USCG Issues Policy Regarding Reporting Suspicious Activity and Breaches of Security

This is CG-5P Policy Letter 08_16.   It discusses requirements and guidelines as summarized below for MTSA regulated ports.  The regulatory standing is quoted as 33 CFR 46, 70103.  It is dated December 14 and was distributed on January 16.  This renewed focus includes reporting requirements for cyberattacks and Unmanned Aircraft Systems activity.

The stated purpose of the letter is to “Promulgate policy for use by Maritime Transportation Security Act (MTSA) regulated vessels and facilities outlining the criteria and process for suspicious activity (SA) and breach of security (BoS) reporting”.

It states, “An owner or operator of a vessel or facility that is required to maintain an approved security plan . . . (a) shall, without delay, report activities that may result in a Transportation Security Incident (TSI) to the National Response Center (NRC), including SA or a BoS. And, (b), the Facility Security Plan (FSP) shall . . . be consistent with the requirements of the National Transportation Security Plan and Area Maritime Transportation Security Plans.”

“The COTP will affirm consistency to help ensure alignment of SA and BoS communication procedures within FSPs throughout their area of responsibility.” 

Regarding cyber activity the letter states, The target and intent of malicious cyber activity can be difficult to discern. The fact that business and administrative systems may be connected to operational, industrial control and security systems further complicates this matter. The Coast Guard strongly encourages vessel and facility operators to minimize, monitor, and wherever possible, eliminate any such connections.

The letter goes on to describe U. S. Coast Guard requirements for reporting BoS and SA for both physical and network or computer-related events.  The U.S. Coast Guard regulations define a breach of security as “an incident that has not resulted in a TSI but in which security measures have been circumvented, eluded, or violated.” This definition includes the breach of telecommunications equipment, computer, and networked system security measures where those systems conduct or support functions described in vessel or facility security plans or where successful defeat or exploitation of the systems could result or contribute to a TSI.

BoS incidents may include, but are not limited to, any of the following:

  •  Unauthorized access to regulated areas;
  • Unauthorized circumvention of security measures;
  • Acts of piracy and/or armed robbery against ships;
  • Intrusion into telecommunications equipment, computer, and networked systems linked to security plan functions (e.g., access control, cargo control, monitoring), unauthorized root or administrator access to security and industrial control systems, successful phishing attempts or malicious insider activity that could allow outside entities access to internal IT systems that are linked to the MTS;
  • Instances of viruses, Trojan Horses, worms, zombies or other malicious software that have a widespread impact or adversely affect one or more on-site mission critical servers that are linked to security plan functions; and/or
  • Any denial of service attacks that Any denial of service attacks that adversely affect or degrade access to critical services that are linked to security plan functions.

 The letter contains lists of Suspicious Activities and Breaches of Security that should be reported and concludes with a Glossary of Terms.

Click here  for the complete document.