State-Backed Exclusions and the Attribution Problem

After NotPetya, the cyber market did not abandon the war exclusion; it rewrote it for the medium. The most influential rewrite came through the Lloyd's Market Association, which developed a family of cyber war and state-backed cyber attack exclusion clauses and moved to require that standalone cyber policies written in that market carry a clear state-backed exclusion. The clauses were designed to do what the legacy language could not: address cyber operations directly, exclude losses arising from state-backed cyberattacks, and define the terms of engagement explicitly rather than leaving a court to decide whether malware counts as an act of war.

These modern clauses are more sophisticated than a blanket exclusion. Several versions distinguish between cyber operations that occur during and as part of a declared or actual war and lower-intensity state-backed attacks that fall short of war. Some contain carve-backs — for instance, attempting to preserve some coverage for so-called bystanding assets, systems located outside the states directly at conflict, to soften the harshest reading. The drafting is deliberate and varied, and the differences between clause versions are the substance of the negotiation. An operator's broker earns its fee here, in knowing which version a given market is using and what it does to a realistic loss scenario.

But rewriting the words only relocated the hard problem. It did not solve it. The hard problem is attribution: deciding that a particular state was responsible for a particular attack. In physical warfare, attribution is usually visible — uniformed forces, claimed territory, declared hostilities. In cyberspace, attribution is contested by design. Attackers route through third countries, borrow criminal infrastructure, plant false flags, and operate through proxies whose relationship to any government is deliberately ambiguous. The technical work of attribution is slow, probabilistic, and frequently classified. And yet the modern exclusion turns on it: if the loss is attributed to a state, the policy may not pay; if it is not, the policy may.

This raises the decisive question a practitioner must ask of any state-backed exclusion: who decides attribution, and by what standard? The clause versions differ. Some lean on formal government attribution — the exclusion engages if the government of the state where the affected systems are located, or another relevant government, attributes the attack to a state. That standard has a clean logic but a real weakness: governments attribute selectively and slowly, and may decline to attribute at all for diplomatic reasons, leaving the coverage question unresolved for years. Other approaches allow the insurer to rely on inference from available evidence where a formal attribution is absent, which is more workable but hands the insurer significant discretion over the very fact that determines whether it pays. Neither standard is neutral. Whoever holds the attribution decision holds the coverage decision.

See the structural stakes clearly. The war exclusion for cyber is not really a debate about war. It is a debate about who gets to characterize an event, and on what evidence, when the characterization determines a billion-dollar payment. The operator wants attribution to be hard, formal, and slow, so that ambiguous events resolve in favor of coverage. The insurer wants attribution to be available and inferable, so that the exclusion can engage on the correlated, catastrophic losses it most fears. The clause language is where that contest is fought, phrase by phrase, and the outcome shapes whether the largest cyber losses land on the operator or the market.

For an infrastructure operator, this is not abstract. Critical infrastructure is precisely the target class most likely to attract state or state-aligned attention, which means the state-backed exclusion is most likely to be tested exactly where these operators live. An operator of a grid asset, a pipeline, or a water system faces a heightened probability that any serious attack it suffers will be at least plausibly attributable to a state, and therefore a heightened probability that its most severe loss is the one the exclusion is built to deny. That is a sobering alignment: the operators with the most at stake face the exclusion at its sharpest.

The practitioner's discipline is to negotiate attribution before an incident, not to discover it during one. Read the exact state-backed clause. Identify who decides attribution and by what standard. Test the clause against a realistic scenario — a plausibly state-linked attack on the operator's own systems — and ask honestly whether the policy pays. Where the clause hands the insurer broad discretion, push for a defined, evidence-based standard and clear carve-backs. The goal is not to eliminate the exclusion, which the market will not permit, but to know precisely where its edge falls. An operator who knows the edge can price the residual risk it retains. One who does not has bought a policy whose largest promise dissolves at the exact moment it is most needed.