IS ROMANIA PREPARED FOR THE PROTECTION OF ITS OWN CRITICAL MARITIME INFRASTRUCTURE?-Author Cam.fl. (rtr.) PhD Ion CUSTURA
Article assumed by the MARITIME SECURITY FORUM
INTRODUCTION
Plecând de la realitățile unor evenimente grave recent desfășurate pe plan internațional, și mă refer aici în primul rând la acțiunile de război hibrid desfășurate de Federația Rusă în M. Baltică, M. Nordului, M. Black and which culminated in the aggression unleashed against Ukraine on February 24, 2022, a number of painful lessons have been identified that should lead to urgent and effective measures to protect, resilience and sustainability of the country’s critical infrastructure in general and critical maritime infrastructure in particular, which have become favorite targets for aggressors in both hybrid actions and warfare proper.
From the last decades of the last century to the present, the security of the normal functioning of nations and the global socio-economic system has been subject to various hybrid threats, both physical and cyber, which have jeopardized the most sensitive components of their critical infrastructure such as the facilities, systems and networks that ensure their normal functioning. The maritime domain is very important for critical sectors and industries such as communications, transportation, energy production and transfer, trade, etc. and is also subject to the types of threats listed above due to the increasing interdependencies and interconnectivity between nations worldwide.
Maritime critical infrastructure in simple terms can be understood as the systems and assets that are essential for the normal functioning of a society, economy and a country from a maritime/maritime perspective. It is very important that Romania’s policy makers also realize the importance and identify what Maritime Critical Infrastructure (MCI) represents for the country, prepare, adopt and put into practice as urgently and effectively as possible, adequate and properly budgeted policies, strategies, legislative documents, plans and programs, so as to enable existing or yet to be specifically established structures and institutions to take effective measures to protect MCI and ensure its resilience and sustainability.
DEFINITION OF CRITICAL INFRASTRUCTURE (CI) AND MARITIME CRITICAL INFRASTRUCTURE (MCI)
Although there is common ground in addressing the content of Critical Infrastructure (CI)/Maritime Critical Infrastructure (MCI), a common definition of the two concepts has not yet been agreed. CI is considered to consist of systems that provide important functions of a country or region that can affect the normal life of their community in the event of disruption/disruption of these functions, covering almost every sector of activity, from a city’s drinking water and wastewater network to the huge network of undersea communications cables that cross the Pacific Ocean.
The US has identified 16 critical infrastructure sectors[1]:
– Chemicals: an integrated component of the economy, businesses, warehouses, users (especially farmers), distributors and transportation of hazardous chemical/petrochemical materials, on which the other sectors rely
– Commercial facilities: provides a diverse area of locations that attract large agglomerations/ crowds of people for shopping, business, relaxation/entertainment or shared housing
– Communications: is primarily a private sector, responsible for protecting its infrastructure and assets, with CISA (Cybersecurity Infrastructure & Security Agency) supporting it to predict, anticipate, and respond to sector disruptions; composed of communications networks (including submarine cables), ISPs’ infrastructure, and satellite systems
– Companies producing disaster response materials and assets: CISA identifies, assesses, prioritizes and protects nationally relevant industries to prevent and mitigate the impact of natural and man-made disasters
– Dams: the sector provides critical water storage, impoundment and control services throughout the country, supplying water to many critical infrastructure sectors
– Defense Industry Manufacturing Bases: consist of industrial complexes around the world that provide research and development of military weapon systems, subsystems, components and spare parts
– Emergency services: infrastructure for police departments, fire departments and emergency management systems that maintain public safety and security, conduct life-saving operations, protect property and the environment, and assist communities affected by disasters
– Energy: thermoelectric power plants and electricity distribution networks, oil and natural gas facilities, oil and fuel pipelines and storage reservoirs, resources and facilities that maintain optimal energy supplies and ensure the health and general welfare of the population
