Port cranes combine heavy physical force, remote access for vendors and a growing layer of automation and AI planning. The threat model therefore centres on remote paths into the crane, the vendor components inside it, and what any planning agent is allowed to command. Public facts so far describe risk and rules, not confirmed attacks.
What have US authorities said?
Two public items frame the discussion, and I found both through search results rather than opening the documents.
- A Federal Register notice dated 23 February 2024 announced Coast Guard Maritime Security Directive 105-4, covering cyber risk management actions for ship-to-shore cranes manufactured by companies in the People's Republic of China. The Coast Guard stated that such cranes account for nearly 80 percent of ship-to-shore cranes at US ports and that remote control and programming features potentially leave them vulnerable to exploitation. The directive itself contains security-sensitive information and is available to operators through their Captain of the Port.
- A Coast Guard Cyber Command report on these cranes, described in search results, says its teams have not observed active malicious cyber activity on cranes, while noting that a threat actor could gain backdoor access and disrupt operations. It also describes unauthorised modems found on some cranes, first publicly reported on 12 March 2024 through a House committee investigation.
Press coverage of that investigation reports the modems did not appear to support crane operations, and that some ports said they had not requested them. An industry association described the episode as a case study in cyber defence, citing Coast Guard testimony that no breaches of port equipment were known. Treat all of this as context, and read the primary documents before quoting.
What is the threat model for a crane?
A crane is a set of controllers, drives, sensors, cameras and operator systems connected to a terminal network and, often, to a vendor for support. Break it into zones, which is the approach ISA describes for the IEC 62443 series for industrial automation and control systems. NIST SP 800-82 Rev. 3 also covers operational technology in transportation.
Questions to ask for each crane:
- What connects it to the outside? Vendor remote support, cellular modems, remote operation desks and update channels.
- What is inside it that you did not choose? Controllers, modems and firmware from the maker or its suppliers.
- What can a remote user do? View, diagnose, reprogram or operate.
- What watches it? Logs and alerts that the terminal, not the vendor, controls.
What changes with AI agents and robots?
Terminals adding automation introduce planners that assign containers, schedule lifts and coordinate vehicles. Each planner adds inputs and command rights.
- Data integrity becomes safety. A wrong container location or weight is an input that drives a physical move.
- Agents hold credentials to systems that talk to cranes.
- More vendors. Planning software, vision systems and robots bring more components and update paths.
- Faster actions. An agent can issue many commands quickly, so limits must be enforced outside it.
What to do
- List every network path to each crane, including modems, and confirm each is intentional and documented.
- Ask the manufacturer for a bill of materials covering controllers and communication modules, and for the support period of each.
- Terminate vendor remote access at a controlled gateway with named accounts, multi-factor authentication, approval for each session and full recording.
- Segment crane networks from the terminal office network and from each other.
- Log control commands and configuration changes to storage you own, and alert on unexpected ones.
- Limit planner authority. Hard bounds on motion, load and area live in the crane controller, not the agent.
- Validate planning inputs such as weights and positions before they reach an actuator.
- Rehearse a manual operations plan for when automation must be switched off.
- Review contracts for software update, vulnerability disclosure and access terms.
Safeguard's SBOM and dependency tooling can inventory software you build, which helps for terminal planning applications, though crane firmware inventories need to come from the manufacturer.
Quick check
Has a cyberattack on port cranes been confirmed?
The Coast Guard report I found says its teams had not observed active malicious cyber activity on cranes. Risk and potential are described, not confirmed incidents.
Where should limits on AI planners be enforced?
In the crane controller and safety systems, outside the planner, so a bad or manipulated plan cannot exceed physical limits.
Sources
- Federal Register, MARSEC Directive 105-4 notice, 23 February 2024 (found via search)
- US Coast Guard Cyber Command, ship-to-shore cranes manufactured in China (found via search)
- ISA, ISA/IEC 62443 series of standards
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
Last reviewed: 18 October 2026.
