Cyber Risks and Cyber Security (No.3) 15 March 2018 No.949 Download PDF (96KB) This is the last in the series of three Club circulars issued to inform and update members on cyber risks and cyber security issues.  The first circular was published on 10 November, 2017 and provided a general introduction to cyber risks.  The second circular was published on 20 February, 2018 and addressed the international regulations and guidance on cyber security.  This third circular considers some possible cyber security scenarios. INTRODUCTION Regardless of technological developments, certain familiar issues will continue to threaten the safe operation of ships.  These include perils of the sea, other vessels operating in close vicinity and system failures.   However with the increase in electrical systems onboard ships, new "cyber" threats are being identified.  These risks can arise from malicious software, targeted attacks and user error. SCENARIO 1 – Unseaworthy vessel? A bulk cargo vessel carrying grain has run aground on a sandbank due to an electronic systems failure on board. There was water ingress into the cargo holds. As a result, a salvage operation was undertaken.  Due to water ingress into the holds, around 50% of the cargo was lost.  General average was declared by Owners and expenses were incurred in bringing the vessel into a safe port and discharging the cargo. Investigations into the cause of the systems failure found that a critical software patch was not applied to one of the vessel's electronic operating systems.  The evidence also showed that in the months leading up to the grounding, the software manufacturer had sent numerous emails to one of the senior managers at Owners' offices advising that the software patch needed to be applied.  These emails had been overlooked by the manager and the recommendations were therefore not followed.  As a result of this failure, the systems were vulnerable to th