Cyberterrorism
An act of terrorism carried out through computer means, a notion with no common legal definition whose treatment depends on what public terrorism schemes say, or leave unsaid.
Cyberterrorism refers to the use of computer means to commit an act that would, if physical, meet the definition of terrorism: violence or a threat intended to intimidate a population or coerce a government, in service of a political, religious or ideological aim. The notion has no shared legal definition, and that is precisely its problem for insurance. Three frameworks overlap without matching. The cyber policy, which generally covers the attack whatever its motive but often excludes war. The property policy, whose terrorism exclusion may or may not reach computer means. And the public terrorism reinsurance scheme, where one exists, which covers cyber only if its text says so. The same act can therefore be covered as terrorism, excluded as war, or fall between the two depending on whether its author is an ideological group, a state proxy or a state itself. For the underwriter, the stake is accumulation: a cyber attack on shared infrastructure hits thousands of insureds at once, exactly like a physical attack downtown, but without any geographic limit.
Since April 2019, Pool Re, the UK public terrorism reinsurer, has covered property damage and consequential business interruption caused by an act of terrorism carried out by computer means, but not pure non-physical losses. In the United States, the Treasury clarified in December 2016 that stand-alone cyber policies fall within the federal TRIA program when an act of terrorism is certified.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.