More concessions needed to allay buyer fears over cyberwar exclusions

Insurance buyers are concerned that cyberwar exclusions are too vague and could potentially deny fair claims, with representatives pushing the market for further concessions to allay such fears. Although insurers continue to resist attempts to have these exclusions removed, there are signs they are beginning to listen to customer concerns and adapt wordings. Matthew McCabe, senior vice-president and assistant general counsel on cyber policy at Marsh, told Commercial Risk Europe that brokers and buyers “would love” to have war exclusion removed from cyber policies. “That would be helpful to our buyers. But the carriers have pushed back against that because this is an important protection for them. However, this doesn’t mean we can’t meaningfully limit the war exclusion under the terms of a cyber insurance policy. We just need to get to the right formulation of the exclusion. I think we will get there as a market, but the type of exclusion we would like to see is not standard yet,” he said . This is a big issue for insureds as the number and scale of cyberattacks increase. More attacks are being assigned to, or believed to emanate from, nation states, bringing potential acts of war to the fore. Verizon’s 2018 Data Breach Investigations Report found that 12% of the 2,200 cases it looked at were launched by nation states or state-affiliated groups, which aim to use breaches as political weapons and for economic advantage. Mr McCabe confirmed there is definitely an escalation in cyberattacks being linked to nation states. “It is a very real and ongoing persistent threat against companies today. There is no doubt this is a very relevant topic for insurers and insureds to be talking about,” he said. However, Mr McCabe, who works for Marsh’s cyber centre of excellence, was quick to stress that as far he understands no insurer has yet denied a cyber claim using a war exclusion. What buyers and brokers want to ensure is this situation never occurs unless under catastrophic loss scenarios where such exclusions are intended to protect carriers. Current wordings mean unfair repudiation of claims is possible. “It is a very real issue for clients. They are experiencing these concerns and events, and no doubt carriers are mulling things over. But the work we are doing is really preventative and trying to ensure that we never get to the situation where the war exclusion is used unfairly,” explained Mr McCabe. The threat of cyberwar exclusions taking companies off cover has not gone unnoticed by Ferma. “As the frequency and severity of cyberattacks continue to increase and are generally originated from an undefined source, companies are looking for an appropriate coverage to quickly recover whether the attack may come from a nation state or conventional criminals. In this respect, war exclusions in cyber policies are a concern for risk managers,” Ferma board member Philippe Cotelle told CRE. Mr McCabe explained that many problems with cyberwar exclusions come from the fact they were lifted from property cover without much modification or updating. Therefore, the exclusions do not really reflect the intricacies of cyberwarfare. “One of the most important points is cyberwarfare is a very different type of activity from conventional warfare. We really have to think outside the box around cyber and work with carriers to refine that language,” he said. While Marsh, Ferma and insurance buyers more widely want to see further progress on this issue, Mr McCabe said the message is starting to get through to insurers. He is increasingly “pleased and impressed” with their willingness for dialogue. “I think that in today’s market we are starting to get through on this issue. We are getting helpful modifications. Brokers are talking about the wording with carriers, and carriers are responding in a way that modifies the language helpfully, while still providing them with the original catastrophic protection they sought,” he told CRE. Mr McCabe made the point that it is in insurers’ interest to have a product that responds to cyber incidents as intended. He stressed there is more than one way to solve this issue and adapt war exclusions. But the important factor is that any modification must reflect the fact such exclusions are only intended to be of limited application to protect underwriters from catastrophic losses, he added. One solution Mr McCabe currently favours and recommends to buyers is ensuring the exclusion is written to only kick in for acts of kinetic warfare. “Such wording effectively says that there has to be some relation to physical use of force. We have carriers who will accept that termination and I think that is very helpful narrowing of the wording,” said the legal expert. Concerns over cyberwar exclusions have increased as nation states are linked to more high-profile cyberattacks. The Pentagon warned back in 2011 about the danger cyberterrorism posed to US national security, and sparked debate regarding when cyberattacks may be considered acts of war. The European Union recently made headlines with a leaked diplomatic document that, for the first time, defined cyberterrorism by a foreign power as an act of war. US, French and German government officials have alleged that North Korean and/or Russian hackers made attacks on recent electoral processes. Russia, in particular, has been identified as the home of cyberattackers who use social media and phishing platforms to try and affect election outcomes. Last year’s WannaCry attack saw UK minister Ben Wallace declare his government is as “sure as possible” that North Korea was behind the attack. The US and UK governments have publically blamed Russia for the NotPetya ransomware attack last June that targeted Ukraine and spread around the world. But McCabe is keen to stress that even under current wordings it take a lot more to invoke a cyberwar exclusion than many people think. Some argue that NotPetya could trigger the war exclusion because it inflicted substantial economic damage on several companies, and both the US and UK governments attributed the attack to the Russian military. However, Mr McCabe said these two factors alone are not enough to escalate this non-physical cyberattack to the category of war or “hostile and warlike” activity. “These terms of art that have been considered by courts, and the resulting decisions, which are now part of the Law of Armed Conflict, make it clear that much more is required to reach the conclusion of ‘warlike’ action,” he explained. “NotPetya was not ‘warlike’ and does not trigger the war exclusion,” he added. Reaching the threshold of warlike activity requires “more than a nation state acting with malicious intent”, said Mr McCabe. “As shown by the recent indictments of foreign military intelligence officers for interfering with US elections, most nation state hacking still falls into the category of criminal activity,” he added. His advice for clients is to keep on top of the issues but do not let knee-jerk comments about cyberattacks being acts of war cause undue worry about the validity of cover. “One the most important pieces of advice for clients right now is: don’t believe the hype about cyberwarfare, which a lot of the time is not even coming from insurers. You will see online pundits and the like who say ‘cyberwar occurred here’ and that is not always true. If you listen to these very flippant assessments you are going to start questioning the coverage, and we haven’t got to that point where cover has been denied yet,” Mr McCabe said.

More concessions needed to allay buyer fears over cyberwar exclusions

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Related Articles