Maritime piracy law combines one of the harshest criminal penalties in the U.S. code — mandatory life imprisonment under 18 U.S.C. § 1651 — with a tangle of civil liabilities that can reach shipowners, cargo interests, insurers, and the private security firms hired to prevent attacks in the first place. International law treats piracy as a crime against all nations, so any country can arrest and prosecute pirates regardless of where they were captured. The civil side is messier: who pays for a ransom, a damaged hull, an injured crew member, or a guard’s use of force depends on contracts, treaties, insurance terms, and sanctions rules that can swing the final allocation by millions of dollars.
What Counts as Piracy Under the Law
The working legal definition comes from Article 101 of the 1982 United Nations Convention on the Law of the Sea. Piracy is illegal violence, detention, or plunder committed for private purposes by the crew or passengers of a private vessel against another vessel on the high seas.1United Nations. United Nations Convention on the Law of the Sea – Part VII The high seas means international waters beyond any country’s jurisdiction, generally starting 200 nautical miles from the coastline.2Legal Information Institute. High Seas
Two features of this definition decide most cases. Piracy requires two ships. A crew mutiny or an onboard hijacking does not qualify under UNCLOS because the violence happens on a single ship.3Legal Information Institute. Piracy And the act must be committed “for private ends,” which excludes politically motivated attacks by state actors. Article 101 also reaches voluntary participation in operating a pirate ship and any act of inciting or intentionally helping an attack.1United Nations. United Nations Convention on the Law of the Sea – Part VII
The geographic limit creates an important gap. Attacks inside a country’s territorial waters fall outside the UNCLOS piracy definition entirely. Those incidents are classified as armed robbery at sea and fall under the coastal state’s domestic criminal law. Because many attacks happen near coastlines and in narrow straits, the distinction matters far more than it looks on paper.
The 1988 Convention for the Suppression of Unlawful Acts Against the Safety of Maritime Navigation (SUA Convention) was built to close that gap. It criminalizes violent acts against ships regardless of whether they occur on the high seas or in territorial waters. Under Article 3, a person commits an offense by seizing a ship by force, committing violence that endangers navigation, or placing a destructive device on board. Signatory states must either extradite offenders to a state with jurisdiction or submit the case to their own prosecutors.4United Nations Treaty Collection. Convention for the Suppression of Unlawful Acts Against the Safety of Maritime Navigation
Who Can Arrest and Prosecute Pirates
Piracy has been treated as a crime against all of humanity since at least the 17th century. UNCLOS carries that forward: Article 100 obliges all nations to “cooperate to the fullest possible extent in the repression of piracy on the high seas,” and Article 105 lets any state seize a pirate ship, arrest everyone on board, and seize all property, with the seizing state’s courts deciding penalties and the fate of ship and cargo subject to innocent third-party rights.1United Nations. United Nations Convention on the Law of the Sea – Part VII
Article 110 adds the Right of Visit. A warship encountering a foreign vessel on the high seas may board it when there are reasonable grounds to suspect piracy. This is one of the few exceptions to the general rule that only a vessel’s flag state can exercise authority over it. If the boarding turns up nothing, the boarded vessel must be compensated for any loss or damage. Only warships or clearly marked and authorized government vessels can exercise this right.1United Nations. United Nations Convention on the Law of the Sea – Part VII
U.S. Federal Criminal Penalties
Chapter 81 of Title 18 of the U.S. Code devotes an entire section to piracy and related crimes, with penalties running from a decade in prison to mandatory life.
The core statute is 18 U.S.C. § 1651. Anyone who commits piracy “as defined by the law of nations” on the high seas and is then brought into or found in the United States faces mandatory life imprisonment, with no judicial discretion to impose a shorter sentence.5Office of the Law Revision Counsel. 18 USC 1651 – Piracy Under Law of Nations Two related statutes extend the same life sentence to specific offenders. Section 1652 covers any U.S. citizen who commits murder, robbery, or acts of hostility on the high seas while claiming authority from a foreign government.6Office of the Law Revision Counsel. 18 USC 1652 – Citizens as Pirates Section 1653 covers foreign citizens found at sea making war on the United States or attacking American vessels in violation of an existing treaty.7Office of the Law Revision Counsel. 18 USC 1653 – Aliens as Pirates
Not every piracy-related offense triggers life. Arming a vessel for piratical purposes under § 1654 carries a maximum of 10 years.8Office of the Law Revision Counsel. 18 USC 1654 – Arming or Serving on Privateers Attacking a vessel with intent to plunder under § 1659 also carries a maximum of 10 years, and this statute reaches not only the high seas but all waters under U.S. admiralty jurisdiction.9Office of the Law Revision Counsel. 18 USC 1659 – Attack to Plunder Vessel That broader geography makes § 1659 a tool prosecutors can use for attacks that happen too close to shore to qualify as high-seas piracy.
