A Comparative Report on War Exclusions and Cyber Attacks

War Exclusions in the Digital Era

Comparative Review – AIDA World

Prof. Sara Landini and Adv. Peggy Sharon

June, 2022

Wars have always been regarded as large-scale events, with an unpredictable catastrophic impact, leading to aggregation of many losses. In view of this, losses caused by wars have been difficult for insurers to manage and were excluded from insurance coverage. 

The term War as used in most of the War Exclusions in Property and Casualty policies, appears in a broad language and encompasses war, hostilities, warlike operations, etc,1 and usually is characterized as being driven by a State2. In addition, the measures of war, e.g use of weapons or military/physical means are not mentioned as a required element3. Moreover, the losses which are excluded are not only those directly caused by war, but rather losses "directly or indirectly arising" therefrom, or " in connection with war " which gives the exclusion a broader scope and reach 4 . 

The "stand alone" Cyber Insurance, aimed at responding to the escalating ransomware attacks, also excludes war from coverage, and similarly, the exclusion is worded in broad terms, including terms such as "invasion" and "hostilities " 5 .

Against this background, the recent judgment in the Merck v. ACE American Insurance Co6, has led to a general interest in War Exclusions in insurance contracts, especially in view of the increasing cyber incidents, and the attribution of some of them to State authorities using the cyber- attacks against their enemies. 

The Merck case was submitted to the Court in a period of time where attacks perpetrated by States took the form of cyber attacks aimed at harming the infrastructure of another State thus causing it destruction by digital means of cyber- attacks, hence the issue dealt with by the New Jersey Court was whether the wording of the exclusion encompasses digital war. 

Merck's computer system was attacked by the NotPetya malware, allegedly by Russia, leading to a damage of over $1.4 Billion. Its insurance claim for coverage under an "All-Risk" Property Policy, issued by Ace American, was declined by the insurer, based on the policy war exclusion relating to "Hostile and Warlike Action".  

Merck argued that the Exclusion did not specifically exclude cyber-related events. 

In January 2022, the New Jersey Supreme Court ruled in favor of Merck's claim. 

The Court applied a strict interpretation of the Exclusion and determined that it did not apply. Despite being aware of cyber-attacks that may be "Acts of War", Ace American did not adapt the language of its Exclusion to this possibility.  In addition, Merck had the "right to anticipate that the Exclusion applied only to traditional forms of warfare".   

This judgment raises some crucial questions re the scope of coverage of the regular Property or the Cyber Insurance policies to cyber-attacks attributed to states. Such attacks, if launched as a destructive tool may cause the catastrophic unpredictable losses or damage to lives and property which the "traditional" war exclusion was meant to exclude from coverage.

 It surely depends on the exact language of the exclusion in each case but still, the common wording in the majority of the policies is broad and relates to "invasion" or "hostilities" which well fit the cyber- attacks. In addition, the interpretation of the exclusion, albeit narrow when the wording is ambiguous, raises questions the weight which should be given to the insured's expectations vis a vis the broad language of the exclusion. 

In view of the general interest and the questions raised concerning the applicability of the war exclusion to state driven cyber- attacks, we decided to elaborate on the topic from the perspectives of the various jurisdictions being members of AIDA World.

As a basis for future debate and analysis, we have posed the following questions: 

What is the usual wording of the "War Exclusion" in Property policies, which is common in your jurisdiction?

Are "War Exclusion" included in Cyber policies in your jurisdiction? If so, what is the wording of these Exclusions?

We will start with the answers from the USA, being the jurisdiction of the Merck judgment, and detail the other answers in alphabetical order.

 

USA7

These exclusions were originally meant to apply to actions by nations or their agents that produce physical results similar to war. They have now come to apply to much more than traditional conflicts by or between sovereign nations.  There are countless variations in title, language, and the scope of coverage used by different insurers, and in different lines of business.

One commonly used form appears in many all-risk property policies that might be implicated in cyber losses.  It provides in relevant part as follows:

Hostile/Warlike Action Exclusion

1) Loss or damage caused by hostile or warlike action in time of peace or war, including action in hindering, combatting, or defending against an actual, impending, or expected attack:

a) by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval or air forces;

b) or by military, naval, or air forces;

c) or by an agent of such government, power, authority or forces.

 

It is highly likely that a cyberattack would be construed as "hostilities", "war" or "warlike operation", when it has kinetic effects i.e it has the same effects as bullets and combs, hurting people and breaking things.      

There is only a single decision addressing the application of any war Exclusion to cyberattacks.  But the issue was sharply focused by the NotPetya cyberattack by Russia on Ukraine in 2017.

The NotPetya cyberattack was attributed to the Russian military by the United States, United Kingdom, Australia, Canada, New Zealand, Denmark, Finland, Latvia, and Sweden.  In the attack, Russia sent malware to at least several dozen Ukrainian companies.  It was disguised as ransomware, similar at first view to an earlier ransomware attack called Petya.  But the new strain was really “wiperware”.  That is, it automatically encrypted the victim’s data, permanently and inalterably.  It was designed to spread to other networks automatically, rapidly, and indiscriminately. NotPetya infected the computer systems of a many non-governmental commercial entities worldwide, causing estimated losses of $10 billion.

Mondelez International and Merck, Inc. were among the companies effected.  They presented claims to their traditional property insurers seeking indemnity for their first party losses, including business interruption loss and extra expense.

Modelez Int’l, Inc. v. Zurich Am. Ins. Co8

Mondelez is an American confectionary food and beverage company.  It presented a claim against Zurich American Insurance Company asserted it suffered over $100m in damages because of the loss of 1,700 servers and 24,000 laptops. Its Insurer has denied coverage because the policy contained the hostile/warlike action exclusion.  

