The Dangerous Tech Found Aboard ‘Dark-Fleet’ Tankers Captured by the U.S.

The practices, discovered by U.S. Coast Guard cyber teams, have left ships in the so-called dark fleet exposed to bad actors who could use those weaknesses to cause an explosion or oil spill.

The Coast Guard’s discoveries, which haven’t been previously reported, paint a picture of criminal bosses skimping on physical-safety measures while relying on information systems that could be exploited or hacked, making some tankers far more dangerous to the environment, to other mariners and to the crews on board than previously known.

“We’ve known for years that the dark fleet posed significant physical risks, because we knew they were operating old ships, they weren’t maintaining them,” said Rear Adm. Jason Tama, head of the Coast Guard’s Cyber Command. “But what we didn’t know until these boardings was what type of cyber risks were aboard these ships.”

With the U.S. and Iran on the verge of officially signing a deal to end the war and reopen the Strait of Hormuz, analysts say dozens of dark-fleet vessels stuck in and around the Persian Gulf could resume their illicit trade, significantly adding to the number of tankers being pursued by the U.S., and putting more potential ticking time bombs back out on the ocean.

Their findings, detailed in a new report shared exclusively with The Wall Street Journal, have both surprised and alarmed officials. They say the ships are intentionally skipping the physical inspections and digital due diligence are typically required of legitimate tankers carrying hazardous cargo.

To start, the ships are often loaded with expensive, high-bandwidth communications systems that keep them connected to the internet at all times. They are also running remote desktop applications such as AnyDesk and TeamViewer that enable dark-fleet owners and handlers to control and tamper with a ship’s systems from afar.

The Coast Guard discovered such applications were “persistent installations,” and that “unattended access was permitted, meaning remote connections could be established without a person present at the workstation,” according to the report.

In at least one instance, dark-fleet administrators attempted to remotely delete data onboard a vessel after the U.S. boarded it, the report said.

“I think all of us probably lost some sleep at night once we really figured out how hazardous some of these vessels are and knew that our personnel were on board,” Tama said. “We needed to make sure that those networks were not compromised or weaponized in a way that could make the environment risky for our personnel.”

The cyber teams found that some of the ships are running pirated software for business management and navigation purposes that is loaded with malware. Officials say the malware-infected computers are inherently risky when they are connected to critical operational and navigational systems.

“For a vessel that’s carrying tens of millions of gallons of crude oil, which is highly volatile, there’s always a risk of fire explosion,” Tama said. “The atmosphere in the tanks of which has to be very carefully managed to ensure that you’re not going to get a situation where there’s a fire explosion. And then there’s always a risk of an oil spill.”

Some tankers had multiple Automatic Identification System devices, which dark-fleet crews employ to broadcast fake identities to the world. In one instance, a cyber team found a toggle switch that sailors were using to electronically flip between vessel names—the digital equivalent of painting over the ship’s real name on the hull.

“Not unlike when somebody searches the obituaries and takes up a name, the dark fleet owners will seek out vessels that have been deconstructed and taken to the breaker yards, and then use those same names so that there is at least an echo in the system of this vessel existing,” said Rear Adm. David Barata, Deputy Commandant for Operations Policy and Capabilities for the Coast Guard.

Dark-fleet vessels were also found with custom-made Ethernet cables soldered to ports on AIS systems, which enabled crews to push out fake location data and mask their whereabouts. How-to guides were discovered on the ships detailing additional methods for faking GPS information, the report said.

“These vessels are attempting to hide in plain sight,” said Barata. “One of the vessels that we went to was showing that it was in Curaçao, but it was really off of Venezuela, and it was lightering oil there.”

The Coast Guard declined to specify which vessels were connected to their findings.

The report supports the conclusion that the tankers aren’t accidentally caught up in sanctioned trades, but rather intentionally designed for illicit activity, according to Michelle Wiese Bockmann, senior maritime intelligence analyst and Windward AI.

“If that’s what they’re putting out publicly, I can only imagine what they have found and not disclosed,” Bockmann said. “This is the first time I am aware of these kinds of insights being put out in the public domain.”

International efforts

By releasing details about the vulnerabilities and evasion tactics found on board dark fleet tankers, Coast Guard officials hope that other countries will be encouraged to step up efforts to interdict them.

Since the U.S. launched its global crackdown on the dark fleet in December, countries such as France, the United Kingdom and Germany have blocked and seized tankers ferrying Russian oil. In a boarding over the weekend, Royal Marines from the U.K. boarded a tanker sailing in the English Channel.

“I think the more pressure that’s put upon them to improve the condition of the vessels, to raise compliance with international law and convention makes a big difference,” Barata said. “The ocean is big, but the ports where they deliver oil are known. And so I think a concerted effort at the very least could raise the condition of the vessels so that we do not have an environmental disaster. And then we can start to impact some of this sanctioned oil.”

Write to Shelby Holliday at [email protected]