Shipowner Civil Liability for Piracy Attacks
Shipowners have a duty to provide a seaworthy vessel, and in high-risk waters that duty expands beyond a sound hull and working engines. Seaworthiness extends to adequate security: trained crew, hardened access points, lookout equipment, and in some cases armed guards. The International Maritime Organization’s ISPS Code requires covered vessels to maintain a ship security plan built from a formal security assessment, designate a Ship Security Officer, and operate at varying security levels depending on the threat environment.10International Maritime Organization. SOLAS XI-2 and the ISPS Code
Industry guidance like BMP5 lays out specific hardening measures and a layered defense approach. BMP5 itself carries a disclaimer that it is guidance used “at the user’s own risk,” and a vessel transiting a high-risk area without armed guards can still be “in full compliance with the BMP.”11Maritime Global Security. BMP5 Even so, courts evaluating negligence look at whether an owner followed industry standards. An owner who ignored specific route warnings and skipped basic hardening has a far harder defense than one who documented a thorough plan and implemented recommended protections.
Jones Act Claims by Injured Crew
For U.S.-connected operations, the Jones Act gives injured seamen a powerful tool. Under 46 U.S.C. § 30104, a seaman injured during employment may bring a civil action with a jury trial against the employer.12Office of the Law Revision Counsel. 46 USC 30104 – Personal Injury to or Death of Seamen In a piracy context the claim turns on whether the employer was negligent in exposing the crew to the risk. Did the company route the vessel through a high-risk area without adequate security? Did it fail to follow its own security plan? Damages can cover medical expenses, lost wages, pain and suffering, and in death cases, wrongful death.
Jones Act claims must be filed within three years of the injury under 46 U.S.C. § 30106.13Office of the Law Revision Counsel. 46 USC 30106 – Time Limit on Bringing Maritime Action for Personal Injury or Death That window looks generous, but piracy cases involve complex jurisdictional questions and evidence scattered across multiple countries. Waiting too long to gather records from foreign ports or military operations can kill a claim well before the statute runs.
Cargo Owner Claims
Cargo owners can pursue shipowners for losses if the vessel was unseaworthy at the start of the voyage. The argument is direct: the owner knew the route crossed a high-risk zone and failed to provide basic security hardening or armed guards, so the loss was preventable. The owner’s defense centers on whether the piracy was a foreseeable risk the owner could have mitigated or an unforeseeable event. The documented security plan and the specific warnings available at the time of sailing are usually the most important evidence on both sides.
The Limitation of Liability Act
Shipowners facing catastrophic claims may invoke the federal Limitation of Liability Act, codified at 46 U.S.C. Chapter 305. Under § 30523, an owner’s total liability for covered claims cannot exceed the value of the vessel plus pending freight, as long as the loss occurred “without the privity or knowledge of the owner.”14Office of the Law Revision Counsel. 46 USC Chapter 305 – Exoneration and Limitation of Liability That phrase is where most piracy limitation fights play out. If the owner or managing agent knew before the voyage that the route was dangerous and failed to provide adequate security, courts impute that knowledge to the owner and deny the limitation.
When personal injury or death claims are involved, the statute sets a floor: the portion of liability available for those claims cannot be less than $420 multiplied by the vessel’s tonnage.14Office of the Law Revision Counsel. 46 USC Chapter 305 – Exoneration and Limitation of Liability Wage claims are excluded from the limitation entirely. The limitation defense hinges on demonstrating genuine ignorance of the risk, and with publicly available piracy threat reports and mandatory security assessments, that is an increasingly difficult case to make.
How Ransom Costs Are Shared: General Average
When pirates capture a vessel and demand ransom, the payment rarely falls on just one party. Maritime law has a centuries-old mechanism for sharing emergency costs. Under Rule A of the York-Antwerp Rules, any extraordinary sacrifice or expenditure intentionally and reasonably made for the common safety of a maritime venture must be shared proportionally among all parties with property at stake — the shipowner, cargo owners, and others with freight at risk.15Comité Maritime International. York-Antwerp Rules 1994
A ransom fits the framework because it is a voluntary expenditure made to preserve the entire venture from total loss. Each party contributes based on the value of their interest. If the cargo on board is worth three times the vessel, cargo interests bear a proportionally larger share. The York-Antwerp Rules were updated in 2016, and the current version is generally applied in modern shipping contracts.
Sanctions Risk When Paying Ransom
This is where piracy law gets dangerous for the people trying to do the right thing. Paying a ransom to free a crew and cargo may violate U.S. sanctions law if the recipients are designated under any OFAC sanctions program, and the penalties are severe even if the payer had no idea the payees were on a sanctions list.
