卡内基国际和平基金会-War-Terrorism-and-Catastrophe-in-Cyber-Insurance-Understanding-and-Reforming-Exclusions_72页_1mb

Summary of "War, Terrorism, and Catastrophe in Cyber Insurance: Understanding and Reforming Exclusions"

Core Content

This paper examines the challenges and potential reforms in the treatment of state-sponsored cyber incidents and catastrophic cyber risks within cyber insurance policies. It highlights the uncertainty and ambiguity surrounding current exclusions, particularly war exclusions, and argues for a more nuanced and functional approach to risk classification and coverage.

Main Points

1. Cyber Insurance and Its Societal Role

• Cyber insurance is a promising tool to address global cyber insecurity.
• It can incentivize better cyber hygiene and reduce cyber risk for society.
• It is not just a financial instrument but also a key mechanism for managing risk in economies and societies.
• A mature and competitive cyber insurance market is considered critical infrastructure.

2. The NotPetya Challenge

• NotPetya (2017) was a massive, state-sponsored cyber attack that caused $10 billion in losses.
• It exposed the unpredictability and scale of cyber risks and the aggregation risk—the risk that a single event could trigger many claims.
• Most losses were uninsured, but the $3 billion in insured losses was still a significant financial burden.
• The attack highlighted the need for better risk assessment and coverage models.

3. War and Terrorism Exclusions in Cyber Insurance

• War exclusions are long-standing clauses in insurance, typically excluding coverage for state actions during peace or war.
• These exclusions are inapplicable to cyber incidents, yet they were used to exclude NotPetya claims.
• The ambiguity of these exclusions raises concerns about fairness, predictability, and market stability.
• Terrorism exclusions also pose similar challenges, though they are less frequently invoked.

4. Challenges with Current Exclusions

• Attribution of cyber incidents is complex and often contested.
• War exclusions are overinclusive and underinclusive, creating legal and financial uncertainty.
• The language of exclusions is often too broad and not tailored to cyber risks.
• Silent cyber—where policies do not explicitly address cyber risks—can expose insurers to unintended liabilities.

5. Proposed Reforms

• Abandon traditional war and terrorism exclusions for cyber claims.
• Introduce a new "cyber catastrophe" exclusion that covers extreme scenarios based on impact, not just perpetrator or geopolitical context.
• Design a narrower "war" exclusion that specifically addresses kinetic war and geopolitical retaliation.
• Use scenario analysis to test and refine exclusion frameworks.
• Government backstops may be necessary to support the market, especially for large-scale, state-sponsored cyber risks.

6. Need for Stakeholder Engagement

• The interdisciplinary nature of the issue requires input from insurers, insureds, and policymakers.
• Industry-led reforms should be grounded in realities of cyber operations and global security trends.
• Public dialogue and transparent frameworks are essential to build trust and clarity.

Key Information

• NotPetya was attributed to Russian military intelligence and caused widespread damage.
• Silent cyber refers to cyber risks not explicitly covered or excluded in traditional policies.
• Aggregation risk is a major concern for insurers, as it can lead to massive financial exposure.
• The coronavirus pandemic illustrates the importance of government financial frameworks in managing catastrophic risks.
• The paper presents eight scenarios to clarify the intent and functionality of proposed exclusions.

Conclusion

To fulfill the potential of cyber insurance, the industry and policymakers must reform current exclusions and develop new frameworks that are clear, practical, and aligned with the nature of cyber risks. The war exclusion is inappropriate and ambiguous, and a cyber catastrophe exclusion could better address large-scale, non-state-sponsored cyber incidents. Scenario analysis and government support are essential for testing and implementing these reforms.