Cyber Threats

Cyber Challenges Still Evolving

A lack of available data hamstrings cyber-risk underwriting, no matter what the exposure.
By: | May 26, 2015 • 4 min read

Some chief information security officers fail to see the value of standalone cyber-risk coverage, while some brokers give the impression that traditional policies cover many of the same risks.

These factors have contributed to surprisingly low recent take-up on standalone cyber coverage, according to Charles Cowan, counsel to law firm Drinker Biddle & Reath’s insurance transactional and regulatory team.


Cowan and Andrea Best, a partner with Drinker Biddle, addressed four emerging areas of cyber-related risk on May 19 in the Old Lloyd’s Library, built in 1928 and now in the basement at Lime Street. That very day, Lloyd’s announced its move into cyber coverage in Poland.

In the heavily wood-paneled atmosphere of the past, the speakers addressed four potential horsemen of the digital apocalypse.

Cyber-risk itself, drones, autonomous vehicles, and ride/car share all fall under the cyber umbrella and share a primary reliance on data that is largely not yet available, given the newness of the risks. The lack of data means that none of these risks is yet properly understood.


“First and foremost in cyber risk,” said Cowan, “is the need for data. Not a lot of reliable data exists about incidents and where future potential attacks might be, or of what size.”

Cowan added that little litigation has yet taken place to clarify the validity of exclusions. The wording of the standard war exclusion “requires a hostile act by a foreign Government,” he said, “without naming names.” The Sony hack, reportedly by the Government of North Korea, came to mind.

Following another hack that exposed some 80 million customer and employee records at Anthem Health Insurance, the company notified and conducted its correspondence with its customers on paper, Cowan said. (Target experienced further opportunist email hacking after advising its customers by email that the personal data of up to 70 million customers, including credit card numbers, had been stolen in late 2013.)

“For larger breaches, costs can be astronomical,” Cowan said, citing a three-year-old U.S. report that valued the average stolen record at about $180. Cowan, who had left Lloyd’s three weeks earlier, is now working with the Department of Homeland Security on garnering more timely information.


About 80 percent of commercial unmanned aerial systems, or drones, are used in agriculture. The U.S. economy might expect to earn $82 billion from the use and knock-on effects of drones by 2025, and the FAA is due to issue a set of standards in this as-yet largely unregulated area.

Liability issues abound: criminal activity, matters of privacy and trespass, nuisance and general danger, air traffic problems, misdirected payloads, and of course hacking. “Any system is hackable,” Cowan said.

Autonomous Vehicles

The Institute of Electrical and Electronics Engineers forecasts that as many as 75 percent of all vehicles, some with removable steering wheels, are expected to be autonomous by 2030, Best said. Legislation in the U.S. is being enacted at the state level (five states plus Washington, D.C.), or has failed (12 states), or is not being considered at all.

Autonomous vehicles will require sensors for vehicle-to-vehicle communication, “but we’ll also have to have sensors on buildings, bridges, traffic lights and other objects we’ll have to navigate around,” Best said.

“The ultimate question, if this technology really takes off, and is so safe, is how much of an automobile insurance coverage market will there be left?” — Andrea Best, partner, Drinker Biddle & Reath

It is not yet clear who will need coverage. Manufacturers of the vehicles? Of component parts? Of the sensors? One known unknown is whether driver premiums for autonomous vehicles will fall, due to the lowered risk, or increase for traditional hands-on drivers.

“The ultimate question, if this technology really takes off, and is so safe, is how much of an automobile insurance coverage market will there be left?” Best asked.

Coverage challenges include the reliability and vulnerability of the technology, the adaptability of the driving public, and the hackability of the autonomous systems.

“These are probably just interim challenges,” Best said. “Given the level of investment, and how much of a push there is for (autonomous vehicles), these issues will fall away.”

Ride/Car Sharing

The former will be familiar from transportation network companies such as Uber, which arrange one-time shared rides on short notice, and others that arrange transportation for a fee using online technology platforms.


The latter includes peer-to-peer car rentals organized by program administrators (such as RelayRides and Getaround) for short periods of time.

“Both services present new insurance coverage challenges,” Best said.

Ride-sharing is typically excluded from personal auto policies, creating coverage gaps. NAIC has issued a white paper to help state insurance regulators, and legislation is pending in more than 35 states. Similar coverage gaps exist in the car-sharing realm.

As if these four risks were not enough to digest, on the subject of emerging risks, in Best’s words, “we could have covered any number of topics and be here for hours.”

Roger Crombie is a United Kingdom-based columnist for Risk & Insurance®. He can be reached at [email protected]

Risk Report: Marine

Crewless Ships Raise Questions

Is a remote operator legally a master? New technology confounds old terms.
By: | March 5, 2018 • 6 min read

For many developers, the accelerating development of remote-controlled and autonomous ships represents what could be the dawn of a new era. For underwriters and brokers, however, such vessels could represent the end of thousands of years of maritime law and risk management.

Rod Johnson, director of marine risk management, RSA Global Risk

While crewless vessels have yet to breach commercial service, there are active testing programs. Most brokers and underwriters expect small-scale commercial operations to be feasible in a few years, but that outlook only considers technical feasibility. How such operations will be insured remains unclear.

“I have been giving this a great deal of thought, this sits on my desk every day,” said Rod Johnson, director of marine risk management, RSA Global Risk, a major UK underwriter. Johnson sits on the loss-prevention committee of the International Union of Maritime Insurers.

