This is just embarrassing on multiple counts. No equipment from adversary countries should be allowed in American infrastructure. I wonder what sort of attacks are possible using such a modem, but maybe it doesn’t matter - they may find creative ways to disrupt operations like disabling the crane remotely.

It’s interesting to see the tactics used by the crane manufacturer, ZPMC, to pressure port customers into accepting modems and arbitrary remote access, as detailed on page 29 (different prices, warranty issues). Also interesting is page 30, which highlights issues with using companies that we might normally trust, like ABB from Germany, because they in turn have a partnership with the offending Chinese company, ZPMC.

What I’m taking away is that we have been complacent in managing risks from countries like China, and need to take an aggressive security minded approach to managing possible vulnerabilities and attacks.