(+30) 2118501121

maritime cyber security Kongsberg Maritime director of autonomy Peter Due explains why e-navigation and technology developed for the Yara Birkeland project will enable a future of autonomous shipping

ECDIS and e-navigation will be essential for generations of future autonomous ships. Although the first unmanned ships will be remotely controlled and operating in coastal waters, in the long term there will be ocean-going autonomous ships, with e-navigation technology monitoring their progress onshore.

IMO placed ocean-going autonomous vessels firmly on the global agenda during the Maritime Safety Committee (MSC) 99 session in May this year, by implementing a working group to conduct a regulatory scoping exercise for using MASS (Maritime Autonomous Surface Ships)*.

Kongsberg Maritime will be part of that working group and will deliver technology to the world’s first all-electric, zero emissions and autonomous container vessel, Yara Birkeland. This ship is scheduled to transport fertiliser products along a 30 nautical mile route to the ports of Brevik and Larvik next year and by 2020 is likely to be unmanned.

Kongsberg Maritime director of autonomy Peter Due said new navigation and collision avoidance systems that centre on e-navigation technology were needed for this project, as Yara Birkeland will operate on a busy waterway.

Kongsberg drew on its experience in autonomous underwater vehicles, dynamic positioning, ECDIS and sensor fusion as a foundation for autonomous navigation. But Mr Due explained to Marine Electronics & Communications that more development was required. “Harmonising with artificial intelligence, machine learning and digital twin technology enables the extreme level of safety required,” he said.

Mr Due said Yara Birkeland’s operations will be planned, pretested and optimised in the cloud using the Kognifai digital platform and its digital twin that Kongsberg generated. This includes navigation in different metocean conditions.

“The twin integrates all data including weather, currents, tides and temperature with a detailed physical ship model,” said Mr Due. “We can then decide the optimum route and simply transfer it to the ship’s autonomy engine, navigation systems and ECDIS when it is in port,” he continued.

“Once the ship sets off, sensor fusion comes into play, enabling the autonomy engine, working with the onboard digital twin and e-navigation systems to adjust and reroute at sea according to the going conditions and other vessels in the vicinity.”

It is this dynamism a fully autonomous navigation system requires that led to the establishment of the Hull to Hull (H2H) EU-funded research project. This will develop technical solutions for safer navigation in close proximity of other stationary or moving vessels and objects.

H2H will use the European Global Navigation Satellite System to enhance safety in busy waters and during close manoeuvring. “This will help mariners to make the correct navigation decisions and will create the fundamental conditions for autonomous vessel navigation,” said Mr Due. Data can be used as an input to an autonomy controller.

Navigational safety is essential if the benefits of MASS are ever to be truly realised”

Ensuring e-navigation and collision avoidance technology works correctly will be fundamental to autonomous shipping. “Navigational safety is essential if the benefits of MASS are ever to be truly realised,” said Mr Due.



Maritime Cyber Attack

Cyber attacks like the NotPetya malware that struck Maersk are raising concerns about cyber risk and its effects on resilience, according to specialty insurer XL Catlin

Shipping industry firms and port operators are worried about linkage between cyber-attacks and supply chain risk, insurer XL Catlin has warned.

Big interdependencies between systems mean maritime firms face major business continuity risks from online threats.

“The problem is that nobody knows, other than the computer systems, where your goods are,” said Pascal Matthey, head of global lines for marine risk engineering at XL Catlin.

“You might never find your container again. Refrigerated containers might lose power, which would mean huge damage,” said Matthey.

Maersk was among those organisations worst hit by the NotPetya contagious malware attack last year.

The global shipping and logistics firm had to reinstall some 4,000 servers, 45,000 PCs, and 2,500 applications; the process took 10 days and cost the company around $450m.

The company was forced to temporarily switch to manual systems – pen and paper, and lots of overtime – resulting in a temporary 20% drop in volumes.

