Evolution of Maritime Safety: From Analog Beginnings to Digital Redundancies

Aaron Crow (0:1.290): Good morning. Thank you for joining us today. I guess today, Christopher Stein, why don't you introduce us and, tell us where you are.

Christopher Stein (0:11.406): Yeah, I'm Christopher Stein. I work for Royal Caribbean Group. Today I am on Mine Shift 7. We are underway from Copenhagen to Gdansk. So for those who don't know, Royal Caribbean owns five brands. It's the Celebrity, Royal Caribbean International, Silver Sea, and then 50 % of Pu 'i Cruises and Hapai Ploid Cruises.

Aaron Crow (0:35.190): and hop like Lloyd's My Shift 7 is the newest shift, we just got it delivered a couple of months ago and now we are doing the sex theory assessment. So I'm staying on for a week from yesterday until the...

Christopher Stein (0:37.806): MineShift 7 is the newest ship. We just got it delivered a couple of months ago and now we are doing the cybersecurity assessment. So I'm staying on for a week from yesterday until the

Aaron Crow (0:52.842): So that's super interesting. I'd love to have an understanding, a high level understanding of what does it look like to do a cybersecurity assessment on a ship, especially one that is at sea, probably with paying customers on it, with thousands of people and staff and all the things that are going on. What does it look like to do a cybersecurity assessment on an active vessel?

Christopher Stein (1:17.806): So that's a very good question. And I guess a lot of people would expect it to be very technical. But in fact, one of the things that is very important in maritime is compliance. So what we're doing today is a compliance assessment for IMO and for ISPIS. And that means that we need to understand our current cybersecurity posture, both on the IT side, but also the OT side.

Christopher Stein (1:41.718): So today we're conducting interviews, we're reviewing drawings, we're looking at a few technical elements, but because as you say, we are sailing with passengers, we can't do deeper dives into the whole technical systems here. So at some point when we are in dock or we have time, we can do more technical and in -depth assessments, which for example involves checking networks and checking configurations, but...

Aaron Crow (1:50.262): Thank

Aaron Crow (1:55.695): technical systems here. So at some point when we are in DOD or we have time, we can do more technical and in -depth assessments, which for example involves checking networks and checking configurations, but as we are at C, we are limited to those more administrative. Yeah, but that's no different. I've done these in manufacturing facilities and

Christopher Stein (2:8.970): As we are at sea, we are limited to a little bit more administrative tasks.

Aaron Crow (2:20.734): you know on power plants and all these spaces and it's not like they just say hey we're gonna do an assessment so we're gonna shut everything down that's not reality right business has to go on so we have to find ways and that's one of the things that's really different in ot i think than it is we don't have an outage window on a friday night from 10 to 12 that i can just patch and do anything that i want because everybody's at home you know watching tv or football

Aaron Crow (2:46.134): these ships have to go. They run 24 seven. They have to be supporting even when the customers are asleep. It's all that stuff still has to work. So we have to find ways as OTC, cyber people to do, to work around those response, those problems, even when they're at port, like you mentioned doing it at port, it doesn't mean that you just have carte blanche because those systems still have to run. So it's not like you can just attack things and bring things down because those ancillary systems, many of those ancillary systems still have to be up and running.

Christopher Stein (3:14.328): Correct. One of the things that is different in maritime than, let's say, a factory is that we need systems to be operational in order to maintain safety. If people loses its propulsion, then it might bring us into an unsafe situation. So we can't just do things right now. That being said, when we are in port, there are some things we can set to local control. We can shut them down. We can do certain things while we are in port, test those, and then

Aaron Crow (3:25.226): Right.

Christopher Stein (3:44.310): you know, start them back up and continue the voyage. It's all about timing, it's all about the scope, and it's all about understanding what it is that you want to get from this assessment.

Aaron Crow (3:58.274): What are some of the types, obviously from a compliance perspective, but what are some of the types of things that you're looking for as you're, you walking it down physically? Are you looking for physical assets? Are you looking for asset inventory? Are you looking for, kind of what is a high level thing that you're looking for in one of these assessments?

Christopher Stein (4:19.480): So in general, we try to do a little bit of everything. It's all about understanding our cyber posture. So we get a ship from the yard. We want to understand in which state it is in to understand what is our exposure and also what should we have to prioritize. If we find out that we're missing an element or something needs to be changed or something like that, we now know about it and we can do something about it. So we do walk the ship physically.

Christopher Stein (4:48.962): We do check the drawings, we do check technical items. We basically do a top to bottom approach on the systems.

Aaron Crow (4:52.950): We basically do a note.

Aaron Crow (5:1.930): Yeah, that's super interesting. And, you know, I really want to hit home and how I have these conversations a lot. And when I'm at conferences, you know, I just got back from Black Hat and Def Con and I was at RSA earlier and, know, I still have a lot of people come up to me and they just don't necessarily understand the difference between OT and IT. And what is OT? What makes it OT? Why is it different? I've had some really

Aaron Crow (5:30.354): intense conversations to say at the least around how, it people or people that don't really understand OT, why it's so different. and this whole it and OT convergence and, all of that and how gray that gets, but, but you just said it right. And I think that's the key piece to remember is, is you guys are dealing with safety. and you can't take it. You can't put anything at risk that can risk the safety of, of the passengers and the crew and other.

Aaron Crow (5:58.432): people that aren't even on the ship because I mean, we just saw in Baltimore, the ship that lost control and hit a bridge and crashed a bridge. Like those things are real. Like when I'm patching my email server at my corporate headquarters, there's no, there's no person's physical safety at risk. Yes, somebody could, we can lose money. We can lose credibility. We can lose people's email. There could be lawsuits, things like that, but there's nobody that's going to physically be harmed.

Aaron Crow (6:23.200): from that, right? That's a big piece that's in OT and a lot of people don't really understand because they just haven't been there. Same thing when I do a power plant or I'm doing a manufacturing facility, those things are, there's a lot of safety issues, safety first. Like I can't trump, no matter what I need to do, I can't trump the safety factor to do what I need to do. I have to wear my hard hat, I have to wear my PPE, I have to make sure that lockout, tagout, that I'm...

