Below is a NATO critique of the current maritime ports held or controlled by China. Of note is NATO identifying the seriousness of the cyber vulnerabilities in these ports. The paragraph titled: The Digital Port, saying “The most critical component of a modern port may not be the quay or the crane. It could be the terminal’s operating system.”
A commercial port is not a military base. Yet, in a European security crisis, it can become almost as important. Tanks, ammunition, fuel, spare parts and troops cannot be moved on a large scale without functioning terminals, rail links, customs systems, warehouses and digital platforms. This is why Chinese involvement in European ports can no longer be assessed solely in terms of trade volumes and returns on investment. The real question is not whether Chinese-run terminals are covert military installations: there is no public evidence to suggest this. Rather, it is whether commercial access could become a strategic lever should relations between China and NATO deteriorate. The answer depends on ownership, operational rights, technology, access to data and the availability of alternatives. Piraeus, Zeebrugge, Hamburg and Kumport are not equivalent cases. The risks involved differ because a 67% controlling stake in the port authority is fundamentally different from a minority shareholding limited to 24.99% in a single terminal company.
The logistics of deterrence - NATO’s current defense plans require the rapid movement of large forces across allied territory. In May 2024, the Allies approved a Logistics Action Plan containing 20 action points aimed at strengthening collective logistical support. NATO’s official framework for resilience also identifies transport systems as one of the Alliance’s seven core requirements: military forces must be able to move rapidly whilst civilian services continue to operate during a crisis. The scale of the challenge became apparent during NATO’s Steadfast Defender exercises, which tested reinforcement routes from North America across Europe and highlighted the importance of collaborating with civilian authorities and the private sector. Ports cannot be separated from this equation. Most heavy equipment arriving from overseas cannot be moved cost-effectively by air. It must enter via seaports and then be transported onwards by rail, road or inland waterways. Europe has reached the same conclusion. In June 2026, the Council of the European Union adopted a strengthened framework for screening foreign investments and approved conclusions on an EU strategy for ports focused not only on competitiveness, but also on resilience and security. The Council explicitly welcomed future guidelines for the assessment of foreign investment in ports. The political signal is clear: ownership and control of port infrastructure are now matters of security, not merely corporate transactions.
Piraeus: the case under the strictest monitoring - The Port of Piraeus is the largest Chinese investment within the European Union. In 2016, as part of the Greek privatization process, 67% of the Piraeus Port Authority was sold to COSCO. UNCTAD recorded the total value of the wider deal at around €1.5 billion, including the share acquisition, mandatory investments and concession payments. Piraeus is strategically distinct from a minority investment in a single container terminal. Interests linked to COSCO hold a controlling stake in the authority that manages a multi-purpose port serving containers, vehicles, ferries, cruise traffic and wider logistics operations. Greek sovereignty remains intact. Customs, the police, the coastguard, defense and national security powers remain under Greek authority. However, ownership can shape capital expenditure, procurement, technological architecture, senior management and long-term operational strategy. The most credible risk is therefore not a dramatic order from Beijing to close the port. Such a move would cause enormous commercial and political damage, including to Chinese interests. The most realistic concerns are more subtle: operational visibility, institutional dependence, influence over investment priorities, and the cost of replacing an established operator during a crisis. A port operator naturally has access to ship schedules, quay usage, container dwell times, equipment performance, gate movements and rail connections. None of this data is necessarily classified. Taken together over time, however, it can reveal capacity, congestion, peak patterns and vulnerabilities. If unusual military movements were to pass through the same commercial systems, their significance might become apparent even without access to defense networks. Piraeus has also demonstrated how investment can transform connectivity. UNCTAD identified it as the best-connected port in the Mediterranean in 2019, following years of investment and expansion of services. That commercial success is precisely why its strategic importance has increased: the more efficient and connected the port becomes, the greater the cost of losing or replacing its capacity.
