Ports Are Cyber Infrastructure Now: Lessons from the 2024 Crane Security Warnings

Ports used to be thought of as concrete, steel and labour. In the past six months, governments have made it clear they now see ports as networks: cranes, terminal operating systems, gate automation and customs interfaces that can be disrupted from thousands of kilometres away. For port operators, logistics firms and investors, cybersecurity has moved from an IT line item to a condition of operating.

Three signals in six months

November 2023: Australia. On 10 November, a cyber intrusion forced DP World Australia to disconnect its terminals in Sydney, Melbourne, Brisbane and Fremantle from the internet. The operator handles close to 40% of the country's container freight. Operations were suspended for about three days, and roughly 30,000 containers backed up at the terminals. No ransomware was deployed. The disruption came from the shutdown needed to contain the breach.

February 2024: Critical infrastructure pre-positioning. In early February, U.S. and allied cyber agencies warned that state-sponsored actors had gained access to IT networks across critical infrastructure sectors, including transportation, with the apparent aim of being able to disrupt operations in a future crisis, not simply to steal data.

February 2024: Cranes. On 21 February, the U.S. issued an executive order giving the Coast Guard new authority over maritime cybersecurity, including mandatory reporting of cyber incidents and power to control vessels that present a cyber threat. A Coast Guard security directive now sets cyber risk requirements for Chinese-manufactured ship-to-shore cranes, which U.S. officials say may, depending on configuration, be controlled, serviced and programmed from remote locations. Washington paired the rules with more than US$20 billion of port infrastructure investment over five years, including support for restarting domestic crane production.

Why ports are uniquely exposed

• Operational technology everywhere. Cranes, straddle carriers, gates and reefer monitoring all run on connected control systems, many designed for reliability rather than security.
• Many hands on the network. Shipping lines, freight forwarders, customs brokers, rail and trucking firms all connect to terminal systems. Each interface is an entry point.
• Vendor remote access. Equipment makers often keep remote maintenance links. Those links are a security risk if nobody inventories, monitors and controls them.
• Concentration. A handful of operators handle most national throughput. The Australian incident showed how a breach at one company becomes a national supply chain event.

Last month's collapse of Baltimore's Key Bridge after a ship strike was not a cyber event, but it showed the same vulnerability: when one node in a port system fails, the costs spread across an entire regional economy.

Canada's direction

Canada's proposed critical cyber systems legislation (Bill C-26) would require federally regulated operators in sectors including transportation to establish cybersecurity programs and report incidents. Whatever its final form, Canadian port and logistics operators should expect obligations that converge with the U.S. and Australian models.

What this means for clients

• Inventory every connected asset. Know every crane, controller and vendor connection on your network, including what can be reached remotely and by whom.
• Segment IT from OT. A breach of corporate email should never be able to stop a crane.
• Rehearse the shutdown. The Australian operator's decision to disconnect quickly probably limited the damage. Have a tested plan for running degraded operations.
• Make security a procurement criterion. New equipment contracts should specify security architecture, patching obligations and remote-access controls.
• Factor cyber into valuation. For investors and lenders, a port's cyber maturity is now part of its risk profile.

Aquamerge works with infrastructure operators and investors on cybersecurity strategy for critical infrastructure. Through our R&D program, we are also developing AI-driven security technology for port environments.

Sources: The Maritime Executive, "US Increases Port Cybersecurity Citing Threat of Chinese Cargo Cranes" (21 Feb 2024); Carnegie Endowment, "Washington Tackles a New National Security Threat: Chinese-Made Cranes" (Feb 2024); White House press call on port cybersecurity (20 Feb 2024); ASIS International, "Cyberattack Disrupts Operations at Four Australian Ports" (Nov 2023); Bloomberg via TT News, "Australia Cyberattack Leaves 30,000 Containers Stuck at Ports" (Nov 2023).