An exclusion removing from cover damage resulting from acts of war, whose cyber versions have been debated since 2023.
The war exclusion clause removes from cover damage resulting from acts of war, hostilities or assimilated operations, on the grounds that such events constitute a catastrophic, non-mutualizable risk. Long confined to conventional armed conflict, this exclusion has become a major source of debate in cyber since state-sponsored or state-backed attacks blur the line between criminality and an act of war. The Lloyd's Market Association published from 2021, then made standard practice in 2023, model cyber-war exclusion clauses intended to clarify the treatment of attacks attributable to a state. These clauses raise a central difficulty, that of attribution, because establishing that a cyberattack emanates from a state or acts on its behalf is technically arduous and politically sensitive, yet it conditions whether the exclusion applies. The Merck litigation against its insurers, in the wake of NotPetya, illustrated how legally uncertain the application of a war exclusion to a cyberattack can be. The stakes for the insured are considerable, since a broadly drafted war exclusion can hollow out cyber cover precisely against the most serious attacks.
Following NotPetya, attributed to a state actor, Merck pursued lengthy litigation against its insurers, who invoked the war exclusion; US courts initially sided with the insured, holding the conventional exclusion ill-suited to a cyberattack.
exclusion de guerre, war exclusion, clauses LMA cyber war