The US Senate is hot on the trail of security aboard cruise ships. Security Management reports:

Because cruise ships operate in international waters or the jurisdictions of foreign countries, they are required to report crimes to the FBI or the U.S. Coast Guard. However, because the ship might be miles from the closest federal officials, it often takes days for the FBI to arrive to investigate a scene. In that time, the investigation can be undermined. Witnesses noted that evidence can disappear, victims can be intimidated, and suspects can be coached. Also, the cruise industry is not required to disclose crime statistics, making it difficult to assess the rate of shipboard incidents

That sounds like what most IT environments used to be like before laws like California’s SB1386 were passed.

Just last year I had to argue with company executives about an investigation after a telecommunications breach where they wanted to destroy evidence. They had “back-to-business” fever and wanted to move on in life as quickly as possible. Without outside governance, it can be almost impossible to get a person driven by sales numbers and pride to stop and dwell on a fault or flaw, especially when harm is externalized.

Sen. John Kerry (D-MA), the subcommittee chairman, noted that the cruise industry lacks mandatory, standardized procedures to prevent and respond to criminal acts on board ships. Terry Dale, president and CEO of Cruise Lines International Association, stated that mandatory procedures were unnecessary because cruise lines implemented voluntary processes to protect passengers.

Where have I heard that before? This is the “trust us” line of reasoning, which is based on an toothless promise. What penalty exists if voluntary measures, even when documented clearly, are not followed? None, of course, because there is no penalty mechanism in volunteerism without governance. A more logical response from Dale (well, from a security professional perspective) would be that governance is welcome because he understands the safety and security needs of customers and is ready to address their concerns directly and with accountability.

The problem with hiding behind toothless volunteerism and not taking a more proactive approach to regulation is that a law could be passed anyway, but without collaborative input. This just wastes everyone’s time.

Bill S.3204 is now under consideration with numerous security measures:

…peep holes, security latches on cabin doors, and CCTV. The bill would require that all ships have crew members aboard who are trained in crime scene investigation. Cruise lines would be required to report all incidents of criminal activity to the Coast Guard, who would then make that information available to the public via the Internet. Under the bill, members of the Coast Guard would be dispatched to cruise ships to ensure that they comply with the law.

Sounds reasonable to me, although it raises the issue of who will be responsible for the privacy of passengers under the surveillance system. Can you trust the same crew already under suspicion of unethical and criminal behavior. Lets hope screening is used and privacy controls are in place to prevent new information security violations from adding fuel to the fire.

LiveMint of The Wall Street Journal points out that a shipping firm in India is finding ways to evade regulators and taxes:

Mercator Lines Ltd, India’s second biggest private shipping firm, has registered more vessels outside the country in a bid to skirt tight local regulations while trying to reap the benefits of tonnage tax, a levy based on the cargo capacity of ships that reduces maritime companies’ tax burden.

The Mumbai-based firm has registered four dredgers, which it purchased in the past year, in the Comoros, an island nation in the Indian Ocean off the eastern coast of Africa, said an official at the directorate general of shipping, the maritime regulator.

I always wonder when I see ships that have city names on them whether there is really any actual association. What is needed to authenticate a ship as genuinely from a port-of-call? Nothing, apparently.

All the ships have been registered outside India directly, without opening a subsidiary in either Marshall Islands or the Comoros.

By doing this, Mercator can hire officers and crew from any part of the world, unlike ships registered in India, which have had to employ only Indian nationals. Last week, the regulator eased the clause on hiring only Indian nationals, but ship owners say strict conditions still apply to employment of foreigners.

Easy to see why the loophole is so attractive, and the irony now of course is that Mercator has to request the authorities treat these non-Indian ships as equal to Indian ships. The question is how a regulatory body should respond when a Mercator ship arrives with an international crew and “Domoni” stenciled on its stern. Their identity profile is different, so should they be authorized?

This seems similar to the debate over yacht tax loopholes in America these days. A typical story runs like this:

Jack Darcy of Redmond paid cash for a $2.2 million yacht through a Lake Union dealership last April, but he didn’t pay a dime in Washington sales taxes.

Instead, the retired corporate executive saved $200,000 by signing papers to buy his snazzy new 73-foot yacht three miles off Washington’s coast, in international waters.

[…]

Before California state law changed last month, resident boat owners needed only to keep their craft away from California for 90 days after purchase. Then they could sail home and never pay a sales tax. Most went to Mexico and were dubbed the 90-day yacht club.

In California the regulators then passed a rule called Chapter 226 that extended the time away from 90 days to a full year. Reports showed closing the so-called “sloophole” had little negative impact.

The state’s official Legislative Analyst’s Report concluded that the temporary one-year law had not resulted “in the sharp reduction in vessel-related sales that some had feared.” According to the report, the law resulted in a $20 million increase in state and local tax revenues from yacht sales made to California residents.

Strangely enough, even though the Republican Governor called on the state to close the gap permanently, he found little support from his party. An LA Times editorial painted a disturbing picture:

Like the characters in some hippie-era pop song, many Republican lawmakers in Sacramento have decided to let this troubled world fend for itself while they sail away to some imaginary shore. On yachts. After dodging their taxes

…or like characters in maritime law who like to ply the International waters as a path to alter their identity just long enough to escape a duty before returning “home” to lay claim to local privileges.