Navigating cyber resilience in seaports: challenges of preparing for cyberattacks at the Port of Rotterdam

1. Introduction

Ports are targets for cyberattacks because they are critical links in global supply chains and production processes (Ahokas et al., 2017; Heilig and Voß, 2017). They are digitalizing at an ever-increasing pace by introducing initiatives for sharing logistical information, coordinating port processes and acquiring real-time information about assets to optimize the efficiency of port operations (Port of Rotterdam Authority, 2022). Ports’ increasing dependence on and adoption of technological solutions is introducing vulnerability to a range of cyberattacks (Kapalidis, 2020; Molavi et al., 2020). In recent years, cyberattacks have disrupted infrastructures at the ports of Antwerp (2011–2013, 2022), Rotterdam (2017), Los Angeles (2017), Barcelona (2018), Long Beach (2019) and Houston (2021) (de la Peña Zarzuelo, 2021). The most impactful cyberattack on the maritime sector to date was NotPetya in 2017, when the Danish logistics and transports company Maersk suffered significant business disruption and 76 port terminals were affected (Greenberg, 2018). With this attack, it became clear that cyberattacks could target not only systems that generate, manage, store and exchange data but also the critical systems that ensure that terminals and bridges function, electric power and gas are distributed, and containers are transported (Kapalidis, 2020). Exploiting the vulnerabilities of these systems can manifest in the disruption of seaports and can have consequences reaching far beyond ports.

With cyberattacks becoming more diverse, frequent and targeted (Dunn-Cavelty and Wenger, 2020), the chances of disruptions occurring in ports have increased. As a result, concerns regarding the insecurity of ports against cyberattacks and the need to be better prepared against disruptions have materialized among scholars and policymakers (Ahokas et al., 2017; Tam et al., 2022). Across disciplines, resilience has emerged as a way of thinking about the permanent, open-ended responsiveness of socio-technical systems to adversity and uncertainty (de Bruijne et al., 2010; Dunn-Cavelty et al., 2015). Some scholars observe a shift away from prevention and the politics of urgency to strategies of building resilience (Medd and Marvin, 2005; Walker and Cooper, 2011). Cyber resilience can be understood as the “ability of systems to prepare, absorb, recover, and adapt to cyberattacks” (Linkov and Kott, 2019, p. 2). Despite the rise in the use of the term resilience in policy-making, few studies in cyber risk management have included challenges for governing, steering or influencing socio-technical systems toward enhanced resilience against cyberattacks (van Eeten, 2017), although some have examined governance mechanisms and the cybersecurity institutional landscape (Kuerbis and Badiei, 2017). Van Eeten (2017) noticed a disconnect between governance literature, which tends to focus primarily on discourses of governance, and cybersecurity research, which tends to focus on technological solutions to security issues. Furthermore, there is an emerging body of literature on information technology (IT) governance (Priyadarsini and Kumar, 2022), but the governance of critical operating systems that ensure seaports function is underexposed in those debates (Tam et al., 2022).

We explore the governance of cyberattacks in seaports, taking the Port of Rotterdam (PoR) as a case study. We assume that building cyber resilience in seaports is a complex governance task because capacities to deal with cyberattacks lie with a broad range of stakeholders and institutions across policy levels and infrastructure domains (Carr and Lesniewska, 2020; Kuerbis and Badiei, 2017), and decisions about cyber resilience are made in a context of limited knowledge and socio-political ambiguity (Dunn-Cavelty and Wenger, 2022; Egloff, 2020). In risk governance debates, dimensions of distributed responsibilities and uncertainty and ambiguity are used to investigate the complexity of governing risks (Klinke and Renn, 2012; Renn et al., 2020). By developing a conceptual framework based on these insights and modifying and applying it to investigate the challenges of governing cyber risks in seaports (Dunn-Cavelty and Wenger, 2022; Egloff, 2020), we investigate how to govern seaports toward enhanced cyber resilience.

Section 2 develops a conceptual framework for governing cyber risks. A description of our methodology is presented in Section 3. Section 4.1 introduces the relevant institutional arrangements for cyber resilience at the PoR. Based on our empiric data, this article then examines the challenges in governing the PoR toward cyber resilience (Sections 4.2–4.4). Section 5 concludes by developing ideas on how seaports could be governed toward cyber resilience.

