War exclusion clause (NMA 464, LMA cyber war)
Removes war, civil war and hostile acts from cover: the NMA 464 wording of 1938, the Merck NotPetya ruling, and the LMA cyber war clauses.
Excludes loss or damage directly or indirectly occasioned by war, invasion, acts of foreign enemies, hostilities (whether war be declared or not), civil war, rebellion, revolution, insurrection, military or usurped power, or confiscation, nationalization, requisition, destruction of or damage to property by or under the order of any government or public or local authority.
The war exclusion is one of the oldest exclusion clauses in the insurance market. It originates in the need for insurers not to assume a potentially unlimited and unmeasurable risk linked to armed conflicts between states. In its traditional form (NMA 464 of 1938, then NMA 2918; Institute War Clauses in marine), it excludes losses caused by war, civil war, revolution, rebellion, insurrection or hostilities between sovereign powers. NMA 464 also excludes confiscation, nationalization and requisition by order of a government. That is exactly what a political risk policy exists to cover. The same clause takes out of an ordinary policy what a specialist policy sells, and it is through this clause that political risk enters a contract that never names it. Faced with cyber, the traditional war exclusion revealed its limits. In Merck v. ACE American, the New Jersey appellate court held in 2023 that the hostile or warlike action exclusion in Merck's property policy did not apply to the damage caused by NotPetya. The clause was drafted without any reference to cyber, and this state-backed cyberattack did not amount to war in the traditional sense. The London market had not waited for that ruling. The Lloyd's Market Association had published cyber-specific clauses as early as November 2021 (LMA 5564 to 5567), replaced in January 2023 by an A and a B version of each. Lloyd's, through Market Bulletin Y5381 of August 2022, required its syndicates to carry such an exclusion in every standalone cyber policy from March 31, 2023. The A versions meet that requirement. These clauses distinguish war, defined by the use of physical force, from a cyber operation, defined by the use of a computer system by or on behalf of a state. The exclusion can thus be applied more precisely in a hybrid conflict. Their central difficulty is attribution: establishing that a cyberattack emanates from a state or acts on its behalf is technically hard and politically sensitive, yet it decides whether the exclusion applies. For the insured, a broadly drafted war exclusion can hollow out cyber cover precisely against the most serious attacks. Not to be confused with the cyber operation exclusion. The war exclusion targets war and physical force, the cyber operation exclusion the use of a computer system by a state, and clauses LMA 5564 to 5567 handle them in two separate definitions. Where the word appears: in the general exclusions of the wording, for instance under endorsement NMA 2918 (War and Terrorism Exclusion Endorsement) in property, and at the head of the exclusions of a standalone cyber policy since bulletin Y5381.
In Merck v. ACE American (2023), the New Jersey appellate court affirmed that the hostile or warlike action exclusion in Merck's all-risk property policy did not apply to NotPetya. Its wording was aimed at traditional forms of warfare. The insurers settled in early 2024, before the state Supreme Court ruled, on a claim of about USD 1.4 billion. The Mondelez v. Zurich case, for its part, settled in 2022 without a judgment on the merits.
- NMA 464, War and Civil War Exclusion Clause, 1938
- LMA, bulletin LMA21-042-PD, 25 November 2021
- Merck & Co. v. ACE American Insurance Co., New Jersey Appellate Division, 1 May 2023
The wording of each of these clauses, with its variants, can be read and compared in the LMA comparator.
NMA 464, nma464
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.