U.S. Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers last month after cyberattacks struck the vessels while they were traveling toward the United States, according to U.S. officials.
uncertain
they → board → officials
was the VL Prosperity, a 1,093-foot Liberian-flagged crude oil tanker headed to Galveston, Texas.
asserted
Prosperity → flag → Galveston
Iranian state media identified the ship shortly after the incident and claimed hackers had gained access to its propulsion, navigation and cargo systems, knocking out communications for 30 hours.
asserted
hackers → identify → hours
The Coast Guard has not publicly pinned the attacks on Iran.
asserted
Guard → pin → Iran
But Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News in a network exclusive interview that investigators did find evidence of a malicious cyber actor.
asserted
investigators → tell → actor
"They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity," Grable said.
asserted
Grable → start → activity
The U.S. is investigating whether the two cyberattacks are connected and whether Iran or another foreign adversary was behind the attacks.
asserted
Iran → investigate → attacks
What happened?
asserted
What → happen → ?
The VL Prosperity is what's known as a supertanker — more than three football fields long and capable of carrying roughly 2.3 million barrels of oil.
asserted
what → know → oil
Public vessel data shows the ship departed Egypt's Sidi Kerir oil terminal on Aug. 1 headed for Galveston.
asserted
ship → show → Galveston
U.S. officials say it slowed near the Strait of Gibraltar around the time of the cyberattack before continuing across the Atlantic and toward the U.S.
asserted
it → say → U.S.
Iran's Mehr News Agency reported on Aug. 20 that the VL Prosperity had been attacked on Aug. 7 while transiting through the Strait of Gibraltar.
asserted
Prosperity → report → Gibraltar
Citing an unnamed crew member, Mehr alleged hackers breached the engine room, reducing engine cooling flow, increasing engine speed and interfering with fuel systems.
asserted
hackers → cite → systems
Rob Lee, CEO of Dragos, an industrial cybersecurity firm specializing in operational technology, said the Iranian report's details were technically plausible, but warned that authorities have not yet revealed who was behind the incident.
"The details that they published, from what we understand of these types of vehicles and ships and similar, is spot on," Lee said.
asserted
Lee → specialize → vehicles
"Everything they're saying is very realistic."
asserted
they → say → ?
The next day, Aug. 21, Coast Guard cyber personnel, law enforcement officers, a vessel inspector and FBI Cyber Action Team operators boarded the ship for four days.
asserted
personnel → board → days
Grable said Coast Guard teams had been alerted by interagency partners and went offshore with the FBI to climb aboard — one of roughly 40 to 50 missions the Coast Guard's Cyber Protection Team has undergone in the past year.
asserted
Team → say → year
She said investigators were hunting for malware and combing through information technology systems to root out malicious activity.
asserted
investigators → say → activity
"The real thing we're concerned about is those IT systems being connected to other systems on the ship that control propulsion, navigation and other systems that are critical to the safety of that vessel," Grable added.
asserted
Grable → concern → vessel
Typically, investigators collect data that is later analyzed, and Grable told CBS News that the Coast Guard plans to provide the vessel owner with recommendations for patching vulnerabilities.
asserted
Guard → collect → vulnerabilities
She stressed that response teams did not find any evidence indicating the ship had become unsafe to navigate when they boarded it.
asserted
they → stress → it
How difficult is it to attack a ship?
asserted
it → attack → ship
The concern surrounding large cargo vessels and maritime critical infrastructure transcends stolen files or disrupted communications.
asserted
concern → surround → files
More and more, modern commercial vessels run on internet-connected systems, relying on them for navigation, propulsion, steering, ballast and additional critical machinery.
asserted
vessels → run → navigation
A cyberattack that penetrates those operational systems could potentially be weaponized or manipulated.
uncertain
that → penetrate → systems
"When these vessels are highly connected, they're susceptible to cyber threats," Grable said, warning that an attack could lead to "a vessel blocking a waterway or a pollution incident or any other number of safety and security hazards to our ports and waterways.
uncertain
vessel → connect → ports
"
The danger that a large vessel could be compromised near an American port is something that authorities fear.
"Of course we're worried about a collision, an explosion, anything that blocks the channel for other vessels to safely enter and exit the port, pollution incidents — we're kind of worried about the whole gamut," Grable said.
uncertain
Grable → compromise → gamut
Grable said $5.4 trillion in commerce flows through U.S. ports annually — which could mean high economic stakes for even a relatively small disruption.
uncertain
which → say → disruption
"Any small delay, because of a cyber breach, like, for example, if a port has to shift to manual operations, it causes a big delay with tankers and cargo vessels coming in and out of the port," she said.
asserted
she → have → port
Perhaps most concerning, Grable said the technical barrier may not be as high as the public assumes.
uncertain
public → say → ?
How sophisticated would an attacker have to be to move beyond breaking into a computer network to manipulating machinery aboard a modern tanker?
asserted
attacker → have → tanker
"Not necessarily that sophisticated," Grable told CBS News.
asserted
Grable → tell → News
"There is malicious source code that people can get their hands on."
asserted
people → be → hands
Grable said that code is available right now, and added that "artificial intelligence is accelerating the rate at which we need to take action."
She urged operators to zero in on network segmentation, phishing attacks and basic cyber hygiene.
asserted
She → say → segmentation
"Just taking basic precautions would prevent most of these occurrences."
asserted
taking → take → occurrences
Behind that firewall, Lee said, can be a shared network containing "navigation, propulsion, ballast, steering, ship command — everything on one shared network."
asserted
network → say → network
Lee explained that artificial intelligence could make that problem worse because it can assist attackers in picking out weakly protected systems, speeding up attempts to breach internet-facing systems on energy carriers.
uncertain
it → explain → carriers
"The very thing that we think is our one protection — not that you should have one protection — is the very thing that AI is actually really good at," Lee said.
asserted
Lee → think → that
Still, experts concede that while older vessels may not have the same digitally connected control systems, even on modern ships, reaching critical machinery still requires some knowledge of the onboard environment.
uncertain
reaching → concede → environment
Asked whether cyber access to a ship could amount to a form of remote hijacking, Grable called it a fair description of the broader risk.
uncertain
Grable → ask → risk
…and 19 more, not listed.
The Aporia
