Institute Cyber Attack Exclusion Clause

On war risk policies it keeps cover for loss arising from the use of a computer system in the launch, guidance or firing mechanism of a weapon or missile: that is the clause 1.2 write-back.

Excludes any loss, damage, liability or expense directly or indirectly caused by the use or operation, as a means for inflicting harm, of a computer, computer system, software, malicious code, virus or any other electronic system. The logic rests on the peril, the malicious attack, not on the outcome.

Widely adopted by marine and cargo insurers from the moment it appeared, and still in use on some classes.

It says nothing about losses arising from non-malicious acts or plain failure, which is its silent cyber blind spot. It is widely and wrongly believed to exclude all cyber; it is often judged too broad and too draconian.

Issued 10 November 2003, two years after clauses NMA 2914 and 2915 on electronic data. Its shortcomings, alongside those of the classic war exclusions and laid bare by NotPetya, set off the 2019 clauses and then the 2021 to 2024 sequence.