– Financial services: banks, stock exchanges, payment systems and home delivery, financial institutions, from the largest global companies to community banks and lending institutions facing potential risks
– Food and agriculture: farms, food processing facilities, food distribution networks and food safety systems and food-related industries
– Government services and facilities: federal, state, local and tribal government facilities and homeland security systems
– Health and public health: hospitals, clinics, and their supply chains of medical supplies and medicines, which rely on collaboration with all sectors of the economy to protect them from hazards such as terrorism, infectious disease outbreaks, and natural disasters
– Information technology: data centers, critical infrastructure software and hardware systems, cyber security systems and internet infrastructure, which protect against cyber threats and vulnerabilities that are becoming increasingly important and complex
– Nuclear reactors, nuclear materials and nuclear waste: nuclear facilities, from reactors to generate electricity to medical isotopes used to treat patients, the US has an extensive civilian nuclear infrastructure
– Transportation system: provides for the safe and rapid movement and transportation of people and goods within the country and around the globe, consisting of airports, sea and river ports, railroads, highways, highways, bridges, and local public transit systems
– Water and wastewater: water treatment plants, reservoirs, pumping stations, and sewage systems, the systems belonging to this sector are vitally important to the nation’s stability and health.
Each of these sectors is considered to be of very high importance both in its own area of activity and for the areas of the sectors it could affect in the event of disruption, but in general, those sectors that ensure the continuation of critical state (government and business) activities and provide vital services that, if compromised or not resumed quickly, could jeopardize the health of the population or national safety and economic security are considered to be of vital importance. Although varying from country to country or region to region, the following sectors are generally considered as vital: energy, water, transportation and communications.
The maritime domain is of particular importance for a number of critical industries such as communications, transportation, energy transfer, trade, etc., which may be subject to threats impacting on the sustainable use and management of marine resources for economic growth, job creation and the general welfare of society. As a result, some major state and non-state actors are paying special attention to critical maritime infrastructure (CMI) by setting up CMI monitoring and analysis structures and force packages to prevent and combat risks and threats to it. Thus, the Maritime Security Center of Excellence (MSC)/ Maritime Security Center of Excellence (MARSEC COE) was established in Istanbul/ Turkye, with Turkey as the framework nation and Romania and Greece as sponsor nations, becoming the XXVI NATO Center of Excellence on June 8, 2020. Moreover, in response to the increasing hybrid actions of the Russian Federation in the Northern M. and M. Baltics, on May 28, 2024 NATO established at MARCOM/ Norfolk, UK the Center for Critical Submarine Infrastructure Security, specifically “designed to protect the thousands of nautical miles of undersea oil and gas cables and pipelines that are vulnerable to attacks aimed at disrupting and disrupting energy supply chains, global communications and international economic activity. The determination of NATO and the EU to strengthen the resilience of its states and the launch of a joint NATO-EU Task Force on Resilient Critical Infrastructure are examples of collective efforts that can lead to increased protection of critical infrastructure in the maritime domain[2].
The MARSEC COE concluded that a generalized definition of Maritime Critical Infrastructure (MCI/ MCI) should be understood as that part of a country’s critical infrastructure that comprises systems and assets that are essential to the functioning of society, economy and a country from a maritime perspective and could include the essential assets, facilities, systems, networks and processes that support the security, safety and stability of maritime domain operations[3].
MARITIME CRITICAL INFRASTRUCTURE (MCI)/ MARITIME CRITICAL INFRASTRUCTURE (MCI) ELEMENTS
Of course, the definition of IMC/MCI is basically a general approach, which can be better supported and explained by the concrete parts that compose it and that contribute to a better understanding and more intuitive explanation.
