TOTAL EXCLUSIONS IN LIMITED WAR

Will 21st century conflict call for 18th century insurance practices?

By Joseph S. Harrington, CPCU

Any Ukrainian currently suffering hardship or exile under Russian bombardment will justifiably recoil at any suggestion that the invasion of their country is a “limited” war. But, to the frustration of President Zelenskyy and his countrymen, that’s what the United States and its NATO allies are trying to establish and maintain.

Despite condemning the invasion and providing military equipment to Ukraine, as of late March no nation other than Ukraine itself (and the Federated States of Micronesia!) had broken diplomatic relations with Russia. Despite widespread economic sanctions imposed on Russia, there is still some commerce between that country and the West, for which existing insurance is presumably still in force for non-sanctioned individuals, organizations, and activities.

This situation is not new, but a return to behavior that existed for centuries.

It may surprise many risk and insurance professionals to learn that, in the second half of the 18th  century, there was a vigorous debate among members of Parliament and underwriters at Lloyd’s whether it was appropriate for British marine insurers to cover cargoes of enemy ships subject to seizure by the Royal Navy.

In the face of protests against dealing with the enemy, there were those in Parliament and among marine insurers who argued that, on balance, collecting premium from enemy shippers actually benefitted Great Britain at the expense of its enemies. That attitude changed during the prolonged wars of the French Revolution and Napoleon, when direct dealings with enemies were prohibited, but indirect commerce with them remained vital to maintaining the supremacy of the London marine market.

Today’s “war risk” and “war and military action” exclusions are relatively new, dating from the late 19th century, when armored warships, torpedoes, mines, and their land-based equivalents brought unprecedented destructive power to bear on the vast amount of constructed and manufactured property produced by industrialization.

Total war; total exclusions

The war exclusions commonly used today reflect 20th century conditions of “total war,” when belligerents sought to cut all ties with their enemies and subordinate all political and economic objectives to military victory. From this developed the widely held idea that private, voluntary insurance could not cover the vast damage caused by military forces systematically wreaking destruction.

Consider the language of the “War and Military Action” exclusion included in commercial property and liability coverage forms provided by the Insurance Services Office:

The added emphasis on the word “or” underscores how broadly the exclusion applies; it applies whenever any of the triggering conditions is present. (As examples, see exclusion f. of CP 10 20 1012, Causes of Loss – Broad Form and CP 10 30 10 12, Causes of Loss – Special Form, and exclusion i. of CG 00 01 04 13.)

American insurers are unlikely to have significant exposure to war damage within Ukraine, which would probably be subject to an ISO-like war exclusion if insured under a policy written in the United States. The largest affected exposure would probably be for business interruption losses in the food sector, should hostilities cause damage that cuts off Ukraine’s substantial grain exports.

Today, attention is focused on the implications of war exclusions in cyber insurance policies.

Public and private sector organizations in Europe and the the U.S. are bracing for a wave of cyberattacks by entities or individuals supporting the Russian war effort in Ukraine. If and when these attacks come, they will be undertaken concurrently with an armed conflict, probably with an announcement that they are being launched directly in response to Western actions responding to the Russian invasion.

Hostile, yes; but warlike?

So, how would the war in Ukraine make these prospective cyberattacks different from previous attacks by Russian state actors? In the most commented-upon case, a New Jersey court found coverage for losses arising from the notPetya attack traced to the Russian military, despite the presence of a cyber exclusion barring coverage for:

• “loss or damage caused by hostile or warlike action in time of peace or war”
• by any government or authority “maintaining or using” armed forces or
• by “an agent of such government, power, authority or forces.” (Emphases added)

In short, even an exclusion written to apply to hostile acts in peacetime by anyone connected to a government or its military establishment was not deemed adequate to prohibit coverage.

But why should it, necessarily? Since virtually all cyber losses are the result of hostile acts and each insurer’s exposure is capped by policy limits, why should it matter where the attackers are housed, who they are connected to, or the geopolitical context in which they operate?

Does the existence of a war indicate an exponential increase in cyber exposure, the way it does for physical damage? Some experts have observed an increase in the number of cyberattacks since Russia invaded Ukraine, although the source of the attacks is not entirely determined.

In a war, a sanctioned country may have incentive to disrupt another country’s commerce without regard to the effect on itself. But there would be countervailing effects as well, including a reduction in the volume of Internet exchanges and a heightened state of alert among potential targets.

Cyber sabotage

Considerations like these have come up before regarding terrorism insurance.

Cyber insurance is now included under the federal Terrorism Risk Insurance Program (TRIP), which provides liquidity to insurers to cover high levels of loss from terrorist attacks. TRIP makes it possible for insurers to maintain coverage they already have in place (such as for fire, explosion, and related liability) for losses caused by terrorist attacks. Without government support, insurers believe they could not cover terrorism losses inflicted by willful actors who strategically select their targets.

Are cyberattacks acts of “terrorism” akin to the bombing of a restaurant or hijacking of an airliner? Or are they better characterized as “sabotage,” severely disruptive but not inherently terrifying?

That semantic distinction takes on practical significance, as TRIP coverage is triggered only if certain officials certify that an event was a terrorist attack, a determination based in part on the motivations of those perpetrating the attack. It’s hard to determine the real motives of attackers who have killed themselves in the process or who operate anonymously in cyberspace.

Just as TRIP coverage relies on a legal-political determination, the application of war exclusions relies on understandings of what constitutes a war, something that will be increasingly hard to determine if countries elect to carry on “peacetime” activities under “warlike” conditions.

Eighteenth-century underwriters could select and price risks on the basis of their size and likelihood of loss, largely unrestricted by governments that generally pursued defined, limited objectives in war. In light of that experience, are absolute war exclusions useful and necessary at a time when we have to accept conflict while avoiding World War III?

Put differently, shouldn’t risk be retained or transferred on the basis of its scope and scale, which can be measured and limited, rather than on subjective consideration of motivations and political conditions?

The author

Joseph S. Harrington, CPCU, is an independent business writer specializing in property and casualty insurance coverages and operations. For 21 years, Joe was the communications director for the American Association of Insurance Services (AAIS), a P-C advisory organization. Prior to that, Joe worked in journalism and as a reporter and editor in financial services.