Protecting Critical National Infrastructure Against Cyber Operations Under International Humanitarian Law: Lessons for Southeast Asia

Andi Agus Salim; Maulidina Sari; Nova Bela Dhyta; Ahmad Sholihin Muttaqin; Try Hardyanthi

doi:10.15294/ildisea.v5i1.42796

Authors

Andi Agus Salim Faculty of Law, Universitas Jambi, Indonesia Author https://orcid.org/0000-0001-5638-817X
Maulidina Sari Faculty of Law, Universitas Jambi, Indonesia Author https://orcid.org/0009-0001-7606-5527
Nova Bela Dhyta Faculty of Law, Universitas Jambi, Indonesia Author https://orcid.org/0009-0007-9874-6511
Ahmad Sholihin Muttaqin Faculty of Law, Universitas Jambi, Indonesia Author https://orcid.org/0009-0001-4716-733X
Try Hardyanthi Faculty of Law, University of Pécs, Hungary Author https://orcid.org/0009-0002-5710-8250

DOI:

https://doi.org/10.15294/ildisea.v5i1.42796

Keywords:

Critical National Infrastructure (CNI), Cyberattacks, International Humanitarian Law (IHL)

Abstract

The rapid evolution of digital technology has significantly reshaped the dynamics of modern armed conflict, most notably through the escalating threat of cyberattacks against critical infrastructure. Essential facilities such as power grids, medical centers, water sanitation systems, and communication networks play an indispensable role in ensuring the safety and well-being of the civilian population. When such infrastructure is targeted during armed conflict, whether by State or non-State actors, the resulting humanitarian consequences can be catastrophic and far-reaching. International Humanitarian Law (IHL), which traditionally governs the protection of civilian objects, has yet to explicitly address the unique challenges posed by the digital frontier, particularly regarding the protection of critical infrastructure from cyber warfare. This research aims to critically examine the extent to which IHL principles can provide adequate protection for critical infrastructure within the context of cyber operations, while identifying the normative gaps that emerge in their implementation. Employing a doctrinal legal research methodology complemented by an interdisciplinary analytical approach integrating international legal analysis with cybersecurity contemporary military studies, and supported by selected contemporary cyber incidents, this study proposes a strengthened normative framework that is more responsive to the exigencies of the digital age. The novelty of this research lies in its specific focus on the protection of vital civilian infrastructure in modern warfare from an IHL perspective, offering legal solutions grounded in state practice and fundamental humanitarian principles. It further highlights the relevance of these normative developments for Southeast Asia by identifying legal and policy lessons that can strengthen regional preparedness for protecting critical infrastructure against cyber operations during armed conflict.

References

Abraham, Doney, Siv Hilde Houmb, and Laszlo Erdodi. “Cyber-Attacks on Energy Infrastructure - A Literature Overview and Perspectives on the Current Situation.” Applied Sciences 15, no. 17 (August 2025): 9233. https://doi.org/10.3390/app15179233.

Ahmad, Nehaluddin, and Ahmad Masum. “Cyber Operations and the Redefinition of Modern Warfare.” Journal of Information Assurance & Cybersecurity, March 3, 2026, 1–12. https://doi.org/10.5171/2026.300029.

Aji, Muhammad Prakoso, Gumilar Rusliwa Somantri, and Muhammad Syaroni Rofii. “The Strategic Role of the National Cyber and Crypto Agency (BSSN) in Maintaining State Sovereignty in Cyberspace.” Journal of Law, Politic and Humanities 5, no. 5 (July 2025): 3916–24. https://doi.org/10.38035/jlph.v5i5.1973.

Alamsyah, Yazid Akbar, and Rafi Ilyasa Ibnu Akbar. “Penggunaan Persenjataan Modern Dalam Konflik Bersenjata Ditinjau Dari Prinsip Hukum Humaniter Dan Hukum Islam.” Sanskara Hukum Dan HAM 3, no. 01 (August 2024): 24–33. https://doi.org/10.58812/shh.v3i01.434.

Alexandru, Adriana, Victor Vevera, and Ella Magdalena Ciupercă. “National Security and Critical Infrastructure Protection.” International Conference Knowledge-Based Organization 25, no. 1 (June 2019): 8–13. https://doi.org/10.2478/kbo-2019-0001.

