The United States Coast Guard has exposed how China is using giant ship-to-shore (STS) container cranes to spy on “the maritime elements” of its national transportation system.
The development shines the spotlight on the owners and operators of over 200 Chinese-made container cranes at U.S. ports, who will now be subject to new cyber-risk management requirements aimed at reducing China’s ability to spy on the country’s domestic supply chains.
The U.S. Coast Guard on Wednesday announced that owners or operators of made in China STS container gantry cranes may now obtain copies of Maritime Security Directive 105-4, which spells out required cyber-risk management actions related to the cranes.
The Coast Guard said the directive contains security-sensitive information, which will not be made available to the general public.
The Coast Guard explained in the notice that the prevalence of such cranes around the country — and the technology that comes with them — is the motivation behind the directive. STS gantry cranes manufactured by the China account for nearly 80% of the STS cranes at U.S. ports.
“By design, these cranes may be controlled, serviced, and programmed from remote locations, and those features potentially leave PRC [People’s Republic of China]-manufactured STS cranes vulnerable to exploitation, threatening the maritime elements of the national transportation system.
“As such, additional measures are necessary to prevent a security incident in the national transportation system due to the prevalence of PRC-manufactured STS cranes in the U.S., threat intelligence related to the PRC’s interest in disrupting U.S. critical infrastructure, and the built-in vulnerabilities for remote access and control of these STS cranes,” it said.
At a White House briefing on Tuesday, Coast Guard Rear Adm. John Vann, who heads the agency’s cyber command, said that his teams have “assessed cybersecurity or hunted for threats” on 92 of the cranes so far.
“Those assessments determine the cybersecurity posture, and the hunt missions actually look for malicious cyber activity on the cranes. We’ve almost canvassed about 50% of the existing cranes,” Vann said.
The Coast Guard’s new requirements are part of a major initiative announced by the White House on Wednesday broadening the agency’s powers to address cybersecurity risks at U.S. ports as terminal operations rely increasingly on automation.
An executive order signed by President Joe Biden gives the Coast Guard the authority to control the movement of vessels suspected of being cyberthreats to U.S. maritime infrastructure, along with the authority to inspect suspicious vessels and facilities. In addition, reporting of cyber incidents by vessels, ports and terminals operators — which so far has been voluntary — will become mandatory.
Copyright Ships & Ports Ltd. Permission to use quotations from this article is granted subject to appropriate credit given to www.shipsandports.com.ng as the source.