that the assured will be possibly paying additional premium under his cyber risk
policy for a loss that would have been ordinarily covered under his general liability
policy.
3.3 Silent (Non-Affirmative) Cyber Cover
When a traditional marine policy (e.g., hull & machinery, cargo insurance, or
protection and indemnity (P & I) cover), does not expressly include or exclude
cyber related losses, it is possible that the policy in question might respond to a loss
connected to a cyber risk if the proximate cause of the loss is judged to be a peril
insured against. In that case, it is often said that the policy has a “silent” or “nonaffirmative” cyber cover. For example, let us assume that a consignment of mobile
phones, insured under Institute Cargo Clauses (ICC) 2009 (A), is carried in a
container from China to the UK. At a transhipment port, which has a computerised
container tracking device, the hackers manage to install password capture devices
and subsequently are able to infiltrate the IT systems of the container terminal.
Hackers identify the container with the mobile phone consignment and generate new
dispatch codes causing the container to be shipped to another destination. The
assured’s claim for indemnity in such case is likely to succeed, as the cover under
the ICC 2009 (A) policy is an all-risk cover, and the loss is not likely to trigger any of
the exclusions stipulated in the policy.
19
However, in the context of a silent cyber cover policy, the assured will not be able
to recover if the cyber risk triggers the application of one of the exclusions in the
policy. This can be illustrated with a couple of examples. In the context of a hull &
machinery policy providing cover against marine risk (e.g., Institute Time Clauses
Hulls (ITCH) (1995)), imagine that the insured vessel was involved in a collision as a
result of her Electronic Chart Display & Information System (ECDIS) not being able
to identify another vessel laid up in a recognised anchorage in full compliance with
all relevant regulations. It transpires that a malicious code or software (distributed by
a commercial rival) was downloaded on the computer system on board, which
prevented the ECDIS from showing accurate information. Clause 26 of the ITCH
1995 stipulates that this policy will not cover “loss damage liability or expense
caused by any person acting maliciously or from a political motive”. In the marine
context, the meaning of “malicious” has generated a degree of uncertainty over the
years. In Shell International Petroleum Co Ltd v. Gibbs (The Salem)
20 Mustil, J, held
that the peril of “persons acting maliciously” in the context of a cargo policy did not
19 Clauses 4–7 of the ICC 2009 (A) excludes losses attributable to the nature of the cargo (i.e.,
insufficiency or unsuitability of packaging, inherent vice of the cargo), delay, unseaworthiness or
unfitness of the vessel which the assured is privy to, war risks, strikes, terrorism, and persons acting
from a political, ideological or religious motive.
20 [1981] 2 Lloyd’s Rep 316, at 328.
634
B. Soyer
policy for a loss that would have been ordinarily covered under his general liability
policy.
3.3 Silent (Non-Affirmative) Cyber Cover
When a traditional marine policy (e.g., hull & machinery, cargo insurance, or
protection and indemnity (P & I) cover), does not expressly include or exclude
cyber related losses, it is possible that the policy in question might respond to a loss
connected to a cyber risk if the proximate cause of the loss is judged to be a peril
insured against. In that case, it is often said that the policy has a “silent” or “nonaffirmative” cyber cover. For example, let us assume that a consignment of mobile
phones, insured under Institute Cargo Clauses (ICC) 2009 (A), is carried in a
container from China to the UK. At a transhipment port, which has a computerised
container tracking device, the hackers manage to install password capture devices
and subsequently are able to infiltrate the IT systems of the container terminal.
Hackers identify the container with the mobile phone consignment and generate new
dispatch codes causing the container to be shipped to another destination. The
assured’s claim for indemnity in such case is likely to succeed, as the cover under
the ICC 2009 (A) policy is an all-risk cover, and the loss is not likely to trigger any of
the exclusions stipulated in the policy.
19
However, in the context of a silent cyber cover policy, the assured will not be able
to recover if the cyber risk triggers the application of one of the exclusions in the
policy. This can be illustrated with a couple of examples. In the context of a hull &
machinery policy providing cover against marine risk (e.g., Institute Time Clauses
Hulls (ITCH) (1995)), imagine that the insured vessel was involved in a collision as a
result of her Electronic Chart Display & Information System (ECDIS) not being able
to identify another vessel laid up in a recognised anchorage in full compliance with
all relevant regulations. It transpires that a malicious code or software (distributed by
a commercial rival) was downloaded on the computer system on board, which
prevented the ECDIS from showing accurate information. Clause 26 of the ITCH
1995 stipulates that this policy will not cover “loss damage liability or expense
caused by any person acting maliciously or from a political motive”. In the marine
context, the meaning of “malicious” has generated a degree of uncertainty over the
years. In Shell International Petroleum Co Ltd v. Gibbs (The Salem)
20 Mustil, J, held
that the peril of “persons acting maliciously” in the context of a cargo policy did not
19 Clauses 4–7 of the ICC 2009 (A) excludes losses attributable to the nature of the cargo (i.e.,
insufficiency or unsuitability of packaging, inherent vice of the cargo), delay, unseaworthiness or
unfitness of the vessel which the assured is privy to, war risks, strikes, terrorism, and persons acting
from a political, ideological or religious motive.
20 [1981] 2 Lloyd’s Rep 316, at 328.
634
B. Soyer