Mondelez argued that the Exclusion was not intended to apply to damage to intangible property, but, rather, was limited to physical war. Mondelez also asserted that its loss was purely economic and did not involve loss of life or injury. According to Mondelez; “the chaos caused by NotPetya bore greater resemblance to a propaganda effort rather than a military action.

The case is still pending in State Court in Illinois. 

The only reported decision on the application of a War Exclusion to a cyberattack to date is Merck & Co., Inc. v. ACE Am. Ins. Co., et al. The pharmaceutical giant Merck suffered a widespread systemic failure caused by NotPetya.  Operations were halted for two weeks, and Merck asserts it suffered more than $1.4 billion in damages.  It had nearly three dozen insurers on all-risk property policies.  The policies provided coverage for loss or damage resulting from the destruction or corruption of computer data and software.  The insurers rejected Merck’s claims based on the policies’ Hostile/Warlike Action Exclusions.

On January 13, 2022, the lowest-level state court in New Jersey rendered its decision.  It said it was interpreting the words of the Hostile/Warlike Actions Exclusion by their “ordinary meaning.”  It said that the term “warlike” could only be interpreted as “like war.”   This is consistent with the definition in the Oxford English Dictionary, which also defines “hostile” as “of, pertaining to, or characteristic of an enemy, pertaining to or engaged in actual hostilities.”  Merck argued this meant that the Exclusion only applied when armed forces engaged in traditional warfare.  The Court agreed.  It cited to a few old cases, and said that “no court has applied a war (or hostile acts) exclusion to anything remotely close to the facts herein.”  Based on this logic, it held “Merck had every right to anticipate that the exclusion only applied to traditional forms of warfare.”  Thus, it held the Exclusion did not apply.

This case has been appealed, with no further decision as of Spring 2022.

 

Australia9

"For Cyber insurance policies the exclusion is generally along these lines  ...any loss or damage based upon ,directly or indirectly arising from or attributable to..- war , invasion , acts of foreign  enemies , civil or military uprising , hostilities ( even if war is not declared ) or government power being taken unlawfully , or property being taken , damaged or destroyed by government or public or local authority " .

There is also an exclusion for consequences of any act of terrorism or any action to control terrorism.

These exclusions are basically applicable to policies sold in the market here " In Australia property policies on all classes contain a similar War exclusion "" we will not cover any loss, damage or liability as a result of ... -war or warlike activity. War does not have to be declared.

Also, there is an exclusion for loss or damage caused by or attributable to hostilities, rebellion, insurrection or revolution."

 

Austria10

"The Austrian recommendations for Cyber Insurance read as follows:

Exclusions from coverage (…)

Damages (…) due to war of any kind (with or without declaration of war), including acts of violence of political organizations and all related military as well as administrative measures.

(…)

Damages due to civil unrest, civil war, revolution, rebellion, riot, insurrection and all related military as well as administrative measures."

In principle, the Austrian clauses are similar to the German wording. However, there are specific Austrian recommendations regarding Cyber Insurance issued by the Austrian Association of Insurance Companies. However, Manfred already pointed out that the market often deviates from such recommendations. The same is of course true for Austria.

 

Belgium11

1. There exists under Belgian insurance law a general exclusion of war which applies, unless otherwise provided in the insurance contract.

- Article 63 of the Act of 4 April 2014 regarding insurance (copy paste of article 9 of the Insurance Act of 25 June 1992) applies to so-called “land insurance contracts” and states:

French official version: « Sauf convention contraire, l'assureur ne répond pas des sinistres causés par la guerre ou par des faits de même nature et par la guerre civile.

L'assureur doit faire la preuve du fait qui l'exonère de sa garantie.

Le Roi peut toutefois fixer des règles allégeant la charge de la preuve du fait qui exonère l'assureur de sa garantie. »

Dutch official version: “Tenzij anders is bedongen, dekt de verzekeraar geen schade veroorzaakt door oorlog of gelijkaardige feiten en door burgeroorlog.

De verzekeraar moet het bewijs leveren van het feit dat hem van het verlenen van dekking bevrijdt.

De Koning kan echter regels vaststellen die de bewijslast van het feit dat de verzekeraar bevrijdt van het verlenen van dekking verlichten.”

(English unofficial translation) “Unless stipulated otherwise, the insurer shall not cover loss caused by war or similar events and by civil war.

The insurer must provide proof of the fact releasing it from the obligation to provide cover.

However, the King may adopt rules easing the burden of proof of the fact releasing the insurer from the provision of cover."

The King has not adopted those rules, so far. 

- Article 243 of the Act of 4 April 2014 regarding insurance (copy paste of Article 19 of the Insurance Act of 1874) applies to reinsurance, maritime insurance, transport insurance and aviation insurance and states: “War risk and loss or damage caused by riots are not insured unless the contrary has been stipulated.”

2.  For some insurance classes, specific rules exist imposing cover for war risks, such as for workers compensation insurance which according to Belgian law is managed by private insurance companies based on insurance contracts but is actually part of the national social security system. The Act of 10 April 1971 states: “The insurance undertaking shall compensate the damage resulting from accidents at work due to the action of explosive, inflammable, corrosive or poisonous substances, during the loading, unloading or handling of war equipment, or due to explosions caused by the mere presence of such equipment.”

3. Only very few cases are published and those require in general a direct causal link. 

4. A specific Act of 1 April 2007 on insurance against damage caused by terrorism. 

Cyberterrorism meeting the requirements of the definition, can fall under the scope of this regulation insofar as the insurance contract covers compensation for damage caused by terrorism and this insurance contract falls under the scope of the Act.

Terrorism is understood to mean "a clandestinely organised action or threat of action with ideological, political, ethnic or religious intent, carried out individually or by a group, in which violence is perpetrated against persons or in which the economic value of a tangible or intangible asset is partially or totally destroyed, either to impress the public, to create a climate of insecurity or to put pressure on the authorities, or to obstruct the movement or normal operation of a service or enterprise (article 2)."

