A new perspective on salvage: The hacking salvor
April 2024
An autonomous future
The Dutch language is full of maritime-inspired proverbs, including 'The best helmsmen stand on shore'. In today's maritime sector, this perspective is increasingly becoming a reality. Ships are transitioning towards autonomous navigation, with vessels like the “Suzaku”[1], “Yara Birkeland”[2], the tug “RT Borkum”[3] and Fugro’s “Blue Shadow”[4] leading the way. The future of maritime transportation will see ships sailing autonomously, with experts guiding them from shore to destination.
When you step onto the bridge of an average ship today, you'll notice helmsmen already equipped with electronic aids like AIS, ECDIS, ARPA, and VHF. However, to move towards a more automated future, further digitalization of shipping is necessary. Ships will need to evolve into even more advanced 'sailing computers'. This increased digitalization underscores the importance of cybersecurity. Previous incidents of malicious individuals compromising shipping computer systems have resulted in significant damage. Therefore, ensuring cybersecurity is crucial for autonomous sailing.
Cybersecurity
Recognizing this risk, the International Maritime Organization (IMO) has taken steps to address it. Through resolutions like 'Maritime Cyber Risk Management in Safety Management Systems',[5] shipowners and managers are now required to identify and assess cyber risks for their vessels and organizations, integrating measures into their mandatory 'Safety Management Systems' as of January 1, 2021. This proactive approach is essential because the consequences could be catastrophic if malicious actors were to gain control of computer systems on board of an fully laden autonomous LNG tanker.
The hacking salvor
If a ‘white hat’ hacker were to intervene to neutralize this malicious interfence and restore control of the LNG tanker to the shipping company, averting a disaster, do his actions fall under the Salvage Convention 1989, and is he entitled to a salvage reward for its efforts? In my opintion, the answer to both question is ‘yes’.
The scope of the Salvage Convention
The Salvage Convention stipulates that it applies to any salvage operations, save to the extent that a contract otherwise provides expressly or impliedly.[6] When it comes to salvage operations the images of tugs towing a vessel adrift on the high seas towards a place of refuge or pulling a ship from a beach or breakwater spring to mind. One does not immediately think of someone running its fingers over a keyboard and making some mouse clicks on a computer.
Salvage operations
Salvage operations are defined as:
“[…] any act or activity undertaken to assist a vessel or any other property in danger in navigable waters or in any other waters whatsoever.”[7]
Thus, the initial inquiry in assessing whether assistance provided to a vessel or property constitutes salvage operations under the Salvage Convention is whether the assisted vessel is in danger in water. The specific location from which assistance is offered holds no significance in this assessment. Salvage operations do not mandate that the assistance be provided directly from water or a vessel.[8] Thus, rescuing a car from a canal from the bank using a tow truck,[9] rendering walk-on assistance to a leaking vessel,[10] salvaging a sunken ship with a shore crane, [11] and merely advising on how to rescue a vessel in danger,[12] and other forms of ‘dry’ assistance all qualify as salvage operations.
In short, the fact that the hacker does not carry out his activities from the water or from a ship to free the LNG tanker does not in any event preclude his entitlement to a salvage reward.
Danger
The concept of 'danger' is pivotal in determining whether assistance rendered to a vessel qualifies as 'salvage operations'. Despite its importance, the Salvage Convention 1989 doesn't offer a clear definition of 'danger'. Consequently, the term has been subject to varying interpretations across different legal systems due to the absence of guidance from both the Convention itself and its drafters.
In English law, the interpretation of 'danger' relies on an objective assessment to ascertain whether the vessel faces a real and sensible risk that could lead to loss or damage without assistance.[13] Under Dutch law, the Supreme Court has held in the “Frio Alaska” and the “Sioux”[14] that there is ‘danger’ when there is a situation of imminent loss or serious harm, for which a vessel cannot save itself without outside help. A relatively small degree of danger is sufficient to assume the existence of danger.
Does a vessel whose computer systems are hacked by malicious parties qualify as being in 'danger'? While cyber-attacks are increasingly common, there's a lack of legal precedent directly addressing this question. However, past incidents suggest parallels with traditional piracy situations. Piracy, as defined by UNCLOS, involves illegal acts directed against vessels, typically resulting in the loss of control to the perpetrators.[15] The loss of control over a vessel due to piracy poses a tangible danger, often requiring external intervention for resolution.
