Burden of proof of an exclusion
The rule that the insured proves the loss falls within the cover, but the insurer proves the exclusion applies, which makes the cyber war exclusion a question of evidence more than wording.
Proof is split into two stages in a coverage dispute. The insured must first establish that the loss falls within the scope of cover: damage, a covered peril, the policy period. It is then for the insurer relying on an exclusion to prove that the factual conditions of that exclusion are met. In French law this allocation follows from article 1353 of the Civil Code and settled case law of the Cour de cassation; English and US law reach the same solution. The rule has considerable practical reach for exclusions that depend on a fact that is hard to establish. The cyber war exclusion is the sharpest example: the insurer must prove the attack was carried out by a state or on its behalf, which requires intelligence it does not hold. Market clauses have tried to address this by organizing how attribution is assessed, without shifting the burden: they invite the parties to take account of an official attribution, but leave it to the insurer to persuade. For the underwriter, an exclusion that cannot be proven is worth less than its wording suggests.
In Mondelez's litigation against its property insurer, arising from NotPetya in 2017, the insurer relied on the war exclusion and therefore had to prove the attack's state character, drawing on the public attributions by the US and UK governments. The case was settled in 2022, after four years of proceedings, without the question being decided on the merits.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.