The U.S. Government Accountability Office (GAO) has released a report urging the Coast Guard to enhance its oversight of the Maritime Transportation System (MTS) to address shortcomings in maritime cybersecurity. The report, titled “Coast Guard: Additional Efforts Needed to Address Cybersecurity Risks to the Maritime Transportation System,” identifies critical vulnerabilities, gaps in oversight, and deficiencies in the agency’s approach to managing cyber risks.
The MTS plays a vital role in the U.S. economy, handling over $5.4 trillion in goods annually and supporting over 30 million jobs. Disruptions to port operations, whether from cyberattacks or other threats, could have severe consequences for global trade, supply chains, and national security. The study was conducted in response to provisions in the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023.
Why GAO Conducted This Maritime Cybersecurity Study
The MTS is a key component of the nation’s critical infrastructure. As the lead risk management agency for the sector, the Coast Guard is responsible for protecting it from cyber threats. The study assessed cybersecurity risks to the MTS, the Coast Guard’s oversight of industry cybersecurity measures, its strategic planning for cyber risk management, and its workforce competencies in addressing cyber threats.
GAO reviewed federal regulations, cybersecurity incident reports, and Coast Guard documentation from 2019 to mid-2024. Investigators also interviewed stakeholders at four major U.S. ports.
Findings: Maritime Cybersecurity Gaps
The GAO found that the MTS faces escalating cyber threats from foreign adversaries, criminal organizations, and insider risks. Key vulnerabilities include outdated technology, increased reliance on remote access, and insufficient cybersecurity protections.
Cyber Threats and Vulnerabilities
- Nation-state actors: China, Russia, Iran, and North Korea are actively targeting U.S. maritime infrastructure.
- Criminal organizations: Ransomware groups have already disrupted MTS operations.
- Hacktivists and insider threats: Individuals within organizations and ideologically motivated attackers also pose risks.
- Operational Technology (OT) weaknesses: Many vessels and port facilities rely on insecure OT systems that were not designed with cybersecurity in mind.
- GPS vulnerabilities: The maritime industry depends on GPS for navigation. Yet, jamming and spoofing attacks have disrupted vessel operations globally.
Coast Guard Maritime Cybersecurity Deficiencies
Despite its role in protecting the MTS, the Coast Guard lacks comprehensive cybersecurity oversight. The GAO found that:
- The Coast Guard does not maintain accurate data on past cyber incidents.
- Cybersecurity deficiencies identified during facility and vessel inspections are not consistently recorded in its case management system.
- The Coast Guard’s cybersecurity strategy does not fully align with key elements of an effective national strategy.
- The agency has not properly assessed or addressed workforce competency gaps in its cybersecurity staff.
Cyber Incidents Impacting U.S. Ports
The report highlights real-world cyber incidents affecting the MTS, including:
- 2017 NotPetya Attack: Russian hackers targeted global shipping company Maersk. This caused significant disruptions at U.S. ports.
- 2019 Ransomware Attack: A U.S. port facility was forced to shut down for 30 hours after hackers encrypted critical systems.
- 2024 GPS Spoofing: Over 100 cargo ships in the Mediterranean experienced GPS manipulation in a single day.
These events clearly demonstrate how cyberattacks to disrupt maritime operations, damage infrastructure, and threaten national security.
GAO’s Recommendations for the Coast Guard
To address these cybersecurity challenges, the GAO issued five recommendations:
- Improve Cyber Incident Tracking
- The Coast Guard should develop and implement procedures to accurately track cyber incidents affecting the MTS.
- Enhance Cybersecurity Deficiency Records
- The Coast Guard must update its case management system to provide better access to cybersecurity-related inspection findings.
- Strengthen Cybersecurity Strategy and Risk Assessments
- The agency should ensure its cybersecurity strategy addresses all key characteristics of an effective national strategy, including a full risk assessment.
- Assess Workforce Competency Gaps
- The Coast Guard should develop clear competency requirements for personnel responsible for MTS cybersecurity.
- Close Workforce Skill Gaps
- The agency should implement training and hiring initiatives to ensure its cyber workforce can effectively mitigate risks.
Next Steps: Coast Guard and DHS Response
The Department of Homeland Security (DHS) concurred with all GAO recommendations and committed to taking corrective actions. Planned steps include:
- Updating Coast Guard procedures for cyber incident tracking.
- Enhancing the agency’s Marine Information for Safety and Law Enforcement (MISLE) system for cybersecurity data management.
- Revising the Coast Guard’s cyber strategy to align with national standards.
- Conducting assessment of the workforce and implementing training programs.
Conclusion
The GAO report underscores an urgent need. The Coast Guard needs to strengthen its cybersecurity. Without accurate cyber incident tracking, better-defined cybersecurity strategies, and a more capable cyber workforce, the U.S. maritime industry remains vulnerable to devastating cyberattacks.
Other News: GAO Prods Feds to Assess Their Potential Response to Catastrophic Cyber Attacks (Opens in a new browser tab)