2. Governing cyber risks in seaports: distributed responsibilities, uncertainty and ambiguity

Recently, ports have undergone a digital transformation (Molavi et al., 2020), driven by emerging technologies, such as the Internet of Things, big data and autonomous vehicles (Sanchez-Gonzalez et al., 2019). The adoption of these technologies has enabled a high degree of automation and streamlining in port procedures (Heilig and Voß, 2017), but they have also introduced new vulnerabilities to a range of cyberattacks. Potential cyberattacks include data or identity theft, espionage, malware and direct denial-of-service in which access to service is blocked (Linkov and Kott, 2019; Sanchez-Gonzalez et al., 2019). The disruption of highly interdependent logistics in seaports as a result of a cyberattack can reduce the amount of freight a port can process for a certain duration (Lam et al., 2017; Verschuur et al., 2020).

The growing vulnerability of seaports to cyberattacks is spurring on seaports to address cyber risks in a variety of ways (Tonn et al., 2019). They may include preventive measures like firewalls, software encryption and system compartmentalization, design methods which improve system architecture or measures related to system management and operation (Paté‐Cornell et al., 2018). These approaches fall under the umbrella of cyber security, which refers to “measures taken to protect a computer or computer system against unauthorized access or attack” (von Solms and van Niekerk, 2013, p. 97). Discussions on cyber security tend to focus primarily on technological strategies (van Eeten, 2017). However, the extensive nature of cyberattacks emphasizes that these measures cannot eliminate cyber risks completely and that sufficient cyber risk management cannot be achieved solely through cyber security measures (Collier and Lakoff, 2008; Medd and Marvin, 2005; Walker and Cooper, 2011).

Many global, interconnected and complex risks, such as those posed by climate change and digitalization, are challenging conventional risk management approaches because their effects are characterized by complexity and uncertainty and, as a result, are almost impossible to calculate or solve (Carr and Lesniewska, 2020; Renn et al., 2020). Building resilience is seen as a way to deal with this complexity and as a shift away from what is perceived as ad hoc arrangements for responding to emergency situations (Medd and Marvin, 2005; Walker and Cooper, 2011). Lakoff (2007) contrasts permanent preparedness, which is a prerequisite for resilience, with the idea of prevention that is common in conventional risk management. The principle of prevention prescribes avoidance and rejects any form of risk-taking, whereas preparedness seeks to develop a set of operational criteria for response based on future scenarios. In the quest to achieve a permanent state of preparedness, the techniques applied include monitoring, scenario development, simulations, stockpiling and crisis communications systems (Lakoff, 2007, p. 254).

The “governance of preparedness” (Medd and Marvin, 2005) can be seen as a complex governance task because it requires stakeholders to continuously address risks across policy levels and infrastructure domains. Due to processes of deregulation and privatization of critical infrastructure (CI) systems, responsibilities for addressing cyber risks have increasingly shifted to nongovernmental organizations (Cedergren et al., 2018; de Bruijne and van Eeten, 2007; Kuerbis and Badiei, 2017). These developments have created a situation where coordination between governmental and nongovernmental organizations has become increasingly necessary to provide cyber security and resilience for CI systems (Carr, 2016; Dunn-Cavelty and Suter, 2009). At the same time, these scholars have identified persistent ambiguity with regard to the parameters for this type of partnership and questioned to what extent the state should be abdicating authority and responsibility to private organizations (Carr, 2016; Dunn-Cavelty and Suter, 2009). In addition, building cyber resilience for CI systems takes place in a context of limited knowledge (Dunn-Cavelty and Wenger, 2022; Egloff, 2020). So far, few studies have analyzed the collective activities needed for building cyber resilience in seaports and the governance challenges that come with preparing for cyberattacks (van Eeten, 2017). This study applies three dimensions commonly used in risk governance debates, namely, distributed responsibilities, uncertainty and ambiguity, to describe particular challenges of governing cyber risks and building resilience in seaports.

The first dimension is distributed responsibilities, which refers to the way institutional capacities are distributed across a range of stakeholders (Voß et al., 2007). For cybersecurity, responsibility for protecting computer systems against cyberattacks primarily lies with internet and communications technology (ICT) managers, who should monitor system vulnerabilities and potential cyber risks and intervene where necessary. However, preparing for potentially disruptive cyberattacks requires the collective effort of all port stakeholders, including governmental authorities and private and public stakeholders (Heilig and Voß, 2017; Kuerbis and Badiei, 2017). Decision-making in a context where responsibilities lie with a broad range of heterogeneous stakeholders is complicated by the fact that these stakeholders have different problem perceptions, values and interests. For seaports to be prepared for cyberattacks, the stakeholders’ perceptions, values and interests need to be aligned and decision-making processes coordinated (Heilig and Voß, 2017).