Aaron Crow (6:50.624): that I'm understanding and three -way communication. It's why we do all of these things in these OT spaces, because lives can be lost and have been. We're not just doing the safety for, because it's fun. We're doing it because lives have been lost in the past and we wanna make sure that that isn't in the future. And obviously from a business perspective, you also wanna make sure that your things are reliable so that passengers will be safe and feel comfortable to come on board and enjoy the facility without worrying about.

Aaron Crow (7:19.092): you know, bad things happening. That's obviously bad press, but in the meantime, you guys are focused on safety because it's the right thing to do. And obviously you want your customers and your employees to be safe on your vessels.

Christopher Stein (7:31.822): Of course, safety is a top priority for us. It is like that in maritime business. Every maritime company will have safety as a top priority. And when incidents do happen, it's typically

Aaron Crow (7:41.352): incidents do happen it's typically

Christopher Stein (7:46.194): wait, maybe we'll want to scratch that and not talk about when incidents do happen. That's probably bad. No, but how should I continue here?

Christopher Stein (8:7.256): Safety is a top priority for maritime companies, right? Every shipping company is interested in keeping passengers, crew, ship, the environment at stake. The things that are, let's say, different in maritime compared to, let's say, industrial processing. Like I mentioned, we need operations to stay safe. And that means

Christopher Stein (8:36.950): It's not always possible to apply the same methodology as you will do in IT. It's not even always possible to apply the same methodology as you do in a manufacturing facility, right? The way that we have to test things also means that we must ensure that we don't break anything. We don't change any configuration. And we also need the vendor to be on board. Compare it to, let's say, a toilet.

Aaron Crow (8:59.962): .

Aaron Crow (9:4.443): Let's say it with toilet paper making The safety element in that is designed to protect the human from or prevent the human from entering the machine and if does it to shut the machine down

Christopher Stein (9:6.008): paper making facility, right? I don't know how to roll a paper, but I imagine you put a big roll of paper inside one end, and in the other end come a smaller roll of toilet paper. The safety element in that is designed to protect the human from or prevent the human from entering the machine. And if he does, to shut the machine down to achieve an element of safety. If you break something in that process, the machine will just not start up.

Aaron Crow (9:32.412): If you break something in that process, the machine will just not start up. When we do things here, we must have operations when we're sailing to maintain safety. We need power generation to run the propulsion. We need power management to control the power. We need navigation to understand where we are. Even the whole life support element of this is important to maintain safety. And that's why there are...

Christopher Stein (9:36.968): When we do things here, we must have operations when we're sailing to maintain safety. need power generation to run the propulsion. We need power management to control the power. We need navigation to understand where we are. Even the whole life support element of this is important to maintain safety. And that's why there are regulations and...

Aaron Crow (10:2.516): There are regulations and, what can you call it? There are requirements to minimum equipment, what do you want call it? Compliance? No, there's a... Standards?

Christopher Stein (10:6.456): what you would call it. There are requirements to minimum equipment, what you would call it. No, there's a...

Christopher Stein (10:25.230): Sorry, there are requirements to the amount of equipment that needs to stay operational in order to be compliant with safety standards. And therefore, if we manage to break something by testing or by disconnecting or doing something that can severely compromise not only actual safety, but also the compliance.

Aaron Crow (10:29.458): Yeah

Christopher Stein (10:52.702): compliance in general, which means that we could be prevented from sailing also. So there are a ton of elements that come into managing a ship, operating a ship, maintaining safety, and cybersecurity is just a part of it, which is quite small, but may have a big impact if misused.

Aaron Crow (10:57.568): So there are ton of elements that come into managing a ship, operating a ship, maintaining safety. And cybersecurity is just a part of it, which is quite small, but may have a big impact if misused. Yeah, and that's where, I just gave a talk at DEF CON around

Aaron Crow (11:23.284): Well, actually you and I were together in Idaho talking about CIE, know, cyber informed engineering and how cybersecurity needs to be part of the overall system conversation and design beyond just being a bolt on, you know, cybersecurity thing, but from a part of the system, making sure that it is done safely, it's done reliably. There's, know, and cyber is a risk, but like to your point, it is a small piece, but it is a significant one, just like

Aaron Crow (11:51.498): The other availability, like if you look at the CIA triad, like we don't care as much about confidentiality. Not that it's not important. It's just not, it doesn't trump availability, which to me, availability and safety are kind of linked together there, right? Obviously you just, mentioned availability of your systems is directly correlated to the safety of the ship and the vessel and the people and everything around it. Because if those systems go down, then you can't control this big moving piece of thing that's in the ocean and just floating. then that,

Aaron Crow (12:21.066): Bad things can happen, which is not obviously what we don't want to happen. And that's where we're dealing in OT. how many types of, mean, ships are huge. Like they're roaming cities. So I imagine they have very similar types of systems and how many numbers of systems and types of things are you having to look at on a large ship like you guys are dealing with?

Christopher Stein (12:49.006): So on the IT side, we have a number of systems which would equate to a medium sized corporation. Everything is tied into the passenger management systems. It's connected to all the shops that we have, all the services that we offer. But on the O .P. side, many people like to think of the ship as one large factory, but it's a ship

Aaron Crow (12:55.712): a medium -sized

Christopher Stein (13:18.574): is a constellation of between 30 and 70 smaller factories. You have, as a plant, you have water, reverse osmosis. Yes, mean reverse osmosis is for generating drinking water. You would have water treatment for the ballast water before we let it out. You would have

Aaron Crow (13:36.670): water treatment facility just like you would in a city right yeah

Aaron Crow (13:47.498): Yep.

Christopher Stein (13:48.046): treatment for all the sewage water. So many people don't even realize the amount of treatment that we give water before we let it out. It's actually cleaner than the water we take in. there are a ton of functions that we need to have running. In general, we can do almost everything ourselves on the ships. We need to load food, we need to load fuel.

