EU cyber sanctions regime
A restrictive measures regime created in 2019 that allows the Union to freeze the assets of cyberattack perpetrators and ban them from its territory, turning an attacker into a person to whom nothing may be paid.
The European Union's cyber sanctions regime rests on Council Decision (CFSP) 2019/797 and Regulation (EU) 2019/796 of May 17, 2019. It allows the listing of persons and entities responsible for cyberattacks, or attempted ones, with a significant effect that constitute a threat to the Union or its member states, as well as those who support them. Listing entails freezing their funds and economic resources, a prohibition on making funds available to them, and a ban on entering Union territory. For insurance, the consequence is immediate and severe. Paying a ransom, or reimbursing an insured who paid one, to a group one of whose members is listed amounts to making funds available to a listed person, which no contract clause can authorize. The regime therefore turns a political decision of the Union into a coverage limit, and does so on a date neither insurer nor insured controls. It is the European extension of the US logic that OFAC applies to ransom payments.
The regime was first used on July 30, 2020: six persons and three entities were listed for WannaCry, NotPetya, the Cloud Hopper espionage operation and the attempted hacking of the Organization for the Prohibition of Chemical Weapons, among them a Russian military intelligence unit and a North Korean front company.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.