Cyber war exclusion clause

The cyber war exclusion clause is a contractual provision inserted in standalone cyber policies to exclude from coverage losses resulting from cyberattacks sponsored or conducted by states or state-related actors. It differs from classical twentieth-century war exclusion clauses (designed for kinetic armed conflicts), whose inapplicability to cyberattacks was demonstrated by the 2023 Merck judgment. Lloyd's of London imposed in August 2022, via Market Bulletin Y5381, the mandatory insertion of such clauses in all standalone cyber policies underwritten by its syndicates from 31 March 2023. The Lloyd's Market Association published four model clauses (LMA 5615 to LMA 5618), differing primarily on the treatment of attribution. Version A clauses require a competent authority to formally recognize state imputability before the exclusion applies; Version B clauses allow the insurer to invoke the exclusion based on reasonable attribution without requiring official recognition. The primary application difficulty lies in the attribution problem: certain states deliberately sponsor criminal groups while maintaining ambiguity about their status, making the boundary between organized crime and state operations deliberately blurred. This uncertainty zone constitutes an anticipated reservoir of litigation for the coming decade.

The 2017 NotPetya attack was attributed by the US and UK governments to Russian military intelligence. Yet in the Merck and Mondelez litigations, insurers attempted to invoke classical war clauses to refuse indemnification. The 2023 Merck decision invalidated this approach for twentieth-century legacy clauses. It is precisely to avoid this type of gap that Lloyd's introduced Y5381: an explicitly drafted cyber-war clause is legally more defensible than a generic war clause, but the attribution question remains its Achilles heel.

war exclusion, acte de guerre cyber, Lloyd's Y5381, LMA 5615-5618, state-sponsored cyber exclusion