US targets Chinese-made container cranes in spy crackdown

“By design, these cranes may be controlled, serviced, and programmed from remote locations, and those features potentially leave PRC [People’s Republic of China]-manufactured STS cranes vulnerable to exploitation, threatening the maritime elements of the national transportation system,” the Coast Guard warned.

“As such, additional measures are necessary to prevent a [security incident] in the national transportation system due to the prevalence of PRC-manufactured STS cranes in the U.S., threat intelligence related to the PRC’s interest in disrupting U.S. critical infrastructure, and the built-in vulnerabilities for remote access and control of these STS cranes.”

At a White House briefing on Tuesday, Coast Guard Rear Adm. John Vann, who heads the agency’s cybercommand, said that his teams have “assessed cybersecurity or hunted for threats” on 92 of the cranes so far.

“Those assessments determine the cybersecurity posture, and the hunt missions actually look for malicious cyberactivity on the cranes,” Vann said. “We’ve almost canvassed about 50% of the existing cranes,” he added, but did not state whether security concerns were discovered on those cranes.

A related advisory by the U.S. Maritime Administration, also issued on Wednesday, points out that China’s ZPMC (Shanghai Zhenhua Heavy Industries Co. Ltd.) has the largest share of the STS crane market worldwide, by sales revenue.

“These cranes may, depending on their individual configurations, be controlled, serviced, and programmed from remote locations. These features potentially leave them vulnerable to exploitation,” the advisory states.

The advisory lists guidance and mitigation measures for ports, vessel operators and shippers for protecting data at risk of being hacked in a cyberattack.

Part of larger maritime cyberagenda

The Coast Guard’s new requirements are part of a major initiative announced by the White House on Wednesday broadening the agency’s powers to address cybersecurity risks at U.S. ports as terminal operations rely increasingly on automation.

“These systems have revolutionized the maritime shipping industry and American supply chains by enhancing the speed and efficiency of moving goods to market, but the increasing digital interconnectedness of our economy and supply chains have also introduced vulnerabilities that, if exploited, could have cascading impacts on America’s ports, the economy, and everyday hard-working Americans,” according to a White House fact sheet.

An executive order signed by President Joe Biden gives the Coast Guard the authority to control the movement of vessels suspected of being cyberthreats to U.S. maritime infrastructure, along with the authority to inspect suspicious vessels and facilities.

In addition, reporting of cyber incidents by vessels, ports and terminals operators — which so far has been voluntary — will become mandatory.

“Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility, including any data, information, network, program, system, or other digital infrastructure thereon or therein, shall be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives,” the executive order states.

Additional cybersecurity requirements for U.S.-flagged vessels, ports and container terminal operators, including minimum requirements for cybersecurity plans, are part of a Coast Guard proposed rule published on Wednesday.

Related articles:

• China in crosshairs of new ocean shipping reforms
• Supply chain pain may lurk in container crane bill
• House passes defense bill with ban on Chinese shipping platform
• FMC commissioner red-flags Congress on China’s container monopoly

Click for more FreightWaves articles by John Gallagher.