Based on the above-mentioned definition and following a thorough analysis by the MARSEC COE experts, it resulted that the IMC/MCI is composed of the following elements[4]:
1. Maritime mega-ports and mega-terminals
2. Offshore Platforms
3. Underwater/submarine internet/communications cables
4. Subsea oil fields
5. Marine drilling and extraction platforms
6. Subsea oil and gas pipelines
7. Refineries
8. Tanks/storage of oil, oil products and gas
9. Power plants and high and medium voltage network nodes near ports and major coastal cities
10. Mandatory crossing points
11. Maritime communication lines
In my opinion and after going through other works[5], I consider that the following elements should be added to the IMC/ MCI components, in addition to those listed above:
12. Navigation channels with their locks, if not included in the
mandatory crossing points
13. Submarine power cables
14. Maritime/offshore wind fields
15. VTSs- Vessel Traffic Systems/ VTIS- Vessel Traffic and Information Systems
16. Shipbuilding yards at sea and on the river
17. Coastal/river military seaports/military bases and their depots
18. Coastal and river road and railroad bridges
19. Logistical bases of zonal importance on the coast and river
20. Reservoirs/storage sites for chemical substances and fertilizers (coastal and marine)
Considering/taking into account all of the above, we could identify what could constitute elements of the Romanian critical maritime (n.a. and river) infrastructure:
1. The ports of Constanța, Mangalia, Midia, Galati, Braila and Tulcea
2. Drilling and extraction platforms in the Romanian EEZ
3. Submarine pipelines and oil terminal at Midia, in the future also the Neptun Deep-Tuzla pipeline
4. Midia- Năvodari refinery
5. Oil and gas tanks/storage facilities in Constanța and storage vessels for oil extracted from platforms (“Buștenari”)
6. Tanks, warehouses and vessels for the storage and transport of chemical substances and fertilizers in Romanian ports, on the coast and at sea
7. The entrance to the Sulina canal, as a mandatory crossing point from the Black Sea to the Danube
8. Maritime communication lines in the Black Sea, mainly Constanta – Bosphorus and Sulina – Bosphorus
9. Canals Danube-Black Sea, Sulina and Midia-Poarta Albă
10. Shipyards at Constanța, Mangalia, Midia, Tulcea, Brăila, Galați, Turnu- Severin and Orșova
11. Bases with naval vessels, large units and their logistic bases and warehouses in the ports of Constanța, Mangalia, Tulcea, Brăila and Galați
12. Road and rail bridges over the Danube-Black Sea and Danube river Danube Canal
13. Iron Gates 1 and 2 dams on the Danube
14. Safe navigation and buoyage systems and traffic routing centers in Constanța and Sulina.
CHALLENGES AND THREATS TO IMC/MCI
Based on the complexity and diversity of the elements that make up the IMC/ MCI we can easily conclude that the challenges and threats to them are at least at the same level of complexity and diversity.
Among the challenges and threats faced by the ICM/CIM are cyber, terrorism, hybrid, and direct physical destruction, whether intentional or unintentional in peacetime or crisis situations, culminating in military actions targeting such objectives in war.
As I mentioned in the introductory part, there have been many incidents and accidents related to critical maritime infrastructure, which have escalated, especially in the last decade and especially since three years ago, when the Russian Federation unleashed aggression against Ukraine and escalated hybrid actions against neighboring states, the EU and NATO. I will review just a few of these.
The acts of sabotage of the Nord Stream 1 and 2 gas pipelines in September 2022, the perpetrator of which has not yet been identified, are already well known and highly topical, and a number of uncertainties are still hanging over the incident, which state and non-state actors are still struggling to clarify and reach a final conclusion on the real perpetrator of the sabotage. The November 2024 incidents that affected the submarine cables between Finland and Germany (Central European countries) and between Sweden and Lithuania are on the same note. Several state and non-state actors have started from the alleged “hybrid actions” supported by the Russian Federation, which may seem very plausible in the context of the actions carried out by the latter in the Baltic and Northern seas in recent years directly or indirectly, through the “shadow fleet” or “intermediaries”. However, it appears that one of the incidents was most likely due to an accident triggered by bad weather and anchor mishandling by the crew of a vessel, and the authorities involved are continuing their investigations. In 2008, between 23 January and 1 February, six fiber-optic communication cables were severed in the Mediterranean Sea, near the entrance to the Suez Canal and in the Red Sea, blocking links between Europe and the Middle East and the North African coast for almost a week. Although the perpetrators have not been identified, the fact that the incidents occurred in about a week has led to the idea that they were deliberate.
