News for hackers. Stuff that matters.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jopsen on Saturday February 02, 2019 @11:08AM (#19063692)
Why should "act of war" not be covered?

If I'm going broke because of a war, why shouldn't my insurance company?

Similar, with natural disasters, those should be covered by default -- insurance companies can easily spread the risk geographically..

These exceptions feels like legacy from the "good" old days when wars were common and globalization limited.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by CPLX on Saturday February 02, 2019 @11:17AM (#19063748)
Because insurance companies are generally in the business of insuring unsystemic risk.

The entire model breaks down in cases of systemic risk, unless that has been accounted for and dealt with. Which is why it's a major element of insurance policies.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by daniel-cussen on Saturday February 02, 2019 @11:25AM (#19063801)
In Chile the insurance companies have fine print saying they won't cover injuries resulting from paramilitary activities (reasonably sensible, OK) or anything nuclear, right down to a nuclear bomb.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jhbadger on Saturday February 02, 2019 @02:06PM (#19064936)
Even in the US it is common for home insurance to not cover nuclear war -- mine specifically says it doesn't for example. Although I suspect not getting an insurance settlement would be the least of my concerns in that event.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jopsen on Sunday February 03, 2019 @03:21AM (#19068429)
Today you can insure against systemic risk through re-insursnce in other countries.. this should be a benefit from globalization, right?

So why we keep allowing insurance companies to make these exclusions?

If there is systemic risks to the entire planet, then an insurance company should just go bankrupt.. I mean the survival of a company isn't very important if we talking about the apocalypse :)

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by edanm on Sunday February 03, 2019 @05:15AM (#19068766)
> So why we keep allowing insurance companies to make these exclusions?

In general, we don't have to "allow" contracts between two private parties to happen. We can "not allow" (i.e., outlaw) certain contracts, but an insurance company and a private party can (and should!) set up the contract between them however they please. Especially in a case like this, where the contract is huge, and probably had teams of lawyers from both sides going over all its details.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jeremyjh on Saturday February 02, 2019 @11:56AM (#19064024)
It should not be covered because there is a statement in the policy that it is not covered. The only controversial thing here is whether or not this actually was an act of war, and that is something the insurance company must prove.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by k__ on Saturday February 02, 2019 @12:02PM (#19064080)
What does prove even mean in that context?
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @12:18PM (#19064199)
That the insurance company feels comfortable nobody will punish them for stealing your money. Their business model is who can they get away with not helping really.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @07:52PM (#19066999)
This is a very strange point of view.

If they are stealing, they aren't doing it very well! Insurance companies tend to only have profit margins around ~5%.

And what does that mean about insurance buyers? Are they all idiots for buying insurance, since it just means their money will get stolen?

Insurance companies can't afford to pay out any more than they need to; doing so would raise premiums for all customers and make their products less appealing in a fairly competitive industry.

Whether NotPetya was an "act of war" (a legal term of art), is a legitimately interesting discussion! To have it reduced to "those insurance companies are stealing" is depressingly simplistic.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @08:14PM (#19067105)
That ~5% worked out to almost 4 billion profit last year for my healthcare company. They are incentivized to decline coverage as much as they possibly can and have a long history showing they want to.

https://en.wikipedia.org/wiki/Anthem_(company)#Controversies

    The DMHC randomly selected 90 instances where Anthem Blue 
    Cross canceled the insurance of policy holders who had 
    been diagnosed with costly or life-threatening illnesses, 
    to find how many of these cancellations were legal. The 
    agency concluded that all these cancellations were 
    illegal.
Falling on "it was an act of war" when no government has declared such a war is nothing more than creative accounting. (this is also Anthem)

    On 17 March 2010, WellPoint announced it was reclassifying 
    some of its administrative costs as medical care costs in 
    order to meet new loss ratio requirements under the health 
    care law, which requires insurers to spend at least 80% or 
    85% of customer premiums on health care services, 
    depending on the type of plan.[5
https://www.quora.com/How-many-people-die-in-the-US-each-yea...

https://www.nytimes.com/2007/03/26/business/26care.html

https://www.thedailybeast.com/my-insurance-company-killed-me...

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @08:58PM (#19067291)
Yes, they are profit making companies. Those profits are distributed to investors, in the case of Anthem, that's mostly institutional investors, i.e. people's retirement funds. What's your point?

Anthem's 4% margins are well below the S&P 500 average of 11%. If Anthem was simply stealing surely their margins would be a little higher? And who are the idiots buying Anthem insurance? I mean, if it was just stealing, everyone would take their money somewhere else, no?

