Cyber operation (LMA cyber war definition)
How the LMA cyber war clauses define a state cyber operation, the use of a computer system by or for a state, and why ordinary cybercrime falls outside it.
On 16 August 2022 Lloyd's issued market bulletin Y5381: from 31 March 2023, every cyber policy written by its syndicates must exclude state-backed cyber operations. The LMA 5564 to 5567 clauses, published in November 2021, supply the wording, and the term that carries it all is cyber operation. Within the meaning of the LMA cyber war clauses (LMA 5564 to 5567), a cyber operation is the use of a computer system by, at the direction of, or under the control of a sovereign state to disrupt, deny access to, or degrade the functionality of a computer system, and/or to copy, remove, manipulate, deny access to or destroy information in such a system. The definition is deliberately broad: it covers destructive attacks, espionage and sabotage alike. The state element is central. It separates the cyber operation from ordinary cybercrime (ransomware, fraud), which is not a cyber operation in the LMA sense. The insurer bears the burden of proving attribution to a state, and the attribution provision of the A versions says so expressly: it guides how the evidence is weighed without shifting that burden. In clauses without attribution (B versions), ordinary contract law applies. The cyber operation is the concept around which the whole cyber war exclusion regime turns. Depending on the clause chosen (LMA 5564 to 5567), its mere occurrence may suffice to trigger exclusion (5564), or the exclusion applies only under certain conditions of intensity or war context (5565, 5566, 5567). Not to be confused with the cyber act of property clauses, which covers any malicious or criminal act committed by means of a system, whoever the author: a cyber operation requires a state. The word appears in the definitions of clauses LMA 5564 to 5567 and of the cyber policies that adopt them. International law uses the same word, in the 2017 Tallinn Manual 2.0, in a sense that does not bind the contract.
In 2017, several Western governments officially attributed NotPetya to Russia's GRU. Its deployment via EternalBlue and automatic propagation make it a state-backed cyber operation within the LMA sense. Insurers therefore invoked war and cyber exclusion clauses in the resulting claims.
- LMA 5564 to 5567, definition of “cyber operation” and attribution provision
- Tallinn Manual 2.0, Cambridge University Press, 2017
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.