A bomb in the City
On April 10, 1992 a van bomb exploded outside the Baltic Exchange, the shipping exchange at the heart of London's financial district. First estimates of the damage ran to 800 million pounds; a year later, Irish diplomatic papers reported that they had been cut to around 350 million, as some buildings turned out not to need demolition after all (CAIN archive, April 26, 1993). The law firm CMS puts the cost of the 1992 bombings to the insurance industry at about 760 million (CMS).
The amount mattered less than what it revealed: nobody could say how many more bombs would come, or where. A risk that cannot be modeled cannot be reinsured, and without reinsurance, insurers could no longer offer the cover to owners of commercial property (Mondaq).
The fix: pool the risk, and have the state guarantee the rest
Pool Re was born in 1993, under the Reinsurance (Acts of Terrorism) Act of the same year. Insurers cede to it the terrorism risk on commercial property in Great Britain; it carries that risk on its own reserves, and beyond them the Treasury undertakes to advance whatever is missing. Pool Re pays a premium for this guarantee, and would repay the state if it ever had to draw on it (HM Treasury).
The scheme was tested almost at once: on April 24, 1993 another IRA bomb devastated Bishopsgate. That 262-million-pound loss long remained the largest Pool Re had paid; Pool Re estimates that the same event would cost more than a billion today, so much denser and more valuable have the buildings become (Pool Re presentation to the US Treasury).
The model traveled, all the way to cyber
After September 11, 2001, other countries reached the same conclusion and chose the same design: GAREAT in France and the Terrorism Risk Insurance Act in the United States, both in 2002. And on April 1, 2018 Pool Re extended its cover to physical damage and direct business interruption caused by an act of terrorism carried out by digital means (Insurance Times, Reinsurance News).
This is the junction AlgoPolis follows. Terrorism is a political risk: its author seeks an effect on the state, not a gain. When it strikes through a network instead of a van, the question of who pays, the market or the state, arises inside a cyber contract.
This page tells a story; it says nothing about what anyone should insure today.