Aaron Crow (13:54.303): and that we do.

Aaron Crow (13:57.632): We are.

Aaron Crow (14:8.456): In general, we can do almost everything ourselves on the ships. We need to load food, we need to load fuel, a small amount of chemicals for this and that, but otherwise we produce a lot on ship, we treat a lot on ship. So, it's very self -sustaining. Yeah, that's impressive. I you know, I've been on a cruise and I've seen it, but you know, I've also been...

Christopher Stein (14:17.643): Small amount of chemicals for this and that but otherwise we produce a lot on ship. We treat a lot on ship so We can know it's very self -sustaining

Aaron Crow (14:37.290): because I've had that OT background, even though I didn't take tours of those locations, I knew they're there. Like know there's a fully generating power plant that's running this whole thing because you don't have all this electricity and slot machines and lights and pumps on the pools and all of the things, if you think about it and you really break down, there's so many subsystems that make all of those things work that are huge. Even beyond, I've done some,

Aaron Crow (15:4.884): conversating and working with, you know, like the military, you know, Navy, obviously their ships are huge as well, but even them, they don't have some of the entertainment type things. Like they don't have a pool on deck. Like obviously they have other things, but they don't have a pool. They don't have a casino. They don't have, you know, water slides and, you know, roller coasters and a lot of the things that a lot of these amazing ships have these days that are just huge and thousands and thousands of people.

Aaron Crow (15:35.094): that all of those systems and different than in the military as well, if one of those systems goes down the military, an ancillary system that's an entertainment type, they're soldiers. Yeah, they may complain, but they're there because they have to be. Whereas if I'm a paying customer and one of those systems goes down, then you have customer upset and you're having to give refunds, you're losing money.

Aaron Crow (16:0.734): All of those things are impactful from a financial perspective as well as customer satisfaction and all those types of things. So that's an amazingly huge thing with a bunch of balls in the air that all of these things have to work perfectly in concert to make sure that each one of these trips are successful to all the people that are coming on. It's just a huge amount of moving parts to be successful and relying on technology for a lot of that.

Christopher Stein (16:31.820): Of course. And while the systems might be categorized differently, you know, have IT, have entertainment, have OT, etc. And even within those categories, there are different categories of systems. We do tend to treat all the systems with the same seriousness, if you will. Because for us, the financial impact on a cruise is no different from

Aaron Crow (16:40.654): and even within

Aaron Crow (16:44.502): Sure.

Christopher Stein (17:1.122): you know, lack of entertainment, then lack of propulsion. it costs us the... Actually, maybe we shouldn't talk about that. Fuck. No, I'm just trying to think about what our... As I'm saying it, you know, I'm picturing our communications team saying, maybe you shouldn't talk about financial impact on, you know, those things.

Aaron Crow (17:5.586): Sure

Aaron Crow (17:24.618): Casey's team saying maybe you shouldn't talk about financial...

Aaron Crow (17:30.538): Understood.

Christopher Stein (17:36.653): So.

Aaron Crow (17:37.142): So.

Christopher Stein (17:39.947): I'm trying to shape my words here.

Aaron Crow (17:41.992): shape my words.

Christopher Stein (17:45.784): So the systems that we have on board, as we categorize them in IT and OT and ET, we still consider all the systems important. So when we do assessments, when we look at how to protect them, when we analyze the attack surface, the exposure, et cetera, we treat all systems similar.

Aaron Crow (17:46.250): So that's it.

Aaron Crow (17:50.142): in IT and OT and ET, we still consider all the systems important. So when we do assessments, when we look at how to protect them, when we analyze the attack surface, the exposure, et cetera, we treat all systems similar. The connections that these systems would have to our corporate office are also treated in the same way, no matter if they are for...

Christopher Stein (18:10.168): connections that these systems would have to our corporate office are also treated in the same way, no matter if they are for an entertainment system or an IT system. It's all equally important because it provides access in one way or another to the ship. So the...

Aaron Crow (18:19.072): your payment system, IT system, it's all equally important because it provides access in one way or another to the ship. Sure. So the

Christopher Stein (18:36.152): with this. I know you're going to cut away the pauses, so...

Christopher Stein (18:45.634): the

Christopher Stein (18:51.234): The level of cyber security measures that we take are

Aaron Crow (18:51.616): the level of cyber security measures that we take.

Christopher Stein (19:2.362): I know you like it unscripted, but maybe we should have prepared something. The whole challenge is there are some things that I cannot say and they only come to me as I am saying those things. I'm like, maybe I shouldn't say that. I'm trying to weigh my words.

Aaron Crow (19:3.590): I know you like it unscripted, but maybe we should have. It's okay. The whole challenge is there are some things that I cannot say. And you know, they only come to me as I'm saying those things. Well, how about this? So it's obvious in OT and IT, we have

Aaron Crow (19:28.576): there's lots of incidents that have happened in the world, right? Colonial pipeline, all these other things that have impacted OT. So there's a lot of argument of was that an OT attack? Was that an OT incident or not? And I've always been a proponent of that in that it doesn't matter. It doesn't matter if the system was quote unquote categorized as OT, did it impact the thing?

Aaron Crow (19:53.844): right? Colonial pipeline. wasn't an OT system, but they couldn't measure the amount of things that were going down the pipeline. So they had to shut it off. So it impacted OT. It impacted the availability, the reliability. The same thing would be truthful in your ship. they couldn't, something simple, if they couldn't count all the passengers that are coming back on from port,

Aaron Crow (20:17.326): accurately, that's going to impact the ability for your ship to be able to leave port because you aren't able to understand if all of it. Now, obviously you have backup systems and all that kind of stuff. Like this is obviously a very high level example, but it just goes to show systems that are not technically OT can still impact the availability, the safety, the reliability, the y 'all's ability to bill. I mean, even going beyond that, like the entertainment systems as you're, you know, you're buying drinks or you're buying, you know,

Aaron Crow (20:46.720): Direct TV or the entertainment on your televisions, all those things are going to impact customer satisfaction and your ability to build like every one of those things has an impact. Yes, it's not necessarily I can't drive the ship. There's a severity of the impact, but impact is impact. And you're going to make financial and safety decisions based on the access of those available systems and your backup systems to be able to run through whether or not there's a true incident that we would report as a cyber thing. And that's the other piece.

