Civil Law And UAE Cyber Resilience Of Court Systems

1. Introduction

Cyber resilience of court systems means the ability of courts, judicial authorities, tribunals, registries, case-management platforms and connected legal infrastructure to prevent, withstand, respond to, recover from and continue operating after cyber incidents.

For civil law, cyber resilience is particularly important because modern litigation increasingly depends on:

• electronic filing;
• digital case-management systems;
• electronic evidence;
• online hearings;
• electronic signatures;
• digital service of documents;
• judicial databases;
• cloud storage;
• remote access;
• electronic payment systems;
• AI and automated document processing;
• digital authentication and identity systems.

The UAE's Evidence Law expressly recognises electronic evidence. Federal Decree-Law No. 35 of 2022 defines electronic evidence broadly as evidence derived from data or information generated, stored, extracted, copied, transmitted, reported or received through information technology and retrievable in an understandable form.

Therefore, a cyberattack against a court is not merely an IT problem. It can potentially affect access to justice, filing deadlines, confidentiality, evidence, procedural fairness, enforcement and the integrity of judgments and court records.

A significant point, however, is that there are relatively few published UAE judgments specifically deciding a claim called “cyber resilience of court systems.” The principles therefore have to be developed from UAE legislation and judicial decisions dealing with IT sabotage, electronic evidence, cybersecurity, electronic documents, digital signatures, disclosure and preservation of electronic information.

2. Meaning of Cyber Resilience in Court Systems

Cyber resilience is broader than cybersecurity.

Cybersecurity

Cybersecurity mainly attempts to:

• prevent unauthorised access;
• protect networks;
• prevent malware;
• protect passwords;
• encrypt information;
• detect attacks.

Cyber resilience

Cyber resilience additionally asks:

What happens if the security controls fail?

A resilient court system should be capable of:

1. detecting an attack;
2. isolating compromised systems;
3. preserving evidence;
4. continuing essential judicial services;
5. restoring databases;
6. maintaining reliable backups;
7. verifying the integrity of restored records;
8. protecting confidential information;
9. communicating with litigants;
10. reconstructing affected procedural events.

Thus:

Cybersecurity = prevention and protection

Cyber resilience = protection + continuity + response + recovery + evidence preservation

3. UAE Legal Foundation

A. Federal Evidence Law

Federal Decree-Law No. 35 of 2022, Law of Evidence in Civil and Commercial Transactions, is particularly important.

Article 53 recognises electronic evidence broadly, while Article 54 identifies forms of electronic evidence including electronic records.

This means that courts must increasingly deal with questions such as:

• Was an electronic record authentic?
• Was it altered?
• Who generated it?
• When was it created?
• Was it properly preserved?
• Was the underlying system compromised?
• Can its integrity be demonstrated?
• Can a party prove that a court-system failure prevented timely filing?

4. Why Court Cyber Resilience Is a Civil-Law Issue

A cyberattack against a commercial company may principally produce financial loss.

A cyberattack against a court can create a much broader legal problem.

For example:

A litigant attempts to file an appeal electronically at 11:59 p.m. on the final day. The court's electronic portal becomes unavailable because of a cyberattack. The filing is recorded the following day.

Potential issues include:

• limitation;
• procedural deadlines;
• access to justice;
• proof of attempted filing;
• authenticity of system logs;
• responsibility for the outage;
• restoration of electronic records;
• whether the litigant should suffer procedural prejudice.

Consequently, resilience becomes connected with procedural fairness and civil rights.

5. Major Components of Court Cyber Resilience

5.1 Secure Case-Management Systems

Courts should protect:

• case numbers;
• pleadings;
• judgments;
• orders;
• evidence;
• identity information;
• financial records;
• expert reports;
• confidential submissions.

Compromise of any of these systems can create disputes over the reliability of the judicial record.

5.2 Identity and Access Management

Access should be controlled through:

• individual accounts;
• strong authentication;
• multi-factor authentication;
• privileged-access management;
• role-based permissions;
• audit trails;
• controlled administrator accounts.

