Bystander cyber asset (LMA cyber war clauses)
A computer system located outside a state impacted by a state cyber operation, which the LMA 5567 clauses bring back into cover while the same attack remains excluded elsewhere.
A cyber operation attributed to a state rarely stops at one border: the same destructive malware also reaches companies on the other side of the world. The LMA cyber war clauses exclude operations that have a major detrimental impact on an impacted state, but the broadest version, LMA 5567, restores cover for systems of the insured or its providers located outside that state. The test is therefore no longer who launched the attack but where the affected machine physically sits. This solves the problem of the collateral victim, which used to lose all cover because of a conflict that was not aimed at it. It creates another: locating a machine in a cloud spread across several countries is not always possible, and proof becomes an issue in the claim.
In the NotPetya attack of June 27, 2017, launched against Ukraine and attributed to the Russian military in February 2018 by the United Kingdom and the United States, companies in Europe and America lost thousands of workstations. Under an LMA 5567 clause, those systems outside Ukraine would be bystander cyber assets, brought back into cover, while those of a Ukrainian subsidiary would remain excluded.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.