Aaron Crow (21:17.024): They're not all cyber events. They're not all China trying to attack us or some bad state actor. Sometimes it's just something broke, right? And it wasn't a cyber attack, but it's still something that brought down a system that makes you not be able to do something that you need to do for your compliance and for your internal policy to say, if we don't have these things, then we're not going to do next, right? We stop here until we find a way to fix this or have a backup system, et cetera.

Christopher Stein (21:46.862): Correct. that is the largest reason is of course that everything is now digital. Everything is running computers. So no matter if you have IT or OT, it's running on a computer and that computer is a computer that you go and buy and just like you buy them best buy, it's running a commercial operating system. It could be Linux, it could be Windows. So they are subject to the same vulnerabilities that your office computer is and therefore

Aaron Crow (21:48.330): That is

Aaron Crow (21:52.554): Right.

Aaron Crow (22:10.155): the same.

Christopher Stein (22:13.996): Because of the safety implications and the operational implications, we have to do much more to protect those and consider all the vectors that could affect the system. And you're absolutely right. It doesn't have to be a cyber incident. It could be something as simple as a thing that's breaking. We need redundancies. We need spare parts. We need things on board that enable us to fix things immediately.

Aaron Crow (22:15.126): Right.

Christopher Stein (22:39.114): Otherwise it could have an impact on safety or on revenue or our reputation or any element that is part of, you know, running ships. The transition, if you will, from mechanical things in the OOT space to digitalized things, to computer -based systems.

Aaron Crow (22:45.002): or education or any element that is part of running shifts.

Aaron Crow (22:57.280): The transition, if you will, from mechanical things in the OT space to digitalized -based, computer -based systems has enabled us to do a million good things. It enables us to have better control of fuel consumption. It allows us to select how we operate the ship, optimize the way that we do things. It allows us to really...

Christopher Stein (23:7.682): has enabled us to do a million good things. It enables us to have better control of fuel consumption. It allows us insight into how we operate the ship, optimize the way that we do things. It allows us to relieve the crew from doing tedious tasks and help have them do something that's more meaningful. And with that comes the, let's say,

Aaron Crow (23:28.277): and help them do something that's more meaningful. And with that comes the, let's say, the...

Christopher Stein (23:38.274): the

Christopher Stein (23:42.291): whatever comes with having things running on a computer, you know, and that's both good or bad. So there are many factors to consider and we just need to ensure that we have all of our bases covered.

Aaron Crow (23:42.971): Sure

Aaron Crow (24:0.871): So how many ships do you guys currently have that you have to maintain and kind of keep up with? is it, it's not a small number right now.

Christopher Stein (24:10.894): Yeah, all across the group. I believe it's 68

Aaron Crow (24:14.870): So basically you have 68 cities with 40 to 50 or 70, I think you said different factories inside of it from power plants and all these types of things. So you guys are managing a huge impact. The scope of that, most people, want our listeners to understand the magnitude of again, human life, cities at sea.

Aaron Crow (24:40.052): You you're going to different countries with different rules and the legalities. Like all of these things, customs and passport management and people coming on and joining from different locations and all of these things.

Aaron Crow (24:54.978): are up in the air. And obviously not all of that is on your shoulders, but as a big entity, all of those things are factors in how you make sure that you get from point A to point B because the customer just joined, you know, they join at this port and they get off over here and did they have a good time? Right? Did they go see the things they wanted to see? Did they have a good time? Did they swim? Did they drink the food? Was it good food or drink and eat and all the things? But there's so much that goes on behind the scenes to make their

Aaron Crow (25:23.784): enjoyable vacation, you know, effortless. Like they don't want to see behind the scenes. They just want to show up and get a drink and get a coffee and get a donut and get the food and all the things. But there's so much that goes on behind the scenes that most people don't even see or understand.

Christopher Stein (25:38.462): You're absolutely right. The experience that comes from cruising is largely because we have a fantastic crew. I would say no matter which company you cruise with, no matter what ship you're looking at, the crew that's working on that ship is working really hard day and night to either deliver your cargo, make sure that you have a great cruise, sail you from point A to point B if it's a ferry or...

Christopher Stein (26:7.630): whatever it is, so ship crews work really, really hard and they deserve much more respect than I do because I'm on the ship for a week and I just do my assessments. But these people, they work 24 hours a day, working much, much harder than shoreside people. And of course, we are dependent on each other, right? But here's the thing, right?

Aaron Crow (26:19.435): Right.

Aaron Crow (26:29.360): Yeah.

Aaron Crow (26:35.190): Just the thing.

Christopher Stein (26:37.952): A ship can live without cyber, but I cannot live without the ship. That being said, I do see that a lot of people would like to understand more of what's happening behind the scenes. We offer tours behind the scenes and I know that other companies do offer the same. So no matter which cruise ship you're on, which company you're with, take the tour. It's really interesting.

Aaron Crow (26:41.930): Right.

Christopher Stein (27:5.940): If you've never seen the bridge of a ship or the engine control room, how we do waste management, especially on waste management, a lot of people believe that, yeah, you do this and that with the trash and you pollute the ocean and whatnot. We don't do that at all. In fact, we have people full -time sorting trash, compacting it, recycling it, sending it off to the right locations to be processed. I don't actually know how it...

Aaron Crow (27:11.296): how we do waste management, especially on waste management. A lot of people believe that, you do this and that with the trash and you pollute the ocean and whatnot. We don't do that at all. In fact, we have people full -time sorting trash, compacting it, recycling it, sending it off to the right locations to be processed. I don't actually know how things happen on the shore side once it's offloaded, but...

Christopher Stein (27:35.626): how things happen on the shore side once it's offloaded, but you would be surprised what actually goes on behind the scenes on a ship.