Are "War Exclusion" included in Cyber policies in your jurisdiction? If so, what is the wording of these Exclusions?

The war exclusion is included in the Cyber policies, although the wording can differ.

For example:

“Strikes or similar actions, war, invasion, an act of a foreign enemy, hostilities or acts of war (whether declared or undeclared), civil war, insurrection, internal disturbances of the proportions of a proportion of a popular uprising, military intervention, insurrection, rebellion, revolution, military or unlawfully obtained power, terrorism and riots, or any measures taken to impede or defend against such or defence against such actions. This exclusion does not apply to actual, alleged or threatened cyberterrorism.”

“Willful damage in connection with, arising out of or as a consequence of armed conflict, civil war, insurrection  civil commotion, riot and mutiny.”

“Any war, invasion, act of a foreign enemy, military operation (with or without a

declaration of war), civil war, rebellion, revolution, insurrection or popular movement, military

intervention, usurpation of power or imposition of martial law”

“War and acts of violence This includes war or similar events, civil wars, attacks, civil or political disturbances, industrial disputes, strikes and lock-outs, riots and acts of collective violence.”

“Armed conflict, civil war, insurrection, internal disturbances, rioting and mutiny.”

What is the usual wording of the "War Exclusion" in Property policies, which is common in your jurisdiction? 

- The war exclusion is included in the fire insurance, although the wording can differ. 

For example:

“Acts of collective violence

War, civil war, military acts of violence with collective motive, requisition or occupation”

“damage caused by war or similar events and by civil war”

The war exclusion is included in the omnium car insurance, although the wording can differ. 

For example:

“Damages due to acts of war, strikes, lock-out or confiscation by a legal authority.”

“Damage caused by war or by acts of the same nature”

“damage occurring in a war zone”

 

Brazil12

The Brazilian Chapter of AIDA collected the answers from its different study groups.

Reinsurance Group:

War Exclusion is common. Considering that cyber insurance is a relatively new product in Brazil in comparison with other jurisdictions, most of (if not all) the cyber insurance policies of the local market are based on foreign products, especially the ones of the London market. As a result, cyber insurance policies usually provide for the same war exclusion wording, which reads as follows:

They are excluded from coverage the risks, losses or claims:

Directly or indirectly arising from terrorism, war, invasion, acts of foreign enemies, hostilities or warlike actions (whether declared or not), riots, revolution, rebellion, insurrection, insurgency, usurpation of power or confiscation by order of any public authority, de facto or legitimate government or martial law, which is understood as the system of laws that takes effect when a military authority takes control of the ordinary administration of justice.

Financial Lines Group:

The war exclusion is included in the cyber policies in Brazil. The exclusion adopts the traditional war exclusion wording. For example, AIG cyber policy states the following:

“The Insurer shall not be liable for any payment based on any Warranty and Extension or related to any Claim resulting from, based on or attributable to damage arising from acts of hostility or war, riots, strikes, rebellion, insurrection, revolution, terrorism, confiscation, nationalization, destruction or requisition arising from any act of civil or military authority and similar events.”

"Reinsurance Group:

Property policies usually reflect the war exclusion provided for in the policies of insurer´s global programs and/or reinsurance contracts, which are very broad as per the free translation below:

“Acts of hostility or war, rebellion, insurrection, revolution, confiscation, nationalization, destruction or requisition arising from any act of de facto or the jure authority, civil or military, and in general, any or all acts or consequences of such occurrences; acts committed by any person acting on the part of, or in connection with, any organization whose activities to overthrow the government by force or to instigate its fall, by the disturbance of the political and social order of the country, through acts of terrorism, revolutionary wars, subversion and guerrillas and any other disturbances of public order; situations where the intervention of the Armed Forces is necessary for any reason; warlike operations, war, civil war, chemical and/or bacteriological warfare, piracy, riots, conspiracy, political demonstrations, and in general, any and all consequences of such events, including vandalism, looting and plunder;”

Liability Group:

The wording of exclusions for acts of war is standard.

 

Finland13

 

Insurance Companies sell special Cyber Insurances for enterprises against cyber damages.

In the Finnish legal system, there is no general ruling for exclusion for war damages. Insurance Companies have their own terms and conditions, by which all damages caused by war can be excluded.

 

France14

 

Insurance contracts: cyber risks - 

a) No cyber coverage - The insurer is not liable

b) Cyber coverage  - 

- nothing about « war » : if the cyber risk is linked to a war, legal exclusion applies

- if there is a clause providing that risk of war is covered, cyber loss linked to a war is covered.

Problem : definition of « war »

- no definition in French Law (of course, there is a war when it’s declared by the French Parliament… : no declaration since 1939)

- trends: a « war » is not only a « declared war ». See Geneva Conventions 1949, and Comments published in 2020: war is also an hostile action from a State against another one. Cyber- attack can be such an hostile action, thus a war cyber attack

Examples, without clear answers 

- NotPetya, June 2017, Russia; See Superior Court of New Jersey, 6 December 2021, Merck & Co. Inc., and International Indemnity Ltd v. Ace American Insurance Company, et al. : contractual exclusion of war does not apply - Sony Hack, November 2014, North Corea.

1) French Law

a) Property and liability insurances

Article L.121-8 French Insurance Code

The insurer shall not be liable for losses and damage caused either by a foreign war, civil war, riots or by civil commotion, unless otherwise agreed.

