Assessing Cyber Challenges of Maritime Navigation

Abstract

This paper provides a close investigation into the landscape of both cyber threats and actual incidents in the maritime sector, identifying the cyber trends and challenges as they relate to safe navigation and marine shipping. As an important subset of cyber threats that impact many maritime systems, the vulnerabilities of satellite navigation systems, in particular the Global Positioning System (GPS), receive special attention. For this article, a systematic literature review was conducted, complemented by the research and analysis of a specific spoofing event. Analyzing available resources, we might summarize that a shift in mind-set is essential to direct more attention and resources toward cybersecurity as well as the necessity for manufacturers to improve the cybersecurity of their products, as shipping systems currently remain vulnerable to cybercriminals. There is a need for multiple positioning, navigation, and timing (PNT) systems onboard maritime vessels to complement GPS-only navigation. The use of multiple satellite navigation constellations, public as well as private, in combination with the terrestrial components of an enhanced LOng-RAnge Navigation (eLoran) system and ports’ laser-based aid system for berthing and docking should provide the shipping industry with the direly needed increased protection from cyber-attackers for the foreseeable future.

1. Introduction

Today’s global maritime sector depends increasingly on digitalization, integration of operations, and automation. New opportunities arise—and cyber threats emerge. Cyber technologies have become essential, even critical, not just to the operation and management of numerous systems and processes onboard ships and in ports, but also for the safety, security, and protection of the ship, the crew, the cargo, and the marine environment. These technologies have integrated IT (Information Technology) and OT (Operational Technology) onboard ships through networking and connectivity to the internet [1,2,3,4,5,6]. In the World Economic Forum’s Global Risks Report 2020, cyberattacks on critical infrastructure with a reference to shipping are rated the fifth top risk in 2020 [1]. According to Rizika [2]: “Cyber–attacks on the maritime industry’s OT systems have increased by 900% over the last three years. There were 50 significant OT hacks reported in 2017, rising to 120 in 2018 and more than 300 in the previous year. This year will probably end with more than 500 major cybersecurity breaches, with substantially more going unreported”. When deliberate disruptions are discovered, there are many incentives to keep that information quiet, mainly because of the maritime industry not being eager to reveal the weaknesses and vulnerabilities of their products or services.

Safety has always been a critical driver in regulations of maritime operations; and now that navigation systems have been increasingly reliant on cyber technologies to improve the effectiveness and safety of navigation, a need for safeguarding shipping from cyber threats has arisen [3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21]. Therefore, the International Maritime Organization (IMO) has already taken action and given ship owners and executives until 2021 to include cyber risk management into ship safety protocols. Owners run the risk of having ships detained if they have not included cybersecurity in the International Safety Management Code (ISM Code) on safety management onboard ships by 1 January 2021 [22,23].

The IT security system is known as cybersecurity. In contrast, the security system of the OT system is known as cyber safety, although both form part of the concept of cybersecurity [22]. Cybersecurity can be defined in brief as the “preservation of confidentiality, integrity and availability of information in the Cyberspace” [24]. However, the longer definition by the International Telecommunication Union (ITU) better reflects the wide scope: “Cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user’s assets. Organization and user’s assets include connected computing devices, personnel, infrastructure, applications, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment” [25]. Indeed, “cybersecurity combines a multiplicity of disciplines from the technical to behavioural and cultural” [26].

Within this definition, ‘cyber environment’ comprises the interconnected networks of both IT and cyber-physical systems utilizing electronic, computer-based, and wireless systems, including the information, services, social, and business functions that exist only in cyberspace. On a ship, the computer-based systems will comprise a range of information technology components (for example, personal computers (PCs), laptops, tablet devices, servers, and networking components such as routers and switches) and operational technology (for example, control systems, sensors, actuators, radar) [27,28,29]. Current shipboard control systems contain significant levels of automation to perform complex functions such as navigation and propulsion control. The purpose of employing automated systems has been to reduce cost and improve performance. While automation offers excellent benefits, it also introduces a set of corresponding cybersecurity-related risks [22,30,31].

The global maritime industry systems depend on satellite navigation, especially GPS. Of particular concern is the relative ease [32] by which these systems can be jammed (through denial of reception by a competing signal) or spoofed (through deliberate introduction of a false signal). Satellite navigation is a vital part of a wide variety of the shipboard, port, and even oil rig systems [22,32,33,34,35,36,37,38,39], including the Automatic Identification System (AIS) that is vital for navigation safety [40].

This article is a close investigation of the landscape of both cyber threats and actual incidents in the maritime sector. Furthermore, it discusses the risks, the motives and likely entities behind the threats, and the impacts of an attack that can range far beyond the company being attacked. Finally, it recommends how cybersecurity could be improved in the maritime sector over time, and hopefully it might inspire further research work.

The paper is organized as follows: Section 2 describes the methodology, Section 3 presents an analysis of the cybersecurity landscape in the maritime sector and practical research into an AIS spoofing event. Section 4 discusses significant findings and provides some recommendation, and Section 5 contains a summary and conclusions.