Aaron Crow (27:42.887): you would be surprised what actually goes on behind the scenes. Yeah, I mean the logistics of all that you just said, right? You know, think about how many people, know, thousands of people of not just from a customer perspective, but also the crew, the food, the water, the, the, you know, the luggage, the, I've only taken one cruise. You and I talked about this in Idaho. I've only taken one cruise. My wife and I went, but you know, it was a big ship.

Aaron Crow (28:11.659): it was rural Caribbean. and the, the amount of how fast we were able to check in, give our bags, you know, we got onto the ship and, know, a few hours later, my, luggage ends up in my room. I mean, the, the logistics of just that, it is, is mind boggling, because they're going through all the things in the background and then they end up in my room. you know, and then the whole week, like, you know,

Aaron Crow (28:40.906): where I'm going to eat and food and we're going into different ports and we're stopping at different islands, which are in different countries and all of these things and managing thousands of people getting off a ship and thousands of people getting back on a ship and in a timely manner and making sure nobody gets lost and left behind. there's just so many things to consider. And also the cybersecurity and the safety systems that are in the background that are running as well that, you know,

Aaron Crow (29:8.070): that are managed. I agree, like there's a great example of OT is everywhere. And I think it's important for people to start looking for it. So when you take the cruise, go on the tour, like, because it'll be fun. It's going to be amazing, but you'll see the things that are supporting you, right? You know, I went to Black Hat, I think last year, my wife went with me, which is in Las Vegas.

Aaron Crow (29:35.796): but not too far from there is the Hoover Dam. So we rented a car and drove to the Hoover Dam and I took a tour with her, which, you know, I grew up around power plants. I've seen them a thousand times. I've seen all of the systems in there, but for her, was eye -opening because of the size of the machines and the turbines and all the things that are there. And even for me, was impressive because the Hoover Dam in and of itself, if never been, I highly recommend. But little things like that, like it opens your eyes to see the complexity of the things that many of us take for granted. We turn the light switch on,

Aaron Crow (30:5.470): And the lights come on, we don't exactly understand. Most people don't understand how difficult it is for these lights and this technology to work. I remember setting up a, our home internet and having battery backup. and we were in the middle of a storm and right after I did it at home, we're, we lost power. It was a rainstorm and I'm in Texas. So there was like a tornado. and my kids and my wife were sitting in the living room, no lights.

Aaron Crow (30:32.650): but the kids are still on their iPads and on their phones surfing the internet. And I looked over at my wife and I was like, you realize what's going on? She's like, no, what do mean? I'm like, you realize we're all still on the internet? She's like, yeah. I'm like, you don't realize that we don't have electricity, but our internet still works? And she's like, how's that? And I'm like, exactly. So I kind of explained it to her, but she didn't even think about it, right? It was just, worked. She knew it was gonna work because I just make sure it works.

Aaron Crow (31:0.648): She just took it for granted. Now she sees it, but it's just funny little things like that. It didn't take me much. It's not like I'm a rocket scientist. I just put a battery backup so that the internet equipment would stay up. But still, that was something that she didn't even recognize. She just expected it to work because our internet always works.

Christopher Stein (31:21.286): No, that's true. mean, the amount of dependencies it requires just to have like a small app on your phone running or your internet be up or as you said, the lights in your house to be on, it's amazing. Previously, it required a lot of humans. Now it requires a lot of technology, right? And so the operational technology, while many people might think, yeah, well, it's just this or it's just that.

Aaron Crow (31:30.206): internally.

Aaron Crow (31:37.974): you

Aaron Crow (31:41.984): Yeah.

Christopher Stein (31:51.066): the most complex things that we have are controlled by the simplest. The relays, the switches, the contactors, the PLCs that control those things are so simple. But it all plays a small piece of a much, much bigger and very complex system.

Aaron Crow (31:54.033): that we have are controlled.

Aaron Crow (31:58.710): Absolutely.

Christopher Stein (32:16.514): that has dependencies far beyond what you can even imagine just sitting in your house. I know you said you're in Texas and I know that the power grid is disconnected. We're not going to get into that. But in the rest of the US and in Europe, the interconnections between different power grids in different countries, the way that...

Aaron Crow (32:29.512): It's disconnected. We're not going to get it. We can do that.

Aaron Crow (32:38.459): the interconnections between different power grids in different countries, the way that the power is converted and switched and transmitted from one country to another when there is too much sun here but not enough base load over there, we transmit power, we convert it, we convert it to high voltage. Some cables are DC, so yeah.

Christopher Stein (32:44.434): the power is converted and switched and transmitted from one country to another when there is too much sun here but not enough base load over there, we transmit power, we convert it to high voltage. Some cables are DC, so we have to convert AC to DC, then we convert it back. It's absolutely mind -boggling, the complexity.

Aaron Crow (33:5.878): convert AC to DC and convert it back. It's absolutely mind -boggling. Yeah. you know, diving into that real quick is, you know, there's a reason. So I've worked for 20 something years and a lot of that time has been spent in power utility in Texas, you know, and Texas is its own grid. But part of that is because of the reliability, because, you know, the United States is so large. You know, the East Coast is a grid, the West Coast is a grid and Texas is a grid.

Aaron Crow (33:34.066): And part of that is because we need, people don't understand, but you need power to start a power plant. Like it's the chicken and the egg conversation. I can't fire up a power plant without electricity. I need electricity to start the electric power plant. So there's a process called black start. So we have these black start plants that can start from diesel fire generators and things like that. They can get one going and then that has enough energy to get the next one going and then the next one and the next one. And then you can get enough

Aaron Crow (34:3.728): rolling generation going so that you can start the grid back on on track. So Texas has DC ties. So ACDC. We have DC ties into Louisiana, Oklahoma, Arizona and Mexico. And the reason for that is because part of that is because of back in the day, the East Coast, we had black rolling blackouts that impacted the entire East Coast of our country. And

Aaron Crow (34:31.594): The cool thing with the way that Texas is, obviously we've had some issues here recently with the Texas grid, and I'm not defending that at all. But the larger grand scheme of the design of this decades ago was so if the East Coast went down, because we're DC -tied into East Coast, their rolling blackout wouldn't impact us, but we could feed them back to help them get started back up again.