When such risks are not covered by the contract, the insured must prove that the loss has been caused by a act other than the foreign war. The insurer shall have the burden of proving that the loss has been caused by civil war, riots or civil commotion.

b) Marine insurance contract

Article L.172-16 French Insurance Code

Unless otherwise agreed, the insurer shall not cover the risks of:

a) civil or foreign war, mines and any engines of war,

b) piracy,

c) capture, seizure or holding by any governments or authorities whatsoever,

d) riots, civil commotion, strikes and lock out, acts of sabotage or terrorist attacks,

e) damage caused by the insured property to other property or persons, apart from that stated in Article L173-8,

f) losses attributable to the direct or indirect effects of explosion, emission of heat, irradiation from the transmutation of atom nucleii or radioactivity as well as losses attributable to the effects of radiation caused by artificial particle acceleration

Article L.172-17

When it is not possible to prove that the loss was caused by a risk of war or an event at sea, it shall be deemed to

have been caused by an event at sea.

c) Insurances of persons

(disability, death, etc.)

Nothing in French Law : 

- no specific exclusion of war in the insurance contract: war is covered

- most of insurance contracts: specific war exclusion

 

Germany15

"Cyber war clause

 Although the majority of market participants follow the GDV recommendations, there are nevertheless numerous deviations in detail

 General Insurance Conditions for Cyber Risk Insurance

(AVB Cyber)

Model conditions of the GDV

A1-17 General exclusions

The following are excluded from insurance cover, irrespective of contributory causes

 Part A Section A1 - Basic Module

12

A1-17.1 Pre-contractual information security breaches

Losses due to information security breaches occurring prior to the commencement of the insurance contract in accordance with A1-2.

A1-17.2 War

Insured events or losses due to war.

War means: war, invasion, civil war, insurrection, revolution, rebellion, military or other or other form of seizure of power.

A1-17.3 Political perils

Insured events or losses resulting from hostile acts, riots, civil commotions, general strikes riot, civil commotion, general strike, illegal strike.

A1-17.4 Acts of terrorism

Insured events or losses due to acts of terrorism.

Acts of terrorism are any actions aimed at achieving political, religious, ethnic or ideological or ideological objectives which are likely to spread fear or terror among the population or or sections of the population with a view to influencing a government or state institutions.

 "The general wording in damage insurance is (non-authorized translation), e.g. 

General conditions for the Fire Insurance

§ 2 Exclusions War, civil unrest and nuclear energy

1. exclusion war

The insurance does not cover, irrespective of contributory causes, damage caused by damage caused by war, warlike events, civil war, revolution, rebellion or uprising, rebellion or insurrection.

2. exclusion of internal unrest

Irrespective of contributing causes, the insurance does not cover damage caused by Damage caused by civil unrest.

 

Greece16

 

    The standard wording of Greek insurance policies largely coincides with and reflects the wording of the respective policies used worldwide without significant deviations as to the construction of the “War Exclusion”, since there is not a set of "standard policy conditions" issued from an official body (i.e., the Regulatory Authority on Insurance). The Greek Insurance Contract Act (ICA), i.e. L. 2496/1997, in its Chapter A' encompassing general provisions applicable to all indemnity insurances, provides for that "no insurance cover is to be provided if the occurrence of the insured risk results from war, rebellion or civil commotion" (art. 13 para 1). Nevertheless, the meaning of the aforementioned provision is that, in the absence of a contractual stipulation to the contrary, war risks are excluded from coverage; this does not prevent the parties to agree on coverage of war risks against payment of an adequate premium.

    1. Having that said, a rather typical wording of the “War exclusion” used in property policies, contained, inter alia, in the Property All Risks policies of two major Greek highways, reads as follows:     

    “Indemnity provided by this Policy shall not apply to nor include: Loss, destruction, damage or liability directly or indirectly occasioned by or happening through or in consequence of war, invasion, acts of foreign enemy, hostilities or warlike operations (whether war be declared or not), civil war, mutiny, civil commotion assuming the proportions of or amounting to a popular rising, military rising, insurrection, rebellion, revolution, military or usurped power or destruction or damage by order of the government de jure or de facto, or by any public authority”.

    2. As far as Cyber (Computer Crime) Policies are concerned, normally an exclusion of damages attributable to war, hostilities, warlike operations etc. is also incorporated in them. A typical example of the wording used thereto, sourced by an Electronic and Computer Crime Policy of a systemic Greek bank, is that of clause NMA2918, reading:

    “…This insurance excludes loss, damage, cost or expense of whatsoever nature directly or indirectly caused by, resulting from or in connection with any of the following regardless of any other cause or event contributing concurrently or in any other sequence to the loss;

    a) war, invasion, acts of foreign enemies, hostilities or warlike operations (whether war be declared or not), civil war, rebellion, revolution, insurrection, civil commotion assuming the proportions of or amounting to an uprising, military or usurped power; or

    b) any act of terrorism, [that is] an act, including but not limited to the use of force or violence and/or the threat thereof, of any person or group(s) of persons, whether acting alone or on behalf of or in connection with any organization(s) or government(s), committed for political, religious, ideological or similar purposes including the intention to influence any government and/or to put the public, or any section of the public, in fear.

    This endorsement also excludes loss, damage, cost or expense of whatsoever nature directly or indirectly caused by, resulting from or in connection with any action taken in controlling, preventing, suppressing or in any way relating to a and/or b above.

    If the Underwriters allege that by reason of this exclusion, any loss, damage, cost or expense is not covered by this insurance the burden of proving the contrary shall be upon the Assured.

    In the event any portion of this endorsement is found to be invalid or unenforceable, the remainder shall remain in full force and effect”.

 

Israel17

 

Property Insurance - War and Terrorism risks Exclusion 

Loss or damage of any kind to the Insured's property and/or loss arising therefrom, caused by and/or resulting from and/or related in any way, directly or indirectly, to one or more of the following events: 

war, invasion, foreign enemy action, hostilities or acts of war (whether declared or not), civil war, sabotage and terrorism, rebellion, military or popular uprising, rebellion, revolution, confiscation, military rule or rule that has been seized illegally, a military regime or a state of siege or events or factors that lead to the declaration or existence of a military regime or a state of siege.