Another cyber-attack, revealed in 2013, struck two shipping companies operating in the Belgian port of Antwerp, and had reportedly gone undetected for about two years before that.

An organised crime group allegedly used hackers to infiltrate computer networks, allowing cocaine and heroin, hidden in containers shipped from South America, to be intercepted by criminals.

“The idea was not to harm the port but to get things out by hacking the system,” said Matthey, based in the specialty insurer’s Zurich office.

He warned about the potentially catastrophic consequences of a cyber-attack by terrorists, such as targeting a ship and interfering with its steering or navigation to cause a collision in congested waters, such as a port or major trade artery such as the Panama Canal.

Maritime Cyber Attack

“What happened on 9/11, you could perhaps now do with a ship, by steering a large vessel into an oil or gas terminal, which could have disastrous consequences,” said Matthey.

XL Catlin is among those re/insurance firms involved in developing blockchain applications – distributed ledger technology for smart contracts, sharing data instantaneously between the relevant counterparties.

A new blockchain platform for marine insurance contracts at XL Catlin and MS Amlin is expected to go live this year.

Maritime Cyber Attack



Maritime Cyber Security

More than half of 6,000 seafarers who took part in a crew connectivity survey have had a part of their role automated over the last two years, and 98% of these seafarers are positive about the change.

The largest ever survey of seafarers to date revealed that nearly all who took part feel that technology and automation provide great opportunity to enhance their job roles and shipping operations. Roger Adamson, Futurenautics Maritime’s chief executive officer, who presented the results during the report’s launch in London this week, said that for the first time Futurenautics looked into the “weird and wonderful technology of the future that everyone talks about – robotics, automation, big data, analytics, unmanned ships,” these topics which had not been explored before.

Adamson explained that they first started talking to seafarers about automation levels. “53% of them came back and said we have had one or more components of our role automated within the last two years. That figure increased to 72% when we included officers.”

Maritime Cyber Security

The impact of automation on seafarers and officers’ roles proved to be positive, with the majority (98%) confirming it had helped rather than hindered them in their role at sea. Adamson also confirmed that automation, robotics, artificial intelligence, and augmented/virtual reality, were viewed as opportunities by the majority of seafarers, rather than as threats, which came as a surprise to Futurenautics. According to Adamson, most saw these processes and technologies as a way to enhance the ability for crew to operate the vessel and do their jobs more efficiently.



GDPR and Crew Management

Review your Crew Management Arrangements

In this article, the Club recommends that as part of your preparations for GDPR you complete a review of your crew management arrangements to ensure they will be GDPR compliant. We are grateful to Ian MacLean of Hill Dickinson LLP for his input into this article.

Key Actions to Consider

In relation to crew management, you should consider the following key actions as part of your wider GDPR compliance programme:

  • Data controller or data processor? Review your crew management arrangements and crew information to determine if you are the ‘data controller’ or the ‘data processor’ of crew personal data. You will be a data controller if you decide the purposes and means in which the personal data is processed; you will be a data processer if you are responsible for the processing of personal data on behalf of a data controller. If you are a data processor, the GDPR places specific legal obligations on you to maintain records of personal data and processing activities concerned with it. However, if you are a data controller the GDPR places additional obligations on you to ensure that the data remains properly controlled/secured if you pass it on to third parties.
  • Determine the lawful basis for the processing of personal data relating to crew –whether or not you are a data controller or a data processer you must determine a valid lawful basis for the processing of crew personal data. GDPR provides for the following lawful bases for the processing of personal data:
    • Consent
    • Contractual
    • Legal obligation
    • Vital interests
    • Public task
    • Legitimate interest

Some practical examples of these lawful bases are considered further in this briefing.

