CL380 Institute Cyber Attack Exclusion Clause
A London market standard clause published in 2003, widely used in marine and energy insurance, excluding losses caused by the malicious use of a computer, except when used to guide a weapon under a war policy.
Clause CL380, published in November 2003 by London market bodies, is one of the first cyber exclusions in insurance history. It excludes loss, damage, liability or expense directly or indirectly caused by the use or operation, as a means of inflicting harm, of any computer, computer system, software or virus. It was drafted for hull, cargo and energy policies, whose older wordings said nothing about computer risk. Its distinctive feature lies in its second paragraph: when endorsed on a policy covering war, civil war, revolution or terrorism risks, it does not exclude losses arising from the use of a computer in the launch, guidance or firing mechanism of a weapon or missile. The clause thus separates the cyberattack, excluded, from the modern computer-guided weapon, covered as war. For a long time it was enough for the marine market to remove silent cyber risk. Its broad wording, which targets any use of a computer as a means of inflicting harm, now raises questions: does GNSS jamming or manipulation of navigation systems fall within it? Insurers now offer limited cyber buy-backs, available for an extra premium.
Textbook case: a bulk carrier runs aground after its navigation system received false positions from satellite spoofing. Its hull insurer invokes clause CL380, the use of a computer system as a means of inflicting harm; the shipowner, who had bought a cyber buy-back limited to 5 million dollars, is paid within that limit.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.