"Terrorism" as aforesaid means - the use of violence for political purposes, including the use of violence for the purpose of intimidating the public or any part of it by a person or persons acting on behalf of or in connection with an organization hostile to the country.

 

Cyber Insurance - NMA464 WAR AND CIVIL WAR EXCLUSION CLAUSE

"Notwithstanding anything to the contrary contained herein this Certificate does not cover Loss or Damage directly or indirectly occasioned by, happening through or in consequence of war, invasion, acts of foreign enemies, hostilities (whether war be declared or not), civil war, rebellion, revolution, insurrection, military or usurped power or confiscation or nationalization or requisition or destruction of or damage to property by or under the order of any government or public or local authority. 

• The State through the Property Tax Authorities indemnifies for property damage caused by war or hostile actions perpetrated against Israel. Loss of profits is paid for business interruption to businesses close to the border. Bodily injuries caused by war or hostilities are indemnified by the National Insurance Institute.

  

Italy18

About Italy art. 1912 of Italian Civil Code contains an exclusion by law. It is not imperative. The Insurer can derogate and include war. Art. 1912 says "Unless otherwise agreed, the insurer is not obligated for damages determined by telluric movements, by war, by insurrection or by popular riots". The insurance contracts usually include the legal disposition contained in art. 1912. It is not clear if the cyber-attack could be considered “war” in case it is originated by a conflict between States.

Regarding the interpretation of the insurance contract, in Italy operates a rule, common to many countries: the so-called contra proferentem rule. In case of doubt, the contract must be interpreted to be contrary to the interest of the insurer. Not insurability technical sense of catastrophic risks, such as cyber risk, should be considered, i.e. the impossibility of operating through risk pooling and the need to use the reinsurance technique. The art. 1912 should represent a general rule for the exclusion of catastrophic risks. The list of events (war, riots, earthquakes, etc.) is only illustrative and not exhaustive.

 

Mexico19

"In the case of Cyber insurance policies, the wording of the exclusion clause generally goes as follows: 

“The company will not be liable for damages or expenses on account of any claim:” …”alleging, based upon, arising out of or attributable to war, invasion, acts of foreign enemies, terrorism, hostilities or warlike operations (whether war is declared or not), strike, lock-out, riot, civil war, rebellion, revolution, insurrection, civil commotion assuming the proportions of or amounting to an uprising, military or usurped power. However, this exclusion shall not apply to an act of cyber-terrorism arising from a claim.”

Property policies in Mexico generally contain a War exclusion clause with the following or similar wording: "The insurance will not cover any loss or damage caused directly or indirectly by:” …”War, invasion of a foreign enemy, hostilities or operations (whether war be declared or not), civil war, rebellion, revolution, insurrection, military power, suspension of guarantees or events that cause these situations by fact or law.”

 

New Zealand20

He indicates examples of war exclusion clauses:

1.Based upon, directly or indirectly arising from, or attributable to: (c) war, invasion, acts of foreign enemies, civil or military uprisings, hostilities (even if war is not declared), or government power being taken unlawfully; or property being taken, damaged or destroyed by a government or public or local authority

 Coverage is also provided by some cover-holders at Lloyd’s, who use LMA5564, 5565, 5566 or 5567 wordings as stipulated by Lloyd’s"

2.Notwithstanding any provision to the contrary within this insurance or any endorsement thereto it is agreed that this insurance excludes loss, damage, cost or expense of whatsoever nature directly or indirectly caused by, resulting from or in connection with any of the following regardless of any other cause or event contributing concurrently or in any other sequence to the loss; 1. war, invasion, acts of foreign enemies, hostilities or warlike operations (whether war be declared or not), civil war, rebellion, revolution, insurrection, civil commotion assuming the proportions of or amounting to an uprising, military or usurped power….. This endorsement also excludes loss, damage, cost or expense of whatsoever nature directly or indirectly caused by, resulting from or in connection with any action taken in controlling, preventing, suppressing or in any way relating to 1 and/or 2 above. If the Underwriters allege that by reason of this exclusion, any loss, damage, cost or expense is not covered by this insurance the burden of proving the contrary shall be upon the Assured. In the event any portion of this endorsement is found to be invalid or unenforceable, the remainder shall remain in full force and effect.

3.War, invasion, act of foreign enemy, hostilities or warlike operations (whether war is declared or not), civil war, civil commotion assuming the proportions of or amounting to a popular rising, military rising, mutiny, rebellion, revolution, insurrection, military or usurped power.

 

Peru21

Property Insurance 

Article 5. Exclusions

This Policy does not cover damage or destruction which, in its origin or extent, is caused directly or indirectly by, or arises or results from:

War, armed conflict, invasion, act of a foreign enemy, hostilities or operations of war, whether war has been declared or not; civil war, uprising, insurgency, insubordination, rebellion, revolution, conspiracy, insurrection, sedition, riot, strike, riot, civil commotion, malicious damage, sabotage, vandalism, riot, lockout, uprising, uprising military, and, in general, events of a social political nature that alter public or constitutional order; confiscation, requisition, expropriation, or nationalization; destruction of property by order of any authority; military power or usurpation of power; or any event or cause that determines the proclamation of a state of siege.

Cybernetics

Art. 2. Exclusions

Unless otherwise stipulated by a special condition in the policy, any loss or damage resulting from the following will be excluded from coverage:

16. War

Article 6. Definitions

19. 'War' means any situation of conflict (whether declared or not) involving the use of armed forces and/or violence to resolve a contentious issue between two or more States or nations, including acts of war such as invasion, insurrection, revolution or coup military.

