News + Resources

The boarding on 21st August of the Galveston, Texas-bound oil tanker VL Prosperity by a combination of US Coast Guard and FBI agents, reportedly in response to an apparent Iranian cyberattack, is a significant validation of the more muscular approach to vessel cyber security practised by the US Coast Guard and reflected in the Maritime Transportation Security Act (MTSA).

Any vessel deemed to be posing a cyber threat can be boarded and/or detained, particularly if the vessel is heading towards or is already in US waters.

It remains to be seen whether the vessel, reportedly attacked on 7th August while transiting the Strait of Gibraltar, was subsequently rendered unseaworthy or otherwise unable to safely complete her voyage. What is clear is that the US authorities are taking no chances when it comes to protecting US ports and terminal infrastructure from a fully laden tanker whose systems may have been compromised.

The incident also highlights the importance of having cyber risk properly embedded within the Safety Management System (SMS), as required by the IMO’s cyber risk management requirements introduced from 2021.

If propulsion, fuel management or engine-control systems were compromised, there should be clearly identified procedures within the SMS for responding to the incident, maintaining safe navigation and managing the consequences.

The reported 14-day gap between the alleged attack and the boarding raises questions about how the incident was managed and whether the crew were able to fully resolve the problem. That said, the US Coast Guard has reportedly stated that the vessel was not unsafe to navigate, so it would be wrong to draw conclusions about her seaworthiness without more information.

To learn more about the boarding, visit: https://www.cbsnews.com/news/coast-guard-fbi-boarded-energy-tankers-cyberattacks-amy-grable-iran/

Three learnings:

• Have a plan for when you are attacked.
• Don’t assume your ships are immune.
• The US Coast Guard and FBI are taking maritime cyber security seriously.

This incident raises an important question: was the operative cyber incident caused by war or terrorism, rather than being merely malicious?

Astaara provides marine cyber solutions designed around the evolving cyber threats facing shipping. We know that significant incidents may arise from state sponsored activity or as part of a wider conflict, rather than from purely malicious acts.

Our cyber cover is designed to be agnostic to the underlying cause of a claim, providing coverage regardless of how the incident occurred.

To find out more about our marine cyber solutions, please contact our team.