Sounds straight forward and if the state itself is the actor, it may be an easily denied claim. However, when it comes to the “nation state actor,”[6] the challenge is more pronounced. A nation state actor often is anonymous and while perhaps acting on behalf of a sovereign state:
Nation-State Actors operate covertly and almost never acknowledge ownership of their actions, unlike our other Suspects, for whom claiming credit can be part of the reward for their labours. Nation-State Actors will go extreme lengths to cover their tracks, and to make it as difficult as possible for cyber security experts to trace their campaigns back to their country of origin – often planting ‘false flags’ to mislead attribution efforts.[7]
State-sponsored attacks are a big fear of technology executives.[8]
Recent Lloyd’s Developments
The Lloyd’s cyber market “has 77 cyber risk insurers under its wing for which it sets the rules.”[9] The latest action by Lloyd’s follows a number of previous actions in the cyberinsurnace market.
Lloyd’s Requirement for Clarity on Cyber Coverage
On the Fourth of July 2019, Lloyd’s issued a bulletin to the market regarding clarity around whether cyber events were covered by all policies.[10] The bulletin provided in part that, for all policies issued on and after 1 January 2020, “Lloyd’s is mandating that all policies provide clarity regarding cyber coverage by either excluding or providing affirmative coverage.”[11] The property and liability policies had different phase-in plans pursuant to the bulletin.
Lloyd’s Market Association Exclusions
In addition, the Lloyd’s Market Association[12], which represents its “members' interests to organisations including governments, regulators, and the market's central supporting body, the Corporation of Lloyd's,” drafted four exclusion clauses to address cyber war and cyber operations in November 2021.[13] The four clauses are:
LMA5564 - War, Cyber War and Cyber Operation Exclusion No. 1
LMA5565 – War, Cyber War and Limited Cyber Operation Exclusion No. 2
LMA5566 - War, Cyber War and Limited Cyber Operations Exclusion No. 3
LMA5567 - War, Cyber War and Limited Cyber Operation Exclusion No. 4
The LMA stated with respect to the four clauses:
“In discussion with Lloyd’s it has been agreed that, in respect of standalone cyber insurance policies, these clauses meet the requirements set out in the Performance Management - Supplemental Requirements & Guidance (July 2020) which state that all insurance and reinsurance policies written at Lloyd’s must, except in very limited circumstances, contain a clause which excludes all losses caused by war.”[14]
The justification for this action by Lloyd’s and the LMA is that without such clauses and limitations, the premiums for cyber insurance will continue to increase exponentially, given how some courts are addressing current wording and interpreting war exclusions.
One critique of these four LMA clauses or exclusions is that they define “war” and “cyber operation” but not “cyber war,” and so courts and insurers will have to continue to resolve the meaning of cyber war.[15]
To date, ISO has no specific cyber war exclusion.
Is the war exclusion when it comes to cyber a bit “Mercky?”
Whether the war and cyber war exclusions will be successful is open to question. In a case that garnered much attention, Merck and International Indemnity v ACE, et al.[16], the Superior Court of New Jersey rejected attempts made by the defendant insurer attempting to exclude coverage under an all-risks policy held by the German pharmaceutical giant, Merck, for losses caused by the NotPetya malware exceeding $1.4 billion. The defendant asserted that NotPetya was an instrument of the Russian Federation and was deployed as part of a broader offensive campaign against Ukraine in 2017. Ace cited to a war exclusion clause to avoid coverage. The war exclusion provided that there was no coverage for war or hostile acts. The New Jersey court rejected the argument, finding in part:
“The court starts by giving the words in the exclusion their ‘ordinary meaning’. The exclusion cites to ‘hostile or warlike action’. As Plaintiffs correctly noted, warlike can only be interpreted as ‘like war’, citing to the Oxford English Dictionary.”[17]
The court went on to agree the exclusion had never been applied to similar facts by any court, writing: “As Plaintiff correctly notes in its’ brief, no court has applied a war (or hostile acts) exclusion to anything remotely close to the facts herein. The evidence suggests that the language used in these policies has been virtually the same for many years.”[18] The court concluded that "Merck had every right to anticipate that the exclusion applied only to traditional forms of warfare" and not to cyber-attacks.[19]
In finding for Merck, the court also looked at the U.S. Court of Appeals for the Second Circuit's 1922 holding in Queens Insurance Co. v. Globe & Rutgers Fire Insurance Co.[20] The Queens court held:
“In order to impose liability under the war risk clause policy, all forms of hostilities or warlike operations of whatever kind must consist of some form or kind of hostility or warlike operations which have proximately caused the loss. Remote consequences of hostilities cannot become a recoverable loss.”
