Cyber risks & marine cargo insurance

The most talked about risk exposure these days is Cyber risk. This may take the form of hacking computer systems to steal data, mis-feed instructions or misuse operating systems/software to cause mishaps, cyber extortion and many more. Criminals are becoming more tech-savvy and finding innovative methods to hack into high-security systems.

As regards cargo, two questions come up-

1) Are cyber risks relevant in case of cargo moving from one place to another?  

2) If yes, whether an All-Risks coverage under ICC-A would respond in case of losses/damages attributable to cyber attacks.

The answer to the first question is definitely in the affirmative, a BIG Yes. Some examples of cyber attacks causing losses could be visualized:

• If a vessel’s navigation system is hacked into, the hackers could cause the vessel to change course and possibly crash into rocky shores or sink in treacherous waters. This can cause losses to both the hull and cargo. Though there are checks and balances and safety features in modern vessels,the very fact that there is an overwhelming dependence on computer systems means that the above scenarios are not outside the realms of possibility.
• If the cargo management systems in ports is breached, the location of any container & its contents could be easily known to the hackers who can then direct the movements of the select containers to chosen points from which they can be whisked away. The claim reported will be for missing containers. These type of attacks have happened in Antwerp port and also with Australian Customs. 
• This is the age of electronic documentation. If the passcodes in electronic bills of lading or electronic delivery instructions are breached, delivery of cargo can be easily manipulated in favour of persons who are not the ones for whom the cargo was intended.

In all the above possibilities, if the insured holds an All-Risk cover under ICC-A, there is no specific exclusion to deny these claims, one might feel.

Look at every contract of insurance or reinsurance. Apart from the insuring clauses there lurks quietly the Institute Cyber Attack Exclusion clause – CL 380, which every client or broker takes for granted as a standard feature which does not impact risk coverage in any way. Nothing can be further from the truth. The operative part of the clause reads as under:

“In no case shall this insurance cover loss damage liability or expense directly or indirectly caused by or contributed to by or arising from the use or operation,as a means for inflicting harm, of any computer, computer system, computer software programme, malicious code, computer virus or process or any other electronic system.”

The wording is draconian — Directly or indirectly CAUSED BY or CONTRIBUTED TO BY OR ARISING FROM …..

In all the three eventualities visualized, the insurer can well invoke the Cyber Attack Exclusion clause and decline the claims. One may say that if the vessel meets with an accident causing damage to cargo or if the container goes missing, ICC-A should respond. No, if the cause of accident or disappearance of the container is traced back to a misuse of any computer system with an intention to inflict harm.One can keep arguing about ‘proximate cause’ and whether the computer system misuse was the sole cause for the loss, etc. but this clause gives the insurers a clear upper hand.

Is there a case for dilution of wordings of this clause? Can there be a buyback of the exclusion under this clause? Understand that discussions are on but nothing concrete has come up yet. Personally, I feel a buyback at a much higher rate will not only provide  cover to assureds desiring it but will also help insurers shore up premiums in cargo which have been going deep south the world over.