Tallinn Manual
A non-binding expert study setting out how existing international law applies to cyber operations, and the reference most often cited when a contract must decide whether an attack amounts to war.
The Tallinn Manual is a study drafted by an international group of legal experts convened by the NATO Cooperative Cyber Defense Center of Excellence, based in Tallinn. Its first edition, published in 2013, dealt with the law applicable to cyber warfare; the second, released in 2017 as Tallinn Manual 2.0, extends the analysis to peacetime cyber operations and sets out 154 rules. None of them is binding: the manual describes the law as its authors read it, and several states dispute parts of it. Its contribution lies in three notions that insurance borrows without always saying so. Use of force is assessed by the scale and effects of an operation, not by the means employed. An armed attack, which triggers the right of self-defense, requires a higher threshold of gravity. And a state can bear responsibility for acts committed by non-state actors it directs or controls. For the underwriter, the manual does not settle a claim, since a policy is read under its governing law, but it supplies the vocabulary in which cyber war exclusions were conceived and in which courts will be invited to read them.
NotPetya, in 2017, was attributed to Russian military intelligence and caused damage estimated at ten billion dollars, yet no state characterized it as an armed attack in the manual's sense. That gap between a destructive state operation and war in the legal sense is exactly what allowed Merck to obtain from the New Jersey appellate court in 2023 a ruling that the hostile acts exclusion in its property policy did not apply.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.