Cyberinsurance Policy: Rethinking Risk In An Age Of Ransomware, Computer Fraud, Data Breaches, And Cyberattacks

Description

Why cyberinsurance has not improved cybersecurity and what governments can do to make it a more effective tool for cyber risk management. As cybersecurity incidents—ranging from data breaches and denial-of-service attacks to computer fraud and ransomware—become more common, a cyberinsurance industry has emerged to provide coverage for any resulting liability, business interruption, extortion payments, regulatory fines, or repairs. In this book, Josephine Wolff offers the first comprehensive history of cyberinsurance, from the early “Internet Security Liability” policies in the late 1990s to the expansive coverage offered today. Drawing on legal records, government reports, cyberinsurance policies, and interviews with regulators and insurers, Wolff finds that cyberinsurance has not improved cybersecurity or reduced cyber risks. Wolff examines the development of cyberinsurance, comparing it to other insurance sectors, including car and flood insurance; explores legal disputes between insurers and policyholders about whether cyber-related losses were covered under policies designed for liability, crime, or property and casualty losses; and traces the trend toward standalone cyberinsurance policies and government efforts to regulate and promote the industry. Cyberinsurance, she argues, is ineffective at curbing cybersecurity losses because it normalizes the payment of online ransoms, whereas the goal of cybersecurity is the opposite—to disincentivize such payments to make ransomware less profitable. An industry built on modeling risk has found itself confronted by new technologies before the risks posed by those technologies can be fully understood. Cover Half title Series title Title Copyright Dedication Contents Series Editor’s Introduction Acknowledgments 1 | Introduction: A Market-Driven Approach to Cybersecurity I | History of Cyberinsurance 2 | Breach on the Beach: Origins of Cyberinsurance The Development Of Auto Insurance Flood Insurance: “A Tool That Should Be Used Expertly Or Not At All” “An Irresistible Target For Financial Knaves And Buccaneers” Early Cyberinsurance Policies Data Breach Notification Laws SEC Guidance On Cyber Risks II | Cybersecurity Claims Under Non-Cyber Coverage 3 | “The Hackers Did This”: Data Breach Lawsuits and Commercial General Liability Insurance Negligent Cybersecurity And Liability For Data Breaches Zurich v. Sony: Pandora's Box Innovak International Inc. And Indirect Publication Rosen Hotels & Resorts And Coverage For Breach Notification Costs 4 | “The Point of No Return”: Computer Fraud Insurance and Defining Cybercrime Intervening Events And Immediate Causes: Brightpoint v. Zurich Hacking, Unauthorized Access, And Pestmaster v. Travelers Phising, Ambiguous Definitions, And American Tooling v. Travelers “Armed With A Computer Code”: Medidata Solutios v. Federal Insurance Company Overlapping Coverange And National Bank Of Blacksburg v. Everest 5 | “Insurrection, Rebellion, Revolution, Riot”: NotPetya, Property Insurance, and War Exclusions Property Insurance And Open-Peril Coverage “War In The Only Sense That Men Know And Understand it”: War Exclusions And Pearl Harbor “A Most Unusual And Explicit Contract”: Terrorism And Overlapping Coverage Mondelez, Notpetya, And Cyberwar No Claw Backs III | Cyber Coverage and Regulation 6 | “The Big Kahuna”: Stand-Alone Cyber Coverage Incomplete And Inconsistent Data Interconnected And Systematic Risks Moral Hazard And Preventive Measures Cyber Risk Insurance Partnerships The Fallacy Of The Stand-Alone Model 7 | “What Is the Point of Collecting Data?”: Global Growth of Cyberinsurance and the Role of Policymakers The Cybersecurity Policy Boom Cyberinsurance Policy Efforts In The United States Cyberinsurance In The European Union Cyberinsurance In China Emerging Cyberinsurance Markets: Brazil, India, And Singapore Policy Approaches To Cyberinsurance 8 | Conclusion: Is Cyber Risk Different? Notes Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 References Index