Under the International Emergency Economic Powers Act, U.S. persons are broadly prohibited from engaging in transactions with individuals or entities on OFAC’s Specially Designated Nationals and Blocked Persons List, or with those covered by comprehensive country or region embargoes. OFAC can impose civil penalties on a strict liability basis, meaning a shipowner or insurer can be held liable even without knowing the recipient was a sanctioned entity.16U.S. Department of the Treasury. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
The numbers are not abstract. Civil penalties for an IEEPA violation can reach $250,000 or twice the transaction value, whichever is greater. A willful violation carries criminal penalties of up to $1,000,000 and 20 years in prison.17Office of the Law Revision Counsel. 50 USC 1705 – Penalties For Somali piracy specifically, Executive Order 13536 declared piracy off the coast of Somalia an “unusual and extraordinary threat to the national security and foreign policy of the United States” and froze the assets of designated persons involved in those operations. The order prohibits any contribution of funds, goods, or services to or for the benefit of blocked individuals.18The White House. Executive Order 13536 Concerning Somalia
OFAC has identified mitigating factors that can reduce enforcement consequences: reporting the incident to law enforcement immediately, cooperating fully and providing ongoing information, and maintaining a risk-based sanctions compliance program before the event.16U.S. Department of the Treasury. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments Any entity involved in ransom negotiations should screen recipients against the SDN List and consult sanctions counsel before transferring funds. Doing so under the time pressure of a hostage situation is extraordinarily hard, which is why a compliance program needs to be in place before a voyage, not after.
Insurance Coverage After an Attack
The financial fallout from a piracy attack runs through several specialized products. Kidnap and Ransom insurance covers the ransom payment itself, along with negotiation fees, delivery logistics, and sometimes crisis response consultants. Hull and Machinery insurance covers physical damage to the vessel from the attack or the recovery operation. Protection and Indemnity clubs cover crew injury claims and third-party liabilities.
All of these policies impose strict conditions. K&R policies typically require immediate notification and prohibit the insured from disclosing the existence of the coverage, on the theory that known coverage inflates ransom demands. Hull policies require compliance with war-risk trading warranties that define which zones require additional premium. Failing to follow these procedures, or sailing into a designated high-risk area without proper notification and additional premium, gives the insurer grounds to deny the claim entirely. Coverage limits, deductibles, and exclusions vary significantly based on vessel size, route, and flag state.
Liability of Private Maritime Security Companies
Armed guards from Private Maritime Security Companies are now routine on vessels transiting high-risk waters. Their legal framework is built mainly through contract, not statute, and the most important contractual document is the Rules for the Use of Force. The RUF defines a graduated response that typically moves from visual warnings and verbal challenges through warning shots to the use of lethal force only as a last resort.19Oil Companies International Marine Forum. Guidance for the Employment of Private Maritime Security Companies
When a guard uses force beyond what the RUF authorizes, the consequences run in two directions. The guard personally faces potential criminal prosecution under the flag state’s law and possibly the law of the coastal state where the incident occurred. The company faces civil liability to any injured parties and potential breach-of-contract claims from the shipowner. Contracts between PMSCs and shipowners typically include indemnity clauses allocating responsibility for legal costs and damages, and well-drafted contracts require the PMSC to carry public liability and employer’s liability insurance.19Oil Companies International Marine Forum. Guidance for the Employment of Private Maritime Security Companies
ISO 28007-1:2015 is the closest thing to an international certification standard for PMSCs. It requires a security management system covering legal compliance, human rights obligations (including conformity with the UN Guiding Principles on Business and Human Rights), personnel competence, risk assessment procedures, and secure storage of firearms and ammunition.20International Organization for Standardization. ISO 28007-1:2015 – Ships and Marine Technology – Guidelines for Private Maritime Security Companies Certification can be achieved through independent third-party audit. The broader governance framework remains advisory: the Montreux Document’s maritime interpretation explicitly notes that its good practices “do not have legally binding effect.”21Montreux Document Forum. Elements for a Maritime Interpretation of the Montreux Document Legal authority ultimately rests with the flag state, the coastal state where force is used, and the contract itself.
Reporting Obligations After an Incident
Reporting duties stack up quickly after an attack or even a credible threat. Under 33 C.F.R. § 101.305, owners or operators of vessels required to maintain a security plan must report suspicious activities, security breaches, and transportation security incidents to the National Response Center “without delay.” A transportation security incident must also be reported to the local Captain of the Port, after which the vessel must immediately begin following the procedures in its security plan.22eCFR. 33 CFR 101.305 – Reporting
Beyond U.S. regulatory requirements, the IMO’s framework calls for alerting the nearest coastal state’s Maritime Rescue Coordination Centre, the Company Security Officer, and the International Maritime Bureau’s Piracy Reporting Centre, with the flag state notified after the initial emergency is handled. Detailed post-incident reports go to the flag state, the IMB, and relevant coastal states.23International Maritime Organization. Piracy and Armed Robbery Against Ships Late reporting does more than create regulatory exposure. It can undermine insurance claims, weaken later civil litigation, and in extreme cases raise questions about whether the owner was trying to avoid sanctions scrutiny on a ransom payment.