“The agreed uncertainty that underpins marine insurance is falling away, but we are pretending that it isn’t. The contractual framework is being made less relevant all the time.”

Defining Autonomous Vessels

Two types of crewless vessels are being contemplated. First up is a drone with no one on board but actively controlled by a human at a remote command post on land or even on another vessel.

While some debate whether the controllers of drone aircrafts are pilots or operators, the very real question yet to be addressed is if a vessel controller is legally a “master” under maritime law.


The other type of crewless vessel would be completely autonomous, with the onboard systems making decisions about navigation, weather and operations.

Advocates tout the benefits of larger cargo capacity without crew spaces, including radically different hull designs without decks people can walk on. Doubters note a crew can fix things at sea while a ship cannot.

Rolls-Royce is one of the major proponents and designers. The company tested a remote-controlled tug in Copenhagen in June 2017.

“We think the initial early adopters will be vessels operating on fixed routes within coastal waters under the jurisdiction of flag states,” the company said.

“We expect to see the first autonomous vessel in commercial operation by the end of the decade. Further out, around 2025, we expect autonomous vessels to operate further from shore — perhaps coastal cargo ships. For ocean-going vessels to be autonomous, it will require a change in international regulations, so this will take longer.”

Once autonomous ships are a reality, “the entire current legal framework for maritime law and insurance is done,” said Johnson. “The master has not been replaced; he is just gone. Commodity ships (bulk carriers) would be most amenable to that technology. I’m not overly bothered by fully automated ships, but I am extremely bothered by heavily automated ones.”

He cited two risks specifically: hacking and fire.

“We expect to see the first autonomous vessel in commercial operation by the end of the decade. Further out, around 2025, we expect autonomous vessels to operate further from shore — perhaps coastal cargo ships. For ocean-going vessels to be autonomous, it will require a change in international regulations, so this will take longer.” — Rolls-Royce Holdings study

Andrew Kinsey, senior marine risk consultant, Allianz Global Corporate & Specialty, asked an even more existential question: “From an insurance standpoint, are we even still talking about a vessel as it is under law? Starting with the legal framework, the duty of a flag state is ‘manning of ships.’ What about the duty to render assistance? There cannot be insurance coverage of an illegal contract.”

Several sources noted that the technological development of crewless ships, while impressive, seems to be a solution in search of a problem. There is no known need in the market; no shippers, operators, owners or mariners advocate that crewless ships will solve their problems.

Kinsey takes umbrage at the suggestion that promotional material on crewless vessels cherry picks his company’s data, which found 75 percent to 90 percent of marine losses are caused by human error.


“Removing the humans from the vessels does not eliminate the human error. It just moves the human error from the helm to the coder. The reports on development by the companies with a vested interest [in crewless vessels] tend to read a lot like advertisements. The pressure for this is not coming from the end users.”

To be sure, Kinsey is a proponent of automation and technology when applied prudently, believing automation can make strides in areas of the supply chains. Much of the talk about automation is trying to bury the serious shortage of qualified crews. It also overshadows the very real potential for blockchain technology to overhaul the backend of marine insurance.

As a marine surveyor, Kinsey said he can go down to the wharf, inspect cranes, vessels and securements, and supervise loading and unloading — but he can’t inspect computer code or cyber security.

New Times, New Risks

In all fairness, insurance language has changed since the 17th century, especially as technology races ahead in the 21st.

“If you read any hull form, it’s practically Shakespearean,” said Stephen J. Harris, senior vice president of marine protection UK, Marsh. “The language is no longer fit for purpose. Our concern specifically to this topic is that the antiquated language talks about crew being on board. If they are not on board, do they still legally count as crew?”

Harris further questioned, “Under hull insurance, and provided that the ship owner has acted diligently, cover is extended to negligence of the master or crew. Does that still apply if the captain is not on board but sitting at a desk in an office?”

Andrew Kinsey, senior marine risk consultant, Allianz Global Corporate & Specialty

Several sources noted that a few international organizations, notably the Comite Maritime International and the International Maritime Organization, “have been very active in asking the legal profession around the world about their thoughts. The interpretations vary greatly. The legal complications of crewless vessels are actually more complicated than the technology.”

For example, if the operational, insurance and regulatory entities in two countries agree on the voyage of a crewless vessel across the ocean, a mishap or storm could drive the vessel into port or on shore of a third country that does not recognize those agreements.

“What worries insurers is legal uncertainty,” said Harris.

“If an operator did everything fine but a system went down, then most likely the designer would be responsible. But even if a designer explicitly accepted responsibility, what matters would be the flag state’s law in international waters and the local state’s law in territorial waters.


“We see the way ahead for this technology as local and short-sea operations. The law has to catch up with the technology, and it is showing no signs of doing so.”

Thomas M. Boudreau, head of specialty insurance, The Hartford, suggested that remote ferry operations could be the most appropriate use: “They travel fixed routes, all within one country’s waters.”

There could also be environmental and operational benefits from using battery power rather than conventional fuels.

“In terms of underwriting, the burden would shift to the manufacturer and designer of the operating systems,” Boudreau added.

It may just be, he suggested, that crewless ships are merely replacing old risks with new ones. Crews can deal with small repairs, fires or leaks at sea, but small conditions such as those can go unchecked and endanger the whole ship and cargo.

“The cyber risk is also concerning. The vessel may be safe from physical piracy, but what about hacking?” &

Gregory DL Morris is an independent business journalist based in New York with 25 years’ experience in industry, energy, finance and transportation. He can be reached at [email protected]