 

Poland22

"Under cyber insurance, the most common wording:

The Insurer shall not be obligated to pay or provide any insurance benefits in connection with a claim or loss: arising out of warfare(s) or of a similar nature, invasion, civil war, riot, civil unrest, rebellion, revolution, insurrection or civil strife

As a side note, it should be noted that there is no Polish case law that directly addresses the application of this exclusion. In the context of the war there are many rulings, but concerning the acquiring of veterans' rights after WWI. Thus, it is difficult to point to a specific practice of the courts regarding this exemption. a comparison of different exclusions of war on the Polish property market.

Cyber guard colonnade: The Insurer shall not be obliged to pay any insurance benefits under the Insurance Agreement in respect of a Loss that: arises from or is related to acts of terrorism, riots, war,  armed invasion, state of emergency or other hostilities, except Loss related to the phenomenon of Cyber Terrorism  Cyber protect Allianz: No cover is provided under this insurance contract in respect of any Loss arising out of, based on or relating to: 4.6 War, Terrorism and Authority Action War, Terrorism, Looting and Authority Action. 

Cyber risks insurance ergo hestia: The Insurer's liability shall not cover losses occurring as a result of: 1) acts of war, martial law, state of emergency, strike, lockout and acts of terrorism and sabotage, as well as confiscation, nationalization, detention or requisitioning by the authorities, cyber RED GENERALI: The cover does not extend to any claim that relates to: war - which is any conflict (whether declared or not) that is fought by the use of armed force or violence to settle disputes between two or more states, nations or ethnic groups, including such acts of war as invasion, insurrection, revolution or military coup; from cyber risks PZU: The Insurer shall not be obliged to pay or provide any insurance benefits in respect of Claim(s) or  Loss(es): arising out of hostilities or acts of a similar nature, invasion, civil war, riot, civil unrest, rebellion, revolution, insurrection or civil strife; electronic equipment insurance UNIQA: We shall not be liable for damage which has arisen directly or indirectly from: war, invasion, hostilities or acts of war, whether war has been declared or not, civil war, revolt, rebellion, martial law or a state of emergency or any event determining the maintenance of martial law or a state of emergency, electronic equipment insurance WARTA: WARTA shall not be liable for Losses arising in connection with or as a result of: 1) war, hostilities, invasion, civil war, revolution, rebellion, subversion, martial law or state of emergency, confiscation, nationalization, requisition, seizure or destruction of property by decision of any lawfully constituted authority, lockout, 2) electronic or cyber- attack, hacker activity, operation of computer viruses, computer worms, Trojan horses, logic bombs or other malicious software, electronic equipment insurance InterRisk: Moreover, the insurance agreement does not cover and therefore the Insurer shall not be liable for losses occurring as a result of: 3) acts of war, martial law, riots and disturbances, sabotage, as well as acts of terror, "The war exclusion is one of the most commonly used exclusions in property insurance. One can find different ways of drafting this exclusion. Under property insurance, the most common wording reads:

The insurer shall not be liable for losses arising in connection with or as a result of: war, hostilities, invasion, civil war, revolution, rebellion, subversion, martial law or state of emergency, confiscation, nationalization, requisition, seizure or destruction of property by decision of any lawfully constituted authority, lockout".

 

Portugal23

In Portuguese jurisdiction “War Exclusions” are common to be included in Cyber policies. As the case with the Property policies above, it can be explained by the prevalence of the LMA wordings in the Portuguese market, although they are adopted to reflect the local regulatory requirements. 

The Cyber policies analyzed for the purpose of this information request, normally exclude war, invasion, action by foreign enemies, hostilities (whether war declared or not), civil war, rebellion, revolution, insurrection, usurpation of power, confiscation, nationalization. 

One of the Cyber policies which included coverage against the Cyberterrorism (defined in the policy as “premediated damaging activities against any of the Company's Computer Systems or network, or the explicit threat of the commission of such activities with the with the intent to cause harm and to further social, ideological, religious, political, or similar aims, or to intimidate any person similar objectives, or to intimidate any person(s) into furthering such objectives”), included specific exclusion of coverage against aforementioned activities where they are part of, or supportive of, a military action, war, or warlike operation.

III. Additional Exclusions

In addition to the “War Exclusions” common in Portuguese jurisdiction, there is now a new trend for the insurers to include “Excluded Territories Endorsement”. 

The Excluded Territories are: the Republic of Belarus, Ukraine (in accordance with the borders established as of the 1991 Declaration of Independence, including the Crimean Peninsula and the Donetsk and Luhansk regions), and the Russian Federation."

"Within the Portuguese jurisdic1on, the usual “War Exclusion” wordings in Property policies correspond to the standard wordings common in the London Markets and Lloyds underwriters. 

It is standard practice for the “War Exclusion” to exclude any losses and damages arising out of the: civil or international war; revolutions; acts of foreign enemies, rebellion, revolution, insurrection, military, or usurped power; hostile action or war (declared or undeclared), whether peacetime or wartime, including preventive, defensive or combat ac1on, expected, imminent or existing counterattack; invasion perpetrated by any ""de jure"" or ""de facto"" government or sovereign power or authority; acts of terrorism and sabotage, being understood as such, those considered as such by the Portuguese penal legislation in force. 

However, one of the analyzed “War Exclusions” contained in the All-Risk policy covering explorations and extrac1on included any loss or damage resulting from errors or viruses affecting data, information, records, computer programs and software, as well as their corruption, alteration or destruction, which could be understood as the consequences of war-like activity."

 

Russia24

General provisions in the Civil Code and Marine Code 

In accordance with the art 270 Chapter 15 “Insurance Contract” of the Marine Code in case of the loss due to the military action Insured is released from his duty to pay a claim. Different to the Civil Code this rule cannot be changed by the Parties of insurance contract. This rule is prevailing over the Civil Code rules following special comments in the art.970. 

