Maritime and port cybersecurity.

Recently a researcher wrote about me, behind the paywall of an academic paper, without consulting me or offering a right of reply, that when I spoke up it was to praise the resilience of the maritime sector and to argue that attacks on it are impossible. For someone who has worked on the subject for more than 25 years, who started this blog in 2017 (when maritime cyber was still of no interest to anyone), who built the first global database of maritime cybersecurity incidents more than five years ago, and who describes part of it here, you will find that as funny as I do.

To those researchers, if you have a minimum of ethics and consideration, allow me only the freedom not to fan the flames when an incident happens, and to avoid on those occasions, out of modesty or out of ethics, reaching every time for the “I told you so” or the “if you need me, I am here”.

An LNG carrier loaded with American gas is still looking for somewhere to deliver her cargo, a month after leaving Louisiana. She gave up the Adriatic terminal, then Barcelona, and is now heading for Gibraltar. Her crew reported losing access to shipboard systems in early September. She is the third ship in a month whose crew suspects a cyberattack. The Italian Coast Guard describes a malfunction whose cause could not be determined. Three successive publications, each more precise than the last, speak of a cyberattack, and none of them comes from a party with access to the ship.

On 15 April 2026, Marlink published three cyber threat intelligence reports [1], built on the 2025 activity of its security operations centres (SOC) and on more than 200 security assessments. The satellite connectivity provider has a rare vantage point: direct telemetry from ships in operation. These documents therefore contain original field data, worth analysing for those of us who usually sit on the other side (well, often), waiting for the attacker to communicate and, broadly, watching the same sources.

On 15 September 2026 the US Coast Guard acknowledged that a federal cyber team had boarded an oil tanker bound for Texas. The next day several sources reported that two vessels were involved, then that nearly twenty merchant ships were under particular watch. The case had begun a month earlier, with an account published in Tehran.

This article is also available in French.

Every year, in northern Norway, several public agencies authorise a few days of GNSS jamming and spoofing transmissions around the island of Andøya, so that manufacturers and operators can put their equipment through real conditions. The exercise is called Jammertest [1], and it is the largest of its kind open to the public. During the 2022 edition, one participant left the Strava app running on their phone in the middle of a spoofing trial. They promptly posted an accidental personal best [2]: 6.44 kilometres in 5 minutes and 50 seconds, with 495 metres of elevation gain. Their phone was not part of the trial. A falsified positioning signal travels into everything that listens to a GNSS receiver, including equipment that has nothing to do with navigation.

This article is also available in French.

Today, for a change from cyber (although we will be talking about AI, data and bias), I suggest you grab a bag of popcorn and settle in comfortably. We are going to talk about a film. More precisely, about two scenarios. Tempted? Off we go.

Two scenarios for a good film, then, with espionage and high-seas operations in the background but, in the end, a single story (and it ends well).

First scenario. A Russian ship, managed by a company under US sanctions, moving slowly in the middle of the Atlantic Ocean, about 1,600 kilometres (860 NM) east of Barbados, and staying there for 41 days. No port call, apparently no other ship encountered, its AIS transponder on the whole time, and, according to some submarine cable maps, a piece of “critical” underwater infrastructure nearby. Calling it a spy ship is only one step further, a step easily taken if you do not stand back.

Second scenario. The same ship, on the same dates and in the same position, running a prospecting campaign across a metallic sulphide deposit, with the fairly irregular kinematics typical of that kind of operation, inside mining blocks allocated to Russia by the International Seabed Authority, 305 kilometres (165 NM) from the nearest cable.