NORFOLK, Va. — The Pentagon is reportedly concerned Chinese-made cranes operating at U.S. ports may be a “Trojan horse,” collecting intelligence on the movements of defense supplies.
According to the Wall Street Journal, ship-to-shore cranes manufactured by Zhenhua Heavy Industries Co. — or ZPMC — contain sophisticated sensors with the capability of tracking the origin and destination of cargo containers.
The cranes in question are widely used by the Portsmouth-based Port of Virginia, with four having been installed at the Virginia International Gateway in 2019 after sailing to Hampton Roads from China. The cranes, standing 170 feet tall and weighing roughly 14.6 million pounds each, are among the largest on the East Coast.
Sachin Shetty, associate professor for Old Dominion University’s Modeling, Analysis and Simulation Center and a cybersecurity expert, said it is “not likely” the cranes could spy on area ports given all the security measures in place.
“Anytime you talk about threats, it is not about possibilities. It is about probabilities. Is it possible? Yes. But is it probable? No,” said Shetty, who has worked with the Port of Virginia in recent years to identify and mitigate potential security threats.
Joe Harris, spokesperson for Port of Virginia, said the Chinese-manufactured cranes purchased by the authority are not brought into port and immediately put into service.
“Before any new cranes are put into service they are subject to a detailed forensic cyber analysis that is performed by one of the nation’s federal law enforcement agencies,” Harris said.
It can take around eight weeks to get the cranes in place, power them up and conduct safety inspections. Those awaiting analysis are isolated with dedicated firewalls to insure there is no contact with port networks or the internet, Harris said.
According to Shetty, the extensive cyber-scrub is necessary, particularly for Hampton Roads ports.
“There is a reason why we need to have these processes in place. It is so we never have devices that are capable of gathering intel on our military operations,” Shetty said.
The report that the Pentagon is concerned about Chinese-manufactured cranes was released one month after the U.S. shot down a high-altitude Chinese surveillance balloon. Officials believe the balloon was deployed by China to collect signals intelligence and other information about U.S. military operations and capabilities.
But Shetty said even if the cranes were capable of gathering useful intelligence, the probability of them doing so is very different than that of the surveillance balloon.
“The balloon was just floating in the air. There was nobody there and no physical place where we could monitor it. It is different with the cranes. There is monitoring that would take place, and there is not enough wiggle room for it to freelance,” Shetty said.
Using technology to gather surveillance, Shetty said, is much like eavesdropping and it is one of the hardest threats to detect because it is “very passive.”
“It is like burglars casing a joint. They know when you come in, when you don’t come in. Do you use the front door or do you use the garage? And that is information we never want to reveal,” Shetty said.
Because this type of surveillance is so hard to catch, the goal of cybersecurity measures such as what the Port of Virginia has implemented, is to reduce the probability of the threat as much as possible.
“It is not to say it will never happen. But you need to make sure that if something happens, if something slips through the cracks, the level of information they gather is so trivial, so benign, that it is just meaningless information,” Shetty said.
--------
