0 incidents, 0 sensors: governing the risks no one owns
The core message of this session is that GNSS jamming and spoofing in Dutch waters is not just a technical navigation issue; it is a governance problem that cuts across organizations, legal responsibilities, reporting channels, and enforcement. Gerco Kanbier opened by tracing how security evolved from antivirus and IT security into cybersecurity with processes, people, and board accountability. He then connected that evolution to maritime operations: pilots are mandatory navigation experts who board large ships and bring them safely into Dutch ports, and their work increasingly depends on resilient IT and OT systems as well as reliable positioning signals.
Gerco used several concrete examples to show the range of satellite interference. A misconfigured scooter alarm in a local harbor blocked satellite signals every six minutes during working hours and took about a week to locate. A yacht in the Wadden Sea disrupted navigation, mobile communication, and Wi-Fi for nearby ships because it carried a jammer intended to stop drones from filming it. He also pointed to disrupted navigation areas in the Baltic, Ukraine, and the Strait of Hormuz, plus a Europe-wide satellite interference incident researchers linked to Russian satellites. These examples framed jamming as something that can be tiny and local, deliberate and protective, or large-scale enough to require a national response.
The session then moved from threat examples to responsibility. When the audience was asked who should signal, locate, and stop jamming, options such as the captain, pilot, port authority, navy, Coast Guard, port police, and government all received some support. Gerco revealed that the responsible reporting body is the Digital Authority for Digital Infrastructure, yet he said he had not known that himself despite being the CISO responsible for IT and OT security at the Dutch pilot organization. The authority has a sensor network on land and a public reporting point, but when he asked how many satellite disruptions had been reported in Dutch waters in 2025, the answer was zero; when he asked how many sea sensors existed, the answer was also zero.
The conclusion of the available transcript is that Dutch ship handling is resilient enough to continue operations in current small incidents, but the system is not organized to learn from or escalate them. Pilots may notice jamming on independent portable pilot units, report it to the port authority, and still bring ships safely into harbor, but the Digital Authority is not informed. Under the new Dutch WWKA law, ship handling is recognized as a vital process, yet each company remains responsible for its own risks while systemic risks belong to the chain as a whole. Jelle Niemantsverdriet took over by arguing that no new organization, mass sensor purchase, or extra budget is necessarily the first answer; the existing parties already see pieces of the problem and need orchestration around one shared risk.
Critical Systems and Chain Security+1 other speaker
