News for hackers. Stuff that matters.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jeremyjh on Saturday February 02, 2019 @11:56AM (#19064024)
It should not be covered because there is a statement in the policy that it is not covered. The only controversial thing here is whether or not this actually was an act of war, and that is something the insurance company must prove.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by k__ on Saturday February 02, 2019 @12:02PM (#19064080)
What does prove even mean in that context?
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @12:18PM (#19064199)
That the insurance company feels comfortable nobody will punish them for stealing your money. Their business model is who can they get away with not helping really.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @07:52PM (#19066999)
This is a very strange point of view.

If they are stealing, they aren't doing it very well! Insurance companies tend to only have profit margins around ~5%.

And what does that mean about insurance buyers? Are they all idiots for buying insurance, since it just means their money will get stolen?

Insurance companies can't afford to pay out any more than they need to; doing so would raise premiums for all customers and make their products less appealing in a fairly competitive industry.

Whether NotPetya was an "act of war" (a legal term of art), is a legitimately interesting discussion! To have it reduced to "those insurance companies are stealing" is depressingly simplistic.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @08:14PM (#19067105)
That ~5% worked out to almost 4 billion profit last year for my healthcare company. They are incentivized to decline coverage as much as they possibly can and have a long history showing they want to.

https://en.wikipedia.org/wiki/Anthem_(company)#Controversies

    The DMHC randomly selected 90 instances where Anthem Blue 
    Cross canceled the insurance of policy holders who had 
    been diagnosed with costly or life-threatening illnesses, 
    to find how many of these cancellations were legal. The 
    agency concluded that all these cancellations were 
    illegal.
Falling on "it was an act of war" when no government has declared such a war is nothing more than creative accounting. (this is also Anthem)

    On 17 March 2010, WellPoint announced it was reclassifying 
    some of its administrative costs as medical care costs in 
    order to meet new loss ratio requirements under the health 
    care law, which requires insurers to spend at least 80% or 
    85% of customer premiums on health care services, 
    depending on the type of plan.[5
https://www.quora.com/How-many-people-die-in-the-US-each-yea...

https://www.nytimes.com/2007/03/26/business/26care.html

https://www.thedailybeast.com/my-insurance-company-killed-me...

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @08:58PM (#19067291)
Yes, they are profit making companies. Those profits are distributed to investors, in the case of Anthem, that's mostly institutional investors, i.e. people's retirement funds. What's your point?

Anthem's 4% margins are well below the S&P 500 average of 11%. If Anthem was simply stealing surely their margins would be a little higher? And who are the idiots buying Anthem insurance? I mean, if it was just stealing, everyone would take their money somewhere else, no?

Of course the truth is not simple, but rather complex. Most any company has a "Controversies" section on their wikipedia page. Toyota once shipped a car with bad brakes. What does it mean? Are all companies simply stealing?

Yes, insurance companies are incentivized to decline coverage, so that they can lower premiums (to compete) and increase margins. But they are also incentivized to payout because if they don't, people stop buying insurance.

> Falling on "it was an act of war" when no government has declared such a war is nothing more than creative accounting. (this is also Anthem)

Quite certain that is not how the courts will interpret the term "act of war." In international law, for example, there is certainly no precedent that a government declaration of war is required for an act to be considered an act of war. Any aggressive act can potentially be considered an act of war.

If Russia decided to blow up a bunch of US freighters, sans-declaration of war, fairly certain the act could pass as an act of war.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @09:06PM (#19067318)
If California had investigated 100 of Anthem's paying customers' cancelled policies at random, instead of 90, and found 100 were illegally cancelled because of the cost instead of the 90 out of 90 they found to be illegally cancelled because of the cost, would it be stealing then?

What is it if it's not stealing when you take people's money in exchange for a service but illegally close their account and keep the money they paid instead of providing the service?