  • Consider whether you hold and process any special category data (data consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation) as you will need to identify:
    • a lawful basis for the processing of this information; and
    • a separate condition or reason for the processing of special category information. These reasons are detailed in Article 9 of the GDPR and include where an individual has given their explicit consent to the processing of this personal data.
  • Complete your ‘record of processing’ – data controllers and data processors are responsible for maintaining a ‘record of processing’ which records their data processing activities. Members should ensure their data processing records detail the data processing activities being undertaken in relation to their crew.
  • Privacy Notices – These explain how you as an organisation collect and process personal data. GDPR sets out the information that you should supply to individuals when collecting and processing personal data. Review your current privacy notices to ensure they meet the GDPR requirements.
  • Contracts – review any third party contracts relating to the processing of personal data and ensure they meet the requirements of GDPR. Members may need to seek specific legal advice in this area in order to ensure data processing arrangements are GDPR compliant.
  • Consider local requirements – if you are located outside of Europe you will need to comply with any applicable local requirements concerning data protection and privacy issues. GDPR will also apply to you if you are offering services to, or are processing personal data relating to, individuals located in the European Union.
  • Unless additional safeguards are in place, the GDPR prohibits the transfer of personal data outside of the European Economic Area to a country that does not, in the view of the European Commission, have adequate data protection (1).

GDPR and Crew Management


Source : The North of England P&I Association Limited


Maritime Cyber Security

Internet at sea ‘strongly influences’ 92% of seafarers’ job choice

An overwhelming 92% of seafarers now say that internet access “strongly influences” their decision on where to work, according to the latest Crew Connectivity 2018 Survey Report published by Futurenautics Maritime this week. This compares to a 75% figure reported in the last edition of the same survey in 2015.

Connectivity at sea is also now viewed by 95% of seafarers as having a positive effect on safety, compared to only 72% three years ago.

The latest survey, sponsored by KVH Industries and Intelsat, polled 6,000 serving seafarers for their views on a broad range of issues surrounding the digital transformation affecting shipping. Inter alia it found that some 75% of seafarers now use the internet at sea, 32% more than in the last survey.

In addition, 69% of respondents viewed the increasing use of big data and analytics as a positive opportunity for their jobs in the next five years, and only 17% as a threat.

Maritime Cyber Security

“It’s our belief that collaborating and sharing information can accelerate the pace of transformation in shipping and maritime, and begin to understand and solve big problems,” said Futurenautics chief executive Roger Adamson, explaining the rationale behind the survey.

The report’s findings show a change in mindset among seafarers regarding many aspects of connectivity. Among the key findings:

  • 92% of seafarers reported that Internet access strongly influences their decision on where to work, up from 78% in prior years.
  • 95% of seafarers view connectivity as having a positive effect on onboard safety, an increase of 72% since the 2015 survey.
  • 69% of respondents view the increasing use of big data and analytics as a positive opportunity for their jobs in the next five years, versus 17% who see it as a threat.

“This is an extremely exciting time for the maritime industry, as digitalization begins to transform ship operations and open up many opportunities to keep this industry vital,” notes Martin Kits van Heyningen,  KVH’s chief executive officer. “We are delighted to support this report, which reinforces the importance of connectivity and how it is changing the life of the individual seafarer.”

“This report further emphasizes the need and desire—from shipping crews to passengers—to have robust, flexible networks that enable always-on connectivity,” says Shane Rossbacher, Intelsat’s director of maritime product management. “We are gratified to see that global high throughput services have further enhanced the ability for ship operators to improve the lives of crew members by providing additional services and the ability to stay in touch with home as well as boost the efficiency of vessel operations.”


Maritime Cyber Security – Five key cyber questions and challenges facing the maritime industry!

To wrap up this year’s National Cybersecurity Awareness Month series, Lt. Cmdr. Brandon Link with the Office of Port & Facility Compliance poses five key questions maritime professionals can consider when deciding how to manage risks to cyber systems.


