Cyber Security: AV/IT Advisory

IMO Resolution MSC,428 (98) requires all SNS systems to include measures to ensure cyber security by the 2021 annual verification date. 

The paper side of this requirement, namely the insertion of new procedures into a current SMS, or the writing of a separate cyber SMS, only goes part way to meeting the intent of the IMO Resolution. The operational aspect is another story. 

Yachting is a special sector of the maritime industry, in that the onboard entertainment systems, Wi-Fi stability and uninterrupted connectivity are deemed of equal importance as, for example, essential navigational data and machinery monitoring. One of the yacht’s entertainment channels may display position, route, speed, ETA, weather and other associated information. So essential data becomes mixed into entertainment, creating an infotainment scenario. Coming into this mix is whatever unmonitored external data streams are being sucked in by crew and guests.

Accordingly, whoever has responsibility for a yacht’s AV/IT systems has two tasks. The first is to maintain the functioning of all units associated with entertainment and with communications/connectivity. The second is to detect and prevent malicious interference with such functioning. 

There is at present no recognised training programme nor any flag-approved qualification for AV/IT personnel in any sector. The IMO has published guidelines on achieving cyber security, but there are at present no flag-approved cyber security qualifications. The UK MCA has published a Code of Practice, but there is no mandatory training. The MCA’s ETO COC for the merchant service is totally irrelevant to the peculiarities of the yachting AV/IT field. All that is available at present is an ad hoc assortment of online self-learning, onboard induction by equipment manufacturers or installers, and some useful classroom courses which have no official sanction. 

The PYA, approached the Merchant Navy Training Board (MNTB) two years ago with a proposal to submit a non-mandatory AV/IT training matrix for yacht personnel, with sufficient credibility to attain formal MNTB recognition. Early work was interrupted by the C-19 pandemic. Recently a well-attended Zoom meeting was chaired by PYA Director John Wyborn to invite industry players to contribute ideas towards giving a recognised status to yacht AV/IT personnel.

A small focus work group has now been assembled to produce a draft proposal for yacht AV/IT training and recognition. There is a general consensus that some core knowledge will be essential, but the time and monetary commitment required for mandatory classroom courses should be circumvented by using an online modular approach, incorporating some of the initiatives referred to above.

For many positions on board yachts, AV/IT skills are a sine qua non for employment. The immediate intent of the PYA and partners in this enterprise is to give AV/IT yacht personnel official recognition of their skills, thereby enhancing career prospects and providing a negotiating base for appropriate salary compensation. In the longer term, the speed of technological advance and its concomitant vulnerabilities will force the IMO to mandate formal training to cover the AV/IT systems on maritime mobile platforms. By that time, we intend to have in place an empirically tried and tested effective training system which will defend the yachting sector from such IMO over-reach as occurred during the drafting of MLC, 2006.

Accordingly, any input from any crew member in any department about how to develop an approved AV/IT (Yacht) Certificate of Proficiency (COP) will be welcome. Think big, think outside the passive classroom setting, think about any personal lessons you may have learned from online instruction during the past 12 months, think for example about ways in which you can demonstrate and upload your skills, or record and transmit a successful solution to a technical AV/IT problem, to a remote monitor/instructor who can credit your work towards issuance of such COP. Any recommendations to make about online or classroom courses you have already attended? All submissions will be acknowledged, with a follow-up acknowledgement if any suggestion is incorporated into the final approved matrix.

Captain Rod Hatch is a PYA director and chair of the Deck & Engineering Committee.