Aaron Crow (35:1.352): And then the same thing, if we went down, we're not going to impact or bring them down. We're not going to be an additional domino that's going to knock them over, but we can, they can help to start us back up. And the same thing with Mexico, the same thing with the West coast, et cetera. Like there's that, that's a great example of the, these systems are so large and complex. It's well beyond most people's even understanding. Even, even me working in power utility for, for

Aaron Crow (35:29.846): so many and my father before me worked there for 40 something years. I have a very high understanding of the power grid in our, in this country and even in Europe and other countries as well. But still my understanding is, you know, still here at which, you know, there's people that are far more understanding of it than me. And I couldn't tell you exactly how it runs. I understand it at enough level to talk about it semi -intelligently on this podcast, but I'm not, I'm not one of the engineers that could make it work.

Aaron Crow (35:58.912): for sure.

Christopher Stein (36:1.474): We have the same on the ship. Starting a ship from cold happens using the emergency generator, which is a smaller device that's not powerful enough to propel the ship, but it provides enough power to allow us to start all the dependencies that allow us to start the bigger engines and generate propulsion power. So, yeah.

Aaron Crow (36:8.522): Right.

Aaron Crow (36:13.462): Right.

Aaron Crow (36:18.518): Right. Yep. Yeah. Well, it's like if you saw the, what is it? The Apollo movie with Tom Hanks, Paul 13, where they're trying to do the startup procedure when they couldn't land on the moon and they were trying, they only had so much power and if they started up, they had to figure out the procedure on ground.

Aaron Crow (36:44.278): So they could give him the procedure because if they started up the wrong way, they'd trip circuits and they didn't have enough amperage to start up their systems. And when they figured out if they turn these things off and they start up in this process, then they had enough power, right? We don't, again, all of these things are interconnected, whether they're cyber, whether they're, but they're all digital, you know, working in a nuclear facility. A lot of the nuclear power plants in our country, in the United States specifically, you know, they were designed in the 50s, they were.

Aaron Crow (37:12.532): They started being built in the 60s and 70s, and a lot of them were turned on in the 80s. Like there's one in Texas that I used to support and it was commissioned in the early 80s. The technology has changed drastically since it was designed to now. A lot of the systems it was designed on and they got their license on are analog. Like you said before, they're very simple relays, very simple systems and processes.

Aaron Crow (37:41.562): Since then, we've added different technical capabilities, digital technologies, ethernet, that kind of thing. But those tertiary systems are still analog. So when we've added capability, because we wanted to get more visibility and control and automation out of things, we added to it, we didn't take away. So we didn't replace the analog system in this system. We added an additional digital system in series so that I could get that data, but

Aaron Crow (38:8.754): If that thing fails, it's still gonna fail back to the physical, old school, tertiary backup system. we have, and obviously in a nuclear environment, there's obvious reasons why that is. I'm sure you guys have a lot of similar type things in safety and tertiary and multiple redundant capabilities because there's high risk. There's a lot of stakes when we're talking about pastoral lives and thousands of people and life and limb and environmental and like all of those factors.

Aaron Crow (38:37.942): So where the little factory that's building toilet paper, like you mentioned, the risk isn't that high. The worst case scenario is, I mean, yes, there is safety issues in any physical thing like that, but maybe it's a few people not saying that that's an acceptable loss, but at the same time, it's not the same as four or 5 ,000 people on a ship that could be impacted by an incident. obviously you're going to...

Aaron Crow (39:3.594): focus and spend more and have more tertiary and more safety systems to ensure those critical processes are not at ever. We're never going to be unable to control. Like maybe it goes back to a manual process, but I still have control in some way.

Christopher Stein (39:18.158): Correct, correct. All systems that we have on board, especially safety related ones, have manual control. So the way that ships have evolved over the last 50 or 60 years is that they've undergone an era of automation. And what that means in practice is that we're still doing the same things on the ships that we did 40 years ago.

Aaron Crow (39:25.408): private.

Christopher Stein (39:47.672): But we're now doing it digitally that allows us to use less crew to monitor the city. We can now have crew come and entertain the passengers instead of sitting down and looking at the gauges and the bars and temperatures and whatnot. And with that, as you said, we've just added things on top of the physical layers that ease management, ease monitoring, ease control.

Aaron Crow (39:53.974): Sure.

Aaron Crow (40:10.678): Yep. Sure. Yep.

Christopher Stein (40:16.738): but they do not take away the fundamental function of that. mean, everything is still physics. So we will have, while we do not necessarily in the engine controller room have all the manual controls there, because now everything is digital and happens on a few monitors, we can always go down in the engine room itself into the machinery space and press the button. Because that's where the magic happens.

Aaron Crow (40:41.404): Because that's where the magic happens. The engine control room is a quiet climate control space that is comfortable for people to in. So we don't have to send them down into the machinery space all the time. Absolutely. Even something as simple as, and again this is something that if you haven't worked in an OT space, something as simple as what we call operator rounds.

Christopher Stein (40:45.656): The engine control room is a quiet climate controlled space that it's comfortable for people to sit in. So we don't have to send them down in the machinery space all the time.

Aaron Crow (41:10.260): So if you think about when you've got equipment, back in the day, before we had all the capability to digitally send data and be able to read the setting of a valve or the temperature or the pressure on a particular area, you had to send an operator down there to look at a physical gauge.

Aaron Crow (41:30.722): and inspect, okay, this is with intolerance. So they would have to do that every so frequently throughout the day and they would have certain machines and equipment that they're responsible for. So they would physically walk those things, put hands on things, look and make sure things sounded right, things looked right, the pressure, like all of those things, those operators could just touch a pipe and understand because they've known what good looks like and what bad looks like, they know when something's out of the right? It's like you're in your car and...

