Pre-positioning in critical infrastructure
A silent, long-lasting intrusion by one state into another's vital infrastructure networks, not to steal but to be able to sabotage on the day of a conflict, turning a latent risk into a war exposure.
Pre-positioning refers to the concealed presence, installed in advance and maintained for years, of a state actor inside the information systems of another state's critical infrastructure: energy, water, transport, telecommunications. Its aim is neither espionage nor extortion, but the capability to disrupt or destroy at a chosen moment, typically at the outbreak of a military crisis. The technique favors legitimate tools already present on the systems, so as to leave no malware trace. For insurance, pre-positioning changes the nature of the risk in three ways. The triggering event precedes the loss by several years, which raises questions for claims-made covers and retroactive dates. The loss, if it occurs, will coincide with a conflict, which places the exposure under war and infrastructure exclusions rather than under ordinary cyber cover. And accumulation is maximal, since pre-positioning targets precisely the services on which every other insured depends.
On February 7, 2024, US cybersecurity, intelligence and law enforcement agencies issued a joint advisory establishing that the Chinese state group Volt Typhoon had pre-positioned itself in communications, energy, transport and water networks in the United States and Guam, with access maintained for at least five years in some cases.
- CISA, NSA, FBI, advisory AA24-038A on Volt Typhoon, 7 February 2024
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.