## 2 Literature Review
In the words of UNCTAD: \"beyond cleaner fuels, the industry needs to move faster towards digital solutions like AI and blockchain to improve efficiency as well as sustainability\" [12]. Enormous investment is being pouredinto developing autonomous ships [19; 20; 21; 22; 23; 24], and other ways AI can be applied to the MTS [25; 26]; such as improved ship design, streamlining work processes, automated monitoring of critical systems like engines, ballast and navigation, and optimised voyage planning, to name a few. While automation can improve efficiency, situational awareness, and safety, the increasing dependence on networks comprising sensors, communication, and Internet of Things (IoT) devices is driving a _convergence_ of IT and OT. In the words of leading UK researchers \"this convergence can provide useful monitoring and fine-grained control, sometimes even remotely, but also increases the possibility a cyber-attack could have physical consequences\" [27]. Kinetic impacts on a ship's OT have been demonstrated in the laboratory, proving a capability to alter the rudder angle and engine function. Using a known Common Vulnerability and Exposure (CVE) and a firmware update attack on a Programmable Logic Controller (PLC) the malicious firmware is able to use geo-fencing to define the entry coordinates to a port and begin to manipulate NMEA Data (The National Marine Electronics Association (NMEA) NMEA 0183 and NMEA 2000 are standards for electronic communication between devices in ships. NMEA allows equipment to exchange information over a single communication network allowing the integration of multiple devices including navigation, sensors, engine monitoring and others). A number of simulated studies have attempted to estimate the potential economic impacts of the shutdown of a major port or strait, such as Seville or the Straits of Malacca and Singapore (the SOMS) [28; 29]. A real-world demonstration of the enormous economic costs from a blockage of a major choke-point came with the grounding of the giant container ship _M/V Ever Given_ in 2021 [2]. While some speculated that the _Ever Given_ grounding could have been due to a cyber attack [30] the official report concluded that the root cause of the incident was \"loss of maneuverability of the ship\" due to \"wind speed, wind direction, squat, bank suction\" and communication difficulties between the two pilots and the master and bridge crew [31]. Regardless of the cause, losses from the grounding were estimated at USD 400 m (GBP 290 m) per hour or USD 9.6 bn (GBP 7 bn) in trade and goods per day [2]. In comparison to the Suez canal which has around 50 ships transiting each day, the SOMS has around 90,000 ships per year or up to 300 ships per day [32] which would make a blockage potentially six times worse by volume. Multiple sources confirm that disruptive attacks on shipping using cyber and cyber-physical attack vectors are increasing and evolving. The Maritime Cyber Attack Database (MCAD) ([[https://maritimecybersecurity.nl/](https://maritimecybersecurity.nl/)]([https://maritimecybersecurity.nl/](https://maritimecybersecurity.nl/)), accessed on 15 December 2023) [33] compiled by researchers at NHL Stenden University, Netherlands, provides an interactive global representation of open-source discrete cyber attacks on the maritime transportation sector. At the time of writing, researchers have catalogued around 165 incidents of cyber attack on the MTS, with further attacks being added through continuous updating. See Figure 1.  
Given the sometimes secretive nature of responses to cyber attack, the creators of the MCAD admit that these open-source recorded incidents are just the \"tip of the iceberg\" [33; 34]. This foreshadows one of the main challenges in maritime cybersecurity, a lack of information sharing, discussed further below. On the evolving nature of attacks, maritime cybersecurity expert [PERSON] commented:  
One of the things that has really dramatically changed over the years is the attacker's strategy.