​

The Coast Guard announces the availability of Maritime Security (MARSEC) Directive 105–4, which provides cyber risk management actions for owners or operators of ship-to-shore (STS) cranes manufactured by People's Republic of China (PRC) companies (PRC-manufactured STS cranes). The directive contains security-sensitive information and, therefore, cannot be made available to the general public. Owners or operators of PRC-manufactured STS cranes should immediately contact their local Coast Guard Captain of the Port (COTP) or District Commander for a copy of MARSEC Directive 105–4.

MARSEC Directive 105–4 provides cyber risk management actions for owners or operators of PRC-manufactured STS cranes. Owners or operators of PRC-manufactured STS cranes should immediately contact their local COTP or cognizant District Commander for a copy of MARSEC Directive 105–4.

The Maritime Transportation Security Act's implementing regulations in 33 CFR parts 101–105 are designed to protect the maritime elements of the national transportation system. Under 33 CFR 101.405, the Coast Guard may set forth additional security measures to respond to a threat assessment or to a specific threat against those maritime elements. In addition, per 33 CFR 6.14–1, the Commandant "may prescribe such conditions and restrictions relating to the safety of waterfront facilities and vessels in port as the Commandant finds to be necessary under existing circumstances."

PRC-manufactured STS cranes make up the largest share of the global ship-to-shore crane market and account for nearly 80% of the STS cranes at U.S. ports. By design, these cranes may be controlled, serviced, and programmed from remote locations, and those features potentially leave PRC-manufactured STS cranes vulnerable to exploitation, threatening the maritime elements of the national transportation system.

As such, additional measures are necessary to prevent a Transportation Security Incident in the national transportation system due to the prevalence of PRC-manufactured STS cranes in the U.S., threat intelligence related to the PRC's interest in disrupting U.S. critical infrastructure, and the built-in vulnerabilities for remote access and control of these STS cranes.

Federal Register: https://www.federalregister.gov/documents/2024/02/23/2024-03822/issuance-of-maritime-security-marsec-directive-105-4-cyber-risk-management-actions-for-ship-to-shore#print