attacks
2 and also the extent of liabilities they could potentially face in those
instances.
3 This trend inevitably focuses the debate on the availability of insurance
against cyber risks and the scope of such coverage.
After setting out the vulnerabilities in the maritime sector against cyber risks and
factors unique to the sector that enable cyber attacks, this paper intends to: (1) provide an overview of coverage provided against cyber risks in the insurance market;
(2) offer a critique of such coverage and exclusions that are often incorporated into
policies; and (3) discuss the changes that need to be implemented in standard
contracts/clauses so as to provide a more satisfactory coverage for shipping corporations against cyber risks.
2 Cyber Risks in the Maritime Sector
2.1 Risks Posed for Shipping Companies
A maritime cyber risk can be defined as “the extent to which a technology asset is
threatened by a potential circumstance or event, which may result in shipping-related
operational, safety or security failures as a consequence of information or systems
being corrupted, lost or compromised.”
4 Cyber risks in the maritime sector can stem
from a variety of sources. Whilst shipping companies could at times be the victim of
collateral damage,
5 in most cases cyber attacks are carried out by external bodies
either to achieve financial gain or to eliminate commercial competition.
2 In July 2018, COSCO Shipping Lines confirmed that it was hit by a cyber attack impacting its
Internet connection within its offices in the Americas. The company was successful in isolating its
internal networks across its global operations; and as a result, even in the United States, Canada, and
South America, cargo handling at its marine terminals was largely unaffected.
3 In 2017, A.P. Moller Maersk, one of the largest container shipping companies, became the victim
of a cyber attack which used a modified version of the Petya ransomware (NonPetya) to bring down
IT systems and operational controls across the board. The attack caused a serious business
interruption, and the cost to the company was reported to be around $300 million.
4 See, Guidelines on Maritime Cyber Risk Management, published by the International Maritime
Organisation (IMO) on 5 July 2017 (MSC-FAL.1/Circ.3) (can be accessed at: http://www.imo.org/
en/OurWork/Security/Guide_to_Maritime_Security/Documents/MSC-FAL.1-Circ.3%20-%
20Guidelines%20On%20Maritime%20Cyber%20Risk%20Management%20%28Secretariat%29.
pdf (last tested on 31 December 2018)).
5 It has been reported that the Global Positioning System (GPS) of several commercial vessels
operating in the Black Sea were jammed during the conflict between Ukraine and Russia in 2017.
These actions were blamed on Russian hackers targeting Ukrainian assets, but as of today these
allegations have not been proven. Similarly, various GPS spoofing incidents around the same time
were treated by some as part of the Russian State testing new cyber weapons (see: https://www.
newscientist.com/article/2143499-ships-fooled-in-gps-spoofing-attack-suggest-russiancyberweapon/ (last tested on 31 December 2018). A GPS spoofing attack attempts to deceive a GPS
receiver by broadcasting incorrect GPS signals, structured to resemble a set of normal GPS signals,
or by rebroadcasting genuine signals captured elsewhere or at a different time.
628
B. Soyer
2 and also the extent of liabilities they could potentially face in those
instances.
3 This trend inevitably focuses the debate on the availability of insurance
against cyber risks and the scope of such coverage.
After setting out the vulnerabilities in the maritime sector against cyber risks and
factors unique to the sector that enable cyber attacks, this paper intends to: (1) provide an overview of coverage provided against cyber risks in the insurance market;
(2) offer a critique of such coverage and exclusions that are often incorporated into
policies; and (3) discuss the changes that need to be implemented in standard
contracts/clauses so as to provide a more satisfactory coverage for shipping corporations against cyber risks.
2 Cyber Risks in the Maritime Sector
2.1 Risks Posed for Shipping Companies
A maritime cyber risk can be defined as “the extent to which a technology asset is
threatened by a potential circumstance or event, which may result in shipping-related
operational, safety or security failures as a consequence of information or systems
being corrupted, lost or compromised.”
4 Cyber risks in the maritime sector can stem
from a variety of sources. Whilst shipping companies could at times be the victim of
collateral damage,
5 in most cases cyber attacks are carried out by external bodies
either to achieve financial gain or to eliminate commercial competition.
2 In July 2018, COSCO Shipping Lines confirmed that it was hit by a cyber attack impacting its
Internet connection within its offices in the Americas. The company was successful in isolating its
internal networks across its global operations; and as a result, even in the United States, Canada, and
South America, cargo handling at its marine terminals was largely unaffected.
3 In 2017, A.P. Moller Maersk, one of the largest container shipping companies, became the victim
of a cyber attack which used a modified version of the Petya ransomware (NonPetya) to bring down
IT systems and operational controls across the board. The attack caused a serious business
interruption, and the cost to the company was reported to be around $300 million.
4 See, Guidelines on Maritime Cyber Risk Management, published by the International Maritime
Organisation (IMO) on 5 July 2017 (MSC-FAL.1/Circ.3) (can be accessed at: http://www.imo.org/
en/OurWork/Security/Guide_to_Maritime_Security/Documents/MSC-FAL.1-Circ.3%20-%
20Guidelines%20On%20Maritime%20Cyber%20Risk%20Management%20%28Secretariat%29.
pdf (last tested on 31 December 2018)).
5 It has been reported that the Global Positioning System (GPS) of several commercial vessels
operating in the Black Sea were jammed during the conflict between Ukraine and Russia in 2017.
These actions were blamed on Russian hackers targeting Ukrainian assets, but as of today these
allegations have not been proven. Similarly, various GPS spoofing incidents around the same time
were treated by some as part of the Russian State testing new cyber weapons (see: https://www.
newscientist.com/article/2143499-ships-fooled-in-gps-spoofing-attack-suggest-russiancyberweapon/ (last tested on 31 December 2018). A GPS spoofing attack attempts to deceive a GPS
receiver by broadcasting incorrect GPS signals, structured to resemble a set of normal GPS signals,
or by rebroadcasting genuine signals captured elsewhere or at a different time.
628
B. Soyer