deal is valued at $6.3B U.S. dollars. COSCO intends to keep in place OOCL’s listing on the Hong Kong Exchange. The OOCL brand, headquarters and management structure is not expected to significantly change. Finally, all OOCL employees will be kept on board for at least two years.
 
Federal Maritime Commission Updates its Controlled Carrier List
On July 19, 2017, the Commission updated its list of “Controlled Carriers,” or, those ocean common carriers that are majority owned or controlled by foreign governments. The Commission is charged with monitoring foreign government control of ocean shipping lines. The FMC maintains a list of these companies which is periodically updated as circumstances warrant.
 
Over the past couple of years, the FMC has demonstrated regulatory flexibility in addressing the burdens for shippers who do business with controlled carriers. For instance, in 2015, United Arab Shipping Company (UASC) was granted the ability to lower tariff rates without waiting the requisite 30 days. However, if UASC wanted to raise rates then they would still be required to wait 30 days prior to implementation.
 
Recent consolidation in the container shipping industry has resulted in four notable changes among Controlled Carriers as listed below:
 
  • China Shipping Container Line was integrated into COSCO Container Lines Company, Limited, which then changed its name to COSCO SHIPPING Lines Co, Ltd.
  • Singapore’s American President Lines, Ltd. and APL Co., Pte. is being removed from this list because it is now wholly owned by CMA CGM S.A. and no state entity is a majority owner
  • United Arab Shipping Company Ltd. (formerly United Arab Shipping Company (S.A.G.) is being removed from this list because it is now wholly owned by Hapag-Lloyd and no state entity is a majority owner
  • China’s Hainan P O Shipping Co., Ltd. is being removed from the list because it no longer operates in the U.S.-foreign trades
  • China’s COSCO SHIPPING Lines Co., Ltd. and Algeria’s CNAN Nord SPA remain on the Controlled Carrier list.
 
Natural Gas as a Marine Fuel: IMO Holds Fast
The International Maritime Organization (IMO) met in London July 3-7. A couple of countries moved to delay or alternatively utilize a “transitional period” for the enforcement of the January 1, 2020 date for the global 0.5% sulfur content cap. The proposal was rejected by the IMO/ Marine Environmental Protection Committee (MEPC). Thus, any suggestion that there may be any delay to the January 1, 2020 implementation of the 0.5% sulfur limit was ruled out.
 
To summarize, in 2008, IMO MARPOL Annex VI regulations were accepted lowering the global sulfur cap from 4.5% to 3.5% by 2012 and then again to 0.5% on January 1, 2020. The 2020 date was conditionally approved with the inclusion of a look-back provision that would allow the IMO to delay implementation of the 0.5% cap from 2020 to 2025 pending a review on the availability of low sulfur fuel. A major step was taken in October of 2016 with the review finding no need to push back the original 2020 implementation date. 
 
Shipowners and operators worldwide are making decisions based on IMO MARPOL’s sulfur cap regulations. There are a limited number of options including LNG as a fuel, scrubbers or low sulfur fuels. Natural gas as a marine fuel substantially exceeds the other options with respect to air quality measures. Liquefied natural gas (LNG) emits zero sulfur oxides (SOx). Moreover, using LNG as a fuel emits near-zero particulate matter into the atmosphere. When compared to heavy marine fuel oil, LNG emits 90% less nitrogen oxides (NOx).
 
Expanded Panama Canal Celebrates First Anniversary
On June 26, 2017, the expanded Panama Canal celebrated its one-year anniversary. It is already having a massive effect on the US East and Gulf Coast. As of June, more than 1,500 neo-Panamax vessels transited the expanded canal with over half of them 13,000 TEU vessels. This dramatic increase in capacity has already yielded significant gains for ports. Both the Georgia and Virginia port authorities have reported double digit year-over-year volume growth for the month of May. Jacksonville saw a 13% bump in Asian containers from October 1, 2016 to end of March 2017 compared to the same period a year before. Because the old canal locks were only wide enough to handle ships of approximately 5,000 TEU, US ports on the east coast are keen to modify themselves to better accommodate the larger vessels.
 
A segment that has witnessed an unexpected rise in traffic is the carriage of natural gas and its byproducts. Prior to the Canal’s expansion, very few LNG tankers were small enough to make the transit. Canal authorities forecasted a single LNG transit per week. However, today, an average of 5.2 LNG vessels transit the new locks every week. Beyond this, liquefied petroleum gas (LPG) vessels have seen a significant uptick, now accounting for 31.5% of all transits through the expanded canal.
 
Numerous ports including Boston, Philadelphia, Charleston, Savannah, Jacksonville, Port Everglades, Tampa, Sabine-Neches Waterway and Houston are in the midst of dredging projects that will enable them to accept the larger post-Panamax vessels. 
 


The Authors
William P. Doyle is a Commissioner with the U.S. Federal Maritime Commission. The FMC, among other things, regulates liner companies, ocean transportation intermediaries and marine terminal operators. The thoughts and comments he expresses here are his own and should not be construed to represent the position of the Commission or his fellow Commissioners.

Also Contributing: Owen Braley is a summer student volunteer in the Office of FMC Commissioner William P. Doyle. Braley is entering his junior year, a Second Class Cadet, at the Massachusetts Maritime Academy, majoring in International Maritime Business (IMB). He recently returned from a semester abroad at the Dalian Maritime University in Dalian, China.


(As published in the July/August 2017 edition of Maritime Logistics Professional)
 

Maritime Logistics Professional Magazine, page 10, Jul/Aug 2017

Read Cyber Attacks Threaten Shipping & Dominate Maritime News in Pdf, Flash or Html5 edition of Jul/Aug 2017 Maritime Logistics Professional

Other stories from Jul/Aug 2017 issue

Content

Maritime Logistics Professional

Maritime Logistics Professional magazine is published six times annually.