Cyber insurance's war exclusion was drafted for navies and now decides who pays for a network attack
The clause that lets an insurer refuse a cyber claim because the attack was an act of war was written for ships, fleets and sovereigns. NotPetya forced courts to read it against a piece of malware, and the answer was that the wording did not fit. Insurers rewrote it. The new wording depends on attribution by a government, which is a political judgment rather than a legal finding, and that is the part nobody has resolved.
