International Emergency Economic Powers Act (IEEPA)
A 1977 US statute letting the president, after declaring a national emergency, block assets and prohibit transactions: the foundation of most sanctions programs, cyber included.
The International Emergency Economic Powers Act, signed into law on December 28, 1977, allows the US president to block assets and prohibit transactions once a national emergency has been declared in the face of an extraordinary threat originating in whole or in part abroad. Most OFAC programs rest on this statute, through executive orders: it is what turns a foreign policy decision into a prohibition binding on every bank, insurer and negotiator. Executive Order 13694 of April 1, 2015 extended it to the authors of significant cyberattacks, which brought ransomware groups within the scope of sanctions. For insurance, IEEPA explains the speed of the risk: a designation does not go through Congress, it takes effect on the day it is published, and can make unlawful the next day a payment that a cyber policy would have covered the day before.
On December 5, 2019, OFAC designated the Evil Corp group and its alleged leader Maksim Yakubets under Executive Order 13694, while the State Department offered 5 million dollars for his arrest. From that day, paying a ransom to Evil Corp exposed the insured and its vendors to a violation.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.