The four clauses LMA 5564 to 5567 were not born of theoretical reflection on digital warfare. They were born of a loss, a lost lawsuit and an instruction from Lloyd's, in that order, and each of those three steps left its mark on the text. Understanding where they come from means understanding why they talk so much about evidence and so little about tanks, and why the question running through them is not "what is war?" but "who is entitled to say there is one?". It is a political risk question asked inside a cyber contract.
The starting point is the classic war exclusion. The London market has written it since the NMA 464 clause of 1938: the policy does not cover losses caused by war, invasion, hostilities or warlike operations, whether war be declared or not. The text assumes that an act of war is recognizable by its means, troops and borders, and that it is committed by an identifiable state. It went through decades without major difficulty because nobody doubted that a bombing was one. It still sits, in similar wordings, in most property policies, which said nothing about cyber either to cover it or to exclude it.
On June 27, 2017, the NotPetya malware spread from the update of a Ukrainian accounting package and destroyed the systems of groups across the world. In February 2018, the British and American governments publicly attributed it to the Russian military. Two victims, the pharmaceutical group Merck and the food group Mondelez, presented their losses under all risks property policies; their insurers raised the war exclusion. Mondelez and Zurich settled in 2022 with no judgment on the merits. Merck, by contrast, obtained a ruling: on May 1, 2023, the New Jersey Appellate Division confirmed that the exclusion of hostile or warlike action requires a link to military action, which a computer attack on a civilian company is not. The case settled on January 3, 2024, on the eve of the hearing before the state Supreme Court.
The market drew a twofold lesson. First, an inherited exclusion cannot be argued against a computer attack with a reasonable chance of success, because it is a defense and the insurer raising it bears the proof. Second, the public attribution of 2018, which seemed to settle the question, played no contractual role: the policy wording gave it none. Meanwhile, Lloyd's had required through Bulletin Y5258 of July 2019 that every policy clearly affirm or exclude cyber. Silence was no longer an option; what remained was to write what was excluded, and on what condition.
On November 25, 2021, the Lloyd's Market Association published four model clauses under reference LMA21-042-PD: LMA 5564, War, Cyber War and Cyber Operation Exclusion No. 1, then three clauses No. 2 to No. 4 which exclude less and less and write back more and more cover. Their novelty was to make attribution part of the contract. The primary but not exclusive factor is whether the government of the state where the affected system is physically located attributes the operation to another state. Pending that attribution, the insurer may rely on an objectively reasonable inference, and no loss is paid. If the state takes an unreasonable time, does not attribute or declares itself unable to, the insurer proves attribution by the other evidence available.
On August 16, 2022, Lloyd's published Bulletin Y5381. From March 31, 2023, at inception or renewal, every standalone cyber policy written by a syndicate must carry an exclusion of state backed cyber attacks, legally reviewed, meeting five requirements: exclude war where the policy has no separate war exclusion, exclude state attacks that significantly impair the functioning or security of a state, state clearly whether systems located outside impacted states remain covered, set out a robust basis for attribution, and define all key terms. The bulletin prescribes no wording; it sets what any wording must do.
On January 18, 2023, the LMA replaced the four clauses with eight: an A and a B version of each number. The grid was tightened, the 2021 list of specified states disappeared, and the only difference between A and B is the attribution clause. The A versions agree that the insured and the insurer consider the objectively reasonable evidence available, which may include official attribution by the government of the state where the system is located, and they leave the burden of proof with the insurer. The rule that no loss is paid in the meantime is gone. The A versions satisfy Bulletin Y5381 for standalone cyber risks under codes CY and CZ; the B versions do not without the prior agreement of Lloyd's.
The sources of this lesson: Lloyd's, Market Bulletin Y5381, August 16, 2022, cross-checked against notes by Kennedys and Clifford Chance; LMA, bulletin LMA21-042-PD of November 25, 2021 and its cyber war clauses page, cross-checked against the DAC Beachcroft analysis of January 2022; Merck v. Ace, New Jersey Appellate Division, May 1, 2023, cross-checked against Insurance Journal and Simpson Thacher; the settlement of January 3, 2024, cross-checked against Reinsurance News and McGuireWoods; the Mondelez and Zurich settlement, cross-checked against The Record and Cybersecurity Dive. The text of the 2023 clauses is reproduced in the observatory's LMA clause comparator.
A case fabricated for this lesson. In 2026 a European property insurer reviews a program tacitly renewed since 2016 for a logistics company. The policy carries an NMA 464 style war exclusion and a cyber affirmation clause added in 2020 after Bulletin Y5258, covering business interruption following physical damage of computer origin. It carries no clause from the LMA 5564 to 5567 family. The underwriter must tell the committee what the war exclusion is worth against a destructive attack attributed to a state, and what the history of the clauses teaches on that point.
The temptation is to answer that the war exclusion "covers" the case, since the word war appears in it and the attack would be state backed. The history of the clauses says the opposite. The only judgment on the merits on this question, Merck in 2023, read a similar exclusion as requiring military action, and the market drew the consequence by writing new clauses rather than litigating the old ones. The inherited exclusion remains a defense, whose proof the insurer bears, and it says nothing about attribution: a public statement by two governments would be an argument of fact there, not a condition met. Bulletin Y5381 does not apply to this contract, which is not a standalone cyber policy written at Lloyd's; but its five requirements supply the reading grid that is missing: does the policy exclude war, severe state attacks, does it say what happens to systems outside impacted states, does it set a basis for attribution, does it define its terms? Here the answer is yes to the first question and no to the other four. What the underwriter must tell the committee is therefore not a coverage recommendation but a finding: the 2020 cyber affirmation opened a cover that the 1938 exclusion was not written to close.
- 01Clauses LMA 5564 to 5567 come from a loss (NotPetya, 2017), a lawsuit lost by insurers (Merck, 2023) and an instruction from Lloyd's (Bulletin Y5381, August 16, 2022).
- 02The 2021 version made attribution by the state where the system sits the primary factor, and paid nothing in the meantime; the 2023 version only keeps objectively reasonable evidence, the burden of proof staying with the insurer.
- 03Bulletin Y5381 prescribes no wording: it imposes five requirements, among them a basis for attribution and a clear answer on systems located outside impacted states.
- 04Since January 18, 2023, each number exists in an A version, with an agreement on attribution, and a B version, without; only the A versions satisfy the bulletin for a standalone cyber policy.