2. Methodology

A systematic literature review was conducted, based on and structured according to documented guidelines [41,42,43] through which a comprehensive, explicit, reproducible, and implicit idiosyncratic method of data collection is followed. This method consists of ten steps that can be grouped into three main phases:

(1)

Planning the review: The planning phase focused on defining a review question to guide the search: “What are the effects of cyberattacks and cybersecurity in the maritime domain?”

(2)

Conducting a review: In the search phase, the relevant research databases, the keywords to be used during these searches, and the proper timeframe for the resulting documents to be included were identified. Data for the study were available in the databases such as Scopus, Web of Science, Google Scholar, and open sources. The search keywords were determined from a knowledge domain analysis around the concept of “maritime cyber”. The two main knowledge domains to be scanned were identified as “maritime cyber” and “cybersecurity”. After the broad initial literature search, explicit inclusion and exclusion criteria—i.e., refined selection (e.g., document type, themes, research area) to identify relevant documents for this analysis—were applied. The documents were analyzed and synthesized according to contexts, methodological approaches, and outcomes. Our final list consisted of 171 documents (76 articles, 52 peer-reviewed journal papers, and 43 reports by specialized agencies) that covered the area of “maritime cyber”, ranging from 2016 to 2020. While the results of this article are novel, a few earlier studies on this topic were also taken into account as references.

(3)

Reporting and dissemination: In the next section, we report on our findings from the literature review.

The specific aspect of AIS/GPS spoofing is reinforced by an analysis in Chapter 3 by the Faculty of Maritime Studies and Transport, the University of Ljubljana, research and analysis [44] regarding a particular AIS spoofing event at Elba Island at the end of 2019.

3. Findings

This chapter demonstrates the unique challenges of maritime cybersecurity that include the issues with securing vessels at sea and the shore-based infrastructure supporting this industry. It presents findings of some of the possible cyberattack trajectories on maritime-related systems for navigation, propulsion, and cargo. Despite recent headlines in the media regarding the effects of cyberattacks in the maritime domain, there still seems to be a lack of understanding of cyber incidents on marine navigation systems [6]. To understand the current research being done, it is essential to apprehend its background, the working of the internet, its liabilities, and the methods which can be used to initiate attacks on the system [45]. Until 2010, the majority of cyberattacks were driven by an attempt to obtain personal or financial data. The nature of cyber is changing, and today, the maritime sector is experiencing highly sophisticated and complex attacks seeking to take the reins of its industrial control systems that are designed to be closed to the outer world [46].

3.1. Regulatory Framework—Global

The maritime cybersecurity legal issues are complex [40]. In 2017, the International Maritime Organization (IMO) adopted resolution MSC.428(98) on Maritime Cyber Risk Management in Safety Management System (SMS) [47]. The resolution stated that an approved SMS should take into account cyber risk management following the objectives and functional requirements of the International Safety Management Code (ISM Code) [48]. It further encourages administrations to ensure that cyber risks are appropriately addressed in safety management systems no later than the first annual verification of the company’s Document of Compliance after 1 January 2021. IMO also developed guidelines on maritime cyber risk management that provide high-level recommendations on maritime cyber risk management to safeguard shipping from current and emerging cyber threats and vulnerabilities. These guidelines highlighted that effective cyber risk management should start at the senior management level [49]. Aligned with both IMO documents, the Guidelines on Cyber Security Onboard Ships were made to provide practical recommendations on maritime cyber risk management covering both cybersecurity and cyber safety [50]. In addition, IMO is preparing, in collaboration with the International Electrotechnical Commission (IEC), a new standard for maritime navigation and radio-communication equipment and systems: IEC 63,154 “Cybersecurity—General Requirements, Methods of Testing and Required Test Results” [3,51].

3.2. Regulatory Framework and Policy Priorities—EU

The 2013 EU cyber strategy aims to safeguard the EU’s core values in cyberspace in light of the rapidly increasing growth of cyberspace and the threats to it. A safe cyberspace is essential to the digital single market that the EU sees as a vehicle for increased prosperity. Goals of the 2013 cyber strategy are increased resilience, decimated cybercrime, development of cyber defense policies and capabilities, increased EU autonomy in industrial resources for cybersecurity, and the fostering of a coherent international policy [52]. An EU Directive of 2013 seeks to legally criminalize cyberattacks and cybercrime [53].

The 2016 NIS directive [54,55] requires that EU Member States are adequately equipped to deal with cyber incidents—e.g., by Computer Security Incident Response Teams (CSIRT)—and that businesses in vital and ICT-dependent sectors that provide essential services take appropriate security measures. Information exchange and operational cooperation are required. The directive specifies operators of essential services for the maritime sector: passenger and freight water transport; ports and their facilities and operating entities; and vessel traffic services.