A large proportion of these incidents are accidental, with nearly 200 cables broken or severed by nets and other fishing gear or anchors on ships around the world each year.
Another major cause of damage to submarine cables and pipelines is earthquakes/undersea tectonic plate shifts, undersea volcanic eruptions followed by tsunami waves, or man-made disasters such as the Fukushima/Japan reactor explosion.
Other significant incidents related to IMC/ CMI were those related to the blockage of major waterways and here I would refer to the blockage of the Suez Canal for six days in March 2021 due to totally unfavorable hydro-meteorological conditions for the maneuvering of the 400 m long 224 000 tdw ( 20 000 TEU) container ship “Ever Given” combined with some maneuvering errors which led to her being put alongside the canal. This blockage resulted in a market loss estimated at USD 9.6 billion. In the same vein, we cannot fail to mention the blocking of the Sulina Canal by the Ukrainian ship Rostock, loaded with metal profiles, on 2 September 1991 in the vicinity of Partizani, which was clearly intentional and left “in a fishtail” from the Romanian authorities’ point of view. It was only in 2005 that the ship was “pulled in pieces” out of the canal, and a bypass canal was dug on the Ilgani bank in order to resume navigation quickly. I have not found details of the total damage suffered by the Romanian state, but it seems that the Ukrainians wanted to open the Basstroe Canal on the Chilia Arm for navigation in order to bypass the Sulina Arm and avoid canal dues.
If the incidents listed above occurred in peacetime, one can imagine that in wartime critical maritime infrastructure elements become favorite targets for military action, hit both by the usual means of combat (aviation bombs, land and naval artillery, rockets, torpedoes, drones, etc.) and by diversionary actions of special forces. In support of these assertions there are many examples from the three years of the Russian Federation’s war on Ukraine and even before it started, when a multitude of hybrid actions were carried out, which continued and intensified during the course of the aggression.
Among the hybrid actions that preceded and then amplified in number and destructive results during the war, the following could be mentioned:
– the annexation of the Crimean Peninsula in 2014 with the “green little men” method (military structures with weapons and military technology and fighters in khaki outfits or rather uniforms without military insignia or insignia, then reusing the same methods before the outbreak of hostilities in the regions targeted at the outbreak of aggression – Donetsk, Herson, Luhansk and Zaporizhia;
– the improper establishment of vast exercise districts for naval vessels with the actual use of artillery ammunition, rockets and torpedoes, which were spread over the entire northern part of the M. Black Sea, practically almost up to the limit of the territorial waters of Ukraine, disrupting, or rather practically blocking, all international maritime communication routes to and from Ukrainian ports in the north and north-west of the M. This also raises a big question mark as to the attitude which the hydrographic authority responsible for this area should have taken, as the aggressive attitude of the Russian Federation was obvious;
– jamming and spoofing of GPS terminals for the electronic navigation of ships and traffic coordination stations in the area of ports and traffic separation systems and their satellite communications
– the destruction of reservoir dams on the Nistru and Dnieper rivers and the flooding of large areas in order to prevent or slow down ground operations (Ukrainian counteroffensive)
– destroying or damaging bridges and communication routes on major rivers in the areas of operations (including the bridge over the Kerci Strait, an action by the Ukrainians, for which the Russians took special protective measures after the attack)
– destruction of power plants and important nodes of power grid connections near or enclosed by sea and river ports
– cyber-attacks on communication and data centers regulating or coordinating maritime activity or dealing with the distribution of the flow of electricity or oil and gas.
