What if… the cyberattacks on European oil ports are a hybrid declaration of war?

The Dutch National Cyber ​​Security Center raised awareness about possible criminal motives behind those cyberattacks, given that both Belgian and Dutch ports have been victims of such attacks before (Van de Pol, 2015; Van Roosbroeck, 2022). These were large-scale cyberattacks to take over logistical systems and software in order to transport cocaine and heroin (Reyntjens and Meulemans, 2017). After the port facility workers complained about slowed-down computers, it became clear that devices were installed that allowed organized crime groups to take over control and manipulate the entire logistics network externally.

Perhaps, it was only a matter of time that these cyberattacks took place. And perhaps there is something else going on than “just” organized crime that undermines the (digital) transport sector to do their illegal drug import and export business.

Due to the recent war in Ukraine, there are fears that in response to economic sanctions against Russia, European economies risk being shut down by cyberattacks on their energy supplies and transportation (Port of Rotterdam, 2022; Ornstein, 2022). Danish maritime analyst Lars Jensen warned for the involvement of Russian cybercriminals in the cyber hacks on transport hubs (Van Marle, 2022), as happened previously in Ukraine with malware and more recently with so-called ‘Black Cat’ ransomware in Germany (Gallagher, 2022; Jansen, 2022).

In 2017, the Maersk port facility in the port of Rotterdam was shut down by NotPetya malware. Although this was not a targeted attack on the port of Rotterdam itself, it was seen as “collateral damage” of a Russian computer virus targeting Ukraine (Scheer, 2022). As such, an international seaport area does not have to be the primary target in order to be damaged by cyberattacks as a method in hybrid warfare.

Attacks on vital infrastructures and processes are timeless, but due to the growing technological development and hybrid warfare, the consequences for society seem to be increasing. North-Western Europe, especially Belgium, France, Germany and the Netherlands, has several of these maritime transport hubs in Antwerp, Le Havre, Hamburg and Rotterdam. They form a part of vital infrastructures and processes because of their responsibility for shipping handling, international and national transport, and energy distribution (NCTV, 2017). If they fail or are disrupted, this can lead to a ‘serious social disruption’ (id. 1). Recent governmental reporting on awareness about states threatening The Netherlands, for example, seem to remain unaware of specifically cyberthreats by foreign powers to Dutch ports and port facilities (cf. WODC, 2021).

Nevertheless, due to the war in Ukraine, there is a strong sense of how dependent all of Europe is on its internal (digital) vital infrastructures and how much it relies on countries outside of its EU borders, in this case on Russia for oil and gas, and on Ukraine for its grain (cf. Tamman et al. 2022). The impact of that war is becoming increasingly visible in, for example, the port of Rotterdam and it may even increase if the number of sanctions against Russia is expanded (Port of Rotterdam, 2022). Despite the fact that there are no concrete indications that the recent cyberattacks are related to the war in Ukraine and to Russia, several companies that use the seaports express their concerns. They want a ‘digital anti-aircraft gun’ against Russian cyberattacks in the port of Rotterdam, as their fear of digital sabotage is growing (Ornstein, 2022).

It is all unclear, but such ambiguousness is exactly what is typical of hybrid warfare. What if organized (cyber)crime is used by important foreign powers that can hide behind the façade of these cyberattacks “just” benefitting organized crime? The goal of creating societal and economic chaos, at least, is still achieved if that was the aim of such powers.

On May 14, 1940, the German bombardment of Rotterdam took place, destroying an entire city center in less than fifteen minutes. It was a matter of shutting down the ports of Rotterdam, because, and although not digitally yet, it was most definitely a vital infrastructure already back then. The Nazis similarly tried to bring the United Kingdom to its knees when they bombed British ports during the Liverpool Blitz.

Transport hubs have been a target throughout war history and they remain to be considered as such, also now in modern hybrid warfare.

What is different during WW2 is that now “only” Russia and Ukraine are at war officially. But hybridly spoken, maybe it is not necessary to have actors and acts of war clearly set out. These may include the cyberattacks on European ports as hybrid acts of war, and thus would constitute a hybrid declaration of war. Ports remain to be energy storage places to keep countries running. Shutting them down seems to indicate more that here is involvement of foreign powers, than that there is of organized crime that needs ports to transport illegal drugs through.

What the questions here show, is that cybersecurity awareness and resilience against the hybridification of organized crime actors and warring actors are of utmost importance, more than before. If only to get it clear what actually an act of war is and what a criminal act these days consists of, and why European maritime ports are used in order to protect them.

This article is based on and consists in part of the original piece in Dutch: https://fd.nl/opinie/1429712/zijn-de-hacks-van-europese-havens-een-hybride-oorlogsverklaring