# AIS Data Vulnerability Indicated by a Spoofing Case-Study
## 5 Discussions  
Along with the previous work by [PERSON] [35] and several other studies, our research has demonstrated AIS shortcomings. It is weakly secured and vulnerable to problems and attacks such as erroneous information, data corruption, and data spoofing. Prior to our case study of a specific spoofing event near Elba in December 2019, only a few cases in the Black Sea [38], the Strait of Hormuz [40], and the Port of Shanghai [42] were known to have a noticeable impact on maritime shipping. In the Elba case study, we internalized the lesson that a spoofing situation in which a relatively large number of generated false signals with a collision course and a very short CPA can have severe consequences for the safety of navigation. We believe that the root cause of a successful AIS spoofing attack is not only that even the cheapest jammers available online can cause complete outages of the receiver signal [52], but a lack of appropriate technical security controls. The AIS user may mistakenly change course to avoid a collision with a non-existent ship, which could have severe consequences for the safety of navigation if it happens in a dense shipping area or where natural obstacles are near. In our case, the system also reached its maximum performance, revealing AIS saturation problems due to the high number of users. It is expected, paradoxically, that this problem may increase since IMO [53] increasingly aims to ensure that more ships are equipped with technology to ensure communication and improve safety. From this perspective, VHF Data Exchange System (VDES) is seen as effective and efficient use of the radio spectrum, building on the capabilities of AIS to meet the increasing demands for data about the system [54]. Unlike AIS, VDES is much more robust and could benefit significantly from authentication mechanisms, such as digital (encrypted) signature techniques, which could be used to discard spoofed messages. As we have already noted, AIS devices no longer follow today's technological developments and cyber threats. We believe that manufacturers should offer devices that provide the reliability and resilience that have previously passed the most demanding systematic deployment methods that an attacker would use to gain access, penetration testing [55]. Such testing should be performed by qualified testers using techniques such as simulating known risk assessments, attack scenarios, remote login solution security, social engineering, and testing of the physical perimeters that protect computer and network devices. It is preferable to perform penetration testing on production systems against test systems (which must be close duplicates of the targeted production systems to provide meaningful results) or against systems that are not yet in production, such as mandated  
Figure 17: VTS applications—(a) Navi-harbor, (b) Pelagus. acceptance testing. In other words, testers must assess how AIS receivers respond to spoof signals and use this information to develop a counterstrategy to increase resistance to interference. There should be a set of standard tests that allow AIS users to select the best equipment for their application based on the degree of protection against jamming and spoofing. However, this type of testing can only be achieved through closer collaboration between the maritime sector, government security organizations, industry, and academia. In other words, security requirements can be met with robust measures that take into account currently known threats that are taken into account during the production of new devices and systems. However, the history of technology and technique suggests that a sober review of the current situation requires an imaginative overview as well. No sane historian of nuclear weaponry would advise any stakeholder in a particular technology to be satisfied at any given time that their technology has reached a stable point and is invulnerable to attack. Techniques and technologies may be said to live lives of their own.