The EU has set up specialized entities such as the European Union Agency for Cybersecurity (ENISA), the European Cyber Crime Centre (EC3) at Europol, and the Computer Emergency Response Team (CERT-EU) [56], as well as launching initiatives to increase cybersecurity in various critical sectors. In particular, the Information Sharing and Analysis Centres (ISAC) are intended to be trusted entities to foster information sharing and good practices about physical and cyber threats and their mitigation [57]. The US also uses ISACs, as well as Information Sharing and Analysis Organizations (ISAO), based on US government regulations, to share cyber threat information between various stakeholders [58], while the maritime sector has three (MPS-ISAO, Maritime ISAC, maritime transportation system (MTS)-ISAC). However, in Europe the maritime sector lags behind in creating ISACs [57]. The European Cyber Security Organisation (ECSO) represents the counterpart to the European Commission for the Implementation of the Cyber Security Contractual Public–Private Partnership (cPPP). Their recent report on the transportation sector [59] aims to take a holistic approach of the implications of cybersecurity on the transport sector as a whole, but also treats the maritime sector separately. It notes that information sharing in the maritime sector falls dramatically short, and recommends the creation of a safe, confidential, and anonymous reporting center for the maritime sector.

The 2017 Joint Communication on Resilience, Deterrence and Defence [60] proposes, among other things, greater resilience, strategic autonomy, more skills, and a security by design approach.

The 2019 EU Cybersecurity Act [61] sets new objectives and tasks for ENISA as a prime tool to implement cybersecurity in the EU, and provides a framework for the establishment of European cybersecurity certification schemes for digital products, services, and processes.

Specifically for maritime, the 2014 European Union Maritime Security Strategy [62] recognizes cyber as one of the risks in the maritime domain. Its 2014 Action Plan [63] contains five actions on cyber, and its 2018 revised Action Plan [64] contains six. Progress reports [65,66,67] provide details on the implementation of these actions in the EU maritime sector, including work on risk assessments, response capacity, exercises, workshops, and working groups. ENISA has published studies dedicated to the maritime sector [68,69].

Most recently, the EU Security Union Strategy for 2020–2025 [70] notes that cyberattacks and cybercrime continue to rise. It calls for a whole-of-society approach to security, with sector-specific initiatives to tackle the specific risks faced by critical infrastructures such as in transport and maritime. The latest conclusions of the Council of the EU [71] underline that cybersecurity remains a shared responsibility of all players, and continue to call for improved cyber resilience, more effective responses to cyberattacks, further development of cybersecurity standards and ICT certification schemes, more cybersecurity research, and innovation capabilities to autonomously secure the EU economy and critical infrastructures.

The development of 5G is expected to boost connectivity, with significant impacts on the maritime sector. The cybersecurity of 5G will be essential, and the recent communication “Secure 5G deployment in the EU—Implementing the EU toolbox” [72] offers references and guidelines.

3.3. Cyber Trends and Challenges

This chapter presents findings of some of the possible cyberattack trajectories on maritime-related systems for navigation, propulsion, and cargo, as well as shore-based systems. It has identified some areas where a special targeted effort is required to ensure cyber and information security [73].

3.3.1. Types of Cyberattack

There may be nothing new about the need for ships to deliver cargo or patrol their country’s coasts. However, the threats they are increasingly likely to encounter, invisible to any telescope, might place the maritime sector in uncharted waters [74]. According to Jones et al. [75], current threat implications of maritime-based cyberattacks include business disruption, financial loss, damage to reputation, damage to goods and environment, incident response cost, and fines or legal issues. For example, attackers could manipulate passenger lists, perform illegal activities (transports), breach sensitive cargo transports, cause engines failures, shut down vessels, or otherwise manipulate onboard control systems [74,76]. Bansal et al. [45] categorized the risks associated with an attack into three dependent factors: threats (who is attacking), vulnerabilities (the weaknesses they are attacking), and impacts (what the attack does).

There is a variety of methods that exist for those who seek to target the shipping industry [74,77]:

• Extortion/ransomware for allowing the vessel/port to restore operations;
• Digital piracy by shutting down the vessel/port;
• Espionage for gaining sensitive information that can be used by the competition;
• Defamation/litigation by causing ISPS Code noncompliance/delaying the vessel/causing disruption;
• Subversion of the supply chain;
• Terrorism;
• (H)Activism for conveying a message.

In the Danish Cyber and Information Security Strategy for the maritime sector, 2019–2022 [73], it is assessed that the general cyber threat is directed against maritime commercial businesses and does not currently pose a direct threat to maritime operations. The strategy on one side considers that the threat from cyber espionage and cybercriminals against the maritime sector is very high. In contrast, on the other side, it evaluates the threat from destructive cyberattacks, cyber activism, and cyber terrorism as low.

In the maritime domain, a rise in spear-phishing of vessels at sea has been noted. The BIMCO survey [78] presented several incidents where malicious software was introduced to ship systems unintentionally, often by third parties, to check or even update specific bridge equipment. Although the malware significantly degraded functionality of the onboard computer system, no essential vessel control system had been impacted [79]. Consequently, BIMCO’s survey [78] shows that maritime companies are increasingly not only assessing their own systems and work practices in a bid to limit the likelihood of an attack but are also assessing the risk introduced across their supply chain. Respondents have also noted that a company’s staff was its greatest cyber vulnerability; therefore, many cybersecurity measures remain firmly focused on reducing human error.

