## 5 Results
### Interview and Roundtable Results  
As one of the compilers of the MCAD explained in interview \"there were some challenges around how you discretely define an incident...one of the common things that happens is ships 'going dark' where they turn their AIS off. If you tracked each one of those as individual incidents, there would be thousands of those alone\" [34]. The approach of the MCAD is therefore, where a similar attack is perpetrated simultaneously from the same source on multiple targets it is recorded as a single incident. Figure 8: Survey responses to the statement “Current legal/regulatory regimes are sufficient to account for changes in new technology and will not need to be revised or reformed to adapt”. Finally, as with other land-based industries, cyber-criminal activities such as phishing, Business Email Compromise (BEC), and ransomware are equally as damaging to the maritime sector. Some research indicates that specific targeting of maritime businesses is increasing, and that the frequency and amounts of ransomware payments are increasing with one 2023 report recording that \"the average cost of a ransom payment is US $3.2 m\" [47]. Several sources noted a lack of information sharing. On the need for sharing of cyber threat intelligence, [PERSON] noted: \"Cyber-attacks are all exploiting vulnerabilities. What we need in the industry is better information sharing of the vulnerabilities...we have some agencies that are doing that in a small way now. But we really need to improve that\" [35]. While mandatory reporting of cyber incidents may not be feasible or desirable, a mechanism for voluntary, anonymous reporting of cyber incidents would be a positive development for cybersecurity and could possibly be introduced on the back of the MCAD and the Structured Threat Information Expression (STIX, [[https://stixproject.github.io/about/](https://stixproject.github.io/about/)]([https://stixproject.github.io/about/](https://stixproject.github.io/about/)), accessed on 15 December 2023) format for reporting cyber threat intelligence. Several of these points were confirmed in interviews providing further support for the following conclusions:  
(a) Traditionally, ships with highly intermittent satellite internet connections provided relative isolation and security for outdated and unpatched IT systems. However, this is changing with the advent of LEO satellite providers--[PERSON] et. al. have noted the \"transformative impact\" of LEO satellites and the \"likely increase in cyber-attacks on ill-prepared industries\" such as the maritime sector [48]. The point was reiterated in interview with a representative of the UK Chamber of Shipping who commented \"Starlink is a game changer if's now so cheap that there's all sorts of stuff going on that wasn't before in terms of remote connectivity, bandwidth\" [49]. And, a maritime cyber practitioner made the following comment:  
The big thing was that ships traditionally were always standalone environments...  
We are now into the realms of being connected. And by virtue of the fact of the way the internet and network connectivity works, there is the ability to be seen. So the last 10 years has been a wakeup call...We have a disconnect between the real world and the maritime world. We're now using equipment that could be on there for 10 years and would be obsolete within one. [50]  
LEO always-on internet connections are highly desirable for ships' crews seeking entertainment and connectivity; however, it drastically increases the attack surface for remote cyber attack, especially on outdated and unpatched IT systems. This is exacerbated by 'just-in-time' approaches to shipping which minimise time spent in ports but maximise the difficulty of patching and updating hardware and software, and this difficulty is further exacerbated by budgetary constraints from ship owners reluctant to invest in updating hardware and software.