According to at least one report, Merck received payment from Ace for the claim.[21]
With the rather new LMA clauses, time will tell if the language suffices.
The Latest Action From Lloyd’s
In August, Lloyd’s issued its latest bulletin concerning cyber insurance, Ref: Y5381.[22] It addressed state-backed cyber attacks and provided instructions to Lloyd’s underwriters and MGAs:
We are therefore requiring that all standalone cyber-attack policies falling within risk codes CY and CZ must include, unless agreed by Lloyd’s, a suitable clause excluding liability for losses arising from any state backed cyber-attack in accordance with the requirements set out below. This clause must be in addition to any war exclusion (which can form part of the same clause or be separate to it). At a minimum, the state backed cyber-attack exclusion must:
- exclude losses arising from a war (whether declared or not), where the policy does not have a separate war exclusion.
- (subject to 3) exclude losses arising from state backed cyber-attacks that
(a) significantly impair the ability of a state to function or (b) that significantly impair the security capabilities of a state.
- be clear as to whether cover excludes computer systems that are located outside any state which is affected in the manner outlined in 2(a) & (b) above, by the state backed cyber-attack.
- set out a robust basis by which the parties agree on how any state backed cyber-attack will be attributed to one or more states.
- ensure all key terms are clearly defined.[23]
The key for regulators to consider and courts as well will be to determine what is “state backed.” Identifying state actors in cyber attacks is not always readily apparent, as many hackers are working undercover and anonymously, and most nations, just as in the terrorism realm, do not directly take credit for the attacks.
As the United States insurers adopt similar exclusions, it will be interesting to see what they do in terms of approving similar wording as LMA has issued.
OFAC Designations
The United States government has classified some state sponsored actors under the U.S. Department of the Treasury’s Office of Foreign Assets Control program. In an October 2020 advisory,[24] OFAC advised in part (footnotes omitted):
OFAC has designated numerous malicious cyber actors under its cyber-related sanctions program and other sanctions programs, including perpetrators of ransomware attacks and those who facilitate ransomware transactions. For example, starting in 2013, a ransomware variant known as Cryptolocker was used to infect more than 234,000 computers, approximately half of which were in the United States. OFAC designated the developer of Cryptolocker, Evgeniy Mikhailovich Bogachev, in December 2016.
Starting in late 2015 and lasting approximately 34 months, SamSam ransomware was used to target mostly U.S. government institutions and companies, including the City of Atlanta, the Colorado Department of Transportation, and a large healthcare company. In November 2018, OFAC designated two Iranians for providing material support to a malicious cyber activity and identified two digital currency addresses used to funnel SamSam ransomware proceeds.
In May 2017, a ransomware known as WannaCry 2.0 infected approximately 300,000 computers in at least 150 countries. This attack was linked to the Lazarus Group, a cybercriminal organization sponsored by North Korea. OFAC designated the Lazarus Group and two sub-groups, Bluenoroff and Andariel, in September 2019.
Beginning in 2015, Evil Corp, a Russia-based cybercriminal organization, used the Dridex malware to infect computers and harvest login credentials from hundreds of banks and financial institutions in over 40 countries, causing more than $100 million in theft. In December 2019,OFAC designated Evil Corp and its leader, Maksim Yakubets, for their development and distribution of the Dridex malware.[25]
While beneficial, except in one of the instances identified by OFAC, the bad actors were designated but not directly tied to a nation state. As discussed, the challenge for all involved in this area with the new policy language will be to demonstrate that hackers are related to a sovereign nation state.
Whether a particular cyber-attack will be excluded under war exclusions will be fact dependent and will involve questions of who determines that a “war” has been declared or invoked.
Insurers will need to be able to convincingly link a cyber-attack to a particular nation state or state actor. This task may require the insurer to have the cooperation of national governmental agencies that might have particular intelligence. Cyber-attacks, as noted, often are carefully masked so that attribution in any particular instance might be difficult, at best.
Conclusion
The most recent action by Lloyd’s will have significant impact on the cyber insurance market in the United States, with many US cyber insurers likely to follow suit. Insureds with cyber policies containing such exclusions may find that they are fighting for coverage and attempting to distinguish the type of action involved when they are the victims of cyber attacks. The battle over whether an attack is the work of a state actor will intensify.