Market Definitions of Cyber War

Abstract

Definitions of war found in cyber insurance policies provide a novel window into the concept of cyber war. Changes in policy wording reflect shifting expectations surrounding technology and military strategy as mediated by market forces. In a recent legal case, an insurer refused to pay a property insurance claim by arguing the cause of the claim, a cyber attack, constituted a hostile or warlike action. We build a corpus of 56 cyber insurance policies. Longitudinal analysis reveals distinct market trends. Some specialist cyber insurance providers introduced policies without war clauses until as late as 2012. Recent years have seen war exclusions weakened as cyber insurance policies affirmatively cover “cyber terrorism”. This article explores the economic, strategic, and regulatory forces driving war clauses in cyber insurance policies.

We then discuss how these definitions contest state-formulated narratives around war by arguing that the insurance industry can influence discourses on offensive cyber operations. Insurance policies constitute private contracts that do not confer rights or responsibilities on third-parties, in this case states. Legal cases do, however, provide a symbolic platform to present evidence about offensive cyber operations and subject it to legal reasoning. Nevertheless, states maintain significant structural power in influencing what evidence can be presented in court and in controlling its production by intelligence agencies.

Keywords: cyber war, insurance, terrorism, cybersecurity, cyber insurance