Second, governing cyber risks is characterized by uncertainty, which refers to the “limitedness or even absence of knowledge that makes it difficult to assess the probability and possible outcomes” of cyberattacks (Klinke and Renn, 2012, p. 276). According to Sanderson (2012), the core problem is not the difficulty of assessing data on which to base decisions but the fact that such data does not yet exist and might never do so. This uncertainty can be a consequence of rapid technical development, where there are few chances to establish a priori the whole spectrum of possible interactions of technologies and foresee the nature and impact of cyberattacks (Bonfanti, 2022; Linkov and Kott, 2019). Despite the limitations of knowledge regarding new technologies, potential attack targets and consequences, decisions about governing cyber risks are still being made. For cybersecurity, uncertainty is addressed by avoiding cyberattacks from occurring, for example, by encrypting software or patching vulnerabilities. Cyber resilience requires “ongoing construction of the appearance of certainty and clarity in the midst of uncertainty” (Atkinson et al., 2006, p. 696). Potential strategies to achieve that involve simulating cyberattacks in crisis exercises or developing scenarios.

A third characteristic is ambiguity, which pertains to the variability of (legitimate) interpretations of the same risk phenomena and their circumstances (Klinke and Renn, 2012). Two types of ambiguity can be distinguished: interpretative ambiguity, which denotes “the variability of (legitimate) interpretations based on identical observations or data assessments” (Renn et al., 2020, p. 3) and normative ambiguity, where different concepts of what is tolerable can be distinguished (Klinke and Renn, 2012). Cyberattacks take place in a contested environment with a lack of public transparency and trusted knowledge regarding who launched a cyberattack, with what purpose, the quality and effects of an attack and the appropriate reactions to it (Dunn-Cavelty and Wenger, 2020). According to Egloff (2020), the contested information environment creates fractured narratives of a shared cyber event and increases interpretive ambiguity. Moreover, substantially different conceptualizations of which risks are deemed acceptable may exist between stakeholders, increasing normative ambiguity. As a result of fundamentally different value systems and worldviews, stakeholders might perceive the risk differently and set different priorities for technical developments and governance strategies (Goerlandt, 2020). Moreover, the difference between accepting the risk of an infrastructure disruption and preparing for one (cyber resilience) versus making a system impregnable (cyber security) can lead to alternative decisions about where to invest.

We can differentiate between distributed responsibilities, uncertainty and ambiguity as characteristics of governing cyber risks. These characteristics not only individually lead to governance challenges but also reinforce each other. For example, a lack of knowledge about cyberattacks can contribute to disputes about how cyber resilience should be implemented. These disputes are reinforced by more stakeholders becoming involved in cyber risk management. In the next sections, we will introduce our methodology that served to assess how these characteristics emerge in the port environment.

3. Methodology

This article draws on a case study design to understand the complexity of governing the PoR toward cyber resilience as a complex and context-specific issue (Harrison et al., 2017). The PoR has a sophisticated and interconnected CI system that is vulnerable to infrastructure disruptions and had suffered a large-scale cyberattack in 2017. We chose a qualitative approach since governance processes are difficult to capture effectively through quantitative study (Yadav and Banerjee, 2022). Qualitative research allows us to examine cyber risk governance challenges and processes in seaports in depth. To this end, three qualitative research methods were used: desk research of policy documents and law and legislation, participatory interviews and semistructured interviews. We triangulated the data to corroborate findings across data sets and reduce researcher and respondent bias (Bowen, 2009).

First, we reviewed and analyzed documents (n = 46), including various international, national, and regional law and legislation, cyber security assessments, guidelines and strategies (between 2011 and 2022) to gain an understanding of cyber resilience regulatory frameworks (Table A1). This analysis also informed the design of the semistructured interviews. Second, between June 2020 and April 2022, we observed and participated in (n = 15) events organized by FERM (a foundation focused on raising awareness about cyber resilience at the PoR) and the national cyber security center (NCSC) to gain understanding of relevant topics around cyber resilience in the PoR and to come into initial contact with key stakeholders for interviews (Table A2). We wrote fieldnotes based on these observations.