Aljohani, Tawfiq M. “Cyberattacks on Energy Infrastructures as Modern War Weapons - Part I: Analysis and Motives.” IEEE Technology and Society Magazine 43, no. 2 (June 2024): 59–69. https://doi.org/10.1109/MTS.2024.3395688.

Amaliya, Laila Rizky. “A Cyber War of Iran-Israel: A Geopolitical Rivalry.” In Proceedings of the International Conference on Strategic and Global Studies (ICSGS 2024), vol. 33, edited by Ibrahim Kholilul Rohman, Wu Zhaoyang, Mohammad Izdiyan Muttaqin, Ismail Suardi Wekke, and Irene Sondang Fitrinitia, 45–56. Atlantis Highlights in Social Sciences, Education and Humanities. Dordrecht: Atlantis Press International BV, 2025. https://doi.org/10.2991/978-94-6463-646-8_4.

America’s Cyber Defense Agency. Update: Destructive Malware Targeting Organizations in Ukraine. n.d. https://www.cisa.gov/news-events/alerts/2022/02/26/update-destructive-malware-targeting-organizations-ukraine.

Ang, Benjamin. “Cybersecurity and Legislation: The Case Study of Singapore.” In Cybersecurity and Legal-Regulatory Aspects, by Gabi Siboni and Limor Ezioni, 89–102. World Scientific, 2021. https://doi.org/10.1142/9789811219160_0004.

Azzahra, Nadia, and Lina Hastuti. “Analisis Hukum Humaniter Internasional Terhadap Penyerangan Dual Use Object Dalam Konflik Bersenjata Rusia Dan Ukraina.” Jurist-Diction 8, no. 1 (January 2025): 91–118. https://doi.org/10.20473/jd.v8i1.54375.

Benmalek, Mourad. “Ransomware on Cyber-Physical Systems: Taxonomies, Case Studies, Security Gaps, and Open Challenges.” Internet of Things and Cyber-Physical Systems 4 (2024): 186–202. https://doi.org/10.1016/j.iotcps.2023.12.001.

Biggio, Giacomo. “Regulating Non-Kinetic Effects of Cyber Operations: The ‘Loss Of Functionality’ Approach and The Military Necessity-Humanity Balance Under International Humanitarian Law.” Journal of Conflict and Security Law 30, no. 2 (July 2025): 241–63. https://doi.org/10.1093/jcsl/kraf008.

BöRöCZ, Miklós. “Critical Infrastructure Protection Policy in the EU.” Strategic Impact 80, no. 3 (February 2022): 46–61. https://doi.org/10.53477/1841-5784-21-15.

Casey-Maslen, Stuart, Arne Willy Dahl, Sofia Galani, and Alexander Lott. “Towards a Definition of Hybrid Warfare.” In Maritime Security Law in Hybrid Warfare, edited by Alexander Lott, 7–27. Brill | Nijhoff, 2024. https://doi.org/10.1163/9789004707993_003.

Costea, Ana Maria. “The Possibility of a Cyberwar: Accountability, Ever-Evolving Threats, No Ultimate Weapon, Threshold, Armed Attack.” In Cyber Deterrence and State Response in the Age of Technology, by Ana Maria Costea, 167–207. Contributions to International Relations. Cham: Springer Nature Switzerland, 2026. https://doi.org/10.1007/978-3-032-13450-9_5.

Delerue, François. Cyber Operations and International Law. Cambridge Studies in International and Comparative Law 146. Cambridge, United Kingdom ; New York, NY, USA: Cambridge University Press, 2020.

Di Pietro, Roberto, Simone Raponi, Maurantonio Caprolu, and Stefano Cresci. “Critical Infrastructure.” In New Dimensions of Information Warfare, vol. 84, by Roberto Di Pietro, Simone Raponi, Maurantonio Caprolu, and Stefano Cresci, 157–96. Advances in Information Security. Cham: Springer International Publishing, 2021. https://doi.org/10.1007/978-3-030-60618-3_5.

Dr. A.Shaji George, Dr. T.Baskar, and Dr. P.Balaji Srikaanth. Cyber Threats to Critical Infrastructure: Assessing Vulnerabilities Across Key Sectors. February 25, 2024. https://doi.org/10.5281/ZENODO.10639463.

European Council. Sanctions Against Cyber-Attacks. May 12, 2025. https://www.consilium.europa.eu/en/policies/sanctions-against-cyber-attacks/.

