Cyber Incursions in Maritime Jurisdictions: International Law, State Responsibility, and Liability Regimes

The integration of digital automation within global maritime logistics has systematically reconfigured the spatial and jurisdictional premises of the law of the sea. Modern commercial vessels and maritime terminals no longer function as isolated mechanical systems operating upon physical waters; rather, they are complex cyber-physical assemblages. Shipboard operational technology (OT)—encompassing Electronic Chart Display and Information Systems (ECDIS), automated ballast control mechanisms, differential Global Navigation Satellite System (GNSS) transceivers, and integrated bridge systems—is linked via continuous satellite uplinks to shoreside superintendents, terminal operating systems, and automated port logistics hubs. While this architecture maximizes supply chain efficiency, it introduces existential vulnerabilities to malicious cyber incursions.

Cyber operations directed against maritime transport infrastructures manifest across a diverse typological spectrum. These range from widespread ransomware deployments that paralyze container terminal supervisory control and data acquisition (SCADA) systems to subtle spoofing of Automatic Identification System (AIS) data and targeted manipulation of shipboard programmable logic controllers (PLCs). Despite the severity of these disruptions, the legal framework governing maritime affairs remains largely grounded in the physical paradigms of the nineteenth and twentieth centuries. The United Nations Convention on the Law of the Sea (UNCLOS), the International Convention for the Safety of Life at Sea (SOLAS), and conventional carriage of goods regimes were conceived to regulate tangible craft, kinetic hostilities, and physical perils of the sea. Applying these traditional instruments to non-kinetic, borderless, and often unattributable digital interventions creates complex jurisprudential challenges across public international law, the law of naval warfare, and private maritime liability.

The Kinetic Threshold and State Responsibility in Cyber Warfare

The primary dilemma in public international law concerns the characterization of a cyber intrusion under the jus ad bellum framework of the United Nations Charter. Article 2(4) of the UN Charter prohibits the threat or use of force against the territorial integrity or political independence of any state. Traditional interpretations have tied the concept of force to kinetic armed violence. However, the International Court of Justice (ICJ) in its landmark advisory opinion on the Legality of the Threat or Use of Nuclear Weapons (1996) emphasized that the provisions of the Charter apply to any use of force, regardless of the weapons employed. This principle establishes that the medium of aggression—whether physical explosives or destructive computer code—does not insulate an action from international legal scrutiny.

The benchmark for evaluating whether a digital operation crosses the threshold into an unlawful use of force is rooted in the scale and effects doctrine formulated by the ICJ in Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America) (1986). Under this doctrine, non-kinetic measures must generate consequences comparable in scale and severity to those of a conventional kinetic armed assault to qualify as a use of force or an armed attack under Article 51 of the Charter. Applying this test to maritime logistics, a cyber infiltration that alters the ballast control logic of an ultra-large container vessel, causing catastrophic structural failure, capsize, and loss of life in a narrow channel, clearly meets the threshold of a use of force. Conversely, digital reconnaissance, electronic espionage against a port authority database, or temporary disruption of terminal billing software generally falls beneath this line, existing instead within the contentious domain of unlawful intervention.

Can a cyberattack on a port trigger article 51?

Under Article 51 of the UN Charter, an inherent right of individual or collective self-defense arises if an armed attack (agression armée) occurs against a Member State. The essential legal inquiry is whether the systemic, digital paralysis of a critical port facility can legally constitute an armed attack absent physical destruction or initial kinetic impact. If an adversary state employs malware to disable the cooling systems of liquefied natural gas (LNG) terminals or overrides the distributed control systems of a major deep-water port, triggering cascading industrial fires, contamination, and mass casualties, the scale and effects test of the Nicaragua ruling is fully satisfied. In such extreme circumstances, victim states possess a defensible legal basis to invoke Article 51 and employ necessary and proportionate responsive measures, potentially including kinetic strikes.