3.3.2. Ships Suffer Cyberattack

Ship onboard systems are susceptible to a cyberattack. There are reports [6,32,33,44,46,75,77,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93] in which significant weaknesses of these systems have been identified. Modern technologies have integrated IT (Information Technology) and OT (Operational Technology) onboard ships through networking and connectivity to the internet [2,22,27,94,95,96]. However, there is no real segregation between the IT and OT networks. Any person can come in on the OT side and penetrate the IT side. We are seeing this now. Our analysis showed that there were many reports issued regarding anonymous hackers trying to disrupt ships’ electronics/computers or to steal sensitive information. The impact of these kinds of attacks could be enormous. It has been noted that successful IT network hacks have their origins in the initial penetration of the OT system [2,22]. To gain remote access to the IT or OT systems, the satellite, 4G, or Wi-Fi connections of the vessel have to be breached [22,27,32].

Concerning security, time is a complicating factor. Technological vulnerability and its exposure change significantly during the lifetime of a vessel. The IT and OT will need dedicated technical improvements over time. The maintenance on IT and OT systems must be aligned with their dock-time, of course, or appropriate remote access management should be in place to ensure that only the vendor is able to perform updates [14].

According to the analysis in [73], there are three prevalent cyber and information security risks related to the maritime sector in general:

• Lack of timely response to technical vulnerabilities: A technology gap is identified between the IT and on ships and land-based systems. Land-based systems are usually better updated than the equivalent ship-based systems [97], which are, therefore, more susceptible to cyberattacks.
• No process in place for upgrades: There is a risk if the upgrading process of OT equipment does not match the standards associated with IT technologies.
• Securing critical systems: The potential consequences of a targeted attack to databases and registers based on older technology are lack of data integrity, loss of reputation, and a potential financial loss.

Two different experiments conducted by Svilicic et al. [98] and Hareide [6] demonstrated that cyberattacks against integrated navigational systems (INS), usually considered as an offline system, are relatively easily achievable. Disconnection from the internet prevents outside threats; however, the vulnerabilities arising from the unmaintained operating system could also be triggered by inside actors (the ship’s crew), either unintentionally or maliciously. With the INS connection to the internet, the cyber threats would rise to a critical level, demanding instant action [3].

According to the BIMCO survey [93], the most vulnerable systems onboard ships are positioning systems (GPS, AIS, Radar), ECDIS, engine control, and monitoring. Like AIS, GPS for civilian use is not encrypted or authenticated, and each has been identified as potentially vulnerable to attack.

ECDIS can be compromised in order to modify files and insert malicious content [6,99]. An ECDIS compromise can take over the whole INS or display the vessel in a false position. A cyberattack can mislead a ship as, for example, in 2016 when two naval ships were misdirected in the Persian Gulf [100]. Another example happened in February 2017. Cybercriminals reportedly took control of the navigation systems of a German-owned 8250 TEU container vessel. The crew attempted to regain control and had to bring IT experts on board to solve the situation. The case serves as a “pre-warning” about hackers’ abilities to gain control over the vessels to carry out, for instance, kidnap and ransom [101,102].

Another potential cyberspace vulnerability is the Voyage Data Recorder (VDR), from its connection to other ship systems that links to online services through satellite communications. However, the risks related to VDR weaknesses is, according to Kala [86], marginal, since VDRs do not directly control the movement of a vessel.

3.3.3. Offices Onshore

After the devastating cyber incident in June 2017 when the NotPetya malware attack, originating in Ukraine, infected the IT systems of the shipping giant Maersk and forced the company to shut down all devices and handle all operations manually, shipping offices onshore have realized that the shipping industry is not immune to cybercrime. Maersk was not explicitly targeted, and thus it was rather collateral damage. The attack resulted in significant interruptions to Maersk’s operations and terminals worldwide, costing them up to USD 300 million [6,77,79,103].

Another wake-up call for the maritime industry were two major cyber incidents reported in 2018. The first happened in July 2018 when COSCO Shipping Lines fell victim to a cyberattack. The company’s internet connection was disrupted within its offices in the Americas. After activation of COSCO’s contingency plans, operations were back to normal after five days. Being aware of what happened to Maersk, they had taken proactive steps to minimize their risk of a cyberattack. The second incident occurred in October 2018 when the Australia-based ferry and defense shipbuilder Austal was hit by a cyberattack that penetrated their data management systems. The attackers managed to steal internal data and offered some of it for sale on the dark web in an apparent extortion attempt [103].

Carnival Corporation was the latest to fall victim to a ransomware attack on its IT systems in August 2020. The cybercriminals managed to download certain data files related to guests and employees’ personal data, which could result in potential claims from guests, employees, shareholders, or regulatory agencies [104].

