Maritime Cybersecurity: A Legal and Risk Perspective

September 19, 2016

Kate B. Belmont Blank Rome LLP The Chrysler Building NY, NY 10174 (212) 885-5075 KBelmont@BlankRome.com

2

• The information presented here is provided as a courtesy by Blank Rome LLP.

• It is not intended as substitute for professional legal advice.

• If you have, or suspect that you may have a legal problem, you should consult your lawyer to obtain legal information and recommendations specific to your problem.

WHAT IS CYBERSECURITY? • Cybersecurity is information security (i.e., computer security)

– Computer networks, smart phones, computers

– Theft and manipulation of information, attacks on computer systems

EX: OPM, Houston Astros, Ashley Madison, U.S. Law Firms, Celebrity email accounts/pictures, Jeep, T-Mobile, SWIFT System, WADA

3

• There are only two types of companies:

– Those who have been breached, and

– Those who have, but don’t know it

4

5

6

The maritime industry is 20 years behind the curve compared to office-based computer systems, and competing industries worldwide: 2011: ENISA REPORT (European Network and Information Security Agency)

2014: GAO REPORT(U.S. Gov’t Accountability Office) 2015: U.S. Coast Guard Cybersecurity Initiative

2016: (1) “The Guidelines on Cyber Security Onboard Ships” (BIMCO, CLIA, ICS, Intercargo, and Intertanko) (2) MSC 96 – “Draft Guidelines on Maritime Cyber Risk Management” (3) ABS CyberSafety Program

7

• Systems on board vessels (communication, navigation, loading)

• Navigation data “in the cloud” • Systems at major ports • Mainland computer systems at maritime companies

• Laptops (work and personal) • Smart phones (work and personal) • USB keys

8

PORT SECURITY • Port of Antwerp

•  Between 2011-2013, organized criminals breached the port IT system, facilitated heroin and cocaine smuggling

• Port of Oakland (2016) •  Denial of service attack •  Believed to be Russian in origin •  Administrative site targeted, did not affect the port’s

transportation servers

9

PIRACY • Enrico Ievoli (2011) (Piracy evolving)

–  Carrying caustic soda from Persian Gulf to Med –  Italian mafia commissioned pirates: premeditated, knew

itinerary, cargo, crew, location, no armed guards –  Online information

• Pirates Hack Shipping Company (2016) •  Global shipping company hacked by pirates for several

months •  Pirates would board a vessel, locate by bar code specific

sought-after crates containing valuables, steal that crate (and that crate alone), and depart without incident

•  Specific, targeted attacks 10

EMAIL CYBER-SCAMS Bunkering Sector: -  Bunkering community targeted frequently – often industry

insiders (over-reliant on email communications) -  Impersonate seller, send an email requesting payment be made

to a different account = funds sent into scammer’s account

• World Fuel Services, 2014 ($18 million loss)

• Limassol-Based Shipping Company, 2015 ($644,000)

• Broker’s Email Account Hacked, 2016 ($500,000)

• Charterer’s Email Account Hacked, 2016

• Nautilus Minerals, 2014 ($10 million) 11

PHISHING / SPEAR-PHISHING CAMPAIGNS - China’s People’s Liberation Army targeting marine shipping providers - Spoof emails target companies to secure access to confidential data

12

2015 U.S. Coast Guard Cybersecurity Initiative: January 15, 2015: “Guidance on Maritime Cybersecurity Standards”

- Public meeting, open to maritime industry June 2015: USCG “Cyber Strategy”

- USCG approach to defending cyberspace: risk assessment, risk management

- framework for the USCG’s plan to operate within the cyber domain

U.S. Coast Guard Maritime Cyber Bulletins: Late November/December 2015: Increased attacks against compromised web servers (reported by maritime port partners)

December 2015: Spoofed business e-mails used against a U.S. port facility

January 2016: Vulnerabilities associated with Furuno Voyage Data Recorders (VDRs) (weak encryption, flawed firmware update mechanism) March 2016: Spike in ransomware infections, targeting maritime industry

13

(January 2016 - BIMCO, CLIA, ICS, Intercargo and Intertanko)

Cyber security guidelines for onboard ships: 4 Main Points:

1. Understanding cyber threats;

2. Assessing the risks of cyber threats;

3. Reducing the risks; and,

4. Developing contingency plans and responding to cyber incidents.

14

High-level recommendations for maritime cyber risk management: 1. Risk management is fundamental to safe and secure shipping operations 2. The risks associated with cyber are not independent of the current range of physical risks and an integrated approach to deal with both is required 3. Technical standards alone will be insufficient in addressing the risk (need risk management) 4. Effective Risk Management:

- start with senior management level - cyber risk requires holistic/flexible approach (continuously reviewed) - cyber assessments should be conducted

5. These guidelines are intended for ALL organizations in the shipping industry: - no two organizations are the same - limited cyber-related systems v. complex cyber-related systems (will require greater level of care)

15

-  Significantly expands on the release of ABS cybersecurity guidance released earlier this year (5 comprehensive volumes)

-  First comprehensive cybersecurity certification and optional notations for marine and offshore assets and facilities

-  Provides actionable guidance for addressing and assessing cyber-enabled systems that emphasize human, systems and environmental safety

Volume 1: The Application of Cybersecurity Principles to Marine and Offshore Operations Volume 2: Cybersecurity Implementation for the Marine and Offshore Industries Volume 3: Data Integrity for Marine and Offshore Operations Volume 4: Software Systems Verification Volume 5: Software Provider Conformity Program

16

• Legal liability for a “spoofing” or “jamming” accident is uncertain:

- Will depend on facts - What measures in place to detect breach and prevent accident?

NEW ISSUE: Whether a vessel ridden with viruses is seaworthy?

17

CYBER RISK IS REAL! CYBER ATTACKS ARE HAPPENING! THE MARITIME INDUSTRY IS A TARGET!

•  The consequences are potentially catastrophic

•  Protections are available

•  Be smart: protect yourself, your company, your port, your crew and your country!

18

19

Kate B. Belmont Blank Rome LLP (212) 885-5075

KBelmont@BlankRome.com www.BlankRome.com/cybersecurity