The central challenge emerges when a cyberattack inflicts devastating economic paralysis upon a state by severing its maritime supply lines without causing direct physical casualties or structural collapse. Consider a scenario where a state-sponsored threat group executes synchronized denial-of-service and firmware-bricking operations against major intermodal transshipment points, halting container traffic for weeks. While the economic harm to the coastal state may equal or exceed that of a physical naval blockade, dominant international jurisprudence—as reflected in the ICJ's judgments in Nicaragua and Oil Platforms (Islamic Republic of Iran v. United States of America) (2003)—maintains a rigorous divide between purely economic coercion and armed attacks.

The ICJ in Oil Platforms held that even actions involving armed combatants do not inherently qualify as an armed attack triggering self-defense unless they meet significant criteria of gravity and intention. Transferring this logic to cyberspace underscores that mere commercial disruption, however catastrophic to gross domestic product, does not automatically unlock the unilateral right to kinetic recourse under Article 51.

In cases falling short of an armed attack, coastal states must operate within the framework of state responsibility codified in the International Law Commission's Articles on Responsibility of States for Internationally Wrongful Acts (ARSIWA). When a malicious cyber operation against a port facility violates the principle of non-intervention or infringes upon the territorial sovereignty of the host state, the victim state is legally restricted to countermeasures under Articles 49 to 54 of the ARSIWA. Countermeasures must remain strictly non-forcible, be directed against the responsible state, and comply rigorously with the requirement of proportionality, aimed solely at inducing the offending sovereign to resume compliance with its international obligations.

Attribution Standards and Due Diligence Under UNCLOS

The viability of public international law remedies depends fundamentally on legal attribution. Under the ARSIWA, conduct is attributable to a state if it is perpetrated by an organ of that state (Article 4) or by individuals acting under its instructions, direction, or control (Article 8). In maritime cyber conflicts, states routinely operate through proxies, patriotic hacker collectives, or private security contractors, interposing plausible deniability. The international legal standard for attribution under Article 8 remains demanding. The ICJ in Nicaragua affirmed the effective control test, requiring proof that the state exercised direct control over the specific operational acts giving rise to the wrongful breach. While the International Criminal Tribunal for the former Yugoslavia (ICTY) advanced the lower overall control threshold in Prosecutor v. Duško Tadić (1999) for qualifying armed conflicts, the ICJ explicitly preserved the strict effective control doctrine in the Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro) (2007).

Because the forensic trail of a maritime cyber assault frequently fails to establish the rigorous standard of effective control over anonymous online actors, an alternative theoretical path focuses on the failure of due diligence. Grounded in the ICJ's historic ruling in the Corfu Channel case (1949), states have an affirmative obligation not to allow knowingly their territory to be used for acts contrary to the rights of other states. In the maritime context, this obligation is mirrored in Article 94 of UNCLOS, which mandates that every flag state shall effectively exercise its jurisdiction and control in administrative, technical, and social matters over ships flying its flag.

• Flag State Inaction: If a state permits private cyber warfare units or compromised shipboard autonomous networks to operate within its registered fleet, failing to implement basic supervisory frameworks, it breaches its primary procedural obligations under international law.
• Coastal and Port State Due Diligence: In The M/V Virginia G (Panama/Guinea-Bissau) (2014), the International Tribunal for the Law of the Sea (ITLOS) highlighted the operational competence of coastal states, which can be extended by analogy to the duty to secure electronic interfaces at automated terminals from becoming staging grounds for cross-border infrastructure compromises.
• Subsea Cable Integrity: Flag states bear duties regarding submarine telecommunication cables—the core physical infrastructure supporting maritime connectivity—pursuant to UNCLOS Articles 113 and 114, demanding penal sanctions against ships severing or manipulating digital lifelines.

How does the ISPS Code regulate cyber security?

In response to asymmetric security risks following the turn of the millennium, the International Maritime Organization (IMO) amended SOLAS Chapter XI-2 and adopted the International Ship and Port Facility Security (ISPS) Code. Conceived primarily to mitigate tangible perils such as piracy, maritime terrorism, and the weaponization of commercial vessels, the legal machinery of the ISPS Code has progressively expanded to address the cyber domain.