A central lesson from UAE/DIFC cyber litigation is that knowledge of credentials does not automatically prove who actually performed an electronic act.

The court must consider the surrounding technical and factual evidence.

6. Backups and Disaster Recovery

A resilient court system should maintain:

• regular backups;
• geographically separated backups;
• immutable backups where appropriate;
• offline or logically isolated copies;
• tested restoration procedures;
• recovery-time objectives;
• recovery-point objectives.

The importance of backup architecture is illustrated by Graciela Limited v Giacobbe [2014] DIFC CFI 027.

The claimant's IT environment contained primary systems, domain controllers, servers and storage, while critical information was replicated to a disaster-recovery location and backed up. The litigation subsequently required detailed examination of system logs and forensic images.

The case demonstrates why resilience requires not merely backups, but reliable and forensically usable backups.

7. Chain of Custody

When a cyberattack affects a court system, investigators must preserve:

• server images;
• access logs;
• database logs;
• firewall records;
• authentication records;
• email logs;
• cloud records;
• backup information;
• system timestamps;
• forensic images.

A basic chain-of-custody record should identify:

1. what was collected;
2. when it was collected;
3. by whom;
4. from which system;
5. how it was preserved;
6. whether it was copied;
7. who subsequently accessed it.

Without adequate preservation, a later party may challenge the reliability of the evidence.

8. Hashing and Integrity Verification

A forensic image can be accompanied by a cryptographic hash.

If the same hash is obtained later, it provides evidence that the relevant digital copy has not changed.

However:

Integrity does not automatically establish authorship.

A hash can demonstrate that a particular digital file remained unchanged after collection. It does not necessarily establish:

• who created it;
• who authorised it;
• whether its underlying information was truthful;
• whether the original system itself had already been compromised.

This distinction is particularly important in court-system cyber investigations.

9. Case Law 1 — Graciela Limited v Giacobbe [2014] DIFC CFI 027

This is one of the most relevant UAE-related authorities for cyber resilience.

The case concerned deliberate interference with an IT system by a former employee.

The court examined:

• IP addresses;
• user accounts;
• Windows Event Logs;
• forensic images;
• remote access;
• virtual servers;
• copied data;
• deleted data;
• administrator privileges;
• system timelines;
• expert evidence.

The forensic expert constructed an attack timeline from the available technical evidence. The court accepted that the combination of technical and circumstantial evidence could establish responsibility on the civil standard.

The court also considered the absence of certain VPN logs and the security weaknesses of the system.

Relevance to court resilience

The case demonstrates several important principles:

• logging is essential;
• administrator accounts require strong controls;
• backups must be protected;
• forensic images can become critical evidence;
• system reconstruction may be necessary;
• technical experts should distinguish evidence from conclusions;
• a cyber incident can generate recoverable civil losses.

The court awarded substantial compensatory damages for system restoration, investigation, emergency servers and employee time associated with the attack.

Although Graciela is a DIFC decision rather than an onshore UAE Federal Court decision, it is highly useful as a UAE judicial example concerning cyber incidents.

10. Case Law 2 — Aegis Resources DMCC v Union Bank of India (DIFC Branch) [2020] DIFC CFI 004

Aegis Resources concerned cyber-enabled payment fraud.

A fraudster obtained access to the customer's email system and sent fraudulent payment instructions to the bank.

The court received evidence concerning:

• email compromise;
• cybersecurity;
• phishing;
• authentication;
• security controls;
• possible two-factor authentication;
• unusual-access notifications;
• expert cybersecurity evidence.

The court expressly described the dispute as arising in the emerging area of cyber fraud and considered the respective responsibilities of the bank and customer.

Relevance to court systems

The case illustrates the importance of:

• secure email;
• multi-factor authentication;
• unusual-access detection;
• cybersecurity monitoring;
• clearly defined responsibility;
• expert evidence following a cyber incident.

