Government internet shutdown and insurance
An internet cut decided by a government. For insurance it falls between two contracts: a cyber policy expects harm to a system and usually excludes network failure, and political risk cover protects assets, not revenue.
A government-ordered internet shutdown is the full or partial interruption of a territory's fixed or mobile networks on the authorities' instructions, most often through an order the telecoms regulator passes on to operators. It is not a cyberattack, since no one reaches the company's systems, and it is not an outage, since the networks work and are switched off. It is an act of state that produces the effect of a cyber loss, which is why it belongs to the junction of cyber and political risk. The resulting loss, first of all non-damage business interruption, finds no natural home in either contract. A cyber policy generally expects a security breach or a failure of the insured's or a provider's system, and it usually excludes the failure of infrastructure the insured does not control, telecoms and the internet included; there is no standard form either, so each wording has to be read on its own. Political risk insurance protects an investment against confiscation, expropriation or political violence: it mainly pays for the deprivation of an asset or for physical damage, and a network shutdown neither deprives the company of an asset nor damages anything. This is not a marginal event: the #KeepItOn coalition, led by Access Now, counted 296 shutdowns in 54 countries in 2024, a record, with conflict as the leading trigger. For the underwriter, the question is therefore not only the cyber war exclusion's "who brought the network down?" but also "who had the power to switch it off?"
On July 18, 2024, at the height of the student protests, Bangladesh cut the internet across its territory. Broadband came back, partially, only on the night of July 23, and mobile internet on July 28. The state minister for information technology first blamed the cut on a fire at a data center; an inquiry committee appointed by the Ministry of Posts and Telecommunications later found that there had been no fire and that he had himself had the regulator order the operators to shut down. Garment exporters, cut off from their buyers at the height of the ordering season, estimated at four billion dollars the orders lost to competitors. The announced cause, a fire, and the established cause, a state order, do not fall under the same clauses.
- Access Now, #KeepItOn, report on 2024 shutdowns (296 shutdowns, 54 countries)
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.