Maritime and port cybersecurity.

This article is also available in French.

Every year, in northern Norway, several public agencies authorise a few days of GNSS jamming and spoofing transmissions around the island of Andøya, so that manufacturers and operators can put their equipment through real conditions. The exercise is called Jammertest [1], and it is the largest of its kind open to the public. During the 2022 edition, one participant left the Strava app running on their phone in the middle of a spoofing trial. They promptly posted an accidental personal best [2]: 6.44 kilometres in 5 minutes and 50 seconds, with 495 metres of elevation gain. Their phone was not part of the trial. A falsified positioning signal travels into everything that listens to a GNSS receiver, including equipment that has nothing to do with navigation.

This article is also available in French.

Today, for a change from cyber (although we will be talking about AI, data and bias), I suggest you grab a bag of popcorn and settle in comfortably. We are going to talk about a film. More precisely, about two scenarios. Tempted? Off we go.

Two scenarios for a good film, then, with espionage and high-seas operations in the background but, in the end, a single story (and it ends well).

First scenario. A Russian ship, managed by a company under US sanctions, moving slowly in the middle of the Atlantic Ocean, about 1,600 kilometres (860 NM) east of Barbados, and staying there for 41 days. No port call, apparently no other ship encountered, its AIS transponder on the whole time, and, according to some submarine cable maps, a piece of “critical” underwater infrastructure nearby. Calling it a spy ship is only one step further, a step easily taken if you do not stand back.

Second scenario. The same ship, on the same dates and in the same position, running a prospecting campaign across a metallic sulphide deposit, with the fairly irregular kinematics typical of that kind of operation, inside mining blocks allocated to Russia by the International Seabed Authority, 305 kilometres (165 NM) from the nearest cable.

Some still picture the maritime cyber threat as exclusively a matter of hijacked ships and tampered AIS transponders. By consolidating the incidents of 2025 in my own research dataset on maritime cyber incidents - one I built during my doctoral work and keep maintaining with my own means - I get a rather different, and sometimes more instructive, picture, because it rests on facts. I call this cyber incidentology, not to sound pompous, but because it is rich in lessons for prevention, protection and response.

This article is also available in French.

Cellular modems were fitted to ship-to-shore cranes bound for US ports while those cranes were being built in China. Port technicians saw them, assumed they were there for remote maintenance, and moved on. Yet the modems appeared in no contract: the remote diagnostics option they corresponded to had been declined at purchase. A joint report by two committees of the US House of Representatives documented the case in September 2024 [1]. Connected to Linux computers inside the cranes, the modems “created an obscure method to collect information, and bypass firewalls in a manner that could potentially disrupt port operations”, the committees wrote. At another port, a modem turned up in the server room hosting the cranes’ firewall and networking equipment, and port officials could not say why it was there [2].

Cet article est aussi disponible en français.

Normally, when the pro-Russian hacktivist outfit NoName057(16) goes after the maritime and port sector, it picks a handful of sites: a ferry company here, a port authority there. This time, over the past ten days or so, the whole ecosystem and hinterland of the port of Constanța have been worked through.