Zeebrugge: a Chinese terminal within a European mega-port - The COSCO Shipping Ports terminal in Zeebrugge operates under a different model. COSCO does not control the entire Port of Antwerp-Bruges. It controls and operates a terminal within one of Europe’s largest maritime-industrial complexes. According to COSCO Shipping Ports’ corporate report for 2025, the Zeebrugge terminal handled approximately 894,000 twenty-foot equivalent units (TEUs) over the course of the year, an increase of around 33% compared with 2024. The figures point to rapid growth and deeper integration into the group’s European network. Zeebrugge’s location is significant as it combines deep-water maritime access with road and rail links to northern and central Europe. In September 2025, the Port of Antwerp-Bruges announced a direct rail link connecting the COSCO terminal in Zeebrugge with Mannheim, strengthening its ties to the heart of Germany’s industrial sector. This is a perfectly legitimate commercial development. It also demonstrates how a terminal is interwoven into continental logistics. A facility is no longer simply a place where ships are unloaded. It has become a hub connecting shipping lines, freight trains, road haulage companies, warehouses, customs procedures and industrial customers. The relevant unit of risk is therefore the terminal and its interfaces, not the entire Belgian port system. COSCO may have detailed visibility of the ships, containers and equipment passing through its own operations, but it does not automatically see every movement elsewhere in Antwerp-Bruges. The wider port area also comprises multiple operators, terminals and sovereign authorities, providing Belgium with greater redundancy than exists in a model where the port authority is majority-controlled. Zeebrugge nevertheless raises a serious issue for defense planners: if a terminal operator controls its own planning systems and customer data, how should military cargo be segregated during a reinforcement operation? The answer should not depend on trust alone. It requires technical segregation, nationally controlled registers and alternative handling capabilities.
Hamburg: participation - The debate over Hamburg illustrates how exaggeration can undermine a legitimate security argument. COSCO does not own the Port of Hamburg. It does not control Hamburger Hafen und Logistik AG. It holds a minority stake of 24.99% in the company that operates the Tollerort Container Terminal. The German investment screening process limited the transaction to below 25%. HHLA explicitly states that the investment gives COSCO neither access to the Port of Hamburg as a whole nor control over HHLA. The agreement concerns a non-controlling stake in a single terminal subsidiary. This does not render the investment insignificant. A minority shareholder may gain commercial insight, integration with customers and certain corporate information, depending on the shareholders’ agreement and governance restrictions. COSCO is also a major shipping customer, which means that the relationship may increase commercial dependence in the long term.
China Merchants: exerting influence through a portfolio - China Merchants Port Holdings represents another strand of China’s global maritime expansion. Unlike COSCO’s integrated combination of shipping lines and terminals, China Merchants often operates through equity partnerships, joint ventures and investment vehicles. Its most significant indirect platform is the Terminal Link group, in which China Merchants holds a 49%. Terminal Link reported a throughput of 26.89 million TEUs in 2024, up 5.7% year-on-year. This figure demonstrates the breadth of the portfolio, but a 49% stake does not automatically guarantee unilateral control over every terminal in which the vehicle has a stake. Governance rights, management agreements and national regulations must be examined on a terminal-by-terminal basis. This clarification is important because China’s exposure in ports is often inaccurately mapped. The COSCO terminal in Zeebrugge is owned by COSCO Shipping Ports, not by China Merchants. China Merchants’ strategic significance, however, lies in its diversified portfolio, its partnership with CMA CGM through Terminal Link, and its investment in facilities such as Kumport in Turkey. The analytical challenge lies in tracing the chain from the Chinese parent company, through holding vehicles and local subsidiaries, to the actual operational rights. A shareholding percentage alone does not reveal who appoints the managing director, approves technology purchases, appoints board members or has access to operational data.
Kumport and Turkey’s geographical leverage - Kumport, situated in the Ambarlı port complex near Istanbul, handled approximately 1.55 million TEUs in 2025, representing a year-on-year increase of 22.8 per cent, according to the annual report of China Merchants Port Holdings. Its importance stems from its geographical location. Turkey is a NATO member situated at the crossroads of the Black Sea, the Mediterranean, the Balkans, the Caucasus and the Middle East. The Marmara region is home to a dense concentration of industry, shipping and road networks. There is no public evidence that NATO relies operationally on Kumport for any specific contingency plan. It would therefore be irresponsible to describe the terminal as a proven vulnerability in an allied military supply chain. But it is equally unrealistic to ignore the strategic value of a high-capacity terminal within such a critical transport region. The question is whether the Turkish authorities could maintain operations, isolate sensitive data and rapidly divert flows should an operator become unavailable or politically constrained. Geography creates opportunities, but resilience determines exposure.
