Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. A state cyber operation paralyzes a small EU country's interbank clearing system for seventy-two hours, making transfers impossible. What qualification follows, and why?
That state becomes an impacted state, financial institutions being an essential service
The impacted state is the notion through which LMA clauses 5565, 5566 and 5567 bound the scope of state cyber operations that trigger the exclusion. A state becomes one when a cyber operation has had a major detrimental impact on its functioning, through disruption to the availability, integrity or delivery of an essential service. The reasoning therefore runs in two steps that must not be merged: first identify an essential service, then establish the impact. Here financial institutions and associated market infrastructure are expressly among the essential services listed, and a three-day paralysis of clearing is a major availability impact. The qualification depends neither on a duration threshold nor on any characterization in international law: it is contractual, and it is what then governs the geographic reach of the exclusion.
Glossary entry →2. The 2015 attack on the Ukrainian power grid cut electricity to hundreds of thousands of customers. What role does classifying the grid as an essential service play in the London market's cyber war clauses?
It conditions the impacted state qualification, and therefore whether the exclusion operates
An essential service is defined by LMA clauses 5565, 5566 and 5567 as a service indispensable to maintaining the vital functions of a sovereign state, including but not limited to financial institutions and associated market infrastructure, health services and utilities. A power grid belongs to the last family. The concept matters because of where it sits in the contractual chain: it measures nothing and caps nothing, it conditions the impacted state qualification, which in turn governs whether the exclusion operates. One point is worth noting because it breeds disputes: the list is not exhaustive, which leaves real interpretive room over what counts as essential, and that room gets argued at claim time rather than at inception.
Glossary entry →3. Two policies in the same tower carry the same LMA cyber war clause, one in its A version, the other in its B version. Same attack, same facts. What changes?
The debate: the first weighs agreed evidence, including attribution by the affected system's state; the second defers to the law of the contract
Two versions of the same clause, two debates on the same facts: that is the point to have seen before placing a tower, not after. The A version contains an agreement on how an operation is attributed to a state: the parties consider the objectively reasonable evidence available, which may include an official attribution by the government of the state where the affected system is located, and the insurer may rely on that evidence in the meantime. The B version contains none, and attribution is then proved under the law governing the contract, with no agreed method. The answer making the B version a wider exclusion gets the mechanism wrong: in both cases the exclusion is a defense and the burden of proof stays with the insurer; what changes is what it must prove and how. As for timing, it is no secondary detail: a clause that gives weight to an official attribution inherits a third party's diplomatic calendar, which can be slower than settling the claim. But that delay is a consequence of the substance, not a difference standing in its place.
Glossary entry →4. A sanctions listing hits a group with which twelve insureds of the same portfolio are negotiating at the same moment. What aggregates?
Impediments, not losses: exposure does not move, the right to pay disappears everywhere at once
It is an accumulation of a different nature from those a model can represent: nothing more is lost, and yet every file tips together. A sanctions impediment is not an exclusion: the cover still exists, it has become unlawful to perform, and strict liability strips good faith of any effect, exposing the insurer personally and not merely financially. The answer seeing only an event outside the portfolio misses that the correlation here is perfect: twelve files, one decision, taken once. And a model indexed on group names measures a naming convention rather than a risk: affiliates migrate from one name to another, real frequency persists, and the statistic falls. The one controlled variable is when the sanctions question is asked: on day one it steers the file, at the moment of transfer it changes nothing.
Glossary entry →5. An international operation seizes a group's infrastructure and makes decryption keys available two days before a ransom transfer negotiated at 2.4 million. Business interruption runs at 220,000 euros per day and the shutdown has already lasted fourteen days. What has the file actually saved?
Perhaps 2.4 million, provided the keys work on this variant and restore faster than a negotiation would have; but fourteen days of shutdown already amount to 3.08 million, so the saving lands on the file's smallest line item
Fourteen days at 220,000 euros is 3.08 million, more than the negotiated ransom, and that arithmetic puts the file the right way up. A takedown reads as good fortune, whereas three distinct things happened at once and only one of them is good. The second is that the sanctions question was never settled: it was overtaken by events. Had the transfer left two days earlier, it would have been lawful or not according to facts nobody had established, and the file came within two days of a personal exposure for the insurer without the question even being recorded. The third is invisible from the file itself: other insureds in the portfolio are in the same position at the same moment, and any stance taken here is taken on all of them at once. Answering that the business interruption is saved confuses stopping the meter with recovering the days already elapsed, which are gone.
Glossary entry →6. What exactly does business interruption cover indemnify, once a loss has occurred?
Lost gross margin, plus increased costs, over an indemnity period set in the contract
Business interruption cover indemnifies the financial consequences of a stoppage or slowdown in trading, not the physical damage itself, which belongs to another cover. Three elements make up the settlement, and confusing them changes the figure. First, lost gross margin, that is, turnover missed net of the variable costs the stoppage saves: indemnifying gross turnover would enrich the insured by the expenses they did not incur. Second, increased costs of working incurred to shorten the interruption, manual workarounds, subcontracting, overtime, on the logic that paying to shorten a stoppage beats indemnifying a longer one. Third, the indemnity period set in the contract, which bounds the whole and often proves the decisive parameter. In cyber this cover has become central, frequently costlier than the technical remediation, because paralyzed systems halt production or invoicing for days or weeks.
Glossary entry →