Similarly, use of a smart phone to facilitate instant communication between members of a criminal organisation which ultimately stops a truck and forcefully takes the
cargo away would be adequate to exclude liability under a cargo insurance policy
incorporating CL380. Or perhaps even more fanciful, if the truck driver is hit by a
laptop on the head, it can be argued that in the context of CL380, the resulting loss of
cargo is an excluded peril. This is possibly not intended to be within the spirit of
CL380, but preference to adopt wide causation triggers in the clause and the use of
certain words in the clause, in particular reference to the use of a “computer as a
means of inflicting harm”, points towards that conclusion.
In evaluating the scope of this exclusion clause, the second issue is whether the
insurers could still rely on CL380 in a case where the assured is the victim of a
collateral damage from a cyber attack aimed at a third party. If, for example, an
amateur hacker is circulating malware randomly, which leads the ECDIS of the
insured vessel to malfunction resulting in her grounding, would the insurer be able to
deny liability assuming that CL380 has been incorporated into the policy? Again,
there is no direct judicial guidance on the matter, but guidance can be obtained from
other authorities, and in particular the decision of the Court of Appeal in Tektrol Ltd
v. International Insurance Co of Hanover Ltd.
31 There, the assured, a manufacturer
of energy-saving devices, obtained insurance to protect its assets including key data
for its products. During the Christmas period of 2001/02, the insured company lost
independent copies of the source code for its most recent energy-saving product
which were stored on a variety of mediums; on desktop and laptop computers, at a
remote site operated by a third party, and a paper copy. A virus on an email
attachment (purporting to be a Christmas card from a firm of solicitors) deleted the
source code held on the laptop and at the remote site. Upon returning after New
Year, the assured discovered their business premises had been burgled and the
desktop computers holding the source code and the paper copy had been stolen.
An indemnity claim by the assured was declined by the insurer relying on an
exclusion clause in the policy which stipulated that loss arising directly or indirectly
from: “erasure loss distortion or corruption of information on computer systems or
other records programmes or software caused deliberately by rioters strikers lockedout workers persons taking part in labour disturbances or civil commotion or
malicious persons” is excluded from coverage. The Court of Appeal, reversing the
judgment of the trial judge,
32 held that the exclusion only applied where the assured
was specifically targeted and as a result the data on computer systems was erased,
lost or distorted. Buxton, LJ, stressed that “the clause does not extend to interferences by such people that are not directed at the computer systems, etc, used by the
insured at the premises. If the insurer wished to exclude all damage caused however
indirectly by a computer hacker he needed to place that exclusion in a separate
clause, and not refer to malicious persons in the same terms as rioters or locked-out
31 [2005] EWCA 845; [2005] 2 Lloyd’s Rep 701.
32 [2004] EWHC 2473 (Comm); [2005] 1 All E.R. (Comm) 132.
638
B. Soyer
cargo away would be adequate to exclude liability under a cargo insurance policy
incorporating CL380. Or perhaps even more fanciful, if the truck driver is hit by a
laptop on the head, it can be argued that in the context of CL380, the resulting loss of
cargo is an excluded peril. This is possibly not intended to be within the spirit of
CL380, but preference to adopt wide causation triggers in the clause and the use of
certain words in the clause, in particular reference to the use of a “computer as a
means of inflicting harm”, points towards that conclusion.
In evaluating the scope of this exclusion clause, the second issue is whether the
insurers could still rely on CL380 in a case where the assured is the victim of a
collateral damage from a cyber attack aimed at a third party. If, for example, an
amateur hacker is circulating malware randomly, which leads the ECDIS of the
insured vessel to malfunction resulting in her grounding, would the insurer be able to
deny liability assuming that CL380 has been incorporated into the policy? Again,
there is no direct judicial guidance on the matter, but guidance can be obtained from
other authorities, and in particular the decision of the Court of Appeal in Tektrol Ltd
v. International Insurance Co of Hanover Ltd.
31 There, the assured, a manufacturer
of energy-saving devices, obtained insurance to protect its assets including key data
for its products. During the Christmas period of 2001/02, the insured company lost
independent copies of the source code for its most recent energy-saving product
which were stored on a variety of mediums; on desktop and laptop computers, at a
remote site operated by a third party, and a paper copy. A virus on an email
attachment (purporting to be a Christmas card from a firm of solicitors) deleted the
source code held on the laptop and at the remote site. Upon returning after New
Year, the assured discovered their business premises had been burgled and the
desktop computers holding the source code and the paper copy had been stolen.
An indemnity claim by the assured was declined by the insurer relying on an
exclusion clause in the policy which stipulated that loss arising directly or indirectly
from: “erasure loss distortion or corruption of information on computer systems or
other records programmes or software caused deliberately by rioters strikers lockedout workers persons taking part in labour disturbances or civil commotion or
malicious persons” is excluded from coverage. The Court of Appeal, reversing the
judgment of the trial judge,
32 held that the exclusion only applied where the assured
was specifically targeted and as a result the data on computer systems was erased,
lost or distorted. Buxton, LJ, stressed that “the clause does not extend to interferences by such people that are not directed at the computer systems, etc, used by the
insured at the premises. If the insurer wished to exclude all damage caused however
indirectly by a computer hacker he needed to place that exclusion in a separate
clause, and not refer to malicious persons in the same terms as rioters or locked-out
31 [2005] EWCA 845; [2005] 2 Lloyd’s Rep 701.
32 [2004] EWHC 2473 (Comm); [2005] 1 All E.R. (Comm) 132.
638
B. Soyer