The four 2023 clauses share a frame, and that is where to start, because their differences only show once the common ground is laid. Each opens with the same words: "Notwithstanding any provision to the contrary in this insurance, this insurance does not cover that part of any loss, damage, liability, cost or expense of any kind". Two expressions carry weight. "Notwithstanding any provision to the contrary" places the exclusion above the covers of the policy, including an extension drafted more generously elsewhere. "That part of" provides that a loss can be divided: only the fraction arising from the excluded event falls away, the rest remains covered. The claims handler must therefore apportion, not decide wholesale.
Then come four definitions, identical from one clause to the next. War is "armed conflict involving physical force", between states or as part of a civil war, rebellion, revolution, insurrection, military action or usurpation of power, "whether war be declared or not". A cyber operation is "the use of a computer system by, at the direction of, or under the control of a state" to disrupt, deny access to or degrade a system, or to copy, remove, manipulate or destroy information. State means "sovereign state". The computer system is defined so broadly, from server to microcontroller to cloud infrastructure, that the policy's own definition prevails in case of inconsistency. An operation run by a criminal group that no state directs or controls is not a cyber operation within the meaning of these clauses.
LMA 5564 is the shortest and the harshest. Its paragraph 1.1 excludes what arises "directly or indirectly from a war"; its paragraph 1.2 excludes what arises "from a cyber operation", with no further condition. There is no severity threshold and no link to a war: it is enough for the operation to be state backed within the definition. It writes nothing back. A cyber policy carrying it covers no attack attributable to a state, however modest, which is why it is rarely met: it takes from the buyer a large part of what the buyer thinks it is buying.
LMA 5565, 5566 and 5567 replace 1.2 with two narrower exclusions. Paragraph 1.2 now only excludes a cyber operation "carried out as part of a war, or the immediate preparation for a war"; paragraph 1.3 excludes a cyber operation "that causes a state to become an impacted state". Everything else, state espionage against a company, targeted sabotage that does not reach the state itself, is no longer excluded. Those remaining operations are what 5565 bounds with two limits to be filled in, one per operation (2.1) and one in the aggregate for the period (2.2), which apply "within the full policy limit and not in addition thereto". And the next sentence is the most dangerous in the family: "Unless an amount is specified in 2.1 and 2.2, there shall be no coverage for any cyber operation(s)". A field left blank turns a 5565 into a 5564.
LMA 5566 carries the same exclusions as 5565, without specific limits: operations that are neither war operations nor the cause of an impacted state are covered within the general policy limit. The 5565 and 5566 pair therefore isolates the effect of a single provision, the cap. LMA 5567 takes 5566 and adds one sentence: "Paragraph 1.3 shall not apply to the direct or indirect effect of a cyber operation on a computer system used by the insured or its third party service providers that is not physically located in an impacted state but is affected by a cyber operation". This is the bystanding cyber asset write-back, and it is what answers the third requirement of Bulletin Y5381 on systems located outside impacted states.
Two careful readings often change the outcome. The first concerns causation. Only 1.1 says "directly or indirectly", while 1.2 and 1.3 say "arising from". A loss indirectly connected to a war is excluded, a loss indirectly connected to a war cyber operation is arguable. The second concerns what the 5567 write-back does not touch: it only neutralizes 1.3. A bystanding system hit by a cyber operation carried out as part of a war remains excluded by 1.2, wherever it sits. 5567 protects the collateral damage of an attack on a state; it does not protect the collateral damage of a war.
What remains is the attribution clause, present in the four A versions in identical words and absent from the four B versions. It changes nothing in what is excluded; it changes how one establishes that an operation is state backed, and therefore falls within the definitions. It is the subject of the next lesson. The full text of the eight 2023 clauses and their translation can be read in the observatory's LMA clause comparator. Sources: the text of clauses LMA 5564A to 5567B of January 18, 2023, published by the Lloyd's Market Association, together with analyses by Marsh, "New cyber war exclusion language raises concerns", and by DAC Beachcroft, "War exclusions in cyber policies: an overview", both of which discuss the reach of the family; the trap of the unfilled amount in 5565 is read directly in its paragraph 2.
A case fabricated for this lesson. A 10 million euro standalone cyber policy carries LMA 5565A; the amounts in paragraphs 2.1 and 2.2 were left in curly brackets in the text delivered to the insured. A foreign intelligence service, identified by consistent technical evidence and by official attribution from the state where the servers are located, exfiltrates the designs of a component manufacturer and encrypts its servers to cover the data theft. No essential service is disrupted, no war is under way between the perpetrating state and the victim state. Response costs and business interruption: 2.4 million euros.
The reflex is to look for war, not find it, and conclude that cover applies. A word by word reading gives another answer. Paragraph 1.1 does not apply, for lack of armed conflict involving physical force. Paragraph 1.2 does not apply, since the operation was not carried out as part of a war or its immediate preparation. Paragraph 1.3 does not apply, since no state has become an impacted state. The operation therefore falls among the "other cyber operations" of paragraph 2, and that is where everything is decided: the clause says that unless an amount is specified in 2.1 and 2.2, there is no coverage for any cyber operation. The file is not excluded by war, it is excluded by an empty field. With a 5566, the loss would have been covered within the 10 million limit; with a properly completed 5565, within the chosen sub-limit. Attribution is not disputed here; on the contrary, it is what brings the operation within the definition. The lesson for anyone reviewing a policy is not to recommend an amount, it is to check that one exists: a 5565 whose brackets were left empty is a 5564 that does not say so.
- 01All four clauses exclude "that part of" the loss arising from the excluded event: a loss is apportioned, not decided wholesale.
- 025564 excludes any state cyber operation; 5565, 5566 and 5567 only exclude war, the war cyber operation and the one that makes a state impacted.
- 035565 covers other operations only within two limits to be filled in, and with no amount specified it covers none: an empty field makes it a 5564.
- 04The 5567 bystanding write-back only neutralizes 1.3: the collateral damage of a war remains excluded by 1.2.