workers.”
33 The decision acts as a reminder that exclusion clauses in insurance
contracts will be construed against the factual and contractual matrix, and a narrow
construction will be adopted in cases where clear language to that effect is used.
34
Here, the language used in the exclusion clause was deemed to have restricted the
meaning of “malicious persons” by the placement of these words at the end of a
sentence where reference is made to rioters, strikers and persons taking part in labour
disturbances and civil commotions. A careful reading of CL380 reveals that the
position is rather different. This is a stand-alone exclusion clause that seems to put no
restriction on the type of people who could cause loss by using a computer, computer
system, computer software programme, malicious code, computer virus or process
or any other electronic system. The only requirement is that the objective of the
people causing such losses is to “inflict harm”. It is, therefore, submitted that CL380
is radically different than the exclusion clause that Buxton, LJ, considered in Tektrol
Ltd v. International Insurance Co of Hanover Ltd and is capable of excluding
liability in cases where damage can be linked to the actions of any hacker acting
with the intention of “inflicting harm”.
Also, reference to a loss caused by a “malicious code” is significant in this
context. A person who authors a malicious code with the intention of inflicting
harm to other computer users is not in a position to know where the code will end up
and what kind of cyber security systems it might penetrate. Therefore, it can
plausibly be argued that the intention of the draftsman was to exclude loss or liability
caused by the use of a computer, computer system, computer software programme,
malicious code, computer virus or process or any other electronic system by any
person as long as he intended to inflict harm to anyone including but not restricted to
the assured.
If this analysis holds true, it is clear that the scope of CL380 is so wide that it
could potentially reduce the utility of conventional marine policies if incorporated
into the policy. In the example given above (i.e., the ECDIS of the insured vessel
malfunctioning as a result of a cyber attack, resulting in her grounding, the assured
will not be able to recover even though “perils of the seas” (including grounding) is
33 [2005] EWCA 845; [2005] 2 Lloyd’s Rep. 701, at [12]. With regard to the question of liability
regarding the burglary, the insurers sought to rely on the following exclusion clause, excluding loss
arising from: “other erasure loss distortion or corruption of information on computer systems or
other records programmes or software unless resulting from a Defined Peril in so far as it is not
otherwise excluded.” It was argued that the physical loss of the data that was stored on the stolen
desktop computers and the print out were covered by the above exclusion and, as theft or burglary
was not a “Defined Peril” under the policy, that such loss could not be recovered. The majority of
the Court of Appeal (Carnwath LJ dissenting) rejected this point as well. It was held that in the
context of the whole clause, the word “loss” did not extend to physical loss by theft, but referred
only to loss by means of electronic interference. The draftsman’s use of words in this clause was
seen as “linguistic overkill” in that a number of words and phrases were used all expressing more or
less the same idea. The majority expressed the view that they would have expected the exclusion of
such a different type of loss as physical loss to be covered in a separate clause.
34 The point was made authoritatively in Impact Funding Solutions Ltd v. AIG Europe Insurance Ltd
[2016] UKSC 57. See, also, Crowden v. QBE [2017] EWHC 2597 (Comm).
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
639
33 The decision acts as a reminder that exclusion clauses in insurance
contracts will be construed against the factual and contractual matrix, and a narrow
construction will be adopted in cases where clear language to that effect is used.
34
Here, the language used in the exclusion clause was deemed to have restricted the
meaning of “malicious persons” by the placement of these words at the end of a
sentence where reference is made to rioters, strikers and persons taking part in labour
disturbances and civil commotions. A careful reading of CL380 reveals that the
position is rather different. This is a stand-alone exclusion clause that seems to put no
restriction on the type of people who could cause loss by using a computer, computer
system, computer software programme, malicious code, computer virus or process
or any other electronic system. The only requirement is that the objective of the
people causing such losses is to “inflict harm”. It is, therefore, submitted that CL380
is radically different than the exclusion clause that Buxton, LJ, considered in Tektrol
Ltd v. International Insurance Co of Hanover Ltd and is capable of excluding
liability in cases where damage can be linked to the actions of any hacker acting
with the intention of “inflicting harm”.
Also, reference to a loss caused by a “malicious code” is significant in this
context. A person who authors a malicious code with the intention of inflicting
harm to other computer users is not in a position to know where the code will end up
and what kind of cyber security systems it might penetrate. Therefore, it can
plausibly be argued that the intention of the draftsman was to exclude loss or liability
caused by the use of a computer, computer system, computer software programme,
malicious code, computer virus or process or any other electronic system by any
person as long as he intended to inflict harm to anyone including but not restricted to
the assured.
If this analysis holds true, it is clear that the scope of CL380 is so wide that it
could potentially reduce the utility of conventional marine policies if incorporated
into the policy. In the example given above (i.e., the ECDIS of the insured vessel
malfunctioning as a result of a cyber attack, resulting in her grounding, the assured
will not be able to recover even though “perils of the seas” (including grounding) is
33 [2005] EWCA 845; [2005] 2 Lloyd’s Rep. 701, at [12]. With regard to the question of liability
regarding the burglary, the insurers sought to rely on the following exclusion clause, excluding loss
arising from: “other erasure loss distortion or corruption of information on computer systems or
other records programmes or software unless resulting from a Defined Peril in so far as it is not
otherwise excluded.” It was argued that the physical loss of the data that was stored on the stolen
desktop computers and the print out were covered by the above exclusion and, as theft or burglary
was not a “Defined Peril” under the policy, that such loss could not be recovered. The majority of
the Court of Appeal (Carnwath LJ dissenting) rejected this point as well. It was held that in the
context of the whole clause, the word “loss” did not extend to physical loss by theft, but referred
only to loss by means of electronic interference. The draftsman’s use of words in this clause was
seen as “linguistic overkill” in that a number of words and phrases were used all expressing more or
less the same idea. The majority expressed the view that they would have expected the exclusion of
such a different type of loss as physical loss to be covered in a separate clause.
34 The point was made authoritatively in Impact Funding Solutions Ltd v. AIG Europe Insurance Ltd
[2016] UKSC 57. See, also, Crowden v. QBE [2017] EWHC 2597 (Comm).
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
639