Returning to the ICM/MCI and its elements in Romania, we could easily identify a number of risks and threats to these elements.
First of all, one should consider the hybrid physical or cyber-physical actions with destructive effects that could be deployed since peacetime on the Romanian sea and river ports and navigable channels that could cause their disruption by: blocking the entry – exit in – from ports and access routes to and from the Danube river with scuttled or sunken ships following collisions or as a result of intentional or unintentional “technical failures”; destruction of the locks of the Danube-M. Neagră canal, which would cause unimaginable catastrophes by flooding large areas, not to mention the sudden rise in the water level in the port of Constanța and the devastating effects on ships in the port and the related port infrastructure; blocking of the waterways (navigable canals and the Danube river) by destroying the rail and road bridges that cross them and the reservoirs at Iron Gates 1 and 2; causing explosions at oil, petroleum products and gas processing, storage and storage facilities near ports, refineries, offshore platforms and oil storage vessels at sea, as well as near-shore pipelines for the transportation of oil, petroleum products and gas; causing explosions (intentional or due to improper handling and storage) of potentially explosive dangerous chemicals and substances (we cannot fail to mention the Beirut disaster on 05. 08. 2020 when 2750 tons of ammonium nitrate, seized from a Georgian ship without legal transport documents and stored in unsafe conditions, exploded, causing the death of 100 people, injuring 4000 others, the disappearance of more than 100 people and the devastation of several neighborhoods in the city, with property damage estimated at 3-5 billion USD – the explosion was equivalent to an earthquake of magnitude 3.3 on the Richter scale and appears to have been the result of a revenge attack for the confiscation of the cargo)[6]; shipyards at sea and on the river can be particular targets for hybrid actions in order to decommission production and repair capacities, affecting both the civil and military sectors; extending to the military field, we could mention acts of sabotage and destruction of bases with military vessels, large units and logistic bases and their warehouses in Romanian sea and river ports and near the coastline or the Danube river the destruction of network nodes, power generation plants and even the electricity transmission infrastructure that supplies power to ports, shipyards, refineries and large coastal cities; equally dangerous for IMC/ MCI may be cyber attacks on databases and communication infrastructure of information systems dedicated to port, maritime, energy and water supply and to ensure the flow through oil and gas pipelines; also the disruption through jamming and spoofing of GPS terminals for the electronic navigation of ships, traffic coordination centers and stations in the port area, traffic separation systems and their satellite communications.
As mentioned earlier, while in peacetime hybrid actions on IMC/ MCI can cause major damage and disruption to economic and social activities in the maritime and maritime-related fields, in wartime the large-scale use of air, naval and submarine weaponry and the massive use of drones on critical maritime infrastructure elements, which have become preferred military targets, could completely paralyze the activity in this field. We have eloquent examples from the Russian Federation’s military actions during the three years of aggression against Ukraine, when sea and river ports, energy infrastructure, dams, war production capacities, military bases and their depots in ports and on the coast were the priority targets of the Russian military’s strikes.
