Attribution of a cyber operation to a state
Who decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.
On February 15, 2018, London and Washington attributed NotPetya to the Russian military. In January 2022 the New Jersey Superior Court, hearing Merck against its property insurers, held that the war exclusion addressed traditional armed conflict and did not reach that attack, attribution or not. State attribution is the process, at once technical, legal and political, by which a cyber operation is imputed to a sovereign state or to entities acting at its direction or under its control. Under the LMA cyber war clauses, it decides whether the exclusions for state-backed cyber operations apply. The A versions of the clauses (5564A, 5565A, 5566A, 5567A) contain an explicit attribution clause. It provides that the insured and insurer will consider such objectively reasonable evidence as is available, including formal or official attribution by the government of the state where the affected computer system is located. The burden of proof stays with the insurer; the wording only guides how the evidence is weighed. The B versions lack it: attribution must then be proven under the law applicable to the contract. Attribution is structurally hard: it takes deep forensic analysis, a geopolitical read and often public or government intelligence. It can be contested over time, and the absence of official attribution does not mean the state in question is not responsible. Not to be confused with a claim of responsibility: a group that signs an attack proves nothing about who sponsored it, and a false flag is precisely a fabricated claim. Where the word appears: in the attribution provision of the A versions of LMA 5564 to 5567, absent from the B versions.
After the 2021 Colonial Pipeline cyberattack, attributed to the DarkSide group without official state imputation, insurers were able to treat the claim as an ordinary cybercrime. WannaCry (2017), by contrast, was officially attributed to North Korea by the United States and the United Kingdom, which could make it a state-backed cyber operation under the LMA clauses. Delay matters as much as authorship, because the claim is settled during that delay. WannaCry hit on May 12, 2017 and the United States attributed it on December 19, 2017, about seven months later. NotPetya, launched on June 27, 2017, was attributed to the Russian military by the United Kingdom on February 15, 2018, about eight months on. KA-SAT was attacked on February 24, 2022, and the EU Council attributed it on May 10, 2022, two and a half months later. Polish energy sites, hit in late December 2025, were attributed by the targeted state on January 13, 2026, then formally by the United Kingdom and the EU on July 13, 2026. Stryker was hit on March 11, 2026, and the U.S. Department of Justice attributed it to Iranian intelligence on March 20, 2026: nine days. The Polish case also shows the three layers of the word: political attribution (a minister), technical (a private vendor and the national team, which did not name the same service) and legal (sanctions).
- LMA 5564A to 5567A, “Attribution of a cyber operation to a state” provision, January 2023
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.