Aaron Crow (41:57.770): you've driven it for a thousand miles or for a long time and something's not right. Like there's a vibration, it's not shifting right or whatever. You can just tell because you've driven that car so many times, you know what good feels like and you know something's different, right? So that's what we used to do. It was all physical. We still do that, but we don't have to do it as much with humans. Because we have more ability to trend and get those readings digitally, remotely, I can send those

Aaron Crow (42:24.778): those trends and the temperatures and pressures and valve placement and all that type of stuff to these computer systems, now we can better say, instead of having to go do these things all the time, I can send them, hey, there's something going on here, go take a look at that thing. Again, that doesn't mean that we don't send an operator to do random, to make sure that the gauges are accurate, but it means that I can do more with less people.

Aaron Crow (42:53.622): that have to physically put hands on things. It makes us more efficient. It means that we can do more with less as far as needing 15 people to do the job. Now maybe I can do it with a few and be more efficient and better outcome because of that, because of the other capabilities that the digitalization has brought us.

Christopher Stein (43:15.662): Correct. Digitalization is a huge new thing in maritime, especially given the whole discussion of decarbonization, switch to alternative fuels. It helps us understand our operations. We can now measure things that were impossible to measure before or really difficult to measure before.

Aaron Crow (43:17.204): Visualization is a...

Aaron Crow (43:21.558): Huge news.

Aaron Crow (43:29.610): E

Christopher Stein (43:44.098): We have sensors everywhere now. We can tell you anything at any time on the ship that you can say, well, okay, this is impacted by X or Y or Z. If we trim here, if we do that, if we add or change or remove something, then we can optimize the operation. We can save fuel, we can lower our emission, we can sail faster or slower. We can arrive just in time at a certain port.

Aaron Crow (43:57.578): if we do that, if we add or change or remove something, then we can optimize the operation. We can save fuel, can lower our emission, we can sell faster or slower. We can around just in time at a certain port because of X or Y or Z. So it really has had a huge impact in shipping and will continue to have that over the next many, years as maritime sort of catches up.

Christopher Stein (44:13.740): because of X or Y or Z. So it really has had a huge impact in shipping and will continue to have that over the next many, many years as maritime sort of catches up on the digital evolution, you know, with big data and AI and whatnot.

Aaron Crow (44:32.577): on the digital evolution, fake data and AI and whatnot. Yeah, that's exciting. I can't even imagine people that got on a ship in the 1800s, they probably, coming from another country, let's just talk about people that came to America, for instance. They got on a ship in Ireland or Scotland or wherever they were coming from and they'd probably never seen or really understood what this America was.

Aaron Crow (44:56.136): or this place that they were going to, they got on a ship, they probably weren't sitting in a fancy, nothing like what you're sitting in today, in the comfort and the wifi and food and drinks and air conditioning and all of that type of stuff. And they traveled across the ocean with analog systems, with physical people running them. Obviously we've heard of incidents like,

Aaron Crow (45:23.126): hitting icebergs and things like that in the middle of the ocean. But storms and loss of power, any number of things could have happened, not to mention even further back than that when people used to sail across the ocean with completely analog, no systems whatsoever, just wind and sails. It blows my mind the ingenuity of humans and how far we've come.

Aaron Crow (45:51.368): in a relatively short amount of time to the capability of the vessel that you're sitting on today and how people just take it for granted. Like they don't think about any, they just get on and have fun and they get off and man, that was amazing, right? And the amount of work that goes into it and the safety and how far it's come from, you know, the Mayflower, these wooden vessels to, or Vikings that came across on little bitty, you know, not even ships, boats more like.

Aaron Crow (46:20.662): to now these huge things that are multiple, 10, 15 stories tall with swimming pools and tennis courts. And it's just incredible that we take it for granted these days. And yeah, let's go on a cruise. It's simple and it's fun. Let's take a 10 day cruise and take the whole family and unlimited food. And it's just a blast. And we happen to be floating across the ocean and going to different countries. But that's...

Aaron Crow (46:49.938): normal, right? That's super normal.

Christopher Stein (46:53.928): I'm happy you take it for granted because that means we're doing our job right.

Aaron Crow (46:57.746): Exactly. That's the funny thing. It's not funny, but it means that we're doing right things, right? So when we talk about all this digitalization and, you know, I'm a parent, I've got three kids and, you know, we look at technology and you can see a lot of negative things with technology with, you know, people zoning out and social media and politics and all the things that you see. But there's a lot, there's so much good that has come from digitization and the technology that we have.

Aaron Crow (47:27.254): our cars are safer, know, I've got, you know, crash detectors in my car and airbags and, you know, all of these things that it's a lot safer now to be to the point that nobody was taking a cruise for fun, you know, 200 years ago, like they were doing it to get from a place to a place like, and it wasn't really an enjoyable trip. They just grin and bared it, right? It wasn't like it was now some of the wealthy, obviously that that's a different conversation, but

Aaron Crow (47:54.338): Everybody can afford to go on a cruise. Everybody can go and enjoy and be like luxury back then, right? Anybody can do that and have a trip and get pampered and have that. It's literally available to absolutely every person within reason, but obviously it's not free, but it's attainable.

Aaron Crow (48:16.690): It's not unrealistic. It's not millions of dollars. You don't have to be a millionaire. You don't have to be independently wealthy. Like this is something that everyday Americans and people from all over the world love and experience and it's not out of reach, which is incredible to say how much technology and digitalization has made that because it's safe. It's affordable. It's repeatable. Like all of those people process and technology have made it so that everyday people can attain this thing that is

Aaron Crow (48:46.131): Again, a hundred years ago was unattainable unless you were super wealthy.

Christopher Stein (48:52.283): totally agree. I don't have any comments to that.

Aaron Crow (48:58.939): So, so with that, I appreciate the time and, and, and I know that you're in the middle of, of, but a, an assessment and, also in the ocean, which is just super cool. This is the first time I've had a, a guest join me, you know, in, that, that wasn't on land as far as I'm aware. so, so, with that, what is kind of closing question I always give to folks is what is one.

