Prove It! Judging the Hostile-or-Warlike-Action Exclusion in Cyber Insurance Policies

In late 2018, snack-food giant Mondelez International sued Zurich insurance for improperly denying coverage for losses caused by the NotPetya computer virus. Zurich has asserted an exclusion for hostile and warlike actions by a sovereign or its agents. Zurich's exclusion argument is not atypical; many standalone cyber insurance policies contain similar exclusions. As a result, the case has garnered significant attention among insurance experts. This Essay explores the challenges facing insurers and insureds litigating denials of coverage under such an exclusion.The current legal framework is ill-equipped to handle litigation that arises when insurers deny coverage citing the hostile-or-warlike-action exclusion. To assert the exclusion, the insurer must demonstrate both that the act was perpetrated by a sovereign or its agent and that the act is hostile or warlike. Insurers and insureds face significant hurdles on both fronts. This Essay explores the significant difficulties of accurately determining the source of a hack, analyzes the implications for determining insurance coverage with respect to the hostile-or-warlike-action exclusion, and offers several novel proposals for improving cyberattack attribution and adjudicating coverage disputes