Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. The module distinguishes two families of wording, called A and B. What separates them?
A versions agree on a method of attributing an attack to a state, B versions on none: same facts, two debates
The difference is about the method of attribution, and it changes the debate over the same claim. The A versions contain an agreement: the parties consider the objectively reasonable evidence available, which may include an official attribution by the government of the state where the affected system is located, the insurer being able to rely on that evidence pending such an attribution, and the burden of proof stays with the insurer. The B versions contain no such agreement, and attribution is then proved under the law governing the contract, with no agreed method. The four numbers, LMA 5564 through LMA 5567, differ on something else, how much cover they keep. The other answers split the two families along criteria that are real elsewhere, the peril's target, the line of business, the date, and none of them describes this divide.
Glossary entry →2. In the worked case, twelve million is presented under a 2019 property policy that does not mention cyber and carries an inherited war exclusion. What must the insurer invoking it establish?
Everything: the exclusion is a defense, and it must establish that war and hostilities capture a cyberattack, which the NotPetya litigation found ill-fitted
Under this wording, attribution plays no contractual role: the clause speaks of war and hostilities, and attribution becomes an argument of fact, not a condition met. The burden therefore rests entirely on the insurer, which makes this policy, the oldest and the most silent on cyber, the one where its defense is weakest. The answer treating attribution as sufficient conflates the module's two regimes: it describes the 2024 cyber policy, where attribution is a condition, and applies it to the 2019 one, where it is not. That is exactly the error the case is built to reveal.
Glossary entry →3. The case notes that the two governments attribute the attack on September 2, months after the facts. Why is the date of attribution a problem in itself?
Because a clause requiring recognition without saying at what date it must exist delegates the outcome to a third party's diplomatic calendar, which can be slower than settlement
A condition without a date stays open indefinitely, and a settlement signed in July on the strength of no attribution is weakened when attribution arrives in November. The flaw is therefore not in what the clause requires, it is in what it omits: a moment. And that flaw is cured only in the drafting, by writing the date at which the condition is assessed. The answer denying any evidential value to a late attribution mistakes the ground: the trouble is, on the contrary, that it can be raised once the file was closed.
Glossary entry →4. The case presents eighteen million, twelve under the 2019 policy and six under the 2024 one. The group's reflex is to present the widest line first. Why does the module say this is backwards?
Because two thirds of the loss rests on the 2019 policy, whose exclusion is the weakest: that is where the characterization of the proximate cause is decided
The effort belongs where the stake is heaviest and the insurer's defense weakest, and those two conditions meet on the 2019 policy. The opposite reflex comes from a habit reasonable elsewhere, starting with the cover best fitted to the facts. The answer speaking of extinguished recourse goes too far the other way: presenting under one policy first extinguishes nothing elsewhere, but installs with the adjuster a causation narrative that then has to be undone, which is a real cost and not a waiver.
Glossary entry →5. The module concludes that a tower whose lines do not carry the same definition of attribution is not a tower. What does that mean concretely?
That these are stacked covers which will respond separately to the same facts, and that the capacity table never shows the hole
A tower is a continuous promise more than a sum of amounts, and that continuity rests on identical definitions. As soon as one line defines attribution differently, it can exclude where its neighbors cover, and the insured discovers the hole at the claim. What makes the flaw durable is the control tool itself: a capacity table adds amounts and layers, it does not read clauses, and it will present this tower as complete. The answer speaking of reduced capacity describes what one would wish the table showed; it does not show it, and that is the whole problem.
Glossary entry →