Last November 25, 2021, the Lloyd’s Market Association published 4 model clauses (LMA 5564/5565/5566/5567) titled “war,cyber war and cyber operation exclusion clauses”. The objective is to exclude from insurance and reinsurance policies, all losses caused by war and cyber operations.
I - The 4 clauses provide different levels of covers.
- Exclusion n°1 (LMA 5564): excludes losses from all kinds of cyberattacks by State actors
- Exclusion n°2 (LMA 5565): covers losses (with specified coverage limits): that are not due to retaliatory operations between the 5 “specified States”; that do not have a major detrimental impact on national security and defense
- Exclusion n°3 (LMA 5566): provides the same conditions as exclusion n°2, except that it does not specify coverage limits
- Exclusion n°4 (LMA 5567): same coverage as exclusion n°3, but it adds the coverage of effects on “bystanding cyber assets”.
II - The four documents are titled “War, Cyber War and Cyber Operation Exclusion”. The definitions of “war” and “cyber operations” are provided. But no definition of “cyber war” is proposed. “Cyber operation means the use of a computer system by or on behalf of a state to disrupt, deny, degrade, manipulate or destroy information in a computer system of or in another state”.
III - Although the definition of “cyber operations”
focuses on state-to-state aggressive activities, it also includes operations
realized “on behalf” of a State. Such perimeter may include a wide spectrum of
actors (state actors such as intelligence agencies, militaries, and non-state
actors such as organized crime groups, terrorist organizations…) and
situations.
IV - The approach is constructed on the basis of only 2 categories of actors: the State and the insurer.
- State level:
o
“States: means sovereign
state »
o
Government
of the State (intelligence, security services) (who is in charge of the
attribution process)
o
Vital
functions of a State: “financial institutions and associated financial market
infrastructure, health services or utility services”
o
“Specified States means China, France,
Germany, Japan, Russia, UK or USA”
o
“Impacted state means any state where a
cyber operation has had a major detrimental impact on: 11.1. the functioning of
that state due to the direct or indirect effect of the cyber operation on the
availability, integrity or delivery of an essential service in that state; and/or
11.2. the security or defence of that state.
o Those who act “on behalf” of a State
- The insurer
V - The coverage of losses is based on the attribution of the cyber-operations. Who is in charge of the attribution?
a) the
government of the State where the attacked system is located,
b) if the
government of the State is unable to attribute the attack, then “it shall be
for the insurer to prove attribution by reference to such other evidence as is
available”.