The operational framework of the ISPS Code requires shipping companies and port facilities to execute comprehensive security assessments and maintain certified operational plans: the Ship Security Plan (SSP) and the Port Facility Security Plan (PFSP). These frameworks enforce mandatory protective measures across three graduated Security Levels. For years, maritime administrations treated cyber threats as distinct from the physical scope of the ISPS Code. However, the IMO systematically bridged this divide by adopting Resolution MSC.428(98), titled Maritime Cyber Risk Management in Safety Management Systems, paired with the circular MSC-FAL.1/Circ.3.

Resolution MSC.428(98) fundamentally alters the operational landscape by formally integrating cyber risk management into the compulsory Safety Management Systems (SMS) governed by the International Safety Management (ISM) Code. Beginning on January 1, 2021, vessel operators became legally required to incorporate cyber hygiene and threat-mitigation protocols into their baseline safety audits under the ISM Code. As a result, cyber vulnerability is no longer treated purely as a localized IT problem. Instead, it is codified as an inherent element of physical maritime safety and security under SOLAS Chapter IX and Chapter XI-2.

Under this evolving framework, an unmitigated software vulnerability within an integrated engine monitoring network directly impacts a vessel's regulatory standing. If a designated Recognized Security Organization (RSO) or Port State Control (PSC) inspector establishes that a vessel has neglected critical security patches, possesses unauthenticated satellite terminals, or maintains default administrative passwords across its ECDIS hardware, the vessel can be deemed non-compliant with SOLAS. In practice, this non-compliance empowers the port state to exercise intervention powers under SOLAS Regulation XI-2/9, including the detention of the ship, denial of entry to the port facility, or immediate expulsion from internal waters.

The SUA Convention and the Criminalization of Cyber Sabotage

While public international law regulates the actions of sovereign states, individual and non-state actors operating as cyber mercenaries or transnational syndicates fall under international criminal law. The bedrock instrument for addressing acts of maritime sabotage is the Convention for the Suppression of Unlawful Acts against the Safety of Maritime Navigation (SUA Convention 1988), substantially augmented by its 2005 Protocol.

Article 3(1)(a) of the SUA Convention criminalizes the seizure of or exercise of control over a ship by force or threat thereof, or any other form of intimidation. The critical interpretive challenge is whether malicious logic injection designed to wrest navigational command away from the bridge watchstanders satisfies the term other form of intimidation. A strict textual interpretation requires evidence of coerced human will. Conversely, an evolutionary, teleological approach—consistent with Article 31(1) of the Vienna Convention on the Law of Treaties (VCLT)—suggests that unauthorized administrative overrides of dynamic positioning systems, causing involuntary trajectory adjustments, undermine maritime sovereignty in a manner equivalent to physical piracy.

Furthermore, Article 3(1)(d) of the SUA Convention explicitly prohibits destroying or seriously damaging maritime navigation facilities or seriously interfering with their operation, if such an act is likely to endanger the safe navigation of a ship. This provision squarely criminalizes electronic interference. Cyber operations targeting land-based differential GPS reference stations, vessel traffic service (VTS) radar installations, or port channel automated beacons fall within this scope. Under the treaty's aut dedere aut judicare (extradite or prosecute) principle, states parties are legally obligated to establish universal domestic criminal jurisdiction over cyber perpetrators who disable navigation channels, regardless of their nationality or geographical location during the cyber offensive.

Who is liable for a maritime cyberattack?

In private maritime law, cyber incidents generate extensive litigation across tort, contract, and marine insurance regimes. When digital networks fail, leading to vessel groundings, terminal deadlocks, or spoiled cargo, liability allocations turn on historical doctrines reinterpreted for the digital era.

Seaworthiness in the Digital Age

Under long-standing admiralty law and Article III, Rule 1 of the Hague-Visby Rules, a common carrier is bound before and at the beginning of the voyage to exercise due diligence to make the ship seaworthy, properly man, equip, and supply the ship, and make the holds fit and safe for the reception, carriage, and preservation of goods. The doctrine of seaworthiness has never been limited to the structural integrity of the steel hull; it encompasses the competence of the crew, the functional adequacy of machinery, and the reliability of navigational equipment, as demonstrated in seminal English jurisprudence such as The Amstelslot (1963) and The Marion (1984).

