The following are a set of FAQs which further interpret Government guidance on Covid-19 for the Maritime Sector.

This information is issued via UK Government departments.  PSS is providing a platform to share the information as widely as practicable so that readers can make informed decisions.  The FAQs are correct at the time of posting.  However, this is a living document which is being routinely updated by government health experts as information emerges.  We will endeavour to keep it up to date, but the reader should check that they are referring to the latest version.

This is version 8, dated 9 July 2020.

Summary of principles

• Recent experience has shown that it is not possible to self-isolate on ships without the risk of continuing transmission
• PHE advice is to get people off ships wherever possible if COVID 19 is suspected
• The same guidance applies as onshore; seriously ill people go to the hospital, mildly ill and contacts self-isolate ashore
• For cases, contact the HPT (in England) for advice on appropriate accommodation
• For those crew members who have been in contact with a case ask the operators to arrange shore-side accommodation for self-isolation. HPT should be able to assist with this however ultimately the responsibility of crew welfare rests with the Master and ship owner
•  Health and safety of the crew takes priority over berthing or mooring vessels

Update: Quarantine rules for arrivals into the UK commence on Monday 8th June. Persons entering the UK, including Britons, need to self-isolate at home for 14 days, except those coming from the Common Travel Area or in exempt category.

LINK

Face-coverings

• The Government’s Our plan to rebuild, May 2020, p27 now advises “that people should aim to wear a face-covering in enclosed spaces where social distancing is not always possible and they come into contact with others that they do not normally meet”

UK GOVERNMENT COVID-19 RECOVERY STRATEGY

Guidance for operators and passengers

COVID-19 SAFER TRANSPORT GUIDANCE FOR OPERATORS

FAQs

Q1 Is there general guidance for the maritime industry to deal with Covid-19?

A Yes

GOV UK GUIDANCE FOR SHIPPING AND SEAPORTS ON COVID-19

CORONAVIRUS (COVID-19): SAFER TRANSPORT GUIDANCE FOR OPERATORS

Q2 Does this guidance cover all maritime situations?

No. The above guidance sets out general principles, but because the maritime industry is so diverse, each incident will need to be assessed on a case by case basis. In England, the local Health Protection Team (HPT) will advise (similar but separate arrangements apply elsewhere in the UK)

Q3. Can a ship with suspected or confirmed COVID-19 cases dock at a UK port?

Yes. The master should send a Maritime Declaration of Health to the PHA with details of illness on board and the PHA/LA will advise, in consultation with the local public health authority. In England, the local HPT will advise (similar but separate arrangements apply elsewhere in the UK). The ship’s owner/operator/crew manager and P&I Club should all be notified by the Port Agent. The local Health Protection Team, in consultation with the Master, will advise if the crew member can safely remain on board in isolation or if shore treatment is required

Q4. Can a pilot join a ship with suspected or confirmed COVID-19 cases on board?

Yes. Specific guidance has been issued for them (see Annex 1 below. This guidance covers PPE and social distancing. Pilots do not need to self-isolate after boarding a ship with suspected COVID-19 cases on board, as these individuals with suspected cases should be isolated in their cabins. From May, see advice on face-coverings (p1). As such, pilots and others in close contact are advised to wear face coverings. Otherwise, there is no change in PPE advice. Ships arriving in UK waters have no right to insist on pilots wearing additional PPE

Q5 What is a sensible level of PPE for marine Pilots boarding a vessel with a suspected case of COVID-19 on board?

Suspected cases should be isolated in their cabins. Pilots should adopt straightforward precautions such as the use of heavy gloves. Government guidance now advises face coverings (p1). Additional PPE, such as overshoes, is not required and may cause other safety issues (e.g. ascending / descending ladders). The most effective safeguard against inadvertent transmission of virus, such as through changing boots, using handrails etc. is thorough handwashing or the use of sanitising hand gel (minimum 60% alcohol content) and minimising hand to face contact. All efforts should be made to maintain 2m distancing, but it is accepted that might not be possible, e.g. on ship’s bridge. In such circumstances common sense should be used e.g. keep symptomatic people or close contacts off the bridge. There is no evidence to confirm that heating, ventilation or air conditioning systems are conduits of COVID-19. As Q4, Ships arriving in UK waters have no right to insist on pilots wearing additional PPE

Q6. What is the risk of transmission of COVID-19 on board from air conditioning or sewage treatment systems?

