Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
September 28, 2026
Originally published in ACTIO E-Magazine Edition 30 (September 2026). Law as of September 2026.
Not automatically. Under Indonesian law, a cyberattack excuses non-performance only if the force majeure clause in the contract covers it and the affected party can show the incident was genuinely beyond its reasonable control. Articles 1244 and 1245 of the Civil Code set only the general threshold; the parties’ own clause, read under Article 1338, usually decides the outcome.
Maritime trade operates through tightly coupled digital infrastructure: terminal operating systems plan and track cargo movements in real time, electronic data interchange platforms digitise trade documents and customs declarations, and port community systems link shipping agents, terminal operators, customs, and logistics providers.
This dependency is now routinely exploited. The Port of Nagoya’s ransomware incident, attributed to actors linked to the LockBit 3.0 group, forced Japan’s largest port, responsible for roughly 10% of the country’s trade volume, to suspend loading and unloading across all its container terminals. Comparable incidents struck Maersk during the 2017 NotPetya attack, the Port of Lisbon in 2022, the South African freight operator Transnet in 2021, and the major Spanish fishing port of Vigo in 2026.
In 2021, Everstream Analytics recorded just 20 cyberattacks on logistics. By 2025, attacks targeting the sector had risen 965%, a trajectory Everstream describes as a “watershed” shift in the threat landscape facing global supply chains. None of these incidents involved a storm, an earthquake, or a strike, the traditional subject matter of force majeure clauses. Each involved a compromised system.
Indonesia carries equivalent exposure. As national strategic ports expand integrated digital terminal and port-community services, dependence on interconnected systems grows in step. Transportation, alongside information and communication technology, is designated a vital information infrastructure sector under Presidential Regulation No. 82 of 2022, which obliges operators to identify, assess, and mitigate cyber risk. Yet the ITE Law addresses cyber issues only broadly, and the Shipping Law is silent on cyber threats in Indonesian shipping, while Bakamla added cybersecurity to the nine threat types it focuses on in 2021.
Under Indonesian law, force majeure is anchored in Articles 1244 and 1245 of the Indonesian Civil Code, with Articles 1444 and 1445 addressing the consequences for loss of the subject matter. In essence, a party is excused from liability, compensation, or interest where non-performance results from an unforeseen event outside its control and free of its fault. The criteria include that the event was unexpected, cannot be accounted for by the debtor, involves no bad faith, prevents performance, is beyond the debtor’s fault, and cannot be avoided.
Indonesian doctrine further separates force majeure into two categories. Absolute force majeure removes liability entirely, since performance becomes genuinely impossible. Relative force majeure, by contrast, requires judicial scrutiny: if negligence contributed to the failure, the resulting risk falls back on the debtor. That distinction matters for ransomware, because many cyber incidents delay port and shipping performance rather than destroy it permanently, and courts generally require a direct causal link between the event and the failure to perform.
What remains unaddressed in Indonesian positive law is the contractual consequence when a cyberattack prevents a vessel from loading. Articles 1244 and 1245 merely establish the general threshold. A court or arbitration panel applying the doctrine to a maritime dispute will still turn first to the force majeure clause the parties themselves negotiated, based on the principle of pacta sunt servanda codified in Article 1338 of the Civil Code, which binds the parties as law between them. The Indonesian Supreme Court has consistently anchored force majeure findings to the specific contractual clause, as in Decisions No. 2401 K/Pdt/2013 and No. 2241 K/Pdt/2020.
In practice, force majeure is determined principally by the parties’ contractual provisions and the allocation of risk expressly negotiated in the contract. The BIMCO Force Majeure Clause 2022 offers a useful benchmark: it expressly lists cybersecurity incidents among qualifying events and includes a catch-all for similar circumstances, while carving out events caused by the affected party’s own negligence. This reflects a broader trend. In cyber-related disputes, force majeure protection depends heavily on the specificity of contractual language, and courts have shown reluctance to treat cyberattacks as automatically qualifying absent clear wording to that effect.
Comparative authority reinforces this caution. In MUR Shipping BV v RTI Ltd [2024] UKSC 18, the English Supreme Court held that a “reasonable endeavours” proviso obliges the affected party to pursue steps capable of achieving contractual performance, but does not extend to accepting a materially different, non-contractual mode of performance absent express wording. Transposed to cyberattack scenarios, this suggests that an Indonesian port operator or shipowner invoking force majeure should expect to demonstrate that it exhausted reasonably available alternatives, such as manual or degraded mode operations, before relying on system failure as an excuse.
Liability analysis increasingly turns on whether the operator maintained a reasonable cybersecurity standard at the time of the incident, since courts and tribunals are progressively benchmarking cyber-related responsibility against evolving security norms. The IMO Resolution MSC.428(98) integrated cyber risk management into the ISM Code, with subsequent IMO guidance structuring compliance around identify, protect, detect, respond, and recover.
At the domestic level, the Director General of Sea Transportation has issued circular letters implementing the IMO Guidelines on Maritime Cyber Risk Management, directing ship and port facility operators subject to the ISPS Code to incorporate mandatory cybersecurity vulnerability assessments into the Ship or Port Facility Security Assessment, and corresponding security procedures into the Ship or Port Facility Security Plan. At minimum, these procedures must address asset identification and accountability, system protection, threat detection, incident response, and system recovery. For Indonesian operators, demonstrable alignment with this framework, rather than reliance on the Civil Code alone, is what will help evidence that a cyberattack was a genuinely uncontrollable risk rather than a foreseeable failure of governance.
Is a cyberattack automatically force majeure under Indonesian law?
No. Articles 1244 and 1245 of the Civil Code set only the general threshold. The outcome turns first on the force majeure clause the parties negotiated and whether the incident was genuinely beyond the affected party’s reasonable control.
What is the difference between absolute and relative force majeure?
Absolute force majeure removes liability entirely because performance becomes genuinely impossible. Relative force majeure requires judicial scrutiny, and if negligence contributed to the failure, the risk falls back on the debtor.
Does the BIMCO Force Majeure Clause 2022 cover cyberattacks?
Yes. It expressly lists cybersecurity incidents among qualifying events, with a catch-all for similar circumstances, while carving out events caused by the affected party’s own negligence.
What does MUR Shipping v RTI add?
The English Supreme Court held that “reasonable endeavours” to overcome a force majeure event do not include accepting a materially different, non-contractual mode of performance absent clear wording, suggesting an affected party should show it exhausted reasonably available alternatives.
Why does an operator’s cybersecurity standard matter?
Because courts and tribunals increasingly benchmark responsibility against evolving security norms, including the IMO cyber risk framework and the Director General of Sea Transportation’s circulars on cyber security assessment and procedures.
Cyberattacks have shown that an attack can stop cargo as decisively as any typhoon. Indonesia’s legal framework, resting on the general overmacht doctrine of Articles 1244-1245 of the Civil Code, was never built for this risk. Closing the gap demands more than statutory reform: charterparties must name cyber incidents plainly, as BIMCO’s 2022 clause does, and operators must evidence real preparedness under the IMO’s cyber risk framework. Law, governance, and people capacity remain inseparable, and Indonesia’s ports cannot claim resilience through regulation alone.