Italia at the heart of the Mediterranean system - Italia has a particular interest in this debate. Its ports link the western and eastern Mediterranean with the Adriatic, the Balkans, Central Europe and North Africa. Genoa and Vado Ligure link the Mediterranean to the Rhine-Alps corridor, whilst Trieste and other Adriatic ports connect maritime traffic with Central and Eastern Europe. Italian infrastructure planning has long treated ports and railways as parts of an integrated continental logistics system. Italia is also a key NATO member on the southern flank. Its ports, airports and industrial base would be vital during any major reinforcement, evacuation or support operation in the Mediterranean. For Rome, the issue is therefore broader than simply the acquisition of a specific shareholding by a Chinese company. The key question is whether Italia has a continuous and detailed understanding of who controls the systems on which port operations depend. An investment may be acceptable at the time of approval but become more sensitive subsequently because the shareholder acquires new rights, the terminal adopts a foreign cloud platform, or a maintenance contractor is granted remote administrative access. Investment screening must therefore be an ongoing process rather than a one-off authorization. Italian strategic bodies should examine changes in ownership, governance, debt, software providers, data localization and remote maintenance agreements throughout the life of the investment.
The Digital Port - The most critical component of a modern port may not be the quay or the crane. It could be the terminal’s operating system. Digital platforms coordinate the allocation of berths, gates, cranes, yard positions, customs declarations, lorry appointments, rail movements, invoices and maintenance. The efficiency gains are substantial. They are also a source of vulnerability. A hostile actor does not need a secret backdoor in the software. The risk may stem from standard administrative privileges, remote support accounts, proprietary updates, data replication or dependence on a vendor whose products cannot be replaced quickly. A port can remain legally European whilst becoming operationally dependent on software, communication components or analytics platforms controlled by foreign entities. This is technological lock-in: the longer a system remains entrenched, the more costly and disruptive it becomes to break away.
The practical questions are straightforward. Where is operational data stored? Who can access it remotely? Are military and civilian cargo records kept separate? Can national authorities maintain records independently of the terminal operator? Can the port continue to operate manually if its main digital platform is taken offline? Are software updates subject to independent security testing? These questions should apply to every operator, regardless of nationality. Chinese state ownership raises additional concerns because corporate autonomy may be constrained by national policy and law, but weak IT governance is dangerous even in a wholly European-owned terminal.
NATO’s Southern Dimension - The Sahel does not belong on the same map as Piraeus, Zeebrugge or Hamburg. It should not be artificially included in a discussion about Chinese stakes in European ports. Its significance lies in its strategic depth. At the 2024 Washington Summit, NATO adopted an Action Plan for the Southern Neighborhood covering the Middle East, North Africa and the Sahel. The Alliance also appointed its first Special Representative for the Southern Neighborhood, creating a dedicated focal point for the region. China’s involvement in African infrastructure must therefore be assessed as part of a wider network. Ports, railways, telecommunications and industrial zones can support regional development and trade. They can also create long-term commercial and technological dependence if contracts, financing and data governance are opaque. The concern is not that African infrastructure built by the Chinese automatically serves military purposes. The evidence does not support such a claim. The issue is cumulative influence: access to ports, logistics data, political relations and financing positions along the routes linking Africa to Europe.
Commercial presence, a strategic option - Chinese investment in ports should be understood through competing hypotheses. The first is simple commercial rationality. Chinese shipping groups invest to secure cargo, improve efficiency and generate returns. The strong growth in throughput at Piraeus, Zeebrugge and Kumport supports this explanation. The second is strategic positioning through commercial means. Long-term shareholdings provide familiarity, relationships and information that may retain value beyond immediate profit. The third is deliberate preparation for dual-use civilian and military exploitation. Public evidence for this stronger claim remains insufficient in the European cases examined. The fourth is mutual dependence. China needs access to European consumers and stable shipping routes, whilst European ports benefit from Chinese cargo and investment. A commercial port is not a military base. However, in a European security crisis, it can become almost as important. Tanks, ammunition, fuel, spare parts and troops cannot be moved on a large scale without functioning terminals, rail links, customs systems, warehouses and digital platforms. For this reason, Chinese involvement in European ports can no longer be assessed solely in terms of trade volumes and returns on investment. The real question is not whether Chinese-run terminals are covert military installations, there is no public evidence to suggest this but whether commercial access could become a strategic lever should relations between China and NATO suddenly deteriorate.
Source: The NATO scenario in Chinese-controlled ports - Il Sole 24 ORE
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
Comments