Insurance exclusions wording is often unnoticed but it grabbed unusual attention in Nov. 2021 when Lloyd’s of London applied the arcane legal terms of insurance contracts to a set of conditions to insure ‘cyber war’ and nation state cyber operations. Regrettably, much of the commentary by cyber security and technology policy experts suggested that the clauses had been interpreted as a legalistic trick for insurers to avoid paying claims. Instead, these clauses represent an important development that should remove one of the major impediments to the growth of cyber insurance. They also provide insights that should be of interest beyond the insurance sector; in crafting the exclusions, insurers have applied a business perspective to some of the strategic themes in the governance of cyberspace, such as attribution of state operations, the balance of responsibility between the public and private sectors in generating resilience and norms of state conduct.
The impetus came from longstanding recognition that existing exclusions for war are inadequate to capture nation-state activity in cyberspace, coupled with scrutiny from regulators and the warning provided by litigation over…
