State due diligence in cyberspace
International law principle that a state must not knowingly allow its territory to be used for operations contrary to the rights of other states. It targets the state that tolerates ransomware groups without directing them.
In the Corfu Channel judgment of 1949, the International Court of Justice set the rule: a state must not knowingly allow its territory to be used for acts contrary to the rights of other states. Albania had not laid the mines that struck the British destroyers, but it knew they were there. The Tallinn Manual 2.0, published in 2017, carries the rule into cyberspace in its rules 6 and 7. The 2015 report of the UN group of governmental experts makes it a non-binding norm of responsible behavior. Not everyone agrees: several states, the US and the UK among them, see it as a desirable norm rather than an obligation already in force. The principle matters for insurance because it names exactly the gray zone that war clauses leave out. A ransomware group working from a country that lets it be does not carry out a cyber operation "on behalf of" a state in the sense of LMA 5564 to 5567. It benefits from tolerance, and tolerance is not an instruction. An insurer that wants to exclude has to show direction, not looking the other way.
Constructed example: a Belgian clinic incurs the costs of a ransomware attack run from a country that has never prosecuted the group, despite three mutual assistance requests. The insurer raises the state exclusion. The file shows no instruction, no funding, no target of interest to that state. It pays: the state's failure may engage its international responsibility, not the contract exclusion.
cyber due diligence, due diligence principle, state due diligence obligation
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.