Risk scenarios in third-party insurance

The high proportion of unreported losses leaves insurers with very little statistical material to calculate the technical premium level.

Despite intensive and lengthy analysis, the insurance industry has so far failed to develop a reliable procedure for IT risks which can be used to calculate potential accumulation losses on a PML basis. However, in order to maintain calculability of the risks, Munich Re pretty much rules out the possibility of insuring first-party risks which go beyond classic property losses, such as data media or computer systems.

An additional problem is that pure financial losses or property damage which occur as a result of the loss or manipulation of data are defined differently in different countries. In a worst-case scenario, insurers could be obliged to accept covers for which they have performed no risk assessment or received no premiums. It is therefore in the interests of primary insurers to make sure that their policies contain a clear separation of IT losses and property damage.

Given the ultimately incalculable accumulation risk, the risk of a breakdown in external networks is also not covered, for example when an excavator breaks communication cables. On the other hand, detailed risk analyses have revealed the insurability of a hacker attack which targets a specific company, as there is no risk of accumulation in such cases.

Risk scenarios in third-party insurance

In addition to the first-party losses outlined above, the internet can also give rise to significant liability claims by third parties. These third-party losses can be divided into the following categories: business interruption risk, security risk, media risk. If the first two categories involve "new exposures" in connection with internet use, the media risk has been familiar to insurers for a number of years.

However, the internet has significantly changed the quality of the risk. Specifically, this means that the spread of information has become much faster and more global simply by means of a mouse click (one click - one spread).

However, the main focus of attention in liability concerns the risks of business interruption and security. As the economy becomes increasingly dependent on electronic media, so the risk of threats from interruption losses has also increased. For example, many companies use the internet as an additional sales and distribution network. If a company suffers an interruption loss and cannot contact its (potential) customers online, the amount of pure financial loss suffered depends not only on the length of this interruption but also crucially on the extent to which traditional sales channels can be used to compensate for the internet failure. Breakdowns can even threaten the very existence of companies that sell exclusively online.

next page »

Loss of image

The subject of the security risk is closely linked to the problem of "loss of image". A bank which fails to adequately protect sensitive client data and thus makes it possible for unauthorised third parties to gain access to this data will certainly have to carefully weigh up the monetary loss against the potential image loss that would no doubt follow once the public finds out about the lack of security. This is a major problem for the insurance industry. The high proportion of unreported losses leaves insurers with very little statistical material to calculate the technical premium level.

Computer viruses are another problem in liability insurance. The problems viruses cause in liability are quite different to those in property insurance. If the risk-assessment process has yielded a positive result, virus risks are certainly insurable in third-party insurance. Unlike first-party losses, liability cases must establish without doubt that the policyholder's conduct was the cause of and at fault for transmission of the virus. This is frequently not the case if even a state-of-the-art security software would have failed to detect the virus. In fact, most newly programmed viruses generally manage to evade detection by even the latest security software. The problem of accumulation losses still exists here but in this case liability would almost certainly be rejected.

The principle of negligence on the part of policyholders (i.e. they unintentionally forwarded the viruses) usually required for third-party claims is a further obstacle to liability. Even if state-of-the-art security software could have identified a virus, a policyholder is only liable if at fault for the failure to upgrade the security software.

However, there remains significant scope for interpretation in defining the requirements of individual cases vis-à-vis the quality and currency of security software. A further factor of uncertainty are the requirements regarding duty of care, how this is handled and how jurisdiction in loss events is tackled very differently in different countries.

It is also necessary to examine the question of whether contributory negligence on the part of the recipient of the virus has any mitigating effect. It is obvious that the forwarded virus was only able to inflict damage because the recipient had also failed to install state-of-the-art security software. However, it is questionable whether the recipient should be burdened with the same standards as the transmitter of the virus.

« previous page