Image: AI Generated
The U.S. maritime sector is increasingly vulnerable to cyber threats, raising concerns over economic and national security risks, according to experts speaking at the AFCEA Atlanta Chapter’s Homeland Security Conference on February 26-27.
A panel of industry specialists, including Daniel Turissini, Rick Siebenaler, and Rear Adm. John Mauger (Ret.), highlighted the urgent need for stronger cybersecurity defenses across the maritime industry. With 90% of U.S. imports and exports passing through ports—accounting for up to 35% of the country’s GDP—even a single cyber attack could have catastrophic consequences.
Mauger pointed out that the maritime industry contributes $5.4 trillion annually to the U.S. economy and employs one in eight Americans in some capacity. That dependence on maritime logistics makes it a prime target for cybercriminals and geopolitical adversaries.
Jurisdictional Challenges and Weak Cyber Defenses
The industry’s cybersecurity vulnerabilities are exacerbated by jurisdictional complexities. The U.S. Coast Guard oversees waterways, but once on land, authority becomes fragmented among state, city, county, and private businesses. That makes coordinated cybersecurity enforcement a challenge.
Adding to the risk is the fact that most small and medium-sized businesses (SMBs) within the sector lack the resources to invest in robust cybersecurity measures. Siebenaler emphasized that these businesses, which include tugboat operators, trucking companies, fuel suppliers, and warehouse firms, are often the weakest links in the supply chain.
“All I have to do is go after one or two of those,” Siebenaler warned. “If I pick the right ones—say, the people who put fuel on a ship—I can stop commerce at that location.”
Cyber Threats Targeting Key Maritime Technologies
The industry’s reliance on outdated technology is another major concern. GPS spoofing, for instance, can mislead vessels about their location, raising the risk of accidents like the Key Bridge incident. Similarly, automatic identification systems (AIS), which track ship movements, can be manipulated to cause confusion or even disguise unauthorized vessels.
Terminal operating systems, which function like enterprise resource planning (ERP) software, also pose cybersecurity risks. These systems manage radio frequency identification (RFID) tags that track containers, making them attractive targets for hackers seeking to disrupt port operations.
China’s Role in U.S. Maritime Cybersecurity Risks
An additional complication stems from reliance on China-manufactured technology in U.S. ports. Many shipping data systems and port cranes are designed or supplied by Chinese companies, raising concerns over foreign surveillance and control over critical infrastructure.
“There’s a big linkage in tracking shipping data that is all based upon technology and services provided by China,” Siebenaler noted. “So, pretty much any ship and the goods that are on that ship are known and understood by China as a free service they offer to the industry.”
Regulatory Efforts and Ongoing Challenges
Progress has been made in recent years to address these vulnerabilities. The Coast Guard’s 2021 cybersecurity strategy laid the groundwork for stronger protections, while a 2024 executive order from the White House further emphasized the risks posed by foreign-manufactured port equipment.
In January 2025, the Coast Guard finalized cybersecurity regulations aimed at ships and port facilities, marking another step forward. However, gaps remain in enforcement and industry-wide adoption of best practices.
Despite ongoing challenges, the industry is rapidly integrating new technologies, including autonomous port vehicles, underwater drones, and big data analytics. Yet, Siebenaler estimated that maritime cybersecurity remains 20 years behind other industries. Without urgent investment and coordinated efforts, the risks to national security and global trade will continue to grow.
