Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
September 28, 2026
Originally published in ACTIO E-Magazine Edition 30 (September 2026). Law as of September 2026.
Indonesian civil liability requires proof of an unlawful act, causation, and fault, but a cyberattack on a vessel strains all three. When a hacked ship causes damage, the chain of events involves the attacker, the shipowner, the manager, and the software provider, and the 19th-century Civil and Commerce Codes offer no settled answer on allocating fault and causation among them.
As ships adopt artificial intelligence and digital systems, cyberattacks threaten safety and raise unresolved liability questions for shipowners, managers, and software providers under Indonesian civil and commercial law. Hackers seeking remote control of a vessel may target its Automatic Identification System (AIS), ECDIS, satellite communications, Ballast Water Management System, and even the ship’s wi-fi, rendering the ship vulnerable to system shutdown or breach, which may lead to collisions with other vessels and shore infrastructure.
With shipping playing such an important role in Indonesia’s economy as a gateway of trade in the global supply chain, the threat of cyberattacks represents a crucial risk for many stakeholders. A central and thus far unsettled question is whether the Indonesian framework of civil liability is adequate for the complexities of increasing digitalisation, and how responsibility should be allocated when a chain of multiple parties is usually involved.
Under the Indonesian civil law regime, a party claiming damages based on the unlawful act of others must prove, among other things, that the defendant committed an unlawful act, that a causal link exists between the unlawful act and the injury or damages suffered, and that the defendant is at fault. These elements rest on Article 1365 of the Civil Code.
For vessel collisions, the Commerce Code allocates liability by fault. Where the fault for a collision lies squarely with one of the ships involved, liability is held by that shipowner. Where both ships bear some fault, liability is allocated proportionally. This also applies to damages caused by ship operations conducted in an erroneous manner or otherwise contrary to law. Meanwhile, if a collision occurs due to matters unintended or beyond the powers of the parties, or if there is doubt regarding the cause of the collision, the resulting damage is borne by the aggrieved party. The source cites Articles 536, 537, 544, and 535 of the Commerce Code.
However, cyber-risk management on ships raises issues that could not have been anticipated when the codes were drafted in the 19th century. Many legal questions remain unanswered, especially regarding the concepts of fault and causation.
In a cyberattack setting, the owner or operator of the ship is not the only party with a role in the resulting damage. The following questions emerge: how should fault be determined, and to what lengths should shipowners or operators be expected to go to ensure the cyber-safety of the ship?
Conventional collision cases are comparatively simple: a shipowner orders the master to enter a waterway without proper clearance, a master steers too close to the edge of a narrow channel contrary to Rule 9 of the COLREG, or a master fails to be onboard and in control when entering port. In each, the unlawful act is isolated from third parties. A cyberattack is different. The conduct of the attacker who intentionally launched the attack, and of software manufacturers or support providers who faultily equipped IT and OT systems or failed to install necessary security updates, may be available to the shipowner as a defence against unlawful act claims.
There is also the question of the standard of care. It is often difficult to determine the extent to which a given software defect or inadequacy can be detected by a shipowner through reasonable due diligence. It is therefore tempting to ask whether such attacks fall under damages that are unintended by the shipowner or operator, or beyond their control under Article 535 of the Commerce Code, which would absolve the shipowner from liability. The source leaves this question open.
Under Article 1365 of the Civil Code, causation is assessed through the adequat veroorzaking theory. It identifies, within a chain of acts, the act proportionate to the resulting consequence, provided that consequence was foreseeable based on patterns derived from factual observations. This analysis is relatively straightforward when a collision involves a short causal chain, separable components, and few actors.
Maritime cyber incidents arise in an environment of highly interconnected and overlapping operational mechanisms. The long chain of events necessarily engages the actions and non-actions of many different actors. How can plaintiffs establish that a cyberattack incident ultimately causing them injury or damage was “caused by” a vessel under attack, for the purposes of Article 536 of the Commerce Code? Is there a basis for imposing a general duty of care on ship software manufacturers and IT support providers, for which a shipowner or operator may shift liability?
The phrase “caused by” in Article 536, read with the adequat veroorzaking doctrine, requires sufficient proximity of an act or omission to the ultimate consequence and reasonable foreseeability that the act or omission may result in such a consequence. Courts will have to decide the parameters for assessing whether a criminal cyberattack on a ship was sufficiently foreseeable to the shipowner, in determining whether the shipowner’s failure to prevent that attack may reasonably be said to have caused it.
Further questions remain unanswered: whether judges would regard software manufacturers and support providers as obligated to foresee the criminal misuse of their products at all, whether the contributory fault of the manufacturer reduces the liability of the shipowner or manager, whether it could negate that liability entirely, or whether it would have no effect on it.
In the face of this regulatory and doctrinal gap, guidance may be found in international instruments. The IMO Guidelines on Maritime Cyber Risk Management and the 2020 Guidelines on Cyber Security Onboard Ships set out general responsibilities for shipowners and third-party software support providers. However, these guidelines are non-binding, which leaves the regulation of liability for cyberattacks to domestic systems.
Indonesia’s civil law regime must therefore fill the legal vacuum with an equitable scheme of liability, ensuring that vessels are held to the highest standards possible in safeguarding their own safety and that of others, while providing an equitable framework for assessing the weight of different acts forming one chain of events in causing the damage.
What must a claimant prove under Article 1365?
An unlawful act, a causal link between the act and the injury or damage suffered, and fault on the part of the defendant.
How is collision liability allocated under the Commerce Code?
Where fault lies squarely with one ship, its owner bears liability; where both ships bear fault, liability is allocated proportionally; where the collision was unintended or beyond the parties’ powers, the damage is borne by the aggrieved party.
Can a shipowner blame the hacker or the software provider?
That is one of the open questions. The conduct of the attacker and of software manufacturers or support providers may be raised as a defence, but there is no settled answer on how their fault interacts with the shipowner’s liability.
What is the adequat veroorzaking theory?
The causation theory applied under Article 1365: within a chain of acts, it identifies the act proportionate to the resulting consequence, provided the consequence was foreseeable based on factual patterns.
Do the IMO cyber guidelines settle liability?
No. They are non-binding and set out general responsibilities; liability for cyberattacks remains a matter for domestic law.
Indonesia’s existing legal framework is unresponsive to maritime cyber incidents. As cyber risks continue to evolve beyond the factual assumptions underpinning traditional maritime law, the development of a coherent and modern legal framework becomes imperative. By addressing the existing gaps in the concepts of fault and causation, Indonesian law can better protect maritime stakeholders, enhance legal certainty, and support the safe and sustainable growth of the nation’s maritime sector.