Not yet known but is unlikely to be significant compared with contamination of surfaces from droplets. The wearing of overshoes is not recommended (they pose a greater safety hazard).

Q7. Does a ship with suspected or confirmed COVID-19 cases on board need to be quarantined?

No. The ship should be allowed to dock as usual. This will allow easy access for affected individuals on board to be removed on shore if required and public health staff to board if required. If the ship is unable to leave the port, it can then be moved to a different anchorage if the berth is required for another ship.

Q8. Should a ship with suspected or confirmed COVID-19 cases on board be treated as a household?

No. Individuals who are confined to their cabins should follow the same guidance as those confined at home. This does not mean that everyone on board automatically has to self isolate for 14 days. As the living conditions on different ships vary widely, each case will be considered individually. In England, the local HPT will advise (similar but separate arrangements apply elsewhere in the UK).

Q9. What should happen to suspected or confirmed cases of COVID-19 on board?

In port, the same guidance applies as for domestic cases. At present, only seriously ill cases should be transferred to hospital (as an urgency). The local HPT will advise on ambulance transfer (similar but separate arrangements apply elsewhere in the UK). Symptomatic individuals who are not seriously ill should ideally be transferred for care ashore, if this is available, but may need to be confined to their cabins on board if this is feasible. They should self-isolate for 7 days. At sea, individuals who are confined to their cabins should follow the same guidance as those confined at home. This does not mean that everyone on board automatically has to self-isolate for 14 days. As the living conditions on different ships vary widely, each case needs to be considered individually.

Q10. What should happen to asymptomatic contacts of suspected or confirmed cases of COVID19 on board?

Given the close proximity of living conditions on board the majority of ships, it is usually more problematical to identify close contacts compared those with a lower likelihood of exposure, depending on the size and configuration of the ship. As with domestic cases, close contacts should self-isolate for 14 days, ideally ashore but on board if unavoidable, bearing in mind the likelihood of contacts becoming symptomatic and contributing to continuing transmission on board.

Q11. Is testing available for people on board a ship with suspected COVID-19 symptoms?

The situation with testing is changing progressively as the capability is ramped up. At present, in England, key workers are now eligible for testing, but tests need to be booked and there are issues about access to testing sites. There are, as yet, no specific arrangements for mariners. Different arrangements may apply elsewhere in the UK.

COVID-19 GETTING TESTED GUIDANCE

Key workers who may be tested in the transport sector include

• those who keep the air, water, road and rail passenger and freight transport modes operating during the coronavirus response
• those working on transport systems through which supply chains pass

Q12. What is the current view of the reliability of testing?

There are two types of test:

• Antigen – ‘do I have COVID?’ – requires a mouth swab which needs to get sent away to a laboratory for processing (polymerase chain reaction, PCR). It takes 24-48 hours to get a result. There is no quicker way and adverts for ‘6-hour test results’ are not reputable or reliable.
• Antibody – ‘have I had COVID?’ – several different tests are in process of being evaluated in NHS trials. Unfortunately, there are problems with the interpretation of the results, in particular there is no assurance that a positive test confirms immunity. It will take some time to get production of the valid antibody test in quantity and the strategy for its use has not yet been promulgated. In the meantime, there is no indication of its use in the port setting. There are a number of companies promoting ‘rapid point-of-care’ testing kits. The current view by PHE is that the use of these products is not advised.

TESTING GUIDANCE

As the Chief Medical Officer has commented, “a bad test is worse than no test”. Also, the current view is that thermal monitoring / temperature screening is unlikely to be an effective screening tool on its own. It is not recommended by the UK science advisory group and is not being utilised at airports.

Q13. What assistance is available to a vessel with COVID-19 on board?