According to Hannemann [103], there are three key takeaways from these three cyberattacks. The first is related to IT hygiene, which is key to fighting cybercrime—a need to shift people’s mind-set towards IT security. Second, every shipping manager needs to approach cybersecurity as an integral part of overall safety management. Response and recovery plans should be in place, updated, and tested frequently. Third, there is no zero cyber risk environment today, since new cyber threats and vulnerabilities are constantly emerging. Despite all precautions, vulnerabilities remain in the systems and networks, and attackers are constantly trying to find new tools to break through cyber defenses.

3.3.4. Ports, Terminals, and Supply Chains

Ports are an integral node of maritime transportation and the land transport chain. They rely on information from both shipping lines and land-side logistics companies. The lack of clear standards and requirements addressing critical maritime infrastructure demonstrates a compelling need for standardized policies for assessing, containing, and mitigating cyber risks. Legacy IT systems and an expanding Internet of Things (IoT) contribute to making ports vulnerable [105]. Roughly half, only, of the world’s shipping ports understand or are aware of their problems and vulnerabilities concerning cybersecurity [59]. As valves in global economic arteries, the port infrastructures’ protection against cyber risks is an absolute imperative [97].

As for this infrastructure, critical systems (ship’s cargo handling, container tracking) may be penetrated, as occurred in the port of Antwerp where hackers gained access to the port’s terminal operating system and trafficked drugs [77]. Hackers working with drug-smuggling criminals infiltrated the computerized cargo tracking system to identify the shipping containers in which consignments of drugs had been hidden. The gang then drove the containers from the port, retrieved the drugs, and covered their tracks. The criminal activity continued for two years from June 2011, until it was stopped by investigative authorities [46,75].

Another example is the hacking into the Port of San Francisco when their Electronic Information System “moved” the port in cyberspace twenty miles north, which became problematic in the foggy weather [106].

The analysis showed that successful cyber penetration into the port infrastructure information system allows attackers movement or the theft of illicit cargo. This system is vulnerable and it is easy to see how it can be exploited by cybercriminals that will continue to do the unexpected [7,107]. We can be certain that the nature of attacks of this sort will evolve [46,73].

Aids to Navigation (AtoN) are an integral and critical part of marine infrastructure. Traditionally AtoNs have been physical objects such as lighthouses, buoys, and beacons. The introduction of virtual AtoNs that appear on AIS INS displays via the AIS communication system is an achievement of the modern digital era. Though still under development, virtual AtoNs play a vital role in enhancing navigational safety. The AIS system is not as secure as it should be and can, therefore, be disrupted by malignant action.

3.3.5. Jamming and Spoofing

This chapter presents the vulnerability of the Global Navigation Satellite System (GNSS) to jamming and spoofing activities of state and non-state actors that can cause significant damage to major economies and everyday consumers alike. GNSS refers to a space-based system such as the US Global Positioning System (GPS/NAVSTAR—a military capability which civilian use), Russia’s Global Navigation Satellite System (GLONASS), the European Union’s Galileo System (a civil project intended for civil government and commercial use), and China’s Beidou Navigation Satellite System. In addition, there are regional systems such as India’s Navigation Indian Constellation (NavIC) and Japan’s Quazi-Zenith Satellite System (QZSS).

GNSS Jamming is the deliberate transmission of signals on frequencies used by GNSS in an effort to prevent receivers from locking-on to authentic GNSS Signals. GNSS jamming requires relatively little technical knowledge and can be conducted by merely drowning out genuine signals with random or disruptive noise. GNSS Spoofing refers to the transmission of simulated false GNSS satellite ephemeris and timing information which coerces the victim receiver into calculating incorrect positioning and, in some cases, timing information [108,109,110]. GNSS spoofing is quite different from GNSS jamming. While navigation systems sound alarms when they recognize jammers, spoofing systems create false signals that confuse even state-of-the-art GNSS systems, leading to more severe consequences. To mitigate most of the vulnerabilities of one navigational system, it is recommended to use more of them [3].

The threat of GNSS spoofing has been known to the maritime industry for years. In 2017, the incident at Gelendzhik Airport received attention in international media. At least 20 vessels in the vicinity of the Black Sea Novorossiysk Commercial Sea Port reported that their AIS traces erroneously showed their position as Gelendzhik Airport, around 32 km inland. There were a large number of vessels involved, and all of the ships’ tracking systems placed them in the same nonsensical location. That led to informed speculation that the incident could be attributed to one of the space superpower states’ testing of satellite navigation spoofing technology. Whether it was as part of its electronic warfare arsenal or they were simply using it as an anti-drone measure for very VIP protection, it is somewhat suggestive that it was GNSS spoofing of defense development inflicted on a civilian scenario.

In his research, Bergman [87] has found ships in various parts of the world reporting locations thousands of miles away and circling at precisely 20 knots. It is unclear if these errors were the result of the ships’ AIS system or some fault or influence on GPS receivers, a real mystery of some form of GPS interference.

