• The loss of intellectual property (IT) or the reputational impact. It should be noted
that some policies extend cover to IT liabilities.
With regard to the scope of the cover, a few observations are in order. First, given
that this is a relatively new product, there is not much guidance from courts as to how
cyber risk policies and especially technical terms (e.g., “mechanical/electronic
failure” or “malicious code”) used in such policies relating to cyber risks will be
construed by courts. This problem is not something unique to cyber policies; it can
arise in the context of any insurance policy providing cover for a new type of risk.
Generally speaking, in a case where a word has a technical meaning, it is presumed
that it was intended in its technical meaning.
15 However, there is convincing judicial
authority to the effect that the courts will not attribute a technical meaning to the
words, especially if the ordinary meaning of a word differs from the technical
meaning and one party to the contact (in this context, the shipping corporation)
cannot be expected to be familiar with the technical meaning.
16 This is likely to be
the case in the context of cyber insurance given that this is a new type of risk that
most shipping corporations have not yet come terms with.
Second, it is not uncommon for cyber risks policies to exclude losses arising from
terrorism. This could be very problematic for shipping corporations, as several
reports seem to suggest that many cyber attacks are politically motivated
17 and
thus could be excluded from cover under an exclusion of that nature.
Last but not least, given that the cyber risks cover is still in its developmental
stage, it is possible that the assured might end up purchasing cyber cover for a risk
that is already covered by a separate insurance product. Let us imagine that the
software which is used to control an automatic crane in a warehouse is corrupted by a
malicious code. The corruption of software causes the crane to malfunction and as a
result one of the employees is injured. It is highly likely that the company’s general
liability policy would respond to the direct liability associated with injury. A cyber
risk policy would also provide cover for this loss, unless of course it expressly
excludes liability for any claim “arising out of or attributable to personal injury”. If
both policies respond to the loss, this is a case of double insurance, which would not
necessarily provide any monetary advantage to the assured
18 ; but the issue here is
15 See, Kumar v. Life Insurance Corporation of India [1974] 1 Lloyd’s Rep 147, at 149, where
Kerr, J, in the context of a life insurance policy, held that a “Caesarean delivery” was an “operation”
on technical usage.
16 See, De Maurier (Jewels) Ltd v. Bastion Insurance Co Ltd [1967] 2 Lloyd’s Rep 550 where
Donaldson, J, disregarding the technical meaning of the words, held that a car “owned by the
insured” included cars held on hire-purchase by the company, as a reasonable assured not fully
aware of the niceties of law would describe them as “the company cars”.
17 See, the regular incident reports published by Carbon Black, at https://www.carbonblack.com/
security_experts/threat-reports/ (last accessed on 31 December 2018).
18 Section 32(2) of the MIA 1906 stipulates: “Where the assured is over-insured by double
insurance— (a)The assured, unless the policy otherwise provides, may claim payment from the
insurers in such order as he may think fit, provided that he is not entitled to receive any sum in
excess of the indemnity allowed by this Act. . .”.
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
633
that some policies extend cover to IT liabilities.
With regard to the scope of the cover, a few observations are in order. First, given
that this is a relatively new product, there is not much guidance from courts as to how
cyber risk policies and especially technical terms (e.g., “mechanical/electronic
failure” or “malicious code”) used in such policies relating to cyber risks will be
construed by courts. This problem is not something unique to cyber policies; it can
arise in the context of any insurance policy providing cover for a new type of risk.
Generally speaking, in a case where a word has a technical meaning, it is presumed
that it was intended in its technical meaning.
15 However, there is convincing judicial
authority to the effect that the courts will not attribute a technical meaning to the
words, especially if the ordinary meaning of a word differs from the technical
meaning and one party to the contact (in this context, the shipping corporation)
cannot be expected to be familiar with the technical meaning.
16 This is likely to be
the case in the context of cyber insurance given that this is a new type of risk that
most shipping corporations have not yet come terms with.
Second, it is not uncommon for cyber risks policies to exclude losses arising from
terrorism. This could be very problematic for shipping corporations, as several
reports seem to suggest that many cyber attacks are politically motivated
17 and
thus could be excluded from cover under an exclusion of that nature.
Last but not least, given that the cyber risks cover is still in its developmental
stage, it is possible that the assured might end up purchasing cyber cover for a risk
that is already covered by a separate insurance product. Let us imagine that the
software which is used to control an automatic crane in a warehouse is corrupted by a
malicious code. The corruption of software causes the crane to malfunction and as a
result one of the employees is injured. It is highly likely that the company’s general
liability policy would respond to the direct liability associated with injury. A cyber
risk policy would also provide cover for this loss, unless of course it expressly
excludes liability for any claim “arising out of or attributable to personal injury”. If
both policies respond to the loss, this is a case of double insurance, which would not
necessarily provide any monetary advantage to the assured
18 ; but the issue here is
15 See, Kumar v. Life Insurance Corporation of India [1974] 1 Lloyd’s Rep 147, at 149, where
Kerr, J, in the context of a life insurance policy, held that a “Caesarean delivery” was an “operation”
on technical usage.
16 See, De Maurier (Jewels) Ltd v. Bastion Insurance Co Ltd [1967] 2 Lloyd’s Rep 550 where
Donaldson, J, disregarding the technical meaning of the words, held that a car “owned by the
insured” included cars held on hire-purchase by the company, as a reasonable assured not fully
aware of the niceties of law would describe them as “the company cars”.
17 See, the regular incident reports published by Carbon Black, at https://www.carbonblack.com/
security_experts/threat-reports/ (last accessed on 31 December 2018).
18 Section 32(2) of the MIA 1906 stipulates: “Where the assured is over-insured by double
insurance— (a)The assured, unless the policy otherwise provides, may claim payment from the
insurers in such order as he may think fit, provided that he is not entitled to receive any sum in
excess of the indemnity allowed by this Act. . .”.
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
633