Geneva Conventions of 1949. https://www.icrc.org/sites/default/files/external/doc/en/assets/files/publications/icrc-002-0173.pdf.

Gunakaya, A. Widiada. Hukum Pidana Internasional. Takaza Innovatix Labs, 2024.

Hartono, Budi. “Ransomware: Memahami Ancaman Keamanan Digital.” Bincang Sains Dan Teknologi 2, no. 02 (May 2023): 55–62. https://doi.org/10.56741/bst.v2i02.353.

Haryanto, Agus, and Satya Muhammad Sutra. “Upaya Peningkatan Keamanan Siber Indonesia Oleh Badan Siber Dan Sandi Negara (BSSN) Tahun 2017-2020.” Global Political Studies Journal 7, no. 1 (April 2023): 56–69. https://doi.org/10.34010/gpsjournal.v7i1.8141.

He, Ying, Aliyu Aliyu, Mark Evans, and Cunjin Luo. “Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review.” Journal of Medical Internet Research 23, no. 4 (April 2021): e21747. https://doi.org/10.2196/21747.

IBM Security X-Force. X-Force Threat Intelligence Index 2023. n.d. https://secure-iss.com/wp-content/uploads/2023/02/IBM-Security-X-Force-Threat-Intelligence-Index-2023.pdf?utm_source=chatgpt.com.

International Committee of the Red Cross. Protection of Medical Personnel, Units and Transports During Armed Conflict. 2025. https://www.icrc.org/sites/default/files/2025-02/06_Medical_facilities.pdf.

International Committee of the Red Cross (ICRC). Cyber and Information Operations and International Humanitarian Law. n.d. https://www.icrc.org/en/law-and-policy/cyber-and-information-operations.

———. International Humanitarian Law Imposes Essential Limits on the Conduct of Cyber Operations. n.d. https://www.icrc.org/en/document/international-humanitarian-law-limits-cyber-operations?utm_source=chatgpt.com.

Ishaq, Fadhli Muhaimin. “Forced Displacement and Blockade Reviewed From International Humanitarian Law: A Case Study of the Humanitarian Attacks in Rafah.” Uti Possidetis: Journal of International Law 5, no. 3 (October 2024): 420–54. https://doi.org/10.22437/up.v5i3.36281.

Khoirunnisa, Khoirunnisa, and Cristy Sugiati. “Cyber Warfare Strategies in the Russia-Ukraine Conflict (2021-2022): Implications for National Security and Modern Warfare.” Jurnal Public Policy 10, no. 2 (April 2024): 138. https://doi.org/10.35308/jpp.v10i2.9026.

Kristalia, Brm Yehizkia Y., and Indra Wisnu Wibisono. “Ancaman Siber Dan Penguatan Kedaulatan Digital Indonesia Dari Perspektif Geopolitik Digital.” Jurnal Ilmiah Multidisiplin 3, no. 02 (March 2024): 83–93. https://doi.org/10.56127/jukim.v3i02.1584.

Lehto, Martti. “Cyber-Attacks Against Critical Infrastructure.” In Cyber Security, vol. 56, edited by Martti Lehto and Pekka Neittaanmäki, 3–42. Computational Methods in Applied Sciences. Cham: Springer International Publishing, 2022. https://doi.org/10.1007/978-3-030-91293-2_1.

———. “Cyber-Attacks Against Critical Infrastructure.” In Cyber Security, vol. 56, edited by Martti Lehto and Pekka Neittaanmäki, 3–42. Computational Methods in Applied Sciences. Cham: Springer International Publishing, 2022. https://doi.org/10.1007/978-3-030-91293-2_1.

Locatelli, Andrea. “Critical Infrastructure Protection.” In Technology and International Relations, edited by Giampiero Giacomello, Francesco N. Moro, and Marco Valigi. Edward Elgar Publishing, 2021. https://doi.org/10.4337/9781788976077.00016.

Lueschow, Holger, and Roberto Pelaez. “Satellite Communication for Security and Defense.” In Handbook of Space Security, edited by Kai-Uwe Schrogl, 779–96. Cham: Springer International Publishing, 2020. https://doi.org/10.1007/978-3-030-23210-8_107.

Mačák, Kubo. “Unblurring the Lines: Military Cyber Operations and International Law.” Journal of Cyber Policy 6, no. 3 (September 2021): 411–28. https://doi.org/10.1080/23738871.2021.2014919.

