When the Bridge Goes Haywire — Exposed PLCs in Movable Bridge and Navigation Lock Infrastructure

Movable bridge control systems should be invisible from the public internet. Passive search results suggest otherwise.

Imagine a hurricane pressing the coast. Emergency planners are ready. Roads are reversed. Shelters are staged. Then a key bridge or a set of bridges goes haywire.

The movable bridge, a bascule, swing, or vertical lift span, is meant to open for marine traffic and close for vehicles on demand. When it works, it is an elegant piece of electromechanical choreography. PLCs read position sensors, interlocks verify clearance, drives rotate counterweights, and signal lights tell drivers when it is safe to cross.

When it does not work, or worse, when it works in ways nobody intended, that choreography becomes a hazard. And the first sign that someone might not be working with the intended script is this:

Industrial protocol devices, Rockwell EtherNet/IP on port 44818 and Modbus TCP on port 502, answering from the public internet at infrastructure sites where no such exposure should exist.

What We Found

Using passive Shodan searches, no active scanning, no probing, we queried for devices responding to industrial protocol banners on known ports. The results were not theoretical.

Rockwell PLCs (EtherNet/IP, port 44818)

37 devices in Alabama

49 devices in the New Orleans metro area

6 devices globally with "lock" in their banner — a small count, but it confirms that devices at navigation lock infrastructure are present in the public index. This is an existence signal, not a volume estimate.

Source: Passive Shodan search, developer tier. Query: port:44818 with geographic and keyword filters.

Modbus Devices (port 502)

91 devices in Alabama

218 devices in the New Orleans metro area

12 devices globally with "lock" in their banner — again, a small number. It tells us this type of infrastructure is represented in the searchable surface. Do not treat it as a full inventory.

Source: Passive Shodan search, developer tier. Query: port:502 with geographic and keyword filters.

We did not inspect any of these devices, confirm what each one controls, or attempt to identify specific hardware models or operators. The point is not to catalog individual assets. It is to paint the broader picture: industrial protocol hardware, of the same families used in movable bridges, navigation locks, and related control systems across the country, is present in publicly reachable search indexes. That is the observation, and it is enough to ask the architectural questions that follow.

These numbers sit in the same corridor as some of the most heavily trafficked movable spans in the country, many of which carry structurally deficient ratings, and alongside navigation locks that run continuously to keep commercial barges moving through the Mississippi and Intracoastal Waterway. The physical infrastructure is already under strain. The OT surface sitting behind it should not be making that strain harder to manage.

These are devices that answered. They are publicly reachable. That does not mean every one is exploitable, unsegmented, or unauthenticated. It means that from the open internet, a query reaches a PLC at a location that controls physical movement, and the PLC answers.

How This Should Be Designed

In a properly designed high assurance OT architecture, the control path for a movable bridge, or any navigation lock or dam, should not have a bidirectional path from the public internet or even from lower trust networks.

The ideal design looks like this:

The control network , which means the PLCs, drives, interlocks, position sensors, and traffic signals, sits behind a unidirectional gateway or equivalent one way transfer mechanism.

Monitoring and status data can flow out. Operators can see what is happening.

Commands, firmware updates, and configuration changes cannot flow in without deliberate, human mediated, or highly controlled break glass procedures.

This follows the spirit of IEC 62443 zones and conduits, NIST SP 800-82, and the higher assurance patterns used in nuclear, some water, and certain critical infrastructure sectors. The principle is simple: information can leave, commands cannot enter, not without someone looking at it first.

How This Actually Exists Today

Most existing movable bridge installations were never built that way. The typical reality is conventional firewalls with rules that accumulate over years, VPNs for vendor access and remote diagnostics, jump hosts and remote desktop for operational convenience, and in the worst cases, direct exposure of industrial protocols on interfaces reachable from the public internet.

Remote operation capability, which AASHTO has been formalizing guidance around, almost always requires some form of bidirectional connectivity. Pure unidirectional designs make remote command and control much harder, so operators and vendors often prioritize operational...