In another event, in July 2019, a British oil tanker, the Stena Impero, was seized by Iranian forces after being spoofed to cause the vessel to shift its course into Iranian waters. As a consequence, the vessel, cargo, and the crew had become more than pawns in a geopolitical war [111]. Many of the shipping companies operating ships in the region have also instructed their vessels to transit Hormuz only at high speed and during the daylight hours. Nevertheless, we should not forget that one-third of the world’s seaborne oil—some 17 million barrels per day—passes through the strait, making it one of the most important oil trading routes in the world.

AIS is a critical safety system designed to provide a ship’s position and course to neighboring ships to prevent collision [3]. The manipulation of the AIS system that was observed not long ago, on 3 December 2019, as illustrated in Figure 1, might have been spoofing.

An Italian AIS base station experienced a ship-spoofing situation near Elba Island that was visible in the European Maritime Safety Agency (EMSA) Maritime Application, SSN Ecosystem GUI [89]. The first investigation provided by the Italian Coast Guard indicated 870 different vessels were created at two different moments (13:13 and 13:28) with a duration of 3 min in the first transmission and 2 min in the second. All the tracks appeared in an area of 28 × 21 nautical miles between Elba Island and Corsica with different routes and speeds, rendering the monitoring of the maritime traffic in the area impossible and impacting real vessel transmissions.

At the Faculty of Maritime Studies and Transport, University of Ljubljana, we have thoroughly investigated the situation to support EMSA’s analysis and found 3742 fake ships (861 false tracks with MMSI 24480XXXX) that generated together 5133 reports, as illustrated in Figure 1. By using the European Marine Observation and Data Network (EMODnet) method [112], a traffic density map (TDM) is created by using ship positioning data collected from Terrestrial and Satellite AIS data sources, the maritime infrastructure, and the SafeSeaNet Ecosystem Graphical Interface (SEG) application. It showed, according to Perkovič [44], shipping density of up to 45 ships/km². The analyses pointed out that the AIS spoofing generator was located in the Elba Island area and that spoofing was conducted by a transmitter tuned onto AIS channel A, occupying around 54% of the available slots. Data were further processed to see whether it affected traffic safety. Only one vessel can be seen to have deviated slightly, although it cannot be proven that the change in course was due to the spoofing.

As evident through such examples, deliberate disruptions have affected shipping in international waters and engaged in innocent passage through territorial waters. Disorders to GNSS-enabled positioning and navigation have therefore become a global phenomenon, and to tackle a global problem, the GNSS community requires a global solution [35].

Another concern of the satnav community is related to the risks of being covertly tracked and of being exposed to malware through a satellite communication channel. The two-way communication that some GNSS systems now offer opens up that possibility. These risks have in particular been discussed in connection with the now officially operational BeiDou system [90,91].

3.3.6. Autonomous Ship

Remotely piloted and even more so autonomous marine vessels are going to revolutionize maritime operations and will be undoubtedly more vulnerable to cyberattacks [66,67]. Navigation issues and cyber risks should be taken into serious consideration by IMO when creating rules for autonomous shipping. It is expected that the maritime attack surface will continue to expand and autonomous ships will form a prominent piece of the future maritime landscape, underscoring the growing reliance on interconnected information systems [74,113].

3.3.7. Cyber and Social Media

Analysis has shown that there is a need to consider the impact of social media on the crew’s life at sea. The usage of social networking services can unintentionally cause many problems, such as the leakage of information on confidential shipping matters, diffusion of marine accident information, and the exposure of personal private information or photos [114]. Communication and socialization with the outside world, particularly with friends and family has become commonplace for the modern seafarer. From the perspective of the human element, cyber wellness is a critical component of their overall health and personal well-being. However, with that privilege also comes the responsibility to protect oneself and ensure that the ship’s safety and security are not compromised. These shared objectives are achieved by employing good personal cybersecurity practices [115].

3.3.8. Hybrid Threats

In recent years, the West and the world’s democratic societies have become increasingly exposed to hybrid threats. Hybrid threats are multi-faceted subversive or coercive activities that aim to undermine a state, frustrate its decision making processes, erode the trust in its institutions, stay below a threshold of detectability, and remain difficult to attribute. A threat is hybrid if it is part of a concerted set of mutually reinforcing actions. Hybrid threat campaigns are long-term and of varying intensity over time [70,116]. As a critical domain for economy, resources, trade, transport, security, and defense, the maritime domain, including ports, finds itself a target of hybrid threats [105]. The fact that much of the (maritime) critical infrastructure is privately owned complicates the construction of a strong and coordinated response to hybrid threats [117,118].

Cyberattacks are one of the main vectors of hybrid threats [117,119], and GNSS spoofing would also seem to be an attractive attack vector [118]. Foreign direct investments to gain ownership of critical infrastructure or technology (e.g., ports, hardware and software companies that supply the maritime industry) are part of the arsenal [119,120].