Cyber systems are prevalent in our daily lives. We face an ever-increasing amount of cyber influence in how we live, work, and operate. The Marine Transportation System (MTS) uses cyber systems in all aspects of operations. With the convenience and improved performance offered by technology come continually-evolving questions and challenges. Cyber threats are real and pose considerable risks requiring attention and action at all organizational levels.

Below are five key cyber questions and challenges facing the maritime industry and how you can begin assessing and reducing risk:

1. How much should I invest in cybersecurity and cyber risk management? The answer varies from organization to organization. Cybersecurity should be viewed as an investment, not a cost. You are in the best position to evaluate your company’s cyber footprint to determine where risks are highest. The National Institute of Standards and Technology (NIST) Cybersecurity Framework and Coast Guard/NIST Cybersecurity Profiles are a few resources available. The Coast Guard continues to work on further guidance to assist in cyber risk management efforts, including the upcoming Navigation and Vessel Inspection Circular (NVIC) 05-17, Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act Regulated Facilities.

2. We have a closed system with an air gap between our network and outside influences. Am I still at risk? Does the system have access control/authentication procedures to prohibit unknown or unauthorized access? Can an equipment vendor access that system remotely, even for seemingly harmless activities such as program updates? Can the system be accessed in person, connecting via laptop or other equipment, introducing an avenue for malicious access? To answer these questions, it is important to know and understand the landscape of, and access to your cyber systems.

3. What are the greatest threats to my cyber systems? A direct cyber attack can come from a malicious actor, either internal or external. Cyber threats can also arise from accidental corruption, like an employee unknowingly connecting a corrupted device (smart phone, “thumb” drive) to a USB port. Risks can increase due to improper system configurations or failure to stay current on software updates. Having policies in place to account for these issues, and ensuring employee awareness, can greatly reduce risks.

4. I think our organization is the victim of a cyber attack or incident. Who can I notify? The National Cybersecurity and Communications Integration Center (NCCIC) is a 24/7 cyber situational awareness, incident response, and management center serving as the national nexus of cyber and communications integration for the Federal Government, intelligence community, and law enforcement. A cyber incident that does not impact physical security or include a pollution event can be reported to the NCCIC at 1-888-282-0870, who will then forward the report to the National Response Center (NRC), meeting the reporting requirements in 33 CFR 101.305, if made aware that you are calling as a Coast Guard-regulated facility. Reports of suspicious activity or a breach of security, and incidents affecting physical security or including a pollution event should be reported to the NRC at 1-800-424-8802.

5. We need to address cyber risks in our organization, where do we begin? There is no single solution that will work the same for every company, but there are steps that will help get you on the path toward an improved cyber posture:

  • Increase cybersecurity training and awareness at all levels of your organization.
  • Understand and educate the workforce on the difference between Information Technology (IT), the storing, retrieving, transmitting, and manipulating of data, and Operational Technology (OT), the hardware and software that detects or causes changes in processes through monitoring or control of physical devices (the “Internet of Things”).
  • Establish positions, teams, or workgroups that are cyber threat-focused. Integrate your IT workforce’s corporate knowledge of systems with the OT workforce and others who possess expertise in your company’s operations.
  • Conduct an assessment to see where cyber threats exist, and identify ways to mitigate those risks. Incorporate cyber risk management into existing policies and procedures, including the Facility Security Plan. Conduct exercises that test your organization’s cyber threat resilience.
  • Identify your local Area Maritime Security Committee, particularly those with a dedicated cybersecurity subcommittee, or other opportunities that allows for the sharing of knowledge and experience. What affects your organization could affect others, so information sharing is crucial to combating threats.


Managing cyber risks will continue to be an ongoing effort requiring time and attention. The most significant threats and highest priorities may not remain the same from month-to-month or even week-to-week, so staying informed could mean the difference between a strong cyber posture or becoming victim to a cyber incident or breach.

Source :

10/30/2017: Nat’l Cybersecurity Awareness Month – Five key cyber questions and challenges facing the maritime industry