Two notions drive clauses LMA 5565 to 5567, and neither can be read in the insured's system. The impacted state is established at the scale of a country; attribution is decided in a capital. The cyber underwriter thus discovers that part of the exclusion is played out on a political map and not on a network. This is the exact point where cyber risk becomes political risk, and it is why this lesson is about geography.
The definition is short. An impacted state is "any state where a cyber operation has had a major detrimental impact on the functioning of that state due to disruption to the availability, integrity or delivery of an essential service in that state", or a major detrimental impact on its security or defense. An essential service is one that is "essential for the maintenance of vital functions of a state", the clause citing, without limitation, financial institutions and associated financial market infrastructure, health services and utility services. Three words carry the weight: "major", which is not quantified; "state", which rules out a region or a city; and "in that state", which ties the service to the territory.
A consequence follows that is often forgotten: the effect on the insured does not count. A company ruined by an operation that reached no essential service is not in an impacted state, and 1.3 does not apply. Conversely, a company barely inconvenienced, located in a country whose power grid was shut down by the same operation, is in an impacted state. The threshold is collective, not individual, which is consistent with its purpose: the exclusion targets the systemic accumulation no portfolio can carry, not the severity of a particular loss. Since "major" is undefined, the boundary will be argued; the clause sets the question, it does not set the answer.
The LMA 5567 write-back adds a second geography, the physical location of systems. Paragraph 1.3 does not apply to a system used by the insured or its service providers that "is not physically located in an impacted state". Two companies hit by the same operation are therefore not treated alike depending on where their servers sit: the one whose machines are in the impacted state is excluded, the one whose machines are elsewhere stays covered. The location of a data center, a managed service provider or a cloud region becomes an underwriting fact, to be asked in the questionnaire and checked in the service contract, because it decides cover on the day of the loss.
The same geography governs attribution. The A versions agree that the insured and the insurer consider "such objectively reasonable evidence that is available to them", which may include "formal or official attribution by the government of the state in which the computer system affected by the cyber operation is physically located" to another state. It is no longer, as in 2021, the primary factor nor a condition of payment; it is one piece of evidence among others, and the burden of proof stays with the insurer. But the government designated is that of the system's location, not that of the insured's head office nor of the insurer. The observatory's underwriting note No. 1, "The server is in Warsaw", is built on that detail: the capital whose word counts is not the one expected.
Attribution has its own calendar, and that is the costliest asymmetry. NotPetya, launched in June 2017, was attributed by London and Washington in February 2018, eight months later. A government may attribute quickly, late or never, for diplomatic reasons foreign to the claim; it may also maintain ambiguity about criminal groups it tolerates. Under the 2021 version, waiting suspended payment; under the 2023 A versions, the insurer must prove with what it has, and an attribution after settlement is only one more piece of evidence. Under the B versions, no method is agreed, and attribution is proved under the law of the contract, before a judge or an arbitrator bound by no government statement.
Sources: the text of clauses LMA 5565A, 5566A and 5567A of January 18, 2023, the definitions of impacted state and essential service, and the attribution clause, published by the Lloyd's Market Association and reproduced in the observatory's comparator; Lloyd's Bulletin Y5381, August 16, 2022, requirement on systems located outside impacted states, cross-checked against Kennedys and Clifford Chance; the attribution of NotPetya by the British and American governments in February 2018, cross-checked against the sources of note No. 1 and the "Merck v. Ace" glossary entry; the 2021 rule on awaiting attribution, from bulletin LMA21-042-PD and the DAC Beachcroft analysis.
A case fabricated for this lesson. A cyber operation shuts down the interbank payment system of a Central European state for three days. Two insureds each carry a cyber policy with LMA 5567A. The first, a regional bank in that state, hosts its servers locally; it loses 3 million euros. The second, a French retailer whose servers are in a data center in France, loses 1.1 million euros because its payment service provider is located in the targeted state. Six weeks later, the government of that state publicly attributes the operation to a neighboring state; France has not spoken.
The temptation is to handle the two files together, since it is the same operation and the same clause. Geography separates them. A three day shutdown of an interbank payment system is a disruption of an essential service the clause expressly cites, and the effect on the functioning of the state will likely be held major: the Central European state is an impacted state. The regional bank, whose servers are in that state, falls under 1.3, and the 5567 write-back does not protect it. For the retailer the question is different: its own servers are in France, outside the impacted state, but the loss comes from systems of its payment provider located in that state. The write-back covers systems used by the insured or its providers "that are not physically located in an impacted state"; the provider's systems are. The part of the loss arising from the shutdown of those systems therefore remains excluded, and only a part attributable to its own systems in France could be written back. As for attribution, the government that counts is that of the state where the affected systems are located, the one that has spoken; French silence changes nothing, and the burden of proof remains with the insurer.
- 01An impacted state is established at country scale, by the major effect of an operation on an essential service or on its security: the severity of the insured's loss does not enter into it.
- 02The 5567 write-back depends on the physical location of the systems of the insured and its providers, which becomes an underwriting fact.
- 03The government whose attribution counts is that of the state where the affected system is located, neither that of the insured's head office nor that of the insurer.
- 04Since 2023, official attribution is only one piece of evidence among others in the A versions; in the B versions, no method is agreed.