Markopoulou, Dimitra, and Vagelis Papakonstantinou. “The Regulatory Framework for The Protection of Critical Infrastructures Against Cyberthreats: Identifying Shortcomings and Addressing Future Challenges: The Case of The Health Sector in Particular.” Computer Law & Security Review 41 (July 2021): 105502. https://doi.org/10.1016/j.clsr.2020.105502.

Maskun, Maskun, Irwansyah Irwansyah, Ahsan Yunus, Armelia Safira, and Siti Nurhalima Lubis. “Cyber-Attack: Its Definition, Regulation, and ASEAN Cooperation to Handle with It.” Jambe Law Journal 4, no. 2 (November 2021): 131–50. https://doi.org/10.22437/jlj.4.2.131-150.

Mattanete, Takdir, Joko Wahyudi, Tarsisius Susilo, Dinand Tumpak Sirait, and Wahyu Rs Wahyu Rs. “Paradoks Hukum Humaniter Di Era Perang Siber Dan Drone: Antara Kepatuhan Normatif Dan Realitas Operasional.” Jurnal Ilmu Hukum, Humaniora Dan Politik 5, no. 5 (June 2025): 4278–83. https://doi.org/10.38035/jihhp.v5i5.4919.

Matthews, Ron, and Fitriani Bintang Timur. “Singapore’s ’Total Defence’ Strategy.” Defence and Peace Economics 35, no. 5 (July 2024): 638–58. https://doi.org/10.1080/10242694.2023.2187924.

Matusitz, Jonathan, and Elizabeth Minei. “Cyberterrorism: Its Effects on Health-Related Infrastructures.” Journal of Digital Forensic Practice 2, no. 4 (September 2009): 161–71. https://doi.org/10.1080/15567280802678657.

McCarthy, James, Lauren Acierto, Glen Joy, Jason Kuruvilla, Titilayo Ogunyale, Nikolas Urlaub, John Wiltberger, and Devin Wynne. Energy Sector Asset Management for Electric Utilities, Oil & Gas Industry. National Institute of Standards and Technology, 2020. https://doi.org/10.6028/NIST.SP.1800-23.

Microsoft Threat Intelligence. Microsoft Digital Defense Report 2023: Building and Improving Cyber Resilience. 2023. https://www.microsoft.com/en-us/search/explore?q=Microsoft+Digital+Defense+Report+2023#:~:text=featuring%20expert%20guidance.-,Microsoft%20Digital%20Defense%20Report,-https%3A//www.microsoft.

Mittal, Manav. “Colonial Pipeline Cyberattack Drives Urgent Reforms in Cybersecurity and Critical Infrastructure Resilience.” International Journal of Oil, Gas and Coal Engineering 12, no. 5 (December 2024): 106–19. https://doi.org/10.11648/j.ogce.20241205.11.

Moore, Gemma, Zuneera Khurshid, Thérèse McDonnell, Lisa Rogers, and Orla Healy. “A Resilient Workforce: Patient Safety and the Workforce Response to A Cyber-Attack on the ICT Systems of the National Health Service in Ireland.” BMC Health Services Research 23, no. 1 (October 2023): 1112. https://doi.org/10.1186/s12913-023-10076-8.

Owusu, Shadrach. “The Rising Threat - Cybersecurity Risks in Critical Energy Infrastructure.” Preprint, SSRN, 2025. https://doi.org/10.2139/ssrn.5370813.

Pipyros, Kosmas, Lilian Mitrou, Dimitris Gritzalis, and Theodoros Apostolopoulos. “Cyberoperations and International Humanitarian Law: A Review of Obstacles in Applying International Law Rules in Cyber Warfare.” Information & Computer Security 24, no. 1 (March 2016): 38–52. https://doi.org/10.1108/ICS-12-2014-0081.

Ramli, Ahmad M., Sigid Suseno, Ranti Fauza Mayana, Ramalinggam Rajamanickam, and Rubben Denova Rohmana. “The Urgency of Regulating Artificial Intelligence in Relation to Cybersecurity and Cyber Resilience.” Cogent Social Sciences 12, no. 1 (December 2026): 2632977. https://doi.org/10.1080/23311886.2026.2632977.

Ramphal, Talitha. “The Principle of Distinction in an International Armed Conflict: Organized Armed Groups Not Belonging to a State Party to the Conflict.” International Journal of Law and Society 4, no. 4 (2021): 275. https://doi.org/10.11648/j.ijls.20210404.15.

