Why Ships Became Hackable

For most of a century, a ship was unhackable for the best possible reason: there was nothing aboard to hack. Navigation was paper, machinery answered to cams and relays, and the only data link to shore was a radio officer. That ship no longer exists. She was replaced piece by piece, and not one of the replacements was sold to the industry as a security decision.

Three quiet revolutions

First, navigation became software. ECDIS, electronic charts on a computer, carriage made mandatory for most of the SOLAS fleet in stages from 2012 to 2018, replaced the chart table with a workstation that needs regular chart updates, delivered by download or, very often, by USB stick carried up the gangway. An ECDIS is not a mystical navigation appliance; it is a computer, frequently running a general-purpose operating system, and it inherits every weakness of one.

Second, the engine room became a network. Engine automation, power management, alarm and monitoring, ballast and cargo control, what the trade calls operational technology (OT), moved from hardwired logic to networked controllers. OT differs from ordinary IT in what failure means. When an IT system fails, information is lost or exposed. When an OT system fails, something physical stops, starts, or moves wrongly. IT security guards the confidentiality of data; OT security keeps physical processes safe and available. Those priorities collide: rebooting a mail server is routine, while "rebooting" a power management system in confined waters is an incident.

Third, the ship got a permanent address. Broadband satellite links brought remote diagnostics, performance monitoring, planned-maintenance sync, and crew internet. Each service is individually sensible. Collectively they ended the air gap: the office network, the vendor's service desk, and the crew's phones now touch, directly or indirectly, systems that move steel.

What incidents actually look like

The instructive incidents are rarely cinematic. The classic patterns, repeated across the industry's incident reporting, look like this:

• Malware walks aboard on a USB stick and lodges in an ECDIS or a loading computer. Nobody targeted the ship; the stick was simply dirty.
• Ransomware detonates in the shore office. In 2017 the NotPetya malware shut down Maersk's IT systems ashore and halted operations at port terminals around the world, and Maersk put the cost at USD 200 to 300 million (The Register, August 2017). Maersk said at the time that its vessels were manoeuvrable and able to communicate, and their crews safe (PortCalls, June 2017): the damage was ashore, and the business stopped anyway.
• Navigation signals are jammed or spoofed in contested waters, and position data quietly stops deserving trust.
• A maker's remote-access connection, installed for warranty support and never inventoried, stays open for years: a back door nobody remembers owning.

Note the common thread: almost none of this is a precision strike on one ship. It is weather, not sniper fire: untargeted and indifferent, which is exactly why every ship needs the same seamanship against it.

The IMO answer: put it in the SMS

The regulatory response was deliberately unglamorous. With resolution MSC.428(98), adopted in 2017, IMO affirmed that cyber risks should be appropriately addressed in the safety management system required by the ISM Code, and expected this no later than the first annual verification of the company's Document of Compliance after 1 January 2021. The placement is the whole message. Cyber was not given its own convention, its own certificate, or its own department. It was folded into the existing discipline of identifying risks, establishing safeguards, and auditing the result: the same machinery that manages enclosed-space entry and mooring operations. A cyber gap is now an SMS nonconformity, findable at any ISM audit.

Three documents sit around the resolution and are worth knowing by name. The resolution itself rests on IMO's Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3, now in its third revision (Rev.3, April 2025). Most SMS cyber chapters are actually written from the industry's Guidelines on Cyber Security Onboard Ships, produced by BIMCO, ICS, INTERTANKO, OCIMF and others, now at version 5 (November 2024). And in the European Union the NIS2 Directive has, since October 2024, placed water transport companies, port managing bodies and vessel traffic services under binding cyber-security and incident-reporting duties.

DNV's overview of the maritime regulatory landscape (maritime cyber security regulations) traces how the pieces stack: the IMO resolution set the management-system floor, and the class societies then built the technical storey above it: the IACS unified requirements we take up in the next two lessons. ClassNK's technical journal survey of ship cybersecurity regulation (Latest Trends in Ship Cybersecurity Regulations) makes the same point from the class perspective: the era when cyber was optional ended when it entered the ISM system.

The rest of this course builds on one habit from this lesson: stop asking whether a system can be hacked, assume it can, and start asking what the ship does in the hour after it misbehaves. That question, it turns out, is one the industry already knows how to answer. It is called seamanship, and the rules in the next lesson are largely seamanship written down for networks.