Insurance definitions of cyber war

Abstract

Definitions of war found in cyber insurance policies provide a novel window into the concept of cyber war. Mediated by market forces, changes in policy wording reflect shifting expectations surrounding technology and military strategy. Legal cases contesting war clauses probe state-formulated narratives around war and offensive cyber operations. In a recent legal case, an insurer refused to pay a property insurance claim by arguing the cause of the claim—the NotPetya cyberattack—constitutes a hostile or warlike action. To understand the implications, we build a corpus of 56 cyber insurance policies. Longitudinal analysis reveals some specialist cyber insurance providers introduced policies without war clauses until as late as 2012. Recent years have seen war exclusions weakened as cyber insurance policies affirmatively cover “cyber terrorism”. However, these clauses provide few explicit definitions, rather they prompt a legal discourse in which evidence is presented and subjected to formal reasoning. Going forward, war clauses will evolve so insurers can better quantify and control the costs resulting from offensive cyber operations. This pushes insurers to affirmatively describe the circumstances in which cyber conflict is uninsurable.