On February 21, 2024, President Biden signed an Executive Order on Amending Regulations Relating to the Safeguarding of Vessels, Harbors, Ports, and Waterfront Facilities of the United States, updating Title 33, Code of Federal Regulations (CFR), Part 6, to explicitly address cyber threats.
“This Executive Order ensures Coast Guard authorities are aligned with emerging cybersecurity threats, and reflects the commitment of the Biden Administration, the Department of Homeland Security, and the U.S. Coast Guard to safeguard maritime critical infrastructure,” said Rear Admiral Wayne Arguin, Coast Guard Assistant Commandant for Prevention Policy.
Section 70051 of title 46, United States Code, commonly referred to as the Magnuson Act, authorizes the President to issue regulations to safeguard vessels, harbors, ports, and waterfront facilities in the United States against destruction, loss, or injury from sabotage or other subversive acts, accidents, or other similar causes.
Since the Magnuson Act’s enactment in 1950, Presidents from multiple Administrations have issued Executive Orders updating 33 CFR Part 6 regulations to meet emerging threats and challenges. For example, in 2002 President George W. Bush signed Executive Order 13273, which updated 33 CFR Part 6 regulations and empowered Captains of the Port to prevent and respond to terrorist attacks.
This Executive Order further enables the protection and security of vessels, harbors, ports, and waterfront facilities by explicitly addressing cyber threats. Among other amendments, the updated 33 CFR Part 6 regulations provide a Captain of the Port with authority to:
-
Respond to malicious cyber activity by establishing security zones;
-
Control the movement of vessels that present a known or suspected cyber threat to U.S. maritime infrastructure;
-
Inspect and search vessels and waterfront facilities – including cyber systems and networks as consistent with law; and
-
Require facilities to correct unsatisfactory cyber conditions that may endanger the safety of a vessel, facility, or harbor.
The updated regulations also:
-
Empower the Commandant of the Coast Guard to prescribe conditions and restrictions for the safety of waterfront facilities and vessels in port, including measures to prevent, detect, assess, and remediate an actual or threatened cyber incident.
-
Require reports to the Captain of the Port, Federal Bureau of Investigation, and Cybersecurity and Infrastructure Security Agencey for evidence of sabotage, subversive activity, or actual or threatened cyber incidents involving or endangering any vessel, harbor, part, or waterfront facility. Guidance on reporting can be found in Navigation and Vessel Inspection Circular 02-24.