See Q9. The Port Agent should assist co-ordinating any medical care for the crew ashore

Q14. If a crew member comes ashore and has to recuperate ashore after being discharged from hospital, is there accommodation available for this to happen?

Is there a central list of suitable accommodation? The LRFs may be able to advise about suitable facilities through their liaison with the local hospitality sector. However, these are likely to be limited. There are some facilities available for accommodating key workers who need to travel or transit and workers who need accommodation post discharge.

Q15. The ship owner/operator/crew manager would obviously be looking to send urgently a replacement crew member, so the ship can depart port. Does the UK have any plans for crew change arrangements and what would be the requirements?

The UK is currently considering what measures may be necessary for relief crew arriving in the UK prior to joining the vessel.

Q16. If a ship leaves port with a suspected case of COVID-19 on board, how can it be ensured that it will not affect others on board?

This needs to be carefully assessed on a case-by-case basis with the PHE HPT prior to sailing. It is preferable that cases, or suspected cases, do not remain on board, but there may be circumstances where this is essential, and the health of affected individuals is not being put at risk (i.e. either a very mild illness or someone testing positive who is asymptomatic). In such circumstances, suspected cases should self-isolate. Also, the length of the proposed journey is important – short voyages will be less risky than long ones and ships with small crews may be more vulnerable to safety being compromised than larger ones. In making a decision to sail, consideration must include realising that though self-isolation may reduce the likelihood of transmission to others, it will not eliminate it completely.

Q17. Are there any plans to introduce thermal screening at ports?

Not at present. Current advice is that this is unreliable, as some cases of Covid-19, or presymptomatic individuals incubating the disease, do not have a fever.

Q18. Can crew from ships with suspected or confirmed COVID-19 cases on board be allowed ashore?

Providing they are not close contacts, they should be allowed ashore for limited exercise and essential shopping, as long as they observe the same social distancing precautions as the rest of the community. https://www.gov.uk/government/publications/covid-19-guidance-on-social-distancing-andfor-vulnerable-people

Q19. Does social distancing guidance apply to both large and small ports?

Yes. See Q18 above.

Q20. Does social distancing guidance apply to off-shore wind-farm and offshore oil & gas vessels?

Yes, insofar as it is possible to. Specific guidance has been produced by Health Protection Scotland.

OFF-SHORE GUIDANCE – SCOTLAND

There is additional guidance on practising social distancing, which provides further details for employers and employees:

STAY SAFE AT HOME GUIDANCE

and

EMPLOYER GUIDANCE

This should help organisations, agencies and others (such as self-employed transport providers) understand how to provide safer workplaces and services for themselves, their workers and passengers across all modes of private and public transport. It outlines measures to assess and address the risks of coronavirus (COVID-19) in the transport sector across England.

SAFER TRANSPORT GUIDANCE

Workplaces should follow guidance published by BEIS on safe workplaces and follow the legal obligations they have under Health and Safety legislation to protect their staff at work. Additionally, workplaces may have specific guidance for protective equipment. The information on face coverings does not replace those workplace recommendations. Workers are advised to follow the specific guidance for their place of work.

WORKING SAFELY GUIDANCE

Q21. Will PHE (or similar public health authorities elsewhere in the UK) advise on safe manning levels for a ship to leave port?

No. This is not within public health area of competence.

Q22. What input does PHE have in the HSE Guidance on Reporting of Injuries, Diseases and dangerous Occurrences Regulations (RIDDOR)

Not known. All queries about the interpretation of these regulations should be made to HSE.

Q23. Is it against international law for a ship to sail with COVID-19 cases on board?

No. There is no applicable international law; there are the International Health Regulations 2005, but their status is as a treaty between Member States. There is, however, a moral obligation to prevent onward transmission to other countries. PHE HPTs will advise on measures to prevent onward transmission on a case-by-case basis.

Q24. What legislation is in place to address the transmission of disease via the maritime sector?

The Public Health (Ships) Regulations 1979, as amended 2007 In addition, the WHO published interim guidance in February 2020.