Of course the truth is not simple, but rather complex. Most any company has a "Controversies" section on their wikipedia page. Toyota once shipped a car with bad brakes. What does it mean? Are all companies simply stealing?

Yes, insurance companies are incentivized to decline coverage, so that they can lower premiums (to compete) and increase margins. But they are also incentivized to payout because if they don't, people stop buying insurance.

> Falling on "it was an act of war" when no government has declared such a war is nothing more than creative accounting. (this is also Anthem)

Quite certain that is not how the courts will interpret the term "act of war." In international law, for example, there is certainly no precedent that a government declaration of war is required for an act to be considered an act of war. Any aggressive act can potentially be considered an act of war.

If Russia decided to blow up a bunch of US freighters, sans-declaration of war, fairly certain the act could pass as an act of war.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @09:06PM (#19067318)
If California had investigated 100 of Anthem's paying customers' cancelled policies at random, instead of 90, and found 100 were illegally cancelled because of the cost instead of the 90 out of 90 they found to be illegally cancelled because of the cost, would it be stealing then?

What is it if it's not stealing when you take people's money in exchange for a service but illegally close their account and keep the money they paid instead of providing the service?

    In May 2014, Anthem Blue Cross refused to pay for the 
    hospitalization of a Sonoma County, California man for 
    stage four cancers, although he had paid Anthem over 
    $100,000.00 in premiums.[61][62] Anthem ended up paying 
    for coverage following public outcry.[63].
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @10:11PM (#19067570)
You are making the following argument:

1. Anthem Insurance stole from policy holders. 2. Ergo, Zurich Insurance stole from Mondelez.

If you are going to make a claim that all insurers are systematically stealing from their customers, I think you are a long way off. So Toyota sometimes ships cars with bad breaks. Ergo all car companies are trying to kill drivers?

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @10:16PM (#19067587)
Are health insurance companies abnormal or representative of non-health insurance companies? Zurich Insurance doesn't look better at all based on the submitted article -

    specifically covered “all risks of physical loss or 
    damage” and “all risk of physical loss or damage to 
    electronic data, programs or software” due to “the 
    malicious introduction of a machine code or instruction.”
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by gubbrora on Saturday February 02, 2019 @09:27PM (#19067409)
5% profit margin doesn't mean I will lose 5% on average. My risk will be pooled with reckless people and scammers. I know I am neither but my insurance company doesn't.

Then there are the sales and administration costs that need to be paid. On both their side (coming out of my premium) and on my side (coming out of my free time). I don't like keeping receipts and I don't like filing claim.

All in all I'd lose much more than 5%.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaggederest on Saturday February 02, 2019 @03:54PM (#19065651)
Actually most insurance companies pay out more money in losses than they take in via premiums.

The real business models for insurance companies isn't underwriting profits, it's arbitraging the time value of money (pay premiums now, pay claims later) via investing the float.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by a1369209993 on Saturday February 02, 2019 @05:28PM (#19066188)
That's not more money though; that's less money exchanged into a weaker (more inflated) currency. Four pounds isn't more than three kilograms just because the number is larger.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by nradov on Sunday February 03, 2019 @08:46AM (#19069512)
That might have been true at some point in history but is no longer possible in a ZIRP environment.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @08:01PM (#19067040)
In this context, "prove" means convince a judge of the Cook County court that the NotPetya ransomware was not an ordinary cyber attack, but rather a Russian act of war against the US.

I think Zurich's point of view is not untenable. If a Russian military submarine had sunk a Mondelez freighter, would it be an act of war? I think possibly. What if a Russian military cyber hacking squad steals their money with ransomware? Less clear, but still certainly a belligerent act on Russia's part.

Of course Zurich will need to present a convincing case that the cyber attack was committed by the Russian government.

Will be an interesting case.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by raincom on Saturday February 02, 2019 @01:13PM (#19064576)
I think Courts will decide on that matter. The insurance company says some govts claim that these are actions perpetrated by Russia. If courts accept it, they have to decide do these come under the scope of "acts of war". Courts will ask that insurance company to provide more than a newspaper claims. So, they will ask for evidence whether Russia indeed committed these.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by anigbrowl on Saturday February 02, 2019 @03:03PM (#19065321)
You're just restating the insurance company's position. The issue is why don't insurance companies want to cover people against war, and the answer is that that's when the people you relied on take the money and run because there's a decent chance that their erstwhile customers will die (physically or financially) and never be able to come after them.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by Ntrails on Saturday February 02, 2019 @03:57PM (#19065669)
They will absolutely cover acts of war. It is simple - just ask them to and hand over the extra money.

