Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
September 28, 2026
Originally published in ACTIO E-Magazine Edition 30 (September 2026). Law as of September 2026.
A ship operator attacked by hackers is plainly a victim, but victim status alone may not eliminate criminal exposure. Under Indonesian law, where a cyber incident reveals serious deficiencies in cybersecurity governance or compliance, authorities may also examine whether those deficiencies contributed to the incident, and the KUHP 2023 recognises corporations as subjects of criminal law.
The digital transformation of the maritime sector has accelerated the adoption of integrated electronic systems in ship operations, including the Integrated Navigation System, GPS, Electronic Chart Display and Information System (ECDIS), Automatic Identification System (AIS), radar, satellite communications, and integrated control systems. These technologies have enhanced efficiency, connectivity, and safety, but they have also broadened the range of cybersecurity risks.
Cyber incidents affecting maritime systems may result not only in economic losses but also in operational disruption, compromised facility security, risks to personnel safety, and interruptions to supply chains. Ransomware, compromise of navigation systems, manipulation of electronic data, and disruption of port management systems may extend beyond financial consequences to affect maritime safety and the resilience of infrastructure supporting Indonesia’s strategic economic activities.
The risk is already practical in Indonesia. In 2023, the ransomware group BianLian claimed responsibility for a cyberattack against PT Pelabuhan Indonesia (Persero) (Pelindo). The incident highlighted the vulnerability of port infrastructure and illustrated the potential for disruption to maritime logistics services and port operations. The Indonesian Government has acknowledged that the national maritime sector continues to face cybersecurity risks, particularly in relation to ship operational systems and port facilities, and the Ministry of Transportation has noted that disruptions may interrupt shipping operations and supply chains and affect the reputation of shipping companies.
Indonesia has yet to establish a dedicated legal framework governing maritime cybersecurity. Instead, cyber incidents involving ships, ports, and other maritime infrastructure are regulated through a combination of criminal, electronic systems, data protection, and maritime legislation.
From a criminal law perspective, the KUHP 2023 contains provisions that may apply where cyber incidents result in disruption to maritime transportation or damage to ships. Conduct amounting to sabotage, intentional interference with transportation systems, or unlawful acts rendering a ship unusable may fall within the Criminal Code, and where such consequences arise from negligence rather than intentional conduct, the Code also provides offences relating to negligent acts that endanger ships or maritime safety. The source cites Articles 329, 210, and 330 of the KUHP.
These provisions operate alongside the ITE Law (Law No. 11 of 2008, as amended by Law No. 1 of 2024), which criminalises unlawful interference with electronic systems, including the alteration, deletion, transfer, or disruption of electronic information and electronic systems. In the maritime context, these offences may become relevant where navigation systems, cargo management systems, or port operational systems are compromised.
The framework is complemented by the PDP Law (Law No. 27 of 2022), which establishes obligations concerning the protection of personal data processed through electronic systems, and Government Regulation No. 71 of 2019, which requires Electronic System Providers to maintain the confidentiality, integrity, availability, and recoverability of their electronic systems. These obligations operate alongside the Shipping Law, which imposes broader duties relating to the safe and secure operation of ships and port activities.
The KUHP 2023 adopts a modern approach to corporate criminal liability by expressly recognising corporations as subjects of criminal law. Corporate liability is no longer confined to the conduct of individual employees; it may extend to acts committed by directors, managers, controlling parties, or other persons acting for or on behalf of the corporation. More importantly, liability may also arise where a corporation fails to implement appropriate preventive measures, permits unlawful conduct to occur, or otherwise fails to fulfil its legal obligations.
Within maritime cybersecurity, this creates a more nuanced legal position. A shipping company or port operator may clearly be the victim of unlawful access, ransomware, malware, or other cyberattacks committed by external actors. However, victim status alone may not eliminate the operator’s legal responsibilities. Where a cyber incident reveals significant deficiencies in cybersecurity governance, risk management, or compliance with statutory obligations, authorities may also examine whether those deficiencies contributed to the occurrence or consequences of the incident.
This does not mean that every successful cyberattack gives rise to criminal liability. Criminal responsibility remains subject to the statutory requirements set out in the applicable legislation and must be assessed on the facts of each case. Nevertheless, the existing framework indicates that investigations may extend beyond identifying the external perpetrator to examining whether the operator discharged its obligations relating to system security, corporate governance, and operational safety.
Although Indonesian courts have not yet considered this issue in the context of maritime cybersecurity, broader developments in corporate criminal liability provide useful guidance. In Decision Number 162/Pid.B/2026/PN Jkt.Pst concerning PT Terra Drone Indonesia, the prosecution argued that failures in safety management and risk mitigation formed part of the basis for criminal responsibility following a fatal fire. While the case concerned occupational safety rather than cybersecurity, it illustrates how prosecutors may examine corporate governance and preventive measures when assessing criminal liability. Similar reasoning may become relevant where cyber incidents expose deficiencies in cybersecurity governance that affect the safe operation of ships or port facilities.
Clear expectations regarding governance, incident response, and cyber risk management not only support effective law enforcement but also assist maritime operators in understanding the standard of care expected under Indonesia’s existing legal framework. The IMO’s integration of cyber risk management into the ISM Code framework, together with GR 71/2019, the PDP Law, the ITE Law, and the Shipping Law’s safety obligations, suggests that ship operators are expected to implement reasonable measures to identify, prevent, detect, respond to, and recover from cyber threats.
Continued efforts to strengthen regulatory coherence and institutional coordination may further enhance Indonesia’s ability to secure its digital maritime infrastructure while providing greater clarity regarding the legal responsibilities of maritime operators following cyber incidents.
Does Indonesia have a maritime cybersecurity criminal law?
No. There is no dedicated framework. Authorities rely on the KUHP 2023, the ITE Law, the PDP Law, GR 71/2019, and the Shipping Law.
Can a company that was hacked be prosecuted?
Potentially, yes. Victim status does not eliminate responsibility where the incident reveals serious deficiencies in cybersecurity governance, risk management, or compliance with statutory obligations.
What does the KUHP 2023 say about corporate liability?
It expressly recognises corporations as subjects of criminal law. Liability may extend to acts of directors, managers, or controlling parties, and may arise where a corporation fails to implement appropriate preventive measures.
Has any Indonesian court decided a maritime cyber case?
No. Indonesian courts have not yet considered corporate criminal liability in the maritime cybersecurity context, but the PT Terra Drone Indonesia decision (162/Pid.B/2026/PN Jkt.Pst) shows how prosecutors examine safety management failures.
What should operators do to reduce exposure?
Implement reasonable measures to identify, prevent, detect, respond to, and recover from cyber threats, consistent with GR 71/2019, the PDP Law, the ITE Law, and the Shipping Law’s safety obligations.
The discussion of corporate criminal liability is not solely about allocating responsibility after a cyber incident. It is equally about encouraging stronger governance, greater preparedness, and more resilient maritime operations in an increasingly digital environment. Greater legal certainty regarding the cybersecurity obligations of maritime operators will not only support safe, secure, and reliable maritime transport, but also provide a clearer basis for distinguishing between corporate victimhood and corporate responsibility following maritime cyber incidents.