For a court system, the same principles become even more important because compromised judicial email could affect:

• filing instructions;
• court orders;
• notices;
• settlement communications;
• evidence transmission;
• confidential communications.

11. Case Law 3 — ICICI Bank Ltd v Bavaguthu Raghuram Shetty [2022] DIFC CFI 034

This litigation involved disputed signatures, including electronic/copy signatures.

The court considered expert evidence concerning the authenticity and provenance of signatures.

An important distinction emerged:

Evidence that a digital or copied signature corresponds to a person's genuine signature does not necessarily establish that the person authorised its application.

The court therefore considered the wider factual circumstances rather than treating the electronic signature itself as conclusive.

Relevance to court cyber resilience

Court systems increasingly depend on electronic:

• orders;
• judgments;
• filings;
• approvals;
• authorisations;
• digital signatures.

A resilient judicial system therefore requires controls capable of answering two separate questions:

1. Is the digital record technically authentic?

2. Was the transaction or act legally authorised?

These questions should not be confused.

12. Case Law 4 — Naho v Neukirchi [2024] DIFC SCT 415

This DIFC case concerned electronic signatures and electronic records.

The court considered the DIFC Electronic Transactions Law, including the principle that an electronic signature may satisfy a legal requirement for signature and that an electronic signature is attributable to a person when it was the person's act.

Relevance to court resilience

The case demonstrates the importance of:

• electronic authentication;
• attribution;
• electronic records;
• reliable digital identity.

A court platform therefore needs reliable mechanisms for determining:

• who logged in;
• who submitted a document;
• when submission occurred;
• whether the submission was authorised;
• whether the record was subsequently modified.

13. Case Law 5 — Taaleem PJSC v National Bonds Corporation PJSC & Deyaar Development PJSC [2010] DIFC CFI 014

This case dealt with electronic document disclosure.

The DIFC Court recognised the increasing importance of electronic documents and considered factors relevant to determining the reasonableness of electronic searches, including the ease and expense of retrieval and the significance of potentially relevant documents.

Relevance to court cyber resilience

A resilient judicial information system must allow courts and litigants to locate relevant digital information.

This requires:

• searchable repositories;
• appropriate indexing;
• reliable retention;
• controlled deletion;
• backup systems;
• document-recovery mechanisms.

If records become inaccessible following a cyber incident, litigation may be affected even when the underlying information technically still exists.

14. Case Law 6 — Alawwal Capital JSC v Rasmala Investment Bank Ltd [2023] DIFC CFI 038

The court considered the enormous quantity of electronically generated information potentially available in modern commercial disputes.

The judgment recognised that electronic systems can generate records capable of reconstructing activities in considerable detail, while also recognising the practical problem that retrieving everything may impose disproportionate time and cost.

Relevance to court systems

This is directly relevant to judicial cyber resilience because courts themselves generate enormous amounts of information:

• access logs;
• filing histories;
• document versions;
• hearing records;
• emails;
• system notifications;
• authentication events;
• database activity.

Resilience therefore requires structured logging, rather than indiscriminate storage of every possible piece of information.

15. Case Law 7 — IDBI Bank Ltd v Mabani Delma General Contracting Co LLC [2018] DIFC CFI 070

The proceedings involved electronic data repositories and disclosure issues relating to servers and storage devices.

The DIFC Court's procedural orders required identification of electronic repositories and clarification concerning the data held on servers, storage devices and backups.

Relevance

This demonstrates the litigation importance of knowing:

• where electronic information is stored;
• which systems contain relevant information;
• where backups are located;
• who controls those repositories.

For judicial systems, an effective data inventory is therefore a component of resilience.

16. Case Law 8 — Techteryx Ltd v Aria Commodities DMCC & Others [2025] DIFC DEC 001

The Techteryx litigation is particularly relevant to modern digital judicial infrastructure because it was before the DIFC Digital Economy Court and involved digital assets and continuing court orders.

A 2026 order in the proceedings concerned alleged non-compliance with earlier court orders and applications concerning contempt and compliance.

