Where this sits
Governing: DfT/gov.uk Code of Practice: Cyber Security for Ships; ISPS Code (information security of the SSP); STCW Table A-VI/6-1. See also: the Yacht ETO programme cyber lessons.
Why yachts are targets
A superyacht combines three things attackers want: valuable, connected systems, wealthy and famous people, and a small crew with no dedicated IT security team. The UK Code of Practice: Cyber Security for Ships sets out how a ship should develop a cyber security assessment and plan, in the same way the ISPS Code requires a ship security assessment and plan.
| Threat | Example on a yacht |
|---|---|
| Phishing | Fake invoices to the captain, fake login pages sent to crew |
| Ransomware | Office and management systems encrypted mid-charter |
| Operational technology attack | Interference with navigation, engine monitoring or AV and lighting systems |
| Data theft | Guest identities, itineraries, owner correspondence |
| Location leaks | Real-time position revealed through social media or apps |
| GNSS jamming or spoofing | False position data in some regions |
Everyday rules
Your yacht's IT policy will be specific. The basics:
- Never plug in unknown USB sticks or charge personal devices from bridge or engine-room computer ports.
- Keep guest, crew and operational networks separate. Do not share passwords across them.
- Use strong passwords and do not write them on the bridge.
- Treat unexpected emails with suspicion, especially urgent ones about payments or logins.
- Update your own devices; they join the crew network.
- Report anything odd: pop-ups, slow systems, unknown devices, strange email.
WARNING: Contractors' laptops Engineers, AV technicians and refit contractors connect laptops to the yacht's systems. The SSO or ETO should know who is connecting what, and when.
Information security and social media
The ISPS Code treats the SSP as confidential. The same thinking applies to anything that tells an outsider how the vessel is protected, where it is going, or who is aboard.
Do not post:
- the yacht's name with its current or planned location;
- guests, their children, or anything that identifies them;
- images of security desks, CCTV monitors, gangway procedures or door codes;
- deck plans, safe locations, or pictures of crew passes.
Most yachts include social media rules in crew contracts. Breaching them is a common reason for dismissal, and it can put people in danger.
Recognising a cyber incident
Signs include:
- systems behaving oddly or slowly for no reason;
- unexpected pop-ups or ransom messages;
- navigation position jumping or disagreeing between sources;
- colleagues receiving messages "from you" that you did not send.
Stop, do not try to fix it yourself, and report to the ETO or SSO. If it affects navigation, tell the officer of the watch at once.
TIP: Two questions Before you click, plug in or post, ask: "Would I be happy explaining this to the SSO?" and "Does this tell a stranger something useful about the boat?"