Skip to content
←Back to glossaryCyber

Joint public attribution

Coordinated statement by several governments attributing the same cyber attack to a state on the same day: NotPetya on February 15, 2018, Microsoft Exchange on July 19, 2021.

Definition

On February 15, 2018, the United Kingdom and then the United States attributed NotPetya to the Russian military; Australia, Canada, New Zealand and Denmark followed within hours. On July 19, 2021, the US, the UK, the European Union, NATO, Japan, Australia, Canada and New Zealand jointly attributed the Microsoft Exchange campaign to China's Ministry of State Security. That is joint public attribution: several governments say on the same day, on the same facts, that a given state did it. The move is political. It signals that the technical evidence has been cross-checked by several services, and it often prepares sanctions, like those the European Union adopted on July 30, 2020 for WannaCry, NotPetya and Cloud Hopper. It also has a contractual effect that clause drafters saw coming. LMA 5564 to 5567 tie attribution first to what the government of the state where the affected system sits says. A joint statement, which nearly always includes the victim's country, settles the question for insured and insurer alike. It comes late, though, eight months after NotPetya, and until then the exclusion has to be applied on inference.

Its 7 cross-references, woven across the glossary's 18 categories
Joint public attribution: Cyber glossary illustration, AlgoPolis
Example

Constructed example: a Dutch manufacturer hit by ransomware in March files its claim. The insurer pays under reservation. In November, the Netherlands, with seven other governments, attributes the campaign to a foreign intelligence service. The policy carries LMA 5566: the insurer stops payments on the business interruption still open, and the claim moves into a dispute over what had already been paid.

Read next
CyberAttribution of a cyber operation to a stateWho decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.Read the entry →CyberNotPetya (2017) and the war exclusion disputesThe 2017 wiper attributed to Russia's GRU, spread through Ukrainian accounting software, which led to the Merck and Mondelez war exclusion disputes.Read the entry →CyberWannaCryGlobal ransomware of May 2017 exploiting the EternalBlue vulnerability to spread automatically across unpatched networks.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

joint attribution, collective attribution, coordinated attribution

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.