Since cyber war has yet to occur, this means all other hacking incidents perpetrated by nation-states and terrorist organizations to date have been something less. Nevertheless, many government officials and respected publications have a tendency to overuse the term. In March, for example, The New York Times wrote in a headline: “Trump Inherits a Secret Cyber War Against North Korean Missiles.” The Atlantic in July 2016 reported,
“The Defense Department launched into a full-on cyberwar against the Islamic State.”
When North Korea allegedly conducted an effective cyber attack against Sony Pictures Entertainment in response to a film that ridiculed its leader, Sen. John McCain, R-Ariz., called it a “manifestation of a new form of warfare.” He added: “When you destroy economies, when you are able to impose censorship on the world and especially the United States of America, it’s more than vandalism.”
Despite his tendency to shoot from the hip when speaking and tweeting, President Donald Trump has yet to call a hacking incident an act of cyber war, including the recent WannaCry ransomware attack allegedly perpetrated by North Korea. But if he did utter the words, would that legally give insurers freedom to activate the war exclusion in their policies and not pay related claims?
In 2001, President George W. Bush clearly perceived the terrorist attacks on Sept. 11, to be the equivalent of war, stating that the “enemies of freedom committed an act of war against our country.” He further commented, “Our war on terror begins with al Qaeda but does not end there.”
Despite this informal declaration of war, the insurance industry did not exclude coverage to the hundreds of businesses affected by the terrorist attacks. Within hours of the attacks, Robert Hartwig, then president of the Insurance Information Institute, was in the difficult position of being asked by The Wall Street Journal whether the property losses would be covered by insurance.
“I instantly said yes,” recalls Hartwig, today a professor of finance at the University of South Carolina. “I felt the attacks did not fit the technical definition of war. Within two days, the industry came to the same conclusion, ultimately paying out more than $30 billion in claims.”