NATIONAL MARITIME CYBERSECURITY PLAN ANNEX C CURRENT MARITIME CYBER THREATS This section provides an overview of the current threats from cyberspace and considerations of how cybersecurity affects the maritime domain. This section also examines the actors, motivations, objectives, and proliferation of “gray-zone” operations against critical infrastructure within the maritime subsector including vulnerabilities, risks, gaps, incident reporting, and the assessed future of maritime cybersecurity. Maritime Cyberspace Actors The Intelligence Community (IC) assesses that state actors, non-state proxies, and cyber criminals execute cyber campaigns targeting maritime critical infrastructure. In 2019, the Office of the Secretary of Defense designated United States critical infrastructure as a contested space where adversaries have caused, and will continue to cause, damage to United States networks. 37 As of 2014, nation-state and criminal actors were able to influence the physical environment through cyberspace, including but not limited to OT, Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), distributed control systems (DCS), and programmable logic controllers (PLC). 38 The cyberspace domain presents an asymmetric opportunity for adversaries to affect our national and economic security without kinetic exchange. The globally interconnected MTS affords adversaries opportunities to conduct maritime cyber-attacks against the United States because execution of these attacks occurs from significant distances to the target(s) and still render considerable economic losses, with variable chances of attribution. As technology develops and proliferates, more state and non-state actors will compete in this domain to gain a competitive advantage. Just as the NotPetya cyber-attack disrupted global commerce, similar malicious activities could follow and directly impact the MTS. While state-sponsored cyber activities are typically more sophisticated, criminal cyber activities also threaten the United States and occur more frequently with less sophistication. Cybercrime nets approximately $2 trillion annually for cyber criminals and projections indicate an increase to $6 trillion by 2021. 39 40 Examples of cybercrime activities in the MTS include, among others, ransomware attacks, industrial espionage, and manipulation of data to support smuggling 37 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf 38 United States Department of Commerce, National Institute of Standards and Technology, Special Publication 800-37 Revision 2. Accessed 14-July-2020, https://csrc.nist.gov/glossary/term/operational_technology 39 Robert Dorey, Managing Ports’ Cyber Risk: White Paper, (United Kingdom: British Ports Association and Astaara, June 2020), 11. 40 U.S Department of Homeland Security, Secure Cyberspace and Critical Infrastructure (Washington D.C: 2020), https://www.dhs.gov/secure-cyberspace-and-critical-infrastructure, accessed 06-July-2020 Robert Dorey, Managing Ports’ Cyber Risk: White Paper, (United Kingdom: British Ports Association and Astaara, June 2020), 11. A-11