WHO INTERIM GUIDANCE

Q25. How is a vessel with an infectious disease stopped from departing port?

Following a meeting with PHE on 21st April, PHE advised that, legally, there were no grounds which could be imposed by them for preventing a vessel from departing from port. This would need to occur in co-operation between PHE and the Harbour Master and/or MCA. In the case of MCA, the only grounds for preventing a vessel departing from port would be by issuance of a prohibition notice or, more likely, a preventative detention. However, it should be noted that an MCA detention could only be issued where a vessel was found to be in breach of the Merchant Shipping Act. Therefore, it is foreseen that the MCA could only prevent a vessel departing port for reasons on Minimum Manning either because the Minimum Safe Manning of the vessel could not be maintained, or the vessel could not continue to operate, in the opinion of the MCA in consultation with the vessel’s Flag State, in a safe manner.

Q26. Is a vessel only stopped when a confirmed case is identified; or when a suspected case is identified?

The presence of COVID-19 on board, whether confirmed or suspected does not prevent a ship from leaving port, unless the criteria in Q25 are met.

Q27. What happens if crew member(s) had to come ashore and the ship no longer meets the minimum manning requirements?

The MCA would want to be informed if a seafarer is removed from a vessel and a replacement member of could crew could not join the vessel. In discussion with vessel’s agent/Master the MCA would request a copy of the Minimum Safe Manning Document and also a crew list. The MCA would then, probably in consultation with the vessel’s flag state, determine if the vessel can continue its voyage safely.

Q28. Where a vessel is stopped from departing port, whom will be responsible for the welfare of those onboard both with the virus (suspected or otherwise) and without?

The welfare of the entire crew will be the responsibility of the Master/owner/operator/agent. The PHA and local HPT will need to be advised of the situation regarding confirmed or suspected cases on board and they will advise accordingly. For contacts or remaining crew, the PHA may advice staying on the vessel following self isolation procedures. Should the situation however require the unaffected crew to leave the vessel then the owner/operator needs to secure accommodation, but availability of suitable premises is reducing and there may be a need to engage with the Local Resilience Forum via health officials.

Q29. What actions are currently being taken with respect to the provisions in the Guidelines on protection of health, repatriation and travel arrangements for seafarers, passengers and other persons on board ships?

We are generally supportive of the recommendations outlined by the EU and already implemented a range of measures prior to the publication of this guidance. The UK welcomes the guidance particularly in relation to the responsibilities shipping operators and the flag state as we have already taken measures to repatriate British nationals and we are currently monitoring the status of vessels with British crew members to ensure their safety and welfare. In relation to crew changes, the UK is supportive of the EU guidelines to allow crew changes at all ports as this is instrumental to the flow of goods and a letter was sent to UN organisations a few weeks ago confirming our position on this. We are currently engaging further with the industry to see what more could be done to facilitate crew changes globally. There are some differences in relation to the health measures adopted by the UK as not all vessels are the same and therefore the same blanket approach cannot be used for all maritime settings. Therefore, any incidents on board vessels have to be considered on a case by case basis and masters will need to seek advice from the local Health Protection Team.

WELFARE

Q30. Do the EU Regulations apply to the UK?

No. As these are only guidelines, they are not legally binding on the UK during the transition period.

Q31. What should a seafarer do if challenged about his movement between an airport and the ship?

Crew should be supplied with a company letter identifying the crew as key workers and including the purpose of travel. Templates have been produced by the ICS, ITF and European Commission.

Q32. What is the best web-link that stresses that handwashing is absolutely crucial?

HAND WASHING GUIDANCE

Q33. What is being done to ensure consistency between PHE, HSE and the Devolved Administrations?

As much as possible, PHE is working to avoid contradictory advice, as are colleagues in the DAs, with whom we are working closely on a regular basis.

Q34. What is the significance of workers who have to be within 2m of each other not doing so for more than 15 minutes?

This is probably a confusion with the case definition of face-to-face contact or close contact, which is within 2m for more than 15 minutes. Guidance for safe working is available at

EMPLOYER SAFE WORKING GUIDANCE

Q35. If workers chose to wear their own PPE, who is responsible for disposal?