In the Civil Code art.964 Chapter 48 Contract of Insurance contains a dispositive norm to regulate duties to pay a claim in case the loss occurred as the result of the military actions, maneuveres or any other military related activity. This rule gives the Parties of any type of insurance contract to use another definition in the insurance contract or do not apply this exclusion at all. 

In practice all insurance contracts include this war exclusion, it can be even broader, with more precise description what is the war and similar to war military activity.

Definition of the WAR in Russian legislation

According to the Military Doctrine of the Russian Federation adopted by Presidential Decree of 25.12.2014 N Pr-2976, a military conflict is a way of resolving contradictions between different states or within one state by employing military force. This definition embraces all kinds of military confrontation including large scale, regional, local wars and armed conflicts.

The Doctrine further defines a local war as a war aimed at achieving limited military and political goals. During such war military actions occur within the borders of confronting states and the war mostly concerns territorial, economic, political, and other interests of these states.

According to Article 18 of the Law on Defence dated 31.05.1996 N 61-ФЗ, a state of war is declared by a federal law in case an armed assault on the Russian Federation by another state or a group of states or where the Russian Federation has to perform its obligations under international treaties.

Time of war begins when a state of war is declared and continues until military actions are actually over.

International Reinsurance

In the international reinsurance contracts war exclusion and definition normally is included with the special wording. This option to use a special definition for any rule in the international (at least one Party of the contract is not Russian resident) reinsurance contract is provided by the art. 1210 of the Russian Civil Code. 

In case there no special war exclusion in the reinsurance contract rules of the applicable law country should apply. Parties are free to choose the applicable law to the international reinsurance contract. In case this applicable law is not chosen by the Parties general rules of the art.2111 assume that applicable law for the international reinsurance contract is the law of the reinsurer’ registration country. 

Prof. Capitolina Tourbina

CMS Partner Leonid Zubarev

 

Singapore25

An Example of War Exclusion Clauses in Cyber Policies, offered in Singapore, is

 “The following Exclusions are specific to this Event Management Coverage Section. They apply in addition to the Exclusions in Section 10 (Exclusions) of the General Terms and Conditions.  

 The Insurer shall not be liable for any Loss:  

 3.7 War and Terrorism  

Arising out of, based upon or attributable to any war (whether war is declared or not), terrorism (except Cyber Terrorism), invasion, use of military force, civil war, popular or military rising, rebellion or revolution, or any action taken to hinder or defend against any of these events ".

Examples of War Exclusion Clauses in Property Policies offered in Singapore:

 War and Terrorism

“We will not cover any loss damage, Injury or liability directly or indirectly caused or contributed to by:  

• War invasion, act of foreign enemies, hostilities or warlike operations (whether war be declared or note), civil war, mutiny, rebellion, revolution, insurrection, military or popular uprising, or usurpation of power; or  

• Any Act of Terrorism and any action taken in controlling, preventing, suppressing or in any other way relating to any Act of Terrorism.

# This Policy does not cover:  

1. Any loss, damage or other contingency occasioned by or through or in consequence, directly or indirectly, of any of the following occurrences namely:  

(a)  War, invasion, act of foreign enemy, hostilities or warlike operations (whether war be declared or not), civil war.  

(b)  Mutiny, riot, military or popular rising, insurrection, rebellion, revolution, military or usurped power, martial law or state of siege or any of the events or causes which determine the proclamation or maintenance of martial law or state of siege.  

(c)  Any act of terrorism”.

 

Spain 26

In Spain there are several samples of war exclusions in cyber policies:

“Damages arising from civil or international war, popular mutiny or riot, terrorism, earthquakes and floods and other extraordinary events of similar nature.”

“Civil or international war, invasion, acts of foreign foe, national or international armed conflicts, with or without official declaration, acts of national or international troops in time of peace; military or popular uprisings, revolt, rebellion, sedition, revolution, military or usurped power. As well as any act of a person or persons acting on behalf of, or in connection with, organizations  the activities of which are directed to the forceful overthrow of legal governments or to exert influence upon them by terrorist means or through violence.”

“Any terrorist act except for cyber terrorism.”

“The insurer shall not be bound, in any event, to pay any Loss or Claim resulting from, based on or attributable to: 

War, invasion, acts of foreign foe, hostile operations (with or without war declaration), civil war, rebellion, revolution, insurrection, turmoil or social unrest that would amount to or result in a popular uprising, military power o coup d’etat or martial law.” 

 

Switzerland27

Generally, the practice regarding war exclusions is very similar to the one in described by colleagues from European markets like Germany. 

Regarding cyber – from a number of policy wordings briefly retrieved from the internet I find that cyber includes war exclusion clauses, albeit different by company. Attached is the example of AXA for their corporate segment, which included an exculpation on the part of the insured to the effect that the insured may prove that the cyber loss incurred is not related to the war, breach of neutrality, revolution, rebellion, insurrection or riots and any related measures. 

“Schäden bei kriegerischen Ereignissen, Neutralitätsverletzungen, Revolution, Rebellion, Aufstand, inneren Unruhen und den dagegen ergriffenen Massnahmen – es sei denn, der Versicherungsnehmer weise nach, dass der Schaden mit diesen Ereignissen in keinem Zusammenhang steht.»

 

UK28

All risks property policies in the UK have typically contained widely-drawn war/hostilities exclusion provisions and allow for the option of a variety of extensions to cover where agreeable.

The standard war & civil war exclusion, NMA 464, first introduced in the 1930s, is not limited to war. It extends to "war, civil war, rebellion, revolution, insurrection [... etc]". 

