actual delivery, not delivery as a means of access. The judgment was endorsed by the
Court of Appeal and the carrier was found liable for breach of the contract which was
effectively the result of a data breach. Generally speaking, P & I cover offers protection
to carriers for liability they face to third parties under a contract of carriage, but P & I
Rules invariably exclude liability for delivery without production of bill of lading
(mis-delivery).
26 Therefore, in this case the carrier would not be able to recover from his
liability insurer for the cyber related breach, since one of the fundamental exceptions to
liability for cargo loss or damage is triggered.
3.4 Cyber Exclusions
Most conventional marine policies (e.g., hull & machinery, war risks, cargo policies)
explicitly attempt to exclude losses caused by cyber risks. To this end, the Institute
Cyber Attack Exclusion Clause, commonly known as “CL380”, is incorporated into
policies. There are a number of variations to this clause, but in essence it provides:
. . . in no case shall this insurance cover loss damage liability or expense directly or indirectly
caused by or contributed to by or arising from the use or operation, as a means of inflicting
harm, of any computer, computer system, computer software programme, malicious code,
computer virus or process or any other electronic system.
Although the clause has not yet been subjected to judicial airing, applying general
construction rules and principles, one might easily come to the conclusion that the
scope of this exclusion is very broad. First of all, it is noticeable that the causation
triggers used in the clause have the ability to expand the scope of this exception
considerably. The use of the causation triggers such as “directly or indirectly caused
by or contributed to” in the clause, leaves no doubt that the draftsman has gone to
great lengths to ensure that the doctrine of proximate cause
27 does not apply. In fact,
26 See, for example, GARD Rules 2018, Part II. Rule 34. (http://www.gard.no/web/publications/
document/chapter?p_subdoc_id¼20747996&p_document_id¼20747880last
tested
on
31 December 2018).
27 In identifying the proximate cause, one needs to identify the efficient cause of the loss, not the one
which is closest in time. In Leyland Shipping v. Norwich Union [1918] AC 350, Lord Shaw, stated
at p. 369:
To treat proxima causa as the cause which is nearest in time is out of the question. Causes are
spoken of as if they were distinct from one another as beads in a row or links in a chain, but –
if this metaphysical topic has to be referred to – it is not wholly so. The chain of causation is a
handy expression, but the figure is inadequate. Causation is not a chain, but a net. At each
point influences, forces, events, precedent and simultaneous, meet; and the radiation from
each point extends infinitely. At the point where these various influences meet, it is for the
judgment as upon a matter of fact to declare which of the causes, thus, joint at the point of
effect was the proximate and which was the remote cause . . . What does “proximate” here
mean? To treat proximate cause as if it was the cause which is proximate in time is, as I have
said, out of the question. The cause which is truly proximate is that which is proximate in
efficiency.
636
B. Soyer
Court of Appeal and the carrier was found liable for breach of the contract which was
effectively the result of a data breach. Generally speaking, P & I cover offers protection
to carriers for liability they face to third parties under a contract of carriage, but P & I
Rules invariably exclude liability for delivery without production of bill of lading
(mis-delivery).
26 Therefore, in this case the carrier would not be able to recover from his
liability insurer for the cyber related breach, since one of the fundamental exceptions to
liability for cargo loss or damage is triggered.
3.4 Cyber Exclusions
Most conventional marine policies (e.g., hull & machinery, war risks, cargo policies)
explicitly attempt to exclude losses caused by cyber risks. To this end, the Institute
Cyber Attack Exclusion Clause, commonly known as “CL380”, is incorporated into
policies. There are a number of variations to this clause, but in essence it provides:
. . . in no case shall this insurance cover loss damage liability or expense directly or indirectly
caused by or contributed to by or arising from the use or operation, as a means of inflicting
harm, of any computer, computer system, computer software programme, malicious code,
computer virus or process or any other electronic system.
Although the clause has not yet been subjected to judicial airing, applying general
construction rules and principles, one might easily come to the conclusion that the
scope of this exclusion is very broad. First of all, it is noticeable that the causation
triggers used in the clause have the ability to expand the scope of this exception
considerably. The use of the causation triggers such as “directly or indirectly caused
by or contributed to” in the clause, leaves no doubt that the draftsman has gone to
great lengths to ensure that the doctrine of proximate cause
27 does not apply. In fact,
26 See, for example, GARD Rules 2018, Part II. Rule 34. (http://www.gard.no/web/publications/
document/chapter?p_subdoc_id¼20747996&p_document_id¼20747880last
tested
on
31 December 2018).
27 In identifying the proximate cause, one needs to identify the efficient cause of the loss, not the one
which is closest in time. In Leyland Shipping v. Norwich Union [1918] AC 350, Lord Shaw, stated
at p. 369:
To treat proxima causa as the cause which is nearest in time is out of the question. Causes are
spoken of as if they were distinct from one another as beads in a row or links in a chain, but –
if this metaphysical topic has to be referred to – it is not wholly so. The chain of causation is a
handy expression, but the figure is inadequate. Causation is not a chain, but a net. At each
point influences, forces, events, precedent and simultaneous, meet; and the radiation from
each point extends infinitely. At the point where these various influences meet, it is for the
judgment as upon a matter of fact to declare which of the causes, thus, joint at the point of
effect was the proximate and which was the remote cause . . . What does “proximate” here
mean? To treat proximate cause as if it was the cause which is proximate in time is, as I have
said, out of the question. The cause which is truly proximate is that which is proximate in
efficiency.
636
B. Soyer