Cybersecurity risks of automated (and autonomous) offshore oil and gas units—the IMO cybersecurity rules framework

Abstract Automated and/or autonomous offshore platforms or units are becoming more important in the energy sector, whether they are being used for oil and gas extraction or for carbon storage purposes. Automation means that harsh working conditions and risks of personal injury to crew could be cut to virtually zero. Automation also provides significant cost savings and helps make less attractive oil and gas fields more economically viable to exploit. However, automation does come with its own set of challenges—the notable one being the cybersecurity threat. Any regulation or international standard dealing with the cybersecurity risk which is relevant to automated offshore units is usually framed within those rules that apply to ships. This article examines to what extent that regulatory approach, especially that of the International Maritime Organisation’s (IMO) regime, could and should apply to automated or autonomous offshore platforms. It argues that whilst, for now, the IMO cybersecurity guidelines are relevant, a more targeted regulatory approach is needed.