State cyber proxy
A criminal or supposedly independent group acting for a state, with its consent or under its protection, which makes state attribution of an attack, and therefore the cyber war exclusion, deliberately uncertain.
A cyber proxy is a non-state actor, whether a criminal group, a militant collective or a security firm, that conducts operations serving a state's interests, either on its instructions, under its control, or simply because that state tolerates it on its territory in exchange for its restraint toward it. Using a proxy gives the state what it wants: a strategic effect without a signature, and therefore without established international responsibility. For insurance, this is the hardest case at the junction of cyber and political risk. Market cyber war exclusions target operations carried out by a state or on its behalf, and international law recognizes a state's responsibility for acts it directs or controls. But proving that link requires intelligence that neither insurer nor insured holds, and that governments publish only when they choose. The underwriter must therefore reason about a lasting gray zone: the same group can be treated as criminal at the time of the loss, then as a state proxy after an official attribution made months later. Not to be confused with a false flag, where a state poses as another actor: the proxy is a real actor, acting for that state. Where the word appears: nowhere under that name; the policy captures it through the words "on behalf of a state" in the cyber operation definition of clauses LMA 5564 to 5567.
On February 25, 2022, the Conti ransomware group publicly announced its support for the Russian government. In April it paralyzed several Costa Rican ministries, raising its ransom demand to twenty million dollars, and the new president declared a national emergency on May 8, 2022: a criminal organization had put a state in crisis without any government attributing a state operation to it.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.