Concerns about NCBR (nuclear, chemical, biological or radioactive) materials being used as weapons grew with concerns about state and other forms of terrorism either side of the 9/11 attacks. Restrictions have been put in place by Lloyd's of London regarding who can carry - and at what levels/types/exposures - war/NCBR risks. 

RACE (radioactive contamination exclusion) provisions, excluding liability for escape of radiation from nuclear power stations also latterly came under the spotlight when extended to exclude liability for terrorist and/or state-implemented "dirty bombs" by explosives being combined with/targeted at radioactive materials as "weapons". 

An Extended RACE Clause known as CL370 was designed to exclude the effects of electromagnetic pulse weapons aimed at disabling electrical equipment including computers in an area around the site of any explosion/physical attack.   

In recognition of the widespread impact of terrorist cyber- attacks in 2018 the property risk cover provided by the UK government backed Pool Re was extended to include damage by "remote digital interference".  

For some time the market has been tackling two growing phenomena: (i) cyberattacks leading to claims under traditional policy forms, as well as under cyber policies; and (ii) the rise of suspected state involvement in the use of cyberattacks as "weapons". The adequacy of exclusions is central to the management of war, cyber war and cyber operations risks.

In November 2021, the Lloyd's Non-Marine Association (LMA) introduced four model exclusions addressing War, Cyber War and Cyber Operations for standalone cyber insurance policies.

These afford underwriters a good deal of flexibility with regard to the extent to which losses are to be excluded. The certainty/comfort it affords them in part remains to be seen as the burden falls on the insurer to prove that the exclusion applies as well as any attribution of a cyber operation to a state. Some have observed that the burden of attribution re cyber events perpetrated by nation-state actors' risks exclusions not providing the certainty sought. 

Analysis and discussion of these lies beyond the scope of what is supplied, but I reproduce a copy of the four exclusions in the link to the LMA announcement. Cyber War and Cyber Operation Exclusion Clauses – LMA Cyber Business Panel. 25 November 2021

See: https://www.lmalloyds.com/LMA/News/LMA_bulletins/LMA_Bulletins/LMA21-042-PD.aspx

 

Uruguay29

"In this case the exclusion is more detailed and explanatory:

1. War, Civil Uprisings and Terrorism 

Derived from, based on, related to, attributable to, or as a consequence of: 

(a) war, whether officially declared or not, or civil war; or

b) warlike action by a military force, including any action to control, prevent, deter, suppress or defend an actual or expected attack, by any government, sovereign, or other authority using military personnel or other agents; or

c) insurrection, rebellion, civil commotion, revolution, invasion, mutiny, usurpation of power, or any action taken by a governmental authority using military personnel to control, prevent, impede, repress or defend against any of these; or

d) any act or preparation with respect to an action or threat of an action designed to influence the de jure or de facto government of any nation or political division thereof or to intimidate the population of a nation or a section of the population for the purpose of furthering political, religious, ideological or similar ends, carried out by any person or group of persons, whether acting alone or on behalf of or in connection with any de jure or de facto organization or government and which:

(i) involves violence against a person or persons; or

(ii) involves damage to property and assets; or

(iii) endangers lives other than those of the persons committing the action; or

(iv) creates a risk to the health or safety of the public or a section of the public; or

(e) any action to control, prevent, suppress, repress, retaliate against or respond to any act or preparation in respect of an action or threat of an action described in paragraph (d) above.

This exclusion shall not apply to cyberterrorism”.

We have a general exclusion, short and simple, like this one:

- Acts of war, invasion, act of foreign enemy, act of hostility or warlike operation with or without declaration of war, civil war, internal state of war, insurrection, rebellion, sedition, usurped or usurping military, naval or air power; outbreak of or act of revolution".

Notes

1. See e.g in Australia . France- lack of definition

2. See in Peru – "... violence to resolve a contentious issue between two or more States or nations" , Poland : " any conflict (whether declared or not) that is fought by the use of armed force or violence to settle disputes between two or more states, nations or ethnic groups… UK- "invasion perpetrated by any ""de jure"" or ""de facto"" government or sovereign power or authority; 

3.  See in Austria, -"…military or administrative measures"

4. The phrase "directly or indirectly" is included in the War Exclusions in Australia, Brazil, Greece, Israel, Mexico, New Zealand, Peru, Poland, Singapore.

5.  See   e.g in Israeli Cyber policies - NMA 464 WAR AND CIVIL WAR EXCLUSION CLAUSE:"……this Certificate does not cover Loss or Damage directly or indirectly occasioned by……. or in consequence of war, invasion, acts of foreign enemies, hostilities (whether war be declared or not), civil war, rebellion, revolution, insurrection, military or usurped power …." 

6.  case No. UNN-L-2682-18 (N.J. Sup. Ct.)

7. Based on Vincent J. Vitkowsky " The Russian Invasion of Ukraine, Worldwide Cyberattacks, and War Exclusions in Property and Casualty Insurance Policies".  

8. No. 2018-L – 011008 (III Cir. Ct. Oct.10, 2018) 

9. Christopher J. Rodd 

10. Prof. Dr. Stefan Perner

11. Prof. Caroline Van Schoubroeck

12. Barbara Bassani De Souza

13. Taisto Hujala

14. Prof. Jérôme Kullman

15. Prof. Dr. Manfred Wandt

16. Prof. Dr. Ioannis Rokas

17. Peggy Sharon

18. Prof. Sara Landini 

19. Yves Hayaux du Tilly 

20. Jonathan Scragg

21. Alonso Nuñez del Prado Simons

22. Anna Tarasiuk 

23. Ana Cristina Borges

24. Prof. Capitolina Tourbina & Leonid Zubarev

25. Prof. Hwee-Ying Yeo

26. Jorge Angell 

27. Christian Felderer

28. Tim Hardy

29. Dr. Andrea Signorino Barbat