Relevance to cyber resilience

Modern digital-asset litigation demonstrates why courts need infrastructure capable of handling:

• blockchain records;
• digital assets;
• cryptographic information;
• electronic evidence;
• digital asset-control mechanisms;
• complex preservation and enforcement issues.

It also illustrates that digital litigation may require courts to understand technical systems without allowing technology itself to replace judicial decision-making.

17. Court-System Cyber Resilience Model

A UAE court system can conceptually be divided into seven layers.

Layer 1 — Identity

Protect:

• judges' accounts;
• lawyers' accounts;
• staff accounts;
• litigant accounts;
• administrator accounts.

Layer 2 — Network

Protect:

• court networks;
• VPNs;
• firewalls;
• remote-access systems;
• internal communications.

Layer 3 — Applications

Protect:

• e-filing;
• case-management systems;
• electronic payment;
• scheduling;
• judgment-management systems.

Layer 4 — Data

Protect:

• pleadings;
• evidence;
• judgments;
• orders;
• personal information;
• financial information.

Layer 5 — Evidence

Preserve:

• logs;
• metadata;
• timestamps;
• audit trails;
• forensic images.

Layer 6 — Continuity

Maintain:

• backup systems;
• disaster recovery;
• alternative filing procedures;
• emergency communication channels.

Layer 7 — Legal Recovery

Determine:

• what happened;
• which records are reliable;
• whether deadlines were affected;
• whether evidence was compromised;
• whether parties suffered loss;
• what procedural remedy is appropriate.

18. Court Cyberattack Scenarios

Scenario 1 — E-Filing Portal Failure

Suppose a filing deadline expires at midnight.

At 11:45 p.m., a cyberattack makes the court portal unavailable.

The system should ideally retain:

• attempted login records;
• failed-upload records;
• server logs;
• timestamps;
• authentication data;
• transaction IDs.

This allows the court to reconstruct what occurred.

Scenario 2 — Judgment Database Compromise

Suppose an attacker obtains administrator access and modifies a judgment database.

The resilience architecture should allow comparison between:

• original database;
• backup database;
• audit logs;
• hash values;
• version history;
• digitally signed judgment.

The objective is to establish the authoritative version.

Scenario 3 — Ransomware

Suppose ransomware encrypts the case-management system.

A resilient system should:

1. isolate infected systems;
2. preserve forensic evidence;
3. activate business continuity procedures;
4. restore from trusted backups;
5. verify restored records;
6. notify affected stakeholders where legally required;
7. reconstruct missing transactions.

19. Cyberattack on Electronic Court Evidence

An especially difficult problem occurs when the attacker changes evidence.

For example:

A litigant produces a court-generated PDF. The opposing party claims the PDF was altered after the cyberattack.

The court may need to consider:

• document metadata;
• server records;
• database versions;
• digital signatures;
• hash values;
• audit logs;
• timestamps;
• access records;
• backup copies;
• expert evidence.

No single technical indicator should automatically determine the legal conclusion.

20. Importance of Audit Logs

Audit logs are particularly important for judicial systems.

They can record:

• login;
• logout;
• document upload;
• document download;
• modification;
• deletion;
• administrative changes;
• password changes;
• permission changes.

The Graciela case demonstrates how event logs can assist in reconstructing an attack timeline.

Therefore:

A resilient court system should treat logs as potential legal evidence, not merely IT diagnostics.

21. Role of Expert Evidence

Cyber incidents often require specialised expertise.

A forensic expert may examine:

Technical layer

• servers;
• networks;
• endpoints;
• cloud systems;
• databases.

Evidence layer

• metadata;
• logs;
• hashes;
• timestamps;
• forensic images.

Attribution layer

• user accounts;
• authentication;
• IP addresses;
• device identifiers;
• access patterns.

Causation layer

• what caused the incident;
• what systems were affected;
• what information was lost;
• what restoration was required.

But the expert should not replace the judge.