Finally, we conducted semistructured interviews (n = 18) between July 2020 and February 2022 to analyze the governance challenges and coping strategies of governing cyber resilience at the PoR. Our aim was to cover a broad spectrum of stakeholders to limit the bias of a narrow scope of respondents. This is especially relevant as preparing for disruptive cyber-attacks requires the collective effort of most port stakeholders (Heilig and Voß, 2017; Kuerbis and Badiei, 2017). We also created some overlap regarding function descriptions and backgrounds to be able to compare and contrast interview material. To that extent, our selection criteria were organizations that own, manage or use infrastructure connected to the PoR, are affiliated with cyber risk management in Rotterdam and are concerned with crisis management. Interviewees included stakeholders from organizations, such as the PoR Authority, the Rotterdam–Rijnmond Safety Region, the municipality of Rotterdam, the Dutch Ministries of Justice and of Safety and Economic Affairs and various cyber consultancies, port companies and CI providers (Table A3). To select interviewees, we first mapped the institutional arrangements relevant to attaining cyber resilience in the PoR. Participatory observations brought us into initial contact with some key stakeholders. From there, we used a snowballing method to come to our full list of interviews. The interviews were based on a thematic interview guide that was inspired by the conceptual framework developed in Section 2. Questions included how port stakeholders would respond to a cyber-attack scenario; how they cope with uncertainty, ambiguity and distributed responsibilities; and what they saw as the biggest challenges and opportunities for governing cyber resilience.

The interviews were conducted in Dutch and consequently transcribed and translated into English. We approached the interview transcripts, field notes and relevant documents inductively through qualitative content analysis (Mayring, 2000). We coded the material because it allowed us to capture the essence of the data and actively facilitated the development of categories and the analysis of their connections (Saldaña, 2013). We conducted the analysis in two steps. First, we used initial and open coding. Second, we themed and categorized these codes and connected them to the conceptual framing detailed in Section 2. The progress of the analysis was checked by the coauthors and a selection of participants. Figure 1 depicts the codes and themes that emerged from the analysis.

4. Governing cyber resilience at the Port of Rotterdam

5. Conclusion

Using the example of the PoR, this article has explored the governance of cyber risks in seaports. We have identified governance strategies for dealing with cyberattacks in seaports and discussed which challenges stakeholders face in building cyber resilience. Our analysis revealed that to some extent port stakeholders have developed strategies that focus on preparing for disruptions. For example, collective crisis exercises that simulate a disruptive cyberattack are organized by FERM on a regular basis. Furthermore, there is much discussion about how to raise awareness of the insecurity of port infrastructure against cyberattacks and the need to be prepared. These findings can be placed in a broader trend of moving away from ad hoc arrangements for responding to emergency situations to a more permanent governance of preparedness that focuses on building resilience (Medd and Marvin, 2005). However, we identified that the strategies of preparedness remain informal, incremental and noninstitutionalized. In the event of an actual cyberattack, stakeholders often do not know what to do because they do not have incident response plans in place, or it is unclear which legal obligations they have.

Other governance challenges we identified include a lack of information exchange about cyber risks, insufficient knowledge regarding cyber risks and, as a result of ambiguous risk perceptions and economic interests, disagreement about how to govern seaports toward cyber resilience. These findings highlight how characteristics of distributed responsibilities, uncertainty and ambiguity reinforce each other and lead to various governance challenges. We can also conclude that aligning stakeholders’ perceptions, values and interests has proven difficult, which complicates governing cyber resilience in a context where responsibilities lie with a broad range of stakeholders (Heilig and Voß, 2017). Yet, coordination between governmental and nongovernmental organizations has become increasingly necessary to provide cyber security and resilience for CI systems (Carr, 2016; Dunn-Cavelty and Suter, 2009). Furthermore, we found a mandatory legal framework for building cyber resilience is missing, which means building resilience largely depends on the creativity and agency of stakeholders. As a result, informal factors such as trust, personal networks and a sense of shared responsibility, emerge as key components of the current governance of cyber resilience. These findings are in line with Boholm et al. (2012), who advocate a practice-near approach to resilience. However, we also argue that without a comprehensive legal framework for cyber resilience, the scope of action of these stakeholders remains limited. Furthermore, the price of resilience should be considered. We identified a lack of economic incentive among port stakeholders to invest in cyber resilience. Boin and van Eeten (2013) point out that resilience is often described in terms of redundancy and slack, but these components usually come at a cost, which creates challenges for implementing resilience strategies.

We conclude that, for the time being, resilience is no more than an ideal at the PoR that some stakeholders are trying to incrementally translate into action(s). Yet resilience and a culture of preparedness will likely become increasingly important in the face of global, interconnected risks. For example, a proposed EU directive (EU, 2020a) that should update the EU Directive (EU, 2016) could result in statutory requirements to improve the resilience of CIs against cyberattacks. Future research is needed into how procedural standards and future legislation can cope with the continuous innovation of cyberattacks and the digitalization of seaports and how they can contribute to building cyber resilience. Furthermore, since our research is based on a single case study, it would be relevant to compare the different challenges and processes for cyber resilience in various seaports. Gaining insight into how seaports can better prepare for infrastructure disruptions as a result of cyberattacks is important for introducing new technological solutions to guarantee the socioeconomic function of seaports.