END
There are states and international organizations, the most relevant for us are the USA, France, UK, Germany, Baltic and Nordic states, NATO and the EU, which, understanding the importance of critical infrastructure and the need to protect it, have developed policies, strategies, laws, documents and action plans important for Critical Infrastructure in general and Maritime Critical Infrastructure in particular. Searching on the legislative and CSAT websites for laws or normative acts related to the critical infrastructure of our country, I have not found any document that addresses this highly topical issue, especially given that for three years we have had a full-scale war on the country’s borders and even the penetration of Russian drones or their remnants on Romanian territory as well as drifting sea mines on the maritime communication seaways in our territorial sea, contiguous zone and Exclusive Economic Zone. There would also be the possibility that all documents related to the Romanian critical infrastructure are contained in secret documents, to which the general public cannot have access, but why have the other states, NATO and the EU publicly addressed this issue, without publishing those truly secret data and activities whose public disclosure would jeopardize the IMC/ MCI? The only visible reactions on the part of the Romanian state have been to alert the population, to send air-police aircraft to the area to discover, recognize and monitor their trajectory, and to set up commissions (sometimes headed by the Minister of Defense) and teams to investigate the crash site. A series of effective measures were taken at sea involving SMFN forces and assets (combat and auxiliary vessels, helicopters, EOD divers and radio-electronic surveillance and observation means) with a special operational effort for surveillance and early warning of dangers in the maritime environment, particularly against drifting sea mines, which ensured safe navigation on the sea lines of communication in the SMFN area of responsibility. Are these measures alone sufficient to protect Romania’s critical infrastructure in general and its critical maritime infrastructure in particular? I believe that they are not, and I would like to point out that the main documents issued by the EU[7] and NATO[8] in this regard are not covering and cannot replace the documents to be adopted at national level by each country, the two organizations emphasizing the particular importance of specific measures taken at national level in this area in the context of close, efficient and complementary cooperation between their members.
CONCLUSIONS
In the light of the above, we can draw the following conclusions:
1. Romania is only to a limited extent prepared to protect its critical infrastructure, i.e. maritime critical infrastructure.
2. It is absolutely necessary for Romanian policy makers to understand the importance of critical infrastructure and the need to protect it, and to develop important policies, strategies, laws, documents and action plans to protect Critical Infrastructure in general and Maritime Critical Infrastructure in particular, taking into account their importance in ensuring the economic and social life of the country.
3. Dedicated structures need to be created and interconnection of those that can ensure surveillance, analysis and countering of various hybrid threats of physical and cyber nature that can jeopardize the most sensitive components of Critical Infrastructure/ Critical Maritime Critical Infrastructure such as facilities, systems and networks that ensure their normal functioning. Adequately equip them with modern means that can ensure effective action by those established to intervene to protect and ensure the resilience and sustainability of the CMI/CMI.
4. Prepare the population, the economy and the force components of the Romanian State for action in case of hybrid/armed attacks, or disasters as a result of natural calamities or undesirable human actions.
5. Measures of paramount importance in ensuring the safety and resilience of critical maritime infrastructure include situational awareness and risk analysis in the creation and development of an early warning system dedicated to the protection of ICM/CIM.
[1] US Cyber Security & Infrastructure Security Agency,
https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors, accessed on 03.02.2025
[2] “NATO formally launches new Maritime Center for Undersea Critical Infrastructure Security “Article by “Public Affairs Office at MARCOM”, https://mc.nato.int/media-centre/news/2024/nato-officially-launches-new-nmcscui, accessed on 04.02.2025
[3] Diren DOĞAN, Cdr. (TÜR N), Deniz ÇETİKLİ (MARSEC COE), “Maritime Critical Infrastructure protection (MCIP) in a changing security environment”, p. 5-7
[4] Idem, p. 14
[5] Njall FRIDBERTSSON, General Report- “Protecting Critical Maritime Infrastructure- the role of technology”, rev.2, NATO, 07 October 2023 https://www.nato-pa.int/document/2023-critical-maritime-infrastructure-report-fridbertsson-032-stc, accessed 05.02.2025; “WHAT IS CRITICAL INFRASTRUCTURE?”, https://www.ibm.com/think/topics/critical-infrastructure, accessed 05.02.2025
[6] Uta Steinwehr , “What happened in Lebanon?”, article, https://www.dw.com/ro/ce-s-a-%C3%AEnt%C3%A2mplat-%C3%AEn-liban/a-54464910, accessed 04.02.2025
[7] EU Strategic Compass for Security and Defense,
https://www.eeas.europa.eu/sites/default/files/documents/strategic_compass_en3_web.pdf, accessed on 03
February 2025
[8] ” NATO 2022 Strategic Concept”,