Aaron Crow (49:25.141): one thing that you see in the next five to 10 years coming up over the horizon, and you can focus it specifically on maritime, that maybe is concerning, and what's one thing that is exciting that you see coming up over the horizon in maritime cyber?

Christopher Stein (49:42.162): That's a very interesting question, actually two very interesting questions. So what is concerning? The number of dependencies that we have on external systems requires us to be more vigilant in terms of how to protect them and the availability of tools that are available to regular people to, you know, attempt to do something different.

Aaron Crow (49:50.432): the

Aaron Crow (50:1.428): and the availability of tools.

Aaron Crow (50:9.472): you know, attempt to do something. Sure.

Christopher Stein (50:12.218): He didn't say that.

Aaron Crow (50:17.008): Take two.

Christopher Stein (50:21.728): I see.

Christopher Stein (50:28.831): The thing is, I can't really say anything about war, GPS jamming, and stuff like that.

Aaron Crow (50:33.536): Sure. Yeah. Yep. Don't want to be any specific. Absolutely. Understood.

Christopher Stein (50:36.994): I'm

Aaron Crow (50:44.542): Maybe just saying something like, as we get more digital, there's obviously more opportunity for bad actors to impact us. obviously, we have to be defensive in all of those areas and making sure they're available. As more more things that we digitize, that also increases the risks in those areas as well. Something more generic.

Christopher Stein (51:8.748): Yeah, yeah, yeah. Yeah, of course. mean, as we digitize more, the number of dependencies that we have on computer based systems increases. We depend more on the connections that we have to shore side. We also want to deliver an experience to our passengers that also depends on all of these systems. So we need

Christopher Stein (51:38.328): We need more efforts put into understanding the new digital solutions that are coming out and how they potentially could affect our operations, our systems, our safety, and be proactive in terms of preventing things from happening. On a more positive note, and this is very maritime -specific,

Aaron Crow (51:42.268): into understanding the new digital solutions.

Aaron Crow (51:47.348): and how they potentially could affect our operations, our safety, be proactive in terms of preventing things from happening. On a more positive note, and this is very, very maritime specific, the various organizations and lawmakers in maritime are starting to align on maritime

Christopher Stein (52:9.207): the various organizations and lawmakers in maritime are starting to align on maritime requirements, securing on the cyber part maritime as a whole. There are now more cyber requirements to systems that operate the ships both in the OT and the IT space. And that means that

Aaron Crow (52:17.354): requirements securing on the cyber part maritime as a whole there are now more cyber requirements systems that operate the ships both in the OTA IT space and that means that we are less susceptible to bad actors we will reach

Christopher Stein (52:37.538): We are less susceptible to bad actors. We will reach a point.

Christopher Stein (52:47.298): We will continuously improve cybersecurity on the ships. And as legislators become more aligned and more aware of actual risks, we go into a future that is similar to other elements of shipbuilding, more prescriptive, and offers actual solutions.

Aaron Crow (52:47.722): We will continuously improve cybersecurity on the ships. And as legislators become more aligned and more aware of actual risks, we go into a future that is similar to other elements of shipbuilding, more prescriptive, and offers actual solutions. Sure.

Aaron Crow (53:15.958): No, that, that, that's so true. And, as you were saying that all I was thinking of is, know, relatively recently we've, we've started having internet available on airplanes, right? And now everybody takes it for granted that it works. So when, for whatever reason, internet access stops working on a plane, people complain about, you know, I just can't believe the internet didn't work or it was slow or whatever. Like, do you realize you're flying 30 ,000 feet in the air?

Aaron Crow (53:45.418): hundreds of miles an hour and you're surfing the internet. It's like the discussion I had with my wife about the internet working in the middle of a power outage. You don't think about what it takes for that to work. You guys have a giant ship with thousands of people on it in the middle of the ocean and if the internet goes down, you're gonna have a bunch of upset people, which is funny because the amount of things that it takes to make all of that work is beyond most people's comprehension.

Aaron Crow (54:13.322): but people take it for granted. And that's a good thing. Like you said before, we want them to take it for granted because that just means that you're doing your stuff right. But the amount of things that it takes to make all of that trip be successful is incredible. So I'm excited to see the changes and the focus being put in the maritime environment, obviously for the entertainment side, but also in shipping and all of the things.

Aaron Crow (54:40.374): Because you know we we are as a society very dependent on on our maritime environment both for entertainment like on a cruise ship But also getting goods and services across the ocean and and there's just no better way to do it That we've come up with today You can you know planes are only so big and you can only put so much stuff in there whereas in it on a on a merchant ship you can put thousands and thousands of containers and ship all sorts of stuff from cars to You know weight is almost no issue. So it's very important and we see that with

Aaron Crow (55:9.876): you know, terrorists that are going after things in certain parts of the country or of the world where it's slowing things down and it takes longer, which means it's more expensive and it increases, you know, the cost of goods because it takes more money and to get things to where they need to go. So all those things are impactful. And cyber is a big piece of that as well. Obviously it's a relatively small piece. That does not mean it's insignificant. So.

Aaron Crow (55:38.071): I applaud you, sir, for all that you guys do. definitely next time I take a cruise, I will definitely be taking the tour and taking my wife so she can see all of the dependencies and all the cool stuff behind the scenes that go into making that awesome experience so effortless as a customer.

Christopher Stein (55:59.003): I'm happy to have had the opportunity to join this podcast and I hope that I've inspired you and your listeners to open your minds a little bit about what actually happens on a ship.

Aaron Crow (56:13.526): Absolutely. Very, very, very behind the scenes, literally as you're sitting on a ship, which is so, so cool. So, well, thank you, Chris, for joining me. I really appreciate your time, sir. It's been a long time coming, getting this, getting this scheduled. So I appreciate you, you being here and taking time with me. And I look forward to seeing you again in the future, sir.

Christopher Stein (56:32.366): Thank you, Aaron. Happy to be here.

Aaron Crow (56:34.432): You too.

Transcript lightly edited for readability.