U.S. Maritime Advisory 2024 - 002
U.S. Maritime Administration: Threat Type: Foreign Adversarial Technological, Physical, and Cyber Influence Geographic Area: Worldwide.
U.S. Maritime Administration: Threat Type: Foreign Adversarial Technological, Physical, and Cyber Influence Geographic Area: Worldwide.
This revised advisory cancels U.S. Maritime Advisory 2023-009.
1. Issue: This Advisory seeks to alert maritime stakeholders of potential vulnerabilities to maritime port equipment, networks, operating systems, software, and infrastructure.
Foreign companies manufacture, install, and maintain port equipment that creates vulnerabilities to global maritime infrastructure information technology (IT) and operational technology (OT) systems.
In the past few years, the U.S. Government has published several documents (see paragraph 4 below) illuminating the risks associated with integrating and utilizing the People’s Republic of China’s (PRC’s) state-supported National Public Information Platform for Transportation and Logistics (LOGINK), Nuctech scanners, and automated ship-to-shore cranes worldwide.
LOGINK is a single-window logistics management platform that aggregates logistics data from various sources, including domestic and foreign ports, foreign logistics networks, shippers, shipping companies, other public databases, and hundreds of thousands of users in the PRC.
The LOGINK logistics platform, which was first marketed outside of the PRC in 2010, was developed by the PRC Ministry of Transport. At least 24 global ports have cooperation agreements with LOGINK, which can collect massive amounts of sensitive business and foreign government data, such as corporate registries and vessel/cargo data.
The PRC government is promoting logistics data standards that support LOGINK’s widespread use, and LOGINK’s installation and utilization in critical port infrastructure very likely provides the PRC access to and/or collection of sensitive logistics data. Nuctech Company, Ltd. (Nuctech) is a PRC State-controlled entity that manufactures and fields data-centric partially state-owned security inspection equipment at key logistic nodes worldwide.
Nuctech equipment capabilities include x-ray, backscatter, and thermal platforms; explosives detection; non-intrusive products (such as baggage and parcel inspection (NIIE); Artificial Intelligence (AI); and facial cognition/recognition capabilities). Nuctech equipment access includes biometric information, personally identifiable information (PII), patterns of life cargo information, proprietary data, and geo-locational metadata.
Several countries have raised concerns about the security risks posed by Nuctech equipment deployed in critical infrastructure given the company’s control by the PRC government. The United States added Nuctech to the Department of Commerce’s Entity List for its involvement in activities contrary to the national security interests of the United States. Specifically, the U.S. government determined Nuctech's lower-performing equipment impairs U.S. efforts to counter illicit international trafficking in nuclear and other radioactive materials.
Lower-performing equipment means less stringent cargo screening, raising the risk of proliferation. ZPMC (Shanghai Zhenhua Heavy Industries Company Limited) maintains the largest share, by sales revenue, of the ship-to-shore crane market worldwide.
These cranes may, depending on their individual configurations, be controlled, serviced, and programmed from remote locations. These features potentially leave them vulnerable to exploitation.