LMA publishes updated war and cyber operation exclusions

Published 30 enero 2023

In the latest instalment regarding war exclusions, on 18 January 2023 the LMA published eight new clauses addressing war and cyber operations (LMA5564A and B to LMA5567A and B). 

The clauses include iterative changes to the original clauses and were considered in light of differences in approach in the Marsh-Munich Re clause circulated in the Spring of 2022. 

As before, the clauses escalate in terms of complexity.  They range from a relatively straightforward exclusion for losses directly or indirectly arising from a war or arising from a cyber operation, to more complex clauses weaving in further concepts.  As before, the simplest clause is suitable for more straightforward cover.  Although the clauses have been primarily drafted for use in stand-alone cyber policies, this clause will also be suitable for some policies for other lines of business.   

Some of the key changes include the following:

1. The clauses overall have been shortened.  The causation language in the preamble has been abbreviated.  The concept of retaliatory cyber operations between “specified states” has been deleted. 

2. The more complex clauses expressly refer to a cyber operation that is carried out as part of the “immediate preparation” for a war. We have some misgivings about this and the contrast with the simpler clauses in the series.

3. The clause on attribution is more concise.  There are B versions of each clause in which this is omitted entirely.

4. The LMA has made the following comment in its Notes for Users on the clauses, specifically addressing attribution:

“These clauses are replacements for the original suite of cyber war clauses (LMA5564 - LMA5567 inclusive). The ‘A’ versions meet the requirements of Lloyd’s Bulletin Y5381 in relation to stand alone cyber-attack policies under risk codes CY and CZ, which requirements take effect from 31 March 2023 at the inception or renewal of each policy. The ‘B’ versions do not address attribution and are therefore not compliant without prior agreement from Lloyd’s.”

It is implicit from this comment that Lloyd’s is willing to consider alternative formulations, subject to prior consultation.

5. The definition of war has been improved.  It now refers in the first limb to state-on-state armed conflict involving physical force.  This represents an improvement on language prescribed by Lloyd’s 2016 Bulletin on this topic and can be regarded as having Lloyd’s approval. 

6. The language of the collateral damage writeback has been simplified, more in line with the Marsh-Munich Re clause.  The original clauses referred to “bystanding cyber assets”, as a defined term.  This term is no long used.

In certain respects no changes have been made.  For example, the concepts of “major detrimental impact” on an “essential service” in a state have been preserved.  Similarly, “state” is still defined to mean “sovereign state”.

The original four clauses published by the LMA on 25 November 2021 have been withdrawn.  This recalls the prescient words of Matt Webb, former chairman of the LMA’s CWWG, when the original clauses were published, that they would not be in circulation for anything like as long as NMA464, published in 1938. 

The market has come a long way since the CWWG was first convened and the original LMA clauses were published.  Not all of the challenges have been resolved and further innovation is both to be expected and welcomed.  Lloyd’s has signalled that there is not a single acceptable solution to addressing exclusions for war and cyber operations, and a number of carriers have invested in drafting new clauses. 

We await further news from Lloyd’s regarding its expectations of syndicates, as first published in Lloyd’s Bulletin Y5381 on 16 August 2022.