I recently wrote an article for Business Insurance on how the war exclusion will affect commercial policyholders. The war exclusion has received a lot of attention over the past year, particularly since Russia invaded Ukraine in February. Policyholders’ concern that insurers will assert the exclusion as a basis to deny coverage is increasing in light of recent coverage litigation and the potential that cyberattacks emanating from Russia would have serious financial consequences.

The war exclusion is in a moment of possible flux, as insurers consider changes that could increase its scope. A few months before Russia invaded Ukraine, the Lloyd’s Market Association introduced four model clauses designed to exclude, to a greater or lesser extent, coverage for war risks from cyber policies.

In the article, I analyze the model clauses and what might happen next. One aspect of all these exclusions that is particularly worrisome is that they would give the insurer the right to determine whether a cyber operation was “indirectly” carried out “by or on behalf of” a sovereign state. The language potentially could result in the elimination of coverage for attacks in which the victim was not the intended target and the actor merely claims to be acting for the benefit, or in support of, a state rather than being directed by the state.

You can read the full article here.