Since 2016, the EU and NATO have been cooperating on hybrid threats and cybersecurity [121], with these two topics prominently figuring in a common set of proposals [122,123]. In relation to that cooperation, the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) was set up in April 2017 in Helsinki to encourage strategic dialogue and carry out research and analysis on hybrid threats [124]. To this end, common exercises and workshops are carried out [125]. Following a closer look at hybrid threats versus sea lines of communication, the Hybrid CoE recently published a Handbook on Maritime Hybrid Threats [126].

Due to their low-level and dispersed nature, hybrid threats can only be fully recognized by bringing together the information about occurrences of disruptions that individually may seem minor but are part of a larger whole, thereby creating situational awareness [70]. The sharing of information on disruptions is therefore crucial, just like it is the case for cyberattacks outside the hybrid context. For adequate business continuity, operators should develop a resilience against hybrid attacks. The EU plans to identify sectoral hybrid resilience baselines [70]—one sector would be the maritime. Sectorial approaches, including maritime, are proposed in several other EU policies [127,128]. Risk analysis and enhancing of the overall resilience of EU critical maritime infrastructure with regard to cyber and hybrid threats, among others, are slated for action in the updated EU Maritime Security Strategy Action Plan [64]. A proper defense against hybrid threats requires all-of-society awareness and resilience [118,129,130].

3.3.9. Environmental Pollution

According to research, the side effects of disasters caused by a hacked port system or deluded onboard ship system could include environmental threats. The key to the security of the waterways is agility and constant paradigm-shifting to out-manoeuvre those who want to damage or disrupt the maritime transportation system (MTS) [69,131]. One might expect that cybercriminals, terrorists, and rogue states will, at some point, begin holding the environment to ransom—cyber-induced environmental pollution [2]. It is a possible scenario that hackers would over-ride ship systems in ports, open valves and initiate leaks, or dump hazardous materials, ballast water, fuel, or oil.

4. Discussion

Analyzing available resources, we may summarize that there are severe consequences posed by cybersecurity risks, ranging from ship accidents caused by hacking e-Navigation to massive operational and economic disruption, to a port or shipping companies’ activities and business. Cybercrime is a growing threat to the shipping industry that may have severe repercussions, as the Maersk, COSCO, Austal, Carnival, and other incidents have demonstrated. The present security situation in regard to hybrid threats further exposes the risk. As per BIMCO [78], it is not a question of whether an organization will be affected by a cybersecurity incident, but of when. Perhaps the organization has already been affected without knowing it. It is the connectedness of multiple and diverse systems that exacerbates the cyber risks, and connectivity will only continue to increase—e.g., with the introduction of the Internet of Things (IoT) and 5G in the maritime domain [59,67,132]. Therefore, maintaining the operational safety of these systems is of paramount importance. There continue to be numerous advancements in the field of hardware and software network security with which cyber administrators need to keep up. Though with the increased demand of the internet, it is only going to become more difficult; therefore, IT managers of maritime specialty may become necessities.

The maritime sector has always focused on safety and security issues, such as aspects of seafarer safety, transport, and cargo security. Now, the essence of navigational safety and maritime security include building a significant security culture which needs to be developed even further to include the cyber and information security domain, maritime cybersecurity. Maritime cybersecurity includes people, technologies, and processes capable of preventing cyber and information security breaches [73]. Hareide et al. [6] and Fitton et al. [133] note that maritime cybersecurity can be understood as a part of maritime security concerned with the protection from cyber threats of all aspects of maritime cyber systems that should include technology, information, and the human factor to understand and mitigate cyberattacks. Hasratyan et al. [59] mention the new concept of ‘cyber seaworthiness’ recently introduced in the shipping insurance industry.

Following the BIMCO 2020 survey [78], we found that there is room for improvement in regard to the human factor in maritime cybersecurity training that is seen by many as the first line of defense against the most common cyber incidents. The survey is quite encouraging, as 88% of respondents indicated that their company offers some sort of cybersecurity training; however, improvement is necessary, as only 22% of respondents received high-quality training. A 2020 ECSO report estimates that the maritime industry lacks 50,000 to 100,000 trained people in the cyber field [59]. It is a fact that cybersecurity training and awareness are paramount to the maritime industry. People need to be aware of the threats they encounter, not only on work IT systems but to their private devices as well. Training courses, refreshers, and adequate software protection should be offered and modified to fit the crews’ needs. The crew on the ships might rotate quite often, meaning that seafarers potentially often use systems they are unfamiliar with, which might increase the potential for human error.

It was noted, concerning technology and information, that a shift in mind-set is essential to direct more attention and resources toward cybersecurity [134,135,136]. In the event of the worst scenario, appropriate contingency plans should be in place. Such plans should also include the use of alternative modes to ensure safe and reliable operations in the cyber non-secure environment [75,137]. Manufacturers should also improve the cybersecurity of their products, not leaving critical shipping systems vulnerable to cybercriminals [60].

