Marine insurance deserves a lesson to itself in a course on silent cyber, and not because it would be exotic. It brings together three traits found together nowhere else: contracts whose wording sometimes goes back decades, insured objects that have become floating computer systems without anyone amending the policies, and an exposure crossing hull, cargo, liability and detention at the same time. It is the ground where the gap between the text and the thing insured is widest.
One must first see what a ship has become. Steering, navigation, cargo handling, stability and engines are driven by systems communicating with each other and with the shore. A modern ship depends on a positioning signal to navigate, on a management system to balance its ballast, and on a satellite link to receive its instructions. None of those dependencies existed when the principles of modern marine insurance were laid down, and the policies went on speaking of perils of the sea, average and marine fortune.
The first point of friction is detention without damage. A ship whose navigation systems are corrupted cannot sail, although its hull is intact, its engines sound and its cargo aboard. A hull policy answers for damage to the thing insured: it is built around average. Detention without damage nonetheless produces considerable losses for an owner, in lost hire, demurrage and broken rotation. The question is therefore not whether the loss is serious, it is whether it crosses a trigger written for physical damage.
The second point is cargo, and it is different. Goods suffer no physical harm because a port IT system is down, but they arrive late, they wait on a terminal, they deteriorate if perishable and they miss their market if seasonal. Cargo policies classically cover physical loss of or damage to the goods, and delay is very generally excluded. An IT stoppage at a terminal can therefore produce a major commercial loss without either policy concerned finding any damage to indemnify.
The third point is the one that most exercised the market, and it is the conjunction of cyber and war. A cyber act attributed to a state, aimed at a ship or at port infrastructure, sits at the crossing of two inherited clauses: a war exclusion present in the ordinary hull policy, and a separate war risks policy taking back part of what the first excludes. The boundary between them was written for mines, seizures and armed conflict. A professional must know it is today the object of standardized clauses, and above all that it differs from one placement to another.
A legal particularity of this line must be added, and it changes the arithmetic: general average. Where a sacrifice is made for the common safety of the adventure, its burden is shared between ship, cargo and freight. A cyber incident forcing a deviation, a tow or a lightening therefore raises the question whether those costs enter a general average adjustment, and so whether a shipper can be called to contribute for an IT event occurring aboard a ship it does not operate.
What should be retained from this lesson is not a list of clauses, it is a reading reflex particular to marine. In this line the question is almost never whether cyber is excluded: it is whether the loss crosses the trigger, which is almost always physical damage or physical loss. A professional who looks first for the cyber clause misses the point; a professional who looks first at what the policy requires in order to respond finds the answer in two cases out of three, and looks for the cyber clause for the remaining third.
A time-chartered container ship arrives on November 14 off a terminal whose management system is paralyzed by ransomware aimed at the port operator. The ship itself is untouched: hull, engines and onboard systems all work. It waits six days at anchor for want of being discharged, then a further eleven days to find a slot, seventeen days lost in all. The owner puts the loss at 620,000 dollars of hire and bunkers. One shipper loses an entire consignment of fruit worth 340,000 euros, spoiled while waiting. A second shipper, carrying Christmas goods, receives them intact on December 4 and can no longer sell them, a commercial loss of 900,000 euros. None of the policies involved carries a cyber clause. Who is indemnified?
The useful reflex is the lesson's own and must be applied before even looking for a cyber clause, which exists in none of these contracts: the question is not whether cyber is excluded, it is whether each loss crosses the trigger of the policy it is presented to. The owner is the clearest and, for him, the most disappointing case: his 620,000 dollars is detention without damage, his ship suffered no harm, and a hull policy is built around average; it therefore does not respond, and the subject moves to any loss of hire cover, which is a separate contract and which most often also conditions its response on damage to the ship. The fruit shipper is the only one whose loss stands a serious chance of being indemnified, and that is counter-intuitive since there was no impact at all: the fruit underwent physical alteration, spoiling, which is physical loss of the goods; the difficulty will be characterizing the cause, the waiting, and checking whether the cargo policy excludes delay as such or only delay loss without alteration. The Christmas goods shipper loses the most and has the least chance of cover: the goods are intact, no physical loss occurred, and the loss is purely commercial, that is, very generally excluded as delay. Two lessons emerge. The first is that the ranking by amount and the ranking by recovery are inverted in this file, the largest loss being the least covered, and that clients should be told so before shipment rather than after. The second is that the recourse of all three against the port operator, and their insurers' subrogation once they pay, is this file's real route, which requires preserving now the evidence of the stoppage and of its duration.
- 01A ship has become a floating computer system, and its policies still speak of perils of the sea and average.
- 02In this line the question is almost never the cyber exclusion: it is the trigger, almost always physical damage.
- 03Detention without damage costs an owner dearly and does not cross the trigger of a hull policy built around average.
- 04Delayed goods are not damaged goods: delay is very generally excluded, save where the thing itself is physically altered.
- 05General average can call a shipper to contribute for an IT incident occurring on a ship it does not operate.