Ride the Lightning

Lloyd’s of London: Insurers Should Not Cover ‘Retaliatory Cyber Operations’ Between Nation States

December 2, 2021

The Register reported on November 30^th that Lloyd’s of London may no longer extend insurance coverage to companies affected by acts of war. New clauses drafted for providers of cyberinsurance are raising the alarm for organizations impacted by nation state-backed attacks.

The insurer’s “Cyber War and Cyber Operation Exclusion Clauses” include an alarming line suggesting policies should not cover “retaliatory cyber operations between any specified states” or cyber-attacks that have “a major detrimental impact on… the functioning of a state.”

“The insurer shall have the burden of proving that this exclusion applies,” according to the exclusion policies published by the Lloyd’s Market Association.

The four clauses are published as a suggestion for insurers in Lloyd’s-underwritten policies and are not concrete rules. Nonetheless, it seems likely that some insurers will follow these clauses.

According to the article, “The policy clauses also raise the idea of insurance companies attributing cyber-attacks to nation states in the absence of governments carrying out attribution for specific incidents, an idea that seems extremely unlikely to survive contact with reality.”

All four of the clauses contain this wording:

“Pending attribution by the government of the state (including its intelligence and security services) in which the computer system affected by the cyber operation is physically located, the insurer may rely upon an inference which is objectively reasonable as to attribution of the cyber operation to another state or those acting on its behalf. It is agreed that during this period no loss shall be paid.”

Nation state attacks are common. If they are excluded from cyberinsurance policies, I’m not at all sure what the policy is really worth. But if Lloyd’s of London is going down this road, it is likely that other cyberinsurers will as well.

Hat tip to Dave Ries.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225, Fairfax, VA 22030
Email: Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson