Shadow Fleets, Cyber Effects, and Plausible Deniability

This panel at DEF CON's Maritime Hacking Village looks at gray zone activity at sea, meaning coercive or disruptive operations below the threshold of armed conflict. The moderator, a former Coast Guard rear admiral with Cyber Command experience, framed the stakes: most global trade moves by ship, so interference with shipping, ports or maritime infrastructure can undermine economics and security without a formal attack.

The panelists argued that the main obstacle is organizational rather than purely technical. IT and operational technology responsibilities are often split, regional and functional teams see the same incident differently, and the people who hold the risk frequently lack the authority to fix it. One speaker described ships and ports as large, poorly documented systems whose unintended behaviors are hard to map, and whose legacy hardware can outlast its vulnerabilities. Sanctions on Russian and Iranian oil were cited as the reason dark tanker fleets grew, and a 2024 cable incident near Finland showed how jurisdictional limits can stall enforcement. A 1990s oil spill law requiring a single responsible owner was proposed as a possible model for cyber liability.

The closing takeaways were to consolidate fragmented data into a clearer picture, assign an accountable leader with a mandate to disrupt threats and restore systems, and tailor responses to the actor's goal, since sanctions evasion calls for different friction than efforts to shift geopolitical boundaries. Panelists also suggested that government software requirements should demand verifiable artifacts and how components connect, not just parts lists.