They are responsible for the safe disposal of their own PPE. It is not clinical waste and should be double-bagged and disposed of in a waste bin as usual.

Q36. Can workers over 70 years old return to work?

There is no unequivocal answer. People over 70 are classified as clinically vulnerable. Some of them with underlying health conditions may be classified as extremely clinically vulnerable (as might some people under 70 who have serious underlying health conditions). Anyone classified as extremely clinically vulnerable should have been notified by letter by their GP. Those people in the clinically vulnerable group are advised to stay at home wherever possible, and practice rigorous social distancing, but, if they can’t work from home, can go to work, if workplace safety can be assured after a workplace safety assessment. People in the extremely clinically vulnerable category should not go to work. Individual cases should be referred to the employer’s Occupational Health Advisor to assess each case on an individual basis.

Q37. Are the Quarantine Regulations introduced on 8th June applicable to small boats and yachts and also ports without a Border Force presence?

This is a policy issue which will have to go to the Home Office, or local Border Force officer to answer

Q38. If an employee us contacted by NHS ‘Track and trace’, is their advice to self-isolate for 14 days mandatory or subject to risk assessment and mitigation measures being put in place?

Unless there are very pressing reasons to the contrary, the track-and-trace guidance is mandatory. Exceptions should be considered on an individual basis but should be kept to the absolute minimum.

Q39. Does the husband & wife crew of a yacht which has taken 16 days to sail across the Atlantic without calling anywhere before the UK need to self-isolate for 14 days in accordance with the Quarantine Regulations?

Despite the obvious observation that the journey was longer than the COVID-19 incubation period, there is no exemption in the Regulations for such an event.

Q40 Does a crew change need to be recorded on the Maritime Declaration of Health?

If a MDH is issued by a ship, any passengers or crew who have joined “since international voyage began or past thirty days, whichever is shorter” should be listed, “upon request of the competent authority of the port of arrival” (IHR2005, Annex 8). There has been no national requirement in England during the Covid-19 pandemic to require this, though this may be different in some Devolved Administrations. It means there may be local variations in requiring this. The corollary is that crew or passengers joining the ship do not, of themselves, require a MDH to be issued if the ship is free from infection (unless local requirements differ). Any crew who have joined a ship, who are still within the incubation period of Coid-19, are exempt from the Quarantine Regulations (see Q18).

Other useful contacts:

• (England only) Find your local Health Protection Team (HPT) here: https://www.gov.uk/healthprotection-teamS
• Contact details for Port Health Authorities (PHA) available here: http://www.porthealthassociation.co.uk/

Annex 1

Coronavirus Resilience: Maritime Pilot Transfer Arrangements – suggested procedure at UK ports – 31 March 2020

This guidance note has been prepared in consultation with a collection of UK maritime trade associations (British Ports Association, UK Maritime Pilots’ Association, UK Harbour Masters’ Association and UK Major Ports Group) and is designed to give some non-prescriptive options to help pilotage authorities remain resilient. There are a wide variety of pilotage options around the UK and our approximately 500 maritime pilots are an important component in facilitating a wide number of shipping movements, helping to maintain supply chains and trade. Pilots and other port and maritime operatives have been identified as ‘Key Workers’ by the Government and therefore expected to carry out their roles in as normal a way as possible whilst being mindful of advice on limiting the potential spread of COVID-19. The guidance is intended to supplement other local transfer advice such as already exists or be integrated, either in full or in part, where appropriate. It does not attempt to alter or replace the safety advice contained in the Pilotage Boarding and Landing Code or any Workboat Codes merely highlight procedures that will contribute to limiting the risks presented by infectious diseases such as COVID-19. The guidance is non-statutory and harbour authorities may wish to use sections as appropriate.

