Analysis of the Civil Liability of Information Technology Contractors for Cyberattacks on Industrial Control Systems in the South Pars Refineries

Abstract

Digital transformation in the oil and gas industry, particularly in critical infrastructure such as the South Pars refineries, has increased efficiency, data integration, automation, and reduced operational costs. At the same time, however, it has significantly expanded the cyberattack surface. In this context, information technology contractors, who play a central role in the design, installation, maintenance, updating, support, and integration of operational technology systems and industrial control systems, may incur civil liability when cyberattacks occur. The principal question addressed in this article is: What is the legal basis for the civil liability of these contractors for damage arising from attacks on industrial control systems in the South Pars refineries? Employing a descriptive-analytical method and an argumentative approach, and drawing on legal sources, industrial cybersecurity standards, and experience gained from major cyberattacks, this study demonstrates that a contractor’s mere reliance on technical complexity or the professional nature of the risks is insufficient to exempt it from liability. Rather, civil liability may be established whenever negligence is proven in secure system design, network segmentation, security patch management, access control, event logging, continuous monitoring, or user training. The article further concludes that, in information technology contracts concerning critical infrastructure, the traditional obligation-of-means model should be reconceptualized in favor of a heightened professional duty of care. This approach should be complemented by stronger contractual mechanisms, including risk allocation, cyber insurance, explicit obligations to comply with applicable standards, and security-audit clauses.