France probes ‘foreign interference’ after malware found on ferry

This Feb 23, 2019, file photo shows the inside of a computer. (AP Photo/Jenny Kane, File)

France is probing possible foreign interference after a passenger ferry was infected with malware that could allow the ship to be remotely controlled, the interior minister said Wednesday.

A Latvian was arrested and charged after the malware was found on a ferry with a capacity of over 2,000 passengers called the Fantastic, belonging to Italian shipping company GNV, while it was docked in France’s Mediterranean port of Sete, Paris prosecutors said.

Authorities did not name Russia, but France and other European governments have recently warned that Moscow is stepping up a campaign of interference more than three and a half years into its war against Ukraine.

Italian authorities had warned France that the vessel’s operating system could have been infected by a malware known as a Remote access Trojan (RAT) which allows a hacker to gain remote control of a system.

Two crew members, a Latvian and a Bulgarian, whose identities had been signalled to France by the Italian authorities, were detained last week. The Bulgarian was freed but the Latvian was charged and placed under arrest in the investigation.

The office of the Paris prosecutor said late Tuesday it had opened an investigation into a suspected bid “by an organized group to attack an automated data-processing system, with the aim of serving the interests of a foreign power”.

GNV emphasized it had been the first to alert Italian authorities, telling AFP in a statement that it had “identified and neutralized an attempt at intrusion on the company’s computer systems, which are effectively protected. It was without consequences.”

‘Complicity within the crew’?

Christian Cevaer, director of the France Cyber Maritime monitor, told AFP that any attempt to take control of a ship would constitute a “critical risk” because of the “serious physical consequences” that could endanger passengers.

He said such an operation was complex, likely requiring the use of a device such as a USB key to install the software, a move that would need “complicity within the crew”.

Paris prosecutors are already examining around a dozen cases of suspected foreign interference, ranging from antisemitic graffiti and pig heads left in front of mosques to coffins placed at the foot of the Eiffel Tower.

“This is a very serious matter... individuals tried to hack into a ship’s data-processing system,” Interior Minister Laurent Nunez told France Info radio early Wednesday.

“Investigators are obviously looking into interference. Yes, foreign interference,” he said.

Nunez refused to be drawn over whether the attack was aimed at diverting the ship from its route and did not name Russia.

But he said: “These days one country is very often behind foreign interference.”

‘Confidential files’

The interior minister also said his ministry had been the target of a cyberattack in recent days.

Nunez said a “few dozen confidential files” had been extracted relating to criminal records and wanted individuals.

He said the files were accessed due to “carelessness”, using passwords shared on messaging apps.

In a sign of the gravity of the case, the Fantastic investigation is being led by France’s domestic intelligence service, the General Directorate for Internal Security (DGSI).

After being cordoned off in port, the Fantastic was subjected to an emergency inspection by the DGSI, which led to the seizure of several items.

The vessel was subsequently cleared to sail again having received approval from maritime authorities, after technical checks were completed and any danger to those on board ruled out.

Emergency searches were also conducted in Latvia with the support of Eurojust, the European Union’s judicial cooperation arm, and the Latvian authorities.

The Latvian national’s lawyer Thibault Bailly said he believed the “theory of Russian interference evoked in the press seems superfluous”.

“The investigation will shed light on several aspects of this case that are still unclear. In particular, it will demonstrate that this case is not as worrying as it may have initially seemed,” he added.