Suggested procedures:

Like many Key Workers in other occupations, it will not always be practically possible to follow the Government’s guidance to maintain a two-metre distance at all times during pilotage and pilot cutter operations. However the following measures could greatly reduce the likelihood of spreading COVID19 if followed closely as far as practically possible but subject to review:

• Prior to boarding a cutter, the coxswain and crew should ensure they are not suffering with any of the symptoms of COVID-19 nor are any members of their household, i.e. the people they live with (in this case they should self-isolate in line with Government guidance)
• The cutter crew shall have all washed their hands thoroughly prior to boarding the cutter
• The coxswain/crew shall ensure that the cutter is clean and that appropriate areas such as handrails and seats are wiped down with a soap-based or disinfectant solution or wipes after each run. They should also aim to have an on-board supply of hand sanitiser/wipes which are used regularly, especially on entry into the cabin
• Where possible the cutter should be as ventilated as possible with fresh air
• The pilot shall also be symptom free, having thoroughly washed their hands prior to boarding
• If the pilot is joining from a ship, the cutter crew should where possible provide disposable hand wipes to the pilot and have a suitable way to dispose of them after use
• Pilots should observe the highest precautions with their own health and to minimise exposure whilst on board the cutter, and minimise physical contact with cutter crew members if not essential or use of gloves where possible, maintaining as much distance as practical
• To aid physical distancing, for some operations the Competent Harbour Authority may wish to limit the number pilots transferred on a single cutter and, subject to boat size and seating arrangements attempt to maintain as close as is possible to a 2-metre space for those on board
• Consumption of food or drink whilst on board the cutter should be avoided unless essential
• Prior to boarding or landing the Pilot, the coxswain can, if possible, confirm via radio with the master of the ship that previous advice provided to the harbour authority/VTS that all on board are healthy. Some authorities may choose to seek this confirmation through their VTS.Source: portskillsandsafety

Desperate for information, a work-at-home employee of an industrial port tenant clicks on what appears to be an official looking source promising the latest Covid-19 updates, only to innocently launch malware that for a time disables his employer’s GPS system.

Experts say the risks of such a hypothetical scenario occurring within the vulnerable maritime and offshore communities has grown appreciably as the coronavirus has forced most offices to lock down. This left information technology (IT) specialists scrambling to ensure updated security patches are installed on widely dispersed computers and has intensified monitoring of their respective networks for signs of malicious malware, ransomware and email phishing.

Advancing digitalization and connectivity, combined with more employees exiled to work from remote and sometimes poorly secured locations, has provided fertile ground for cybercriminals set on injecting their own brand of virus into the pandemic-induced anxieties of companies from the inland waterways industry to the deepwater Gulf of Mexico.

“This experience reinforces that cybersecurity has got to be a focus for everyone,” said Jennifer Carpenter, president and CEO of the American Waterways Operators, Arlington, Va., which, so far, has helped headed off any network disruptions to its tug and barge company members. “It doesn’t matter where you’re located, the size of your operation, or the complexity of your operation, we all have to make sure we have the network system that will get us through unusual events.”

The maritime sector is well-versed in monitoring and initiating response plans to unfolding events like slow-developing hurricanes, but the full brutality of Covid-19 slammed the U.S. quickly and with unexpectedly dire health and economic consequences.

“I think it caught a lot of people off guard,” said April Danos, director of homeland security and technology for the Greater Lafourche Port Commission, Port Fourchon, La. The southern Louisiana port is widely recognized as the world’s premier deepwater oil and gas service and supply base. “When this all started happening, I put my security team on high alert and upped the vigilance of our network. I could see what was coming, so we got proactive. We want to be efficient, but we still have to be secure.”

In a joint advisory issued on April 8, the U.S. Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and its UK counterpart warned that “a growing number of cybercriminals and other malicious groups online are exploiting the Covid-19 outbreak for their own personal gain.” However, putting a precise number to the threats or the dollars lost to cybercrime is inexact, at best. Save for widespread disruptions, like the heavily publicized Maersk malware attack in 2017, most companies elect to quietly and internally resolve cyberissues, mainly to save face or preserve client relationships.