Though cyber-attacks differ from traditional piracy in origin, they share the common outcome of loss of control over the vessel, akin to being held hostage digitally. The intervention needed to regain control, such as through a white-hat hacker, is analogous to external assistance required in piracy situations. The absence of physical confrontation doesn't diminish the severity of the danger posed by cyber-attacks, as significant damage and loss of control remain potential outcomes.
In summary, despite the unique nature of cyber-attacks, the danger posed to vessels whose systems are compromised warrants consideration within the framework of the Salvage Convention.
Useful result
Only salvage operations which have had a useful result give right to a reward.[16] Thus, if the hacker succeeds in freeing the LNG tanker from the digital breach, he is entitled to a salvage reward.
The extent of the reward
Until this point, the white hat hacker's position was actually no different from a tugboat providing assistance to the LNG tanker. However, in determining the extent of the salvage reward, the hackers’ position is most likely different because of the fact that he was carrying out his work not from the water, but from an office on shore. Whilst taking the criteria of the Salvage Convention into account,[17] determining the extent of a salvage award is very case-specific and depends on the facts and circumstances of the matter at hand. Although a hacker's work may qualify as salvage operations, it is still a lot less risky to do so with a cup of hot chocolate with whipped cream from behind a computer than with a survival suit on in the North Sea in a storm. Future salvage awards will show whether this difference will affect the quantum of the rewards granted to ‘normal’ salvors and the hacking salvor.
Conclusion
As our industry moves towards an autonomous future, we must adapt our perspectives and redefine our understanding of concepts like salvage. In this evolving landscape, the role of the salvor is no longer confined to the seafaring heroes of yesteryear, such as Tintin's Captain Haddock. The rise of digital threats presents new opportunities for those with a passion for computers to make their mark in the maritime world, safeguarding vessels and their precious cargo from the perils of the digital age. With the increase of autonomous navigating vessels and the already existing cybersecurity risks, it is rather conceivable that such vessels will be ‘hacked’ and that the help of a ‘white hat hacker’ is required to ‘free’ the vessel. Such hacker may well be entitled to a salvage award.
* * *
[1] Japan Demonstrates Long Distance Autonomous Ship Operations (maritime-executive.com).
[2] Yara Birkeland | The first zero emission, autonomous ship | Yara International.
[3] Tug autonomously sails optimal route through port of Rotterdam | SWZ|Maritime (swzmaritime.nl).
[4] Fugro's Blue Shadow® USV Revolutionizes Ocean Data in the Middle East | Fugro.
[5] MSC 98-23-Add.1 - Report Of The Maritime Safety Committee OnIts Ninety-Eighth Session (Secretariat).pdf (imo.org).
[6] Article 5(1) Salvage Convention 1989.
[7] Article 1(a) Salvage Convention 1989.
[8] The Salvage Convention even contains a provision about the apportionment of the salvage reward if the salvage has not been carried from a vessel. See Article 15(2) Salvage Convention 1989.
[9] R. Cleton, Hulp aan schepen, W.E.J. Tjeenk Willink: Zwolle 1992, p. 9.
[10] Court of The Hague 13 February 1981, S&S 1981/61 (Walter Sperling).
[11] J. Reeder, Brice on maritime law of salvage, Sweet & Maxwell: London 2012, 1-97.
[12] F.D. Rose and others, Kennedy & Rose: Law of Salvage, Sweet & Maxwell: London 2013, 5-028 and 5-029.
[13] F.D. Rose, Kennedy & Rose: Law of Salvage, Sweet & Maxwell: London 2021, par. 5-004; J. Reed (ed.), Brice on Maritime Law of Salvage, Sweet & Maxwell: London 2011, 1-145.
[14] Hoge Raad 9 februari 1996, S&S 1996/59 (“Frio Alaska”); Hoge Raad 2 oktober 1998, S&S 2000/1 (“Sioux”).
[15] Article 101(a) UNCLOS.
[16] Article 12 Salvage Convention 1989.
[17] Article 13 Salvage Convention 1989.
