War, Terrorism, and Hactivism Under Cyber Insurance Policies
Cyberspace is the world’s most dynamic domain, and cyber insurance is the industry’s most dynamic product. So far, insurance has focused on losses from data breaches and network disruption. But as hackers move from information technology to operational technology, some insurers are starting to provide coverage for losses from cyber exploits resulting in bodily injury and property damage. All of these exposures can arise through activities by the full range of actors – from lone wolf teenage joyriders through highly organized national military units.
Most cyber insurance policies contain broad war exclusions. Some are silent on terrorism, others contain terrorism exclusions, and only a few affirmatively grant terrorism coverage. Most often, hactivism is not addressed directly.
The application of war and terrorism exclusions and grants will depend on several factors. The first is the policy language, which will be construed in part by reference to existing case law. The second is the nature and effect of the exploit. Is it an act of war, terrorism, hactivism, or something else? The third is the nature of the actor. Is it a nation state, an organized non- state entity, a loose collective, or an individual? What is its relationship with a nation state? What is its purpose and intent? Blurred lines will create challenging issues.