Replacing Port Cranes Just One Portion of Maritime Commerce Vulnerabilities

The White House just announced a new executive order to bolster cybersecurity at US ports, part of the government’s efforts to secure critical infrastructure at home. The most consequential step will be the onshoring of the manufacturing of cranes that are vital to port operations. Cranes now in place that were produced by the People’s Republic of China’s (PRC) state-owned company ZPMC will be replaced by cranes produced by PACEO Corp., a US-based subsidiary company of Japanese Mitsui E&S. This step also further bolsters the US-Japan partnership. Yet replacing domestic cranes just addresses the tip of the iceberg regarding maritime commerce vulnerabilities.

As concerns have arisen over infrastructure and tools produced at US ports, the US government aims to address cybersecurity concerns through replacing cranes with their own. Multiple US agencies have expressed concerns about the ability of these cranes to collect intelligence and their ability to disrupt freight flow during periods of tension.  However according to the Wall Street Journal, “ZPMC says it controls around 70% of the global market and has sold its equipment in more than 100 countries.” While the executive order may prevent the related “espionage and disruption risk” within US shores, it still captures data on the flow of US and allied commerce globally. The 2022 National Defense Strategy commits to “…improve its ability to operate in the face of multi-domain attacks on a growing surface of vital networks and critical infrastructure, both in the homeland and in collaboration with Allies and partners at risk.” Without further action outside the US, the ability for the US and its allied militaries to mobilize could be compromised. This would hamper the ability deter aggression. 

Far more important than the physical construction of port infrastructure and equipment is the technology and software that runs them. It is the digital brains of the cranes that are concerning. As worrisome is Chinese-run data systems such as Logink that track the flow of cargo at ports. It is used not only at Chinese ports, but also-foreign operating ports, “including six in Japan, five in South Korea and one in Malaysia.” While Congress recently passed an amendment to the National Defense Authorization Act banning federal agencies such as the Pentagon from using ports that rely on Logink, it continues to track global shipments. 

Many worry that this “control over the flow of goods and information about them gives Beijing privileged insight into world commerce and potentially the means to influence it.” The concerns are valid, given that  ZPMC and Logink continue to capture this important data globally.

The PRC’s focus on ports makes it a leader in providing their critical infrastructure, along with that infrastructure’s attendant vulnerabilities. The PRC has long paid attention to who controls the ports through which the world’s commerce flows, while the US is just now waking up to their importance. The PRC has a stake in 92 port projects outside of China, of which 13 are now majority Chinese-owned.  America must enhance coordination within US  government agencies and with allied port operators to ensure priority international ports cannot be used for coercion or to America’s disadvantage during a period of tension or conflict. The US International Development Finance Corporation’s financing of India’s Adani Ports to build a terminal in Sri Lanka is an important first step. 

The US must do more than just address those maritime vulnerabilities that justify onshoring jobs in manufacturing. It needs a comprehensive strategy to address vital security gaps in domestic and global maritime commerce. It should include incentivizing US companies to provide better answers  for the technology that runs the world’s ports. To safeguard national security, the US must adapt a cohesive and comprehensive strategy on global ports and act beyond its borders to bolster cybersecurity at foreign-operated ports.