The fact: states switch off, more and more often
In 2024 Access Now and the #KeepItOn coalition recorded 296 internet shutdowns in 54 countries, the highest count on record; conflict was the leading trigger, ahead of protests (#KeepItOn 2024 report, Access Now press release).
The most instructive case for an underwriter is Bangladesh. During the protests of July 2024, mobile internet was suspended area by area from 15 July, then fixed broadband from 18 to 23 July. The government first blamed a fire at a data centre; the inquiry committee appointed afterwards found no connection between the fire and the shutdown, which had been ordered verbally by the state minister for ICT through the telecoms regulator (The Daily Star, BSS).
Why the origin matters
The same business interruption can thus be given two causes. Presented as a fire, the outage looks like an infrastructure loss; established as a state order, it becomes an act of government. For a company that sells online or runs its plants remotely, the loss is the same. For the contract, they are two different claims, and the characterisation may only settle weeks later.
The other form: a state bans a piece of software
An act of state does not only cut the network. On 20 June 2024 the US Department of Commerce prohibited Kaspersky from supplying its security software to US persons: no new agreements from 20 July, no updates from 29 September 2024 (BIS press release, Covington). Companies using it had to migrate within a deadline set by a state. Nothing was attacked; a control simply went away.
What each contract does
The cyber policy covers what reaches the insured's own systems. The act of state does not reach them: it removes an outside service or a supplier. And the infrastructure exclusion takes out precisely the power, telecoms and internet outages beyond the insured's control, because they would hit a whole portfolio at once.
Property business interruption has a civil authority extension, but it generally requires physical damage nearby, which a shutdown does not cause.
Political risk covers the acts of a foreign state against an investment or a contract: confiscation, expropriation, licence cancellation. It is written for the seizure of an asset, not the loss of a network.
An act of state that cuts off a service therefore often falls between these three contracts. This is the junction AlgoPolis studies: a political risk that produces the effect of a cyber loss. This page describes how the contracts are built; it does not say which cover to buy, and each wording must be read as written.
Where we decided it
Our underwriting note no. 2, "The update depends on two States", published on October 2, 2026, takes the second form on a public case, the US ban on Kaspersky (final determination of June 20, 2024), and a fabricated company that depends on it. It decides yes, with conditions of disclosure and reversibility, and keeps the two rejected decisions in writing.