National defense forces are already in the hunt for alternate position, navigating, and timing (PNT) systems (to GPS) within two years. Even though military commanders would prefer equipment that does not need to rely on GPS because their current systems are increasingly being jammed or spoofed, the costly GPS III program is going to be developed in the USA. It will be designed to include improved anti-jam features, including the higher-fidelity M-Code signal for military users only [81]. In the meantime, the US Air Force is looking for solutions that could provide alternative signal sources that might even be from a non-US GNSS system. Lockheed U-2 high altitude reconnaissance jet pilots wear GPS-enabled smartwatches (Garmin D2 Charlie) for navigation backup in case their GNSS signal becomes unavailable [80]. Watches are capable of receiving multiple navigation signals including GPS, GLONASS, and BeiDou. Indeed, the combination of multiple GNSS systems in a smart receiver makes spoofing much more difficult, and now that Galileo is available worldwide, it is already used in over a billion smartphones [138]. The questions we might be asking here are

• Is it not a bit unusual that a superpower state does not have its alternative navigation system for their own defense forces in order not to rely on the signal sources of their rivals?
• Would it not be wise to develop and put into practice GPS-enabled smartwatches for mariners in case their GPS signal onboard becomes unavailable?
• Is there any viable non-GNSS alternative or backup system for vulnerable GPS navigation?

At this stage, we might find an answer only to the third question. IMO recognizes the need for multiple PNT systems onboard maritime vessels. However, there has been no widely available substitute system for GPS navigation, although, now Galileo is becoming a viable alternative. IMO has developed the e-Navigation concept to increase maritime safety and security via means of electronic navigation, based on (at least) two different independent sources of the PNT system to make it robust and fail-safe. The most viable terrestrial system providing PNT services that meets IMO’s requirements an enhancement of LOng-RAnge Navigation (LORAN)—eLoran. Not precisely as accurate as GPS, it can provide sub-5 m (in the Netherlands) to sub-10 m (in the United Kingdom) horizontal positioning accuracy. It meets the availability, integrity, and continuity performance requirements for maritime harbor entrance and approach manoeuvres, aviation non-precision instrument approaches, land-mobile vehicle navigation, and location-based services [83,84,85].

Galileo offers the Public Regulated Service (PRS) which is encrypted to protect against spoofing [139]. However, that is only available for use by authorities. However, in the near future, it will offer (free) Open Service Navigation Message Authentication (OS NMA) that will provide a low level of protection against spoofing, and a (paid) Commercial Authentication Service (CAS) that is encrypted like PRS—but for commercial use—while also providing higher accuracy [140].

Perkovic et al. [37,38,39] presented an impressive laser-based aid system for berthing and docking that is providing accuracy within 2 cm even when the GNSS satellite signal is obstructed by Ship to Shore (STS) cranes, or redirected. This system could be one of the core subsystems required for collision avoidance [141,142] of autonomous surface vessels, which still require solutions for a variety of technical problems [113].

The answer to the third question could eventually come about by a public–private partnership. Humphreys [143] predicts that companies such as Elon Musk’s SpaceX and Amazon’s Project Kuiper, maintaining networks with hundreds of low-Earth-orbit satellites, will eventually become a vital component of the GNSS ecosystem. The new GNSS will pick up the slack in the event of malfunctions or attacks.

5. Conclusions

To summarize, the importance of cybersecurity has been recognized, and there will be a series of new cybersecurity openings in the future through which hackers can attack if systems are not adequately protected. It is expected that cybersecurity challenges will expand as autonomous ships will form a prominent piece of the future maritime landscape, underscoring the growing reliance on interconnected information systems [74]. New, unexpected circumstances may lead to increased cyber risks, as the year 2020 is now seeing with COVID-19, with reports of 400 percent increase in attempted hacks since February 2020 [144]. Moreover, the global security landscape that gives rise to hybrid threats is not expected to improve soon.

The maritime industry has shown that it is neither immune to cyberattacks nor completely prepared to combat the risks involved in using some obsolete or modern digital systems. Maintaining seaworthiness given the impact of digital technologies requires robust cybersecurity policy/strategies, cyber-secure maritime technology, a shift in mind-set, and new insurance offers that specifically cover maritime cyber risks. A modest beginning is to have the right people on board and have established trust between maritime stakeholders. A company under attack must have the confidence to share the information with others in the sector, allowing them to bolster their defenses.

GNSS signals are indispensable to safe and efficient navigation and are an integral component of maritime operations. To interfere with them jeopardizes maritime safety and security at sea. This paper demonstrates the GNSS vulnerabilities that impact many maritime systems. The use of multiple GNSS constellations (public and private), intelligent processing on the receiver side, and encrypted signals will in the near future provide increased robust defense against jamming and spoofing. The paper also recommends that the maritime community implement an eLoran system as a terrestrial augmentation to space-based GNSS capabilities. Terrestrial signals could be coded and authenticated, further increasing security and, subsequently, safeguarding GNSS satellites by making them less attractive targets. Locally, the positioning systems can be complemented by the harbor’s laser-based aid system for berthing and docking, so that the regional shipping industry can be better protected from cyberattacks for the foreseeable future. As presented, building resilience against cybercriminals is a never-ending battle.