Terrorism Risk Insurance Act (TRIA)

In September 2014, seventeen months after the Boston Marathon bombings of April 15, 2013, the Treasury still had not certified the attack as an "act of terrorism" under TRIA: without certification, the act does not respond. The Terrorism Risk Insurance Act (TRIA) is a US federal law enacted in November 2002 in response to the mass withdrawal of terrorism coverage by private insurers following the September 11, 2001 attacks. The mechanism rests on loss-sharing between the private sector and the federal government. Insurers must offer terrorism coverage and bear an initial deductible calculated as a percentage of their prior-year commercial insurance premiums. Beyond this deductible, the federal government reimburses 80% of losses up to an annual aggregate cap of $100 billion. The Treasury then recoups all or part of its outlay through a post-loss surcharge on the premiums of covered policies, on terms set by statute. TRIA has been renewed and amended several times, most recently through 2027. It covers attacks certified as acts of terrorism by the Secretary of the Treasury, in consultation with the Secretary of Homeland Security and the Attorney General. In the debate on the insurability of systemic cyber risk, TRIA is regularly cited as a reference model for a possible federal cyber backstop, given the parallels between the impossibility of diversifying terrorism risk and the impossibility of diversifying cyber accumulation risk.