Raska, Michael, and Benjamin Ang. “Cybersecurity in Southeast Asia.” Paris: Asia Centre & DGRIS, 2018, 1–9.

Riggs, Hugo, Shahid Tufail, Imtiaz Parvez, Mohd Tariq, Mohammed Aquib Khan, Asham Amir, Kedari Vineetha Vuda, and Arif I. Sarwat. “Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure.” Sensors 23, no. 8 (April 2023): 4060. https://doi.org/10.3390/s23084060.

Roscini, Marco. “Cyber Operations as a Use of Force.” In Research Handbook on International Law and Cyberspace, edited by Nicholas Tsagourias and Russell Buchan. Edward Elgar Publishing, 2021. https://doi.org/10.4337/9781789904253.00025.

Rossdiana, Renatha Ayu, and Titing Reza Fahrisa. “Strategi Cybersecurity Pemerintah India Dari Perspektif Kautilya: Serangan Siber Mumbai 2020.” Indonesian Journal of International Relations 7, no. 1 (March 2023): 140–64. https://doi.org/10.32787/ijir.v7i1.408.

Sari, Indah. “Tinjauan Yuridis Hubungan Kejahatan Perang Dan Hukum Humaniter Internasional.” Jurnal Ilmiah Hukum Dirgantara 11, no. 2 (2021).

Schmitt, Michael N. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Cambridge University Press, 2017.

Schmitt, Michael N., ed. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. 2nd ed. Cambridge University Press, 2017. https://doi.org/10.1017/9781316822524.

Schuetz, Sebastian W., Yan Chen, Jens Forderer, and Yusi Ma. “Does Ransomware Make Investors ‘WannaCry’? On Investors’ Divergent Reactions to Ransomware Hits and Near Misses.” MIS Quarterly 49, no. 3 (September 2025): 1153–68. https://doi.org/10.25300/MISQ/2024/18509.

Sigholm, Johan. “Non-State Actors in Cyberspace Operations.” Journal of Military Studies 4, no. 1 (December 2013): 1–37. https://doi.org/10.1515/jms-2016-0184.

Susila, Muh, and Andi Salim. “Cyber Espionage Policy and Regulation: A Comparative Analysis of Indonesia and Germany.” Padjadjaran Jurnal Ilmu Hukum (Journal of Law) 11, no. 1 (2024): 122–44. https://doi.org/10.22304/pjih.v11n1.a6.

Tran Dai, Candice, and Miguel Alberto Gomez. “Challenges and Opportunities for Cyber Norms in ASEAN.” Journal of Cyber Policy 3, no. 2 (May 2018): 217–35. https://doi.org/10.1080/23738871.2018.1487987.

Vihul, Liis, Aaron Shull, Daniel Araya, Samantha Bradshaw, Amandeep Singh Gill, Michael C. Horowitz, Meg King, Robert Mazzolin, Maya Medeiros, and Rodrigo Nieto-Gómez. “International Legal Regulation of Autonomous Technologies.” In Modern Conflict and Artificial Intelligence. Centre for International Governance Innovation, 2020. https://www.cigionline.org/sites/default/files/documents/Modern%20Conflict%20and%20AI_web_0.pdf.

Waldrop, Elizabeth Seebode. “Integration of Military and Civilian Space Assets : Legal and National Security Implications.” McGill University, 2003. https://doi.org/10.82308/5745.

Weiss, Moritz, and Felix Biermann. “Cyberspace and the Protection of Critical National Infrastructure.” Journal of Economic Policy Reform 26, no. 3 (July 2023): 250–67. https://doi.org/10.1080/17487870.2021.1905530.

World Health Organization. WHO Reports Fivefold Increase in Cyber Attacks, Urges Vigilance. Geneva, 2020. https://www.who.int/news/item/23-04-2020-who-reports-fivefold-increase-in-cyber-attacks-urges-vigilance?utm_source=chatgpt.com.

Yuliantiningsih, Aryuni. “Analisis Doktrin Perang Yang Adil (Just War) Dalam Kasus Serangan Siber Rusia Terhadap Georgia Tahun 2008.” Kosmik Hukum 21, no. 3 (October 2021): 175. https://doi.org/10.30595/kosmikhukum.v21i3.10613.