In modern operational environments, cyber fitness is an essential component of seaworthiness. An ocean carrier that dispatches a vessel across international waters with obsolete, unsupported operating systems governing its electronic charting hardware or vulnerable engine monitoring networks has failed to supply a seaworthy ship. If a known, publicly cataloged software vulnerability is exploited during the passage, leading to a loss of propulsion and a subsequent collision, the shipowner cannot credibly claim that the vessel was seaworthy at departure.

The Hague-Visby Exceptions and Due Diligence Defenses

When cargo is destroyed, damaged, or severely delayed as a consequence of a cyber incident, carriers routinely assert immunity under the statutory exceptions set out in Article IV, Rule 2 of the Hague-Visby Rules. Common defenses include:

1. Act of War (Rule 2(e)) and Public Enemies (Rule 2(f)): Invoked when a cyber incursion is suspected of originating from a hostile nation-state or state-sponsored advanced persistent threat (APT) actor.
2. Latent Defects Not Discoverable by Due Diligence (Rule 2(p)): Advanced during novel, zero-day vulnerabilities where malicious actors leverage undocumented security flaws for which no commercial patch or protective signature yet existed.
3. Any Other Cause Arising Without Fault (The Q-Clause, Rule 2(q)): Requiring the carrier to carry the challenging legal burden of proving that neither the actual fault or privity of the carrier nor the fault or neglect of the agents or servants contributed to the loss.

However, the judicial gatekeeper to these immunities remains the non-delegable duty under Article III, Rule 1. As firmly established in Maxine Footwear Co. Ltd. v. Canadian Government Merchant Marine Ltd. (1959), compliance with the obligation of due diligence is an absolute condition precedent to relying on the immunities listed in Article IV, Rule 2. If the cargo claimant proves that an unpatched operational network, an absence of basic endpoint security, or gross crew negligence regarding media usage contributed to the security breach, the carrier's statutory safe harbors collapse.

Marine Insurance and the Institute Cyber Attack Exclusion Clause

The insurance implications of maritime cyber risks are similarly acute. Historically, the underwriting market utilized the Institute Cyber Attack Exclusion Clause (CL 380), an exclusionary provision designed to eliminate cyber-related claims from conventional hull and machinery (H&M) and protection and indemnity (P&I) policies. CL 380 stipulates that in no case shall this insurance cover loss, damage, liability, or expense directly or indirectly caused by or contributed to by or arising from the use or operation, as a means for inflicting harm, of any computer, computer system, computer software program, malicious code, computer virus, or process.

The inclusion of CL 380 left shipowners and port terminal operators exposed to severe coverage gaps. If a sophisticated actor deployed malware to disrupt a port's logistical network, resulting in millions of dollars in demurrage, physical crane collisions, and supply chain interruption, traditional policies invoked CL 380 to deny indemnification. In response, modern underwriters, largely guided by Lloyd's Market Association (LMA) frameworks such as clauses LMA5402 and LMA5403, have transitioned toward affirmative cyber risk policies. These newer instruments distinguish clearly between cyber operations deployed as weapons of warfare and cyber extortion or criminal ransomware, balancing coverage parameters while requiring documented compliance with the ISPS and ISM cybersecurity mandates.

Jurisdictional Ambiguities in Archipelagic and Littoral Waters

The application of UNCLOS to non-kinetic digital interventions generates complex jurisdictional tensions regarding the sovereignty of coastal states over their maritime zones. The cornerstone of coastal control is the regime of innocent passage codified in UNCLOS Articles 17 through 26.

Article 19(1) of UNCLOS stipulates that passage is innocent so long as it is not prejudicial to the peace, good order, or security of the coastal state. Article 19(2) enumerates specific activities that render passage non-innocent, including:

• Any act aimed at collecting information to the prejudice of the defense or security of the coastal state (Article 19(2)(c)).
• Any act of propaganda aimed at affecting the defense or security of the coastal state (Article 19(2)(d)).
• Any act of willful and serious pollution contrary to this Convention (Article 19(2)(h)).
• Any act aimed at interfering with any systems of communication or any other facilities or installations of the coastal state (Article 19(2)(k)).

