Cyber attack risk escalates for Australia's maritime sector

This is the view of industry sources puzzled by the Australian Maritime Safety Authority's refusal to renew the contract for the maintenance of navigation aids in Australia.

That contract was awarded to AMS Group when the work was first privatised in 2001 and held ever since, until now. It expires in June next year. AMS Group was the only tenderer. Presumably, the other parties who initially expressed interest realised they did not have the capacity to do the highly specialised work.

AMSA said: "AMSA's approach to market did not identify a suitable contractor and AMSA is pursuing an alternative strategy to continue maintenance of the Aids to Navigation network."

This is despite AMS Group successfully running the navigation network for the past 22 years and won numerous awards.

AMSA did not say what its new strategy is or how far advanced it is.

Industry and government sources are very concerned because with only seven months left, there is not enough time to get an alternative system running - especially the replacement of AMS Group's very effective cyber protection.

Hackers have already targeted Australian ports. Earlier this month, DP Ports had to shut ports on the eastern seaboard because of a cyber attack. About 30,000 containers were stranded for several days.

Industry sources said AMS Group was concerned without a contract renewal or a developed alternative, its 53 highly specialised staff would start looking for work elsewhere and their skill set would be lost to Australia. In most other countries the navigation aids are run by government agencies, such as the US Coast Guard.

An industry source said before refusing to renew the contract, AMSA should have developed any alternative strategy first and satisfied itself it would be safer than existing arrangements.

Industry sources said the situation was needlessly exposing the entire Australian marine navigation system and the Great Barrier Reef environment to major operational and security risks.

About 18,000 vessels a year pass through the international shipping lane between the reef and the coastline. In parts it is as narrow as five nautical miles. In those circumstances the maintenance of the navigation aids - bouys, radar stations, lighthouses and the like - is critical. As is its protection from cyber attack.

The unrenewed contract also includes the maintenance of Australia's tsunami warning system.

The Security of Critical Infrastructure Act 2018 legislates for specific cyber security controls, however, many federal government agencies are exempt from the act, including the Australian Maritime Safety Authority.

The sources said it was bizarre the Department of Defence and the Department of Infrastructure were not all over AMSA asking: what is going on?

Comment was sought from the Minister for Defence; the Minister for Cyber Security and the Minister for Infrastructure, but no replies were received before publication.