There is essentially no risk that cannot be insured, but the standard pricing is going to exclude a bunch of tail risks that would be prohibitively expensive to include by default

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jeremyjh on Saturday February 02, 2019 @04:21PM (#19065786)
I think there are probably risks that cannot be insured in practice. One of the particulars of war is that it might destroy many insured parties at once, overwhelming any conceivable insurance syndicate. Yes, you could perhaps sell a few policies with limited coverage, but if you cannot credibly calculate the probability of the event occurring it seems hard to imagine there is a price that will make sense to both parties.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by Ntrails on Monday February 04, 2019 @06:24AM (#19075447)
That's no different to any other catastrophe. Earthquake or tsunamis etc.

> it seems hard to imagine there is a price that will make sense to both parties.

The price you'd have to pay is likely to be extremely high due to the value at risk and level of uncertainty, and yes insurance companies would also be modelling their exposure and stop selling at some point. A single tanker, for example, could almost certainly find a price at Lloyds.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @07:45PM (#19066964)
As have been pointed out by others, insurance companies are more than happy to cover acts of war in exchange for higher premiums.

Some insurance policies cover acts of god (extremely rare disasters), some don't. They are priced accordingly. I'm sure it is no different with acts of war or anything else.

Insurance companies pretty consistently report ~5% profit margins. Surely if they were simply stealing, their margins would at least be reaching Google levels?

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by lazyasciiart on Saturday February 02, 2019 @08:40PM (#19067223)
I don't think low margins is a good way to define not-theft. Golden goose, you know.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @10:22PM (#19067618)
Fair enough. Though I guess I just don't see how the argument that insurance companies are "bad guys" has any legs.

Yes, insurance companies only want to pay out when they are contractually obligated to do so. That is patently obvious. If insurance companies paid out when they weren't, insurance would be much more expensive than it is now.

If an insurance company is unsure a situation is contractually covered, they will not pay, and a court will decide the case. Once such ambitious cases are clarified, all future parties benefit.

I don't see anything shady or underhanded about any of this. Especially since it is all basically part of the definition of what an insurance company is!

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by vharuck on Saturday February 02, 2019 @12:12PM (#19064159)
IIUC, it's because a war would likely cause harm to a large number of clients at the same time. The insurance company could not afford to pay so many concurrent claims.

Which makes this case even more important: how could any insurance company guarantee to pay damages caused by a computer virus, when many viruses are designed to quickly spread across many systems?

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by pushtheenvelope on Saturday February 02, 2019 @12:36PM (#19064324)
> IIUC, it's because a war would likely cause harm to a large number of clients at the same time. The insurance company could not afford to pay so many concurrent claims.

disclaimer, I know nothing about the insurance industry, but for sake of intellectual argument:

insurance companies already have to deal with scenarios like this e.g. home earthquake insurance in California.

They do this by re-selling the income and risk from their policies in the "re-insurance" market. This spreads the risk out to counter-parties (who are in the other parts of the US and the world) who buy this stream of income+risk.

In turn, those counter parties are probably buying the income+risk of all kinds of insurance policies from different geographies so any one event of earthquake or war is less likely to catastrophically affect them.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by freewilly1040 on Saturday February 02, 2019 @01:15PM (#19064597)
Yes but even though you might be able to sell “act of war” insurance, like earthquake insurance it wouldn’t be something covered by a generic policy
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jopsen on Sunday February 03, 2019 @03:16AM (#19068409)
But maybe it should be!

Why do we allow these exclusions in the contracts?

I'm sure we have regulation on what can and cannot be part of the insurance terms.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by HillRat on Saturday February 02, 2019 @09:30PM (#19067425)
It arose in the context of maritime shipping, and so was essentially an analogue to floodplain exclusions — i.e., “If you’re going to sail in defiance of a likely sinking or seizure by a hostile power, don’t expect us to make you whole.” It later was included by convention in property and casualty contracts as well.

In the US, at least, Zurich’s attempt to wriggle out of payments would be an uphill battle at best — there are unfavorable judgments in the context of international terror attacks, as well as (in Multi-Foods vs United Commercial) Russian seizure of goods. In the absence of actual war or war-like activities (such as Korea or Vietnam), hard to see how they win. But, hey, even a 5% chance of victory is probably worth the cost of litigation.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by Spooky23 on Saturday February 02, 2019 @12:33PM (#19064299)
Because these institutions have mostly transitioned from mutual insurance companies to public companies.

Their duty is to shareholders vs policy holders.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by thb567 on Sunday February 03, 2019 @07:18AM (#19069216)
I think that the direct loss of lives due to the action and a permanent damage to critical to very important infrastructure is the current guideline to declare a hostile act from a nation state as an act of war