Subparagraph (k) directly governs maritime cyber operations. If a foreign vessel transiting a state's territorial sea activates electronic warfare suites, disrupts local shoreside cellular grids, or launches malware across the wireless local area networks of a nearby port facility, the vessel immediately loses its right of innocent passage. Consequently, the coastal state is legally entitled under UNCLOS Article 25(1) to take the necessary steps in its territorial sea to prevent passage that is not innocent, including electronic interdiction, physical boarding, redirection, and formal arrest.

Significant legal ambiguity arises, however, when a commercial ship transits the territorial sea while unwittingly serving as an infected node in an international botnet. If a vessel's satellite communications terminal has been remotely hijacked by third-party actors without the knowledge of the master or crew, and that terminal is used as a staging platform to launch denial-of-service operations against naval installations, does the vessel forfeit innocent passage? A strict textual analysis of Article 19(2) suggests an intentionality requirement, as the provision repeatedly references an act aimed at generating prohibited outcomes. If the shipowner and crew have no knowledge of the compromise, the physical passage itself lacks intentional interference, placing the incident in a legal gray zone that often sparks diplomatic friction between flag and coastal states.

The International Arbitral Horizon and Evidentiary Challenges

As state-sponsored and criminal cyber intrusions grow more frequent, international arbitral institutions and judicial bodies will inevitably be tasked with adjudicating the resulting maritime claims. The dispute resolution framework under Part XV of UNCLOS—comprising ITLOS, the ICJ, and Annex VII Arbitral Tribunals—relies heavily on rigorous evidentiary thresholds.

In cases such as the South China Sea Arbitration (The Republic of Philippines v. The People's Republic of China) (2016), tribunals addressed complex, technologically sophisticated factual records. In future arbitrations involving maritime cyber aggression, proving attribution and proximate causation will be paramount. International tribunals rarely accept inferred guilt based solely on circumstantial digital indicators or anonymized state intelligence summaries.

Litigants seeking remedies before ITLOS or an Annex VII Tribunal must establish digital forensics that trace the cyber attack's chain of causality to the respondent sovereign with conclusive clarity, satisfying the burden of proof required in international jurisprudence.

The standard of proof applied by the ICJ in cases involving state responsibility for unlawful uses of force is traditionally characterized as clear and convincing evidence. Presenting such proof is inherently difficult when adjudicating malicious code compiled across dynamic proxy chains and obfuscated routing networks. If an Annex VII Tribunal is presented with competing expert forensic testimonies regarding the provenance of a software exploit, it may struggle to issue a definitive ruling, highlighting the urgent need for standardized evidentiary rules governing digital forensics within public international maritime disputes.

Toward a Harmonized Cyber Jurisprudence for the Law of the Sea

The expanding digitalization of the maritime industry has outpaced the incremental evolution of conventional legal regimes. While the physical definitions of the United Nations Convention on the Law of the Sea, the Hague-Visby Rules, and the ISPS Code retain structural utility, they must be interpreted dynamically to retain legal relevance. Cyber disruptions can no longer be addressed merely as anomalous exceptions or intangible phenomena beyond the reach of admiralty law; they represent an active, persistent domain of operational conflict and industrial liability.

To avoid jurisdictional fragmentation, the international maritime community must establish clear, binding norms. The IMO's decisive incorporation of cyber risk management into the ISM Code via Resolution MSC.428(98) provides a valuable regulatory model, but its operational success requires uniform global enforcement by Port State Control authorities. Simultaneously, an evolutionary interpretation of the SUA Convention and UNCLOS must be adopted to confirm that digital interference with navigational infrastructures and the deployment of malicious logic against ships violate the rules-based international maritime order.

Until unified judicial standards emerge, shipowners, port terminal operators, and flag administrations carry the legal responsibility of proactive due diligence. In international law, the absence of physical violence during a security breach does not eliminate state responsibility; in private law, the complexity of modern code does not excuse an unseaworthy vessel. The legal resilience of the global maritime domain depends on reconciling traditional concepts of maritime sovereignty, carriage, and safety with the complex realities of an interconnected digital architecture.