“There are more of these cyber related instances coming to the forefront,” said Arinjit Roy, vice president, North America, for the American Bureau of Shipping (ABS) in Houston. “There have been quite a few already. Some we’ve heard of, but many others kind of go under the radar. This will become more prominent.”

As Covid-19 restrictions laid bare the soft underbelly intrinsic of many remote communication and teleconference technologies, many companies, like those engaged in offshore oil gas development, had recognized the criticality of maintaining network security well before the virus’s furious stampede across the nation. “We’ve been seeing more and more companies asking us to show up and do a breach assessment or a compromise assessment,” said Dr. Mate Csorba, global service line leader for cybersecurity, DNV GL Digital Solutions Group.

CHANGING COURSE

Given the travel risks associated with the highly contagious new coronavirus, DNV GL had to redefine the “show up” component during the late March execution of a planned cybersecurity assessment for a Gulf of Mexico asset. Normally, a certified ethical hacker would be installed aboard the asset to simulate a cybersecurity breach and evaluate the company’s vulnerabilities to a major attack. With travel off the table, the Maritime Advisory and Digital Solutions groups collaborated closely with the client to enable the assessment and penetration tests to be carried out remotely between client personnel and DNV GL offices across three countries.

“We shipped hardware that was installed inside the company and could be remotely controlled,” Csorba said from his office in Trondheim, Norway, where he works with clients from the maritime, offshore oil and gas and utilities industries, among others. “Basically, we simulated an attacker on the inside of the corporate network and if a breach happened, we then looked at what the attacker can do from there, and what are the vulnerabilities offshore that an attacker would be able to exploit.”

A second remote assessment was underway in Europe in May.

Though cybersecurity occupies a high profile among many companies, especially within  the increasingly digitized offshore oil and gas arena, Csorba said the pandemic has further driven home the need for companies to elevate cybersecurity to a level equal to their uncompromising safety programs. “Generally, there is very good safety awareness within the oil and gas industry and there should be equally good security awareness, because there’s no safety without security.”

Any renewed focus on cyberawareness, he said, must begin and end with the human factor. “Even before Covid, what we’ve seen from assessments is that some of the major threats you have in offshore cybersecurity come from the crew taking short cuts. They often breach natural segregation by not following policies and procedures, by installing (contaminated) USB devices in drive ports, making networks connections they’re not supposed to make, and thereby circumventing the technical defenses that are out there. The crew also has onboard email access, so that’s a primary threat factor, even more so than remote access.”

Indeed, the mass office exodus reinforces the weight that must be placed on enforcing corporate security policies, even when the user is working outside the office-based firewall, said Robert Guidry, chief technology officer at Global Data Systems (GDS).

GDS is a Lafayette, La.-based IT managed service provider with complimentary desktop and security management technologies designed to secure data centers, networks and the critical end points. “This is where we get into end point security, and making sure the users, even though they are disjointed from their regular corporate networks, still have a governance about them,” Guidry said. “Which websites can they reach and, more specifically, which ones can they not reach, to make sure they are not subjected to malware or ransomware activities.”

Widespread work-from-home orders also further exposed the technical vulnerabilities of popular telecommunications technologies, which were on the rise well before the blanket pandemic lockdowns. “What happened with Covid is that the hackers started looking at these remote collaboration tools,” Csorba said. “Recognition of the vulnerabilities of remote access was rising before Covid, so hopefully now it will get more focus.”

He said the longer offshore hitches resulting from Covid-related crew change difficulties provides an ideal training window for improving cyberawareness.

Guidry agreed, emphasizing that even with top-of-the line security measures, “no one will ever be 100% secure. Along with technical solutions, we have to stress end-user education. Phishing training campaigns, for instance, are very important.”

PORTS TARGETED

In the early days of the Covid-19 assault on the U.S., Coast Guard Commandant Adm. Karl Schultz spoke of port vulnerabilities during his annual State of the Coast Guard address in February. While not pointing specifically to the then emerging threat, Schultz said over the past year the service’s new Cyber Protection Team had been dispatched to New York, New Orleans and elsewhere as part of an intergovernmental response to what he described, as “an emerging vulnerability in the increasing cyberattacks targeting our ports.”

