War, cyber war and cyber operation exclusion clauses

Last November 25, 2021, the Lloyd’s Market Association published 4 model clauses (LMA 5564/5565/5566/5567) titled “war,cyber war and cyber operation exclusion clauses”. The objective is to exclude from insurance and reinsurance policies, all losses caused by war and cyber operations.

I - The 4 clauses provide different levels of covers.

- Exclusion n°1 (LMA 5564): excludes losses from all kinds of cyberattacks by State actors

- Exclusion n°2 (LMA 5565): covers losses (with specified coverage limits): that are not due to retaliatory operations between the 5 “specified States”; that do not have a major detrimental impact on national security and defense

- Exclusion n°3 (LMA 5566): provides the same conditions as exclusion n°2, except that it does not specify coverage limits

- Exclusion n°4 (LMA 5567): same coverage as exclusion n°3, but it adds the coverage of effects on “bystanding cyber assets”. 

II - The four documents are titled “War, Cyber War and Cyber Operation Exclusion”. The definitions of “war” and “cyber operations” are provided. But no definition of “cyber war” is proposed. “Cyber operation means the use of a computer system by or on behalf of a state to disrupt, deny, degrade, manipulate or destroy information in a computer system of or in another state”.

III - Although the definition of “cyber operations” focuses on state-to-state aggressive activities, it also includes operations realized “on behalf” of a State. Such perimeter may include a wide spectrum of actors (state actors such as intelligence agencies, militaries, and non-state actors such as organized crime groups, terrorist organizations…) and situations.

IV - The approach is constructed on the basis of only 2 categories of actors: the State and the insurer.  

- State level:

o   “States: means sovereign state »

o   Government of the State (intelligence, security services) (who is in charge of the attribution process)

o   Vital functions of a State: “financial institutions and associated financial market infrastructure, health services or utility services”

o   “Specified States means China, France, Germany, Japan, Russia, UK or USA”

o   “Impacted state means any state where a cyber operation has had a major detrimental impact on: 11.1. the functioning of that state due to the direct or indirect effect of the cyber operation on the availability, integrity or delivery of an essential service in that state; and/or 11.2. the security or defence of that state.

o   Those who act “on behalf” of a State

- The insurer

V - The coverage of losses is based on the attribution of the cyber-operations. Who is in charge of the attribution?

a) the government of the State where the attacked system is located,

b) if the government of the State is unable to attribute the attack, then “it shall be for the insurer to prove attribution by reference to such other evidence as is available”.