The Graciela judgment specifically illustrates the distinction between technical expert evidence and the court's ultimate responsibility to determine whether the civil case has been proved.

22. IP Address Evidence

An IP address can be important but should not automatically be treated as conclusive identification.

An IP address may identify:

• a network;
• a device;
• a connection;
• a particular technical environment.

It may not by itself prove:

• who physically operated the device;
• who knew the credentials;
• who authorised the transaction.

The court should therefore consider IP evidence alongside:

• authentication logs;
• device information;
• timestamps;
• user activity;
• access privileges;
• surrounding circumstances.

The detailed treatment of IP addresses and user accounts in Graciela illustrates this approach.

23. Protection of Judicial Confidentiality

Court systems may contain extremely sensitive information concerning:

• businesses;
• individuals;
• families;
• finances;
• trade secrets;
• personal identification;
• medical information;
• corporate transactions.

Cyber resilience must therefore incorporate:

• encryption;
• access restrictions;
• segregation;
• logging;
• secure backups;
• controlled disclosure;
• incident response.

A cyber-resilient court should not merely remain operational; it must remain trustworthy.

24. Employee and Administrator Threats

Cyber resilience must address both:

External threats

• ransomware;
• phishing;
• malware;
• credential theft;
• denial-of-service attacks.

Internal threats

• misuse of administrator privileges;
• unauthorised copying;
• intentional deletion;
• unauthorised disclosure;
• credential sharing.

Graciela is especially important because the court found the relevant attack to have been an insider attack involving privileged access and technical knowledge.

This supports the importance of:

• least-privilege access;
• separation of duties;
• privileged-access monitoring;
• individual credentials;
• prompt termination of access;
• administrator activity logging.

25. Electronic Signatures and Court Resilience

Electronic signatures can improve judicial efficiency but introduce authentication questions.

A resilient system should preserve:

1. identity of the signer;
2. signing time;
3. signing method;
4. certificate information where applicable;
5. document integrity;
6. audit trail;
7. revocation information where relevant.

The reasoning in ICICI Bank v Shetty shows why the court may need to distinguish between the technical existence of a copied/electronic signature and evidence concerning whether its use was authorised.

26. Cloud Computing and Court Systems

Cloud infrastructure can improve:

• scalability;
• redundancy;
• availability;
• disaster recovery.

But it also creates questions about:

• data location;
• access rights;
• third-party providers;
• incident response;
• backups;
• auditability;
• cross-border data transfers.

The contractual relationship between a judicial authority and technology provider should therefore address:

• security standards;
• incident notification;
• evidence preservation;
• access to logs;
• backup obligations;
• recovery procedures;
• termination and data return.

27. Artificial Intelligence and Court Cyber Resilience

As courts increasingly use AI-assisted technologies, resilience concerns may expand to:

• AI-generated summaries;
• document classification;
• translation;
• transcription;
• legal research;
• case-management automation.

The fundamental principle should remain:

Automation must not destroy the integrity, traceability or accountability of the judicial record.

A resilient system should maintain an audit trail showing:

• source document;
• processing event;
• system used;
• human review;
• final judicial record.

28. Procedural Continuity During a Cyberattack

If electronic court systems become unavailable, continuity mechanisms may include:

• emergency filing channels;
• manual filing;
• alternative secure communication;
• extension of deadlines where legally appropriate;
• emergency technical support;
• temporary hearing arrangements;
• restoration notices;
• preservation of attempted filings.

The legal objective is not simply to restore the computer system.

It is to prevent a technical failure from unnecessarily destroying a litigant's procedural position.

29. Cyber Resilience and Access to Justice

Cyber resilience supports access to justice in at least five ways:

1. Availability

Courts remain accessible.

2. Integrity

Records remain trustworthy.

3. Confidentiality

Sensitive information remains protected.

4. Authentication

The court can determine who performed an electronic act.

5. Continuity

Proceedings can continue or be properly reconstructed after disruption.

30. Cyber Resilience and Damages

A cyberattack may produce several categories of civil loss:

• system restoration costs;
• forensic investigation costs;
• emergency technology costs;
• employee time;
• business interruption;
• data-recovery costs;
• professional fees;
• lost transactions.

Graciela is particularly instructive because the court awarded compensation including system restoration and investigation costs, emergency servers and employee time associated with the attack.

This illustrates why a resilient organisation should maintain detailed records of:

• incident response;
• staff time;
• restoration expenses;
• external forensic consultants;
• replacement equipment;
• lost or interrupted operations.

31. Important Legal Distinctions

Cyberattack ≠ automatic civil liability

The occurrence of an attack does not by itself establish who is legally responsible.

Technical access ≠ authorship

A compromised credential may have been used by another person.

IP address ≠ human identity

The IP address must be evaluated with other evidence.

Hash ≠ authorship

A hash supports integrity but does not automatically establish who created the material.

Electronic signature ≠ automatic authorisation

The circumstances of its application may matter, as illustrated by ICICI Bank v Shetty.

Backup ≠ complete recovery

A backup must itself be reliable, available and sufficiently current.

32. Practical Cyber-Resilience Framework for UAE Courts

A useful framework can be expressed as:

PREVENT

• encryption;
• MFA;
• privileged-access controls;
• network segmentation;
• vulnerability management.

DETECT

• continuous monitoring;
• anomaly detection;
• security alerts;
• audit logs.

PRESERVE

• forensic imaging;
• log preservation;
• evidence hashing;
• chain of custody.

RESPOND

• isolate affected systems;
• investigate attack vectors;
• preserve evidence;
• coordinate technical and legal teams.

CONTINUE

• alternative filing mechanisms;
• emergency communication;
• backup systems;
• disaster-recovery procedures.

RECOVER

• restore trusted systems;
• verify data;
• reconstruct missing transactions;
• validate judicial records.

REVIEW

• identify vulnerabilities;
• improve controls;
• update incident-response plans;
• train personnel.

33. Case-Law Summary

The cases above are primarily DIFC authorities and should not be treated as automatically binding precedents for onshore UAE Federal Courts. Their value for this topic is principally in illustrating how UAE-based courts have approached electronic evidence, cybersecurity incidents, digital authentication, electronic disclosure and technologically complex disputes.

34. Practical Checklist

For a cyber-resilient UAE judicial environment, the following should be maintained:

Technical

•  Multi-factor authentication
•  Encryption
•  Network segmentation
•  Privileged-access management
•  Secure backups
•  Disaster recovery
•  Continuous monitoring

Evidentiary

•  Immutable or protected logs
•  Forensic imaging capability
•  Hash verification
•  Chain-of-custody procedures
•  Timestamp preservation
•  Metadata preservation

Procedural

•  Emergency filing mechanism
•  Business-continuity plan
•  Alternative communication channel
•  Deadline-management procedure
•  Restoration procedure

Legal

•  Electronic-evidence rules
•  Confidentiality safeguards
•  Expert evidence procedures
•  Data-protection compliance
•  Incident documentation
•  Evidence-preservation obligations

35. Conclusion

Cyber resilience of UAE court systems is an important part of modern civil justice. The legal significance of resilience goes beyond preventing hacking. Courts must also be able to establish what happened, preserve reliable evidence, protect confidential information, maintain procedural continuity and restore trustworthy judicial records.

The UAE Evidence Law provides an important statutory foundation by expressly recognising electronic evidence. The DIFC authorities add practical judicial examples concerning IT sabotage, cyber fraud, electronic signatures, electronic disclosure and complex digital records.

The central principle can be stated as:

A cyber-resilient court must preserve not only system availability, but also the integrity, authenticity, confidentiality, traceability and legal reliability of the judicial record.

In civil litigation, the strongest approach is therefore:

Cybersecurity + resilience + evidence preservation + authentication + expert analysis + procedural continuity = trustworthy digital justice.