The Lafourche Port’s Danos said conversations with her peers show that ports and maritime interests have “absolutely” seen more targeted hits amid the pandemic. The 60-year-old port, however, managed to avoid any cyberissues and remained secure, even as most of its employees were forced to work outside the port’s Galliano, La., administrative office.

“We’ve been very safe here so far,” Danos said. “There’s always issues with people working at home and one concern is the wireless networks and how they’re being segregated and if they’re being segregated. We advise people working at home to make sure your business wireless is on a segregated channel, so you don’t have that crossover between personal and business.”

More than 250 different companies, with varied levels of cyberprotection, use Port Fourchon as an operational base. Louisiana’s southernmost port also is home to the separately managed Louisiana Offshore Oil Port (LOOP), the nation’s only deepwater oil export and import terminal with drafts capable of accommodating very large crude carriers (VLCC). With Port Fourchon’s strategic importance to U.S. energy infrastructure, security gets top billing and the initiation of established response plans critical for any impending threat.

Danos said that pandemic response protocol included installing updated security patches without interruption while the work-at-home mandate was in effect. She emphasized, however, that any security upgrade is never a one-and-done  proposition. “Just because you’re working from home doesn’t mean you don’t continue to patch. But this not something you fix one time and never touch again. You may put up a gate or fence on the physical side and hope it blocks out the bad people, but in cybersecurity you’re constantly having to upgrade, because they are constantly trying to get ahead of you.”

While the port and its tenants operate under totally different networks, Danos said it is incumbent on her security team to help all companies operating out of the port stay secure. “As a port authority, our goal is to try to help everybody stay cybersecure, especially with so many working from home. It’s important that I know what my tenants’ cyber posture is, because if they’re not doing proper cyber hygiene to protect themselves, the port could get shut down and that would impact us all.”

Danos said tenant outreach includes sharing the pertinent alerts and updated information that come only from trustworthy sources such as CISA, the Maritime Transportation System–Information Sharing Analysis Center (MTS-ISAC), and the American Association of Port Authorities (AAPA). “We also do cyberassessments every year and cyberawareness training for our employees and tenants, which is paying off with everybody working at home,” she said.

Among the port’s largest tenants is Edison Chouest Offshore (ECO). The Cut Off, La.-based offshore service vessel operator has built, what it claims, is one of the maritime sectors most robust cybersecurity infrastructures. Other than adding a small section to the business continuity plan to address the pandemic, ECO Fleet Cybersecurity Manager Joseph Jaubert said the company had no need to develop any special crisis response. “We haven’t really needed to change anything, because we had some of maritime’s highest cybersecurity standards way before any of this,” he said. “We’ve been ahead of the curve for years and was doing this when nobody else even thought it should be done.”

MARITIME VULNERABILITIES

That alone puts Edison Chouest in an exclusive club within the maritime community, said GDS sales consultant Justin Getzinger, who works exclusively with inland marine, offshore maritime and offshore oil and gas clients. “Before this pandemic came to the doorstep of the maritime and offshore sectors, a basic survey of maritime companies showed that 70% were unprepared for a cyberattack,” he said. “They either lacked a business continuity plan or lacked the resources just to be able to identify when an attack was happening, detect where the attack was happening, and mitigate it in an organized fashion.”

Getzinger, who worked 12 years for a major vessel operator, said the maritime industry’s susceptibility to cyberattacks can be traced, in no small part, to 2015 and the height of the previous oil and gas industry downturn, which filtered down to supporting industries. With companies operating in survival mode, the limited capital available was allocated only to what was deemed absolutely critical to maintain operations. Cybersecurity did not qualify.

“What I saw firsthand among many clients across the industry was that a lot of IT managers and IT staff struggled to get executive management buy-in,” he said. “They were unable to communicate the importance of identifying cyber risks on a regular basis and communicate the impact of those risks if they’re not addressed. This (Covid-19) is a great opportunity for IT managers to have the leverage they may not have had previously to get executive buy-in.”

Source: workboat