    In May 2014, Anthem Blue Cross refused to pay for the 
    hospitalization of a Sonoma County, California man for 
    stage four cancers, although he had paid Anthem over 
    $100,000.00 in premiums.[61][62] Anthem ended up paying 
    for coverage following public outcry.[63].
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @10:11PM (#19067570)
You are making the following argument:

1. Anthem Insurance stole from policy holders. 2. Ergo, Zurich Insurance stole from Mondelez.

If you are going to make a claim that all insurers are systematically stealing from their customers, I think you are a long way off. So Toyota sometimes ships cars with bad breaks. Ergo all car companies are trying to kill drivers?

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by benologist on Saturday February 02, 2019 @10:16PM (#19067587)
Are health insurance companies abnormal or representative of non-health insurance companies? Zurich Insurance doesn't look better at all based on the submitted article -

    specifically covered “all risks of physical loss or 
    damage” and “all risk of physical loss or damage to 
    electronic data, programs or software” due to “the 
    malicious introduction of a machine code or instruction.”
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by gubbrora on Saturday February 02, 2019 @09:27PM (#19067409)
5% profit margin doesn't mean I will lose 5% on average. My risk will be pooled with reckless people and scammers. I know I am neither but my insurance company doesn't.

Then there are the sales and administration costs that need to be paid. On both their side (coming out of my premium) and on my side (coming out of my free time). I don't like keeping receipts and I don't like filing claim.

All in all I'd lose much more than 5%.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaggederest on Saturday February 02, 2019 @03:54PM (#19065651)
Actually most insurance companies pay out more money in losses than they take in via premiums.

The real business models for insurance companies isn't underwriting profits, it's arbitraging the time value of money (pay premiums now, pay claims later) via investing the float.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by a1369209993 on Saturday February 02, 2019 @05:28PM (#19066188)
That's not more money though; that's less money exchanged into a weaker (more inflated) currency. Four pounds isn't more than three kilograms just because the number is larger.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by nradov on Sunday February 03, 2019 @08:46AM (#19069512)
That might have been true at some point in history but is no longer possible in a ZIRP environment.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @08:01PM (#19067040)
In this context, "prove" means convince a judge of the Cook County court that the NotPetya ransomware was not an ordinary cyber attack, but rather a Russian act of war against the US.

I think Zurich's point of view is not untenable. If a Russian military submarine had sunk a Mondelez freighter, would it be an act of war? I think possibly. What if a Russian military cyber hacking squad steals their money with ransomware? Less clear, but still certainly a belligerent act on Russia's part.

Of course Zurich will need to present a convincing case that the cyber attack was committed by the Russian government.

Will be an interesting case.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by raincom on Saturday February 02, 2019 @01:13PM (#19064576)
I think Courts will decide on that matter. The insurance company says some govts claim that these are actions perpetrated by Russia. If courts accept it, they have to decide do these come under the scope of "acts of war". Courts will ask that insurance company to provide more than a newspaper claims. So, they will ask for evidence whether Russia indeed committed these.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by anigbrowl on Saturday February 02, 2019 @03:03PM (#19065321)
You're just restating the insurance company's position. The issue is why don't insurance companies want to cover people against war, and the answer is that that's when the people you relied on take the money and run because there's a decent chance that their erstwhile customers will die (physically or financially) and never be able to come after them.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by Ntrails on Saturday February 02, 2019 @03:57PM (#19065669)
They will absolutely cover acts of war. It is simple - just ask them to and hand over the extra money.

There is essentially no risk that cannot be insured, but the standard pricing is going to exclude a bunch of tail risks that would be prohibitively expensive to include by default

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jeremyjh on Saturday February 02, 2019 @04:21PM (#19065786)
I think there are probably risks that cannot be insured in practice. One of the particulars of war is that it might destroy many insured parties at once, overwhelming any conceivable insurance syndicate. Yes, you could perhaps sell a few policies with limited coverage, but if you cannot credibly calculate the probability of the event occurring it seems hard to imagine there is a price that will make sense to both parties.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by Ntrails on Monday February 04, 2019 @06:24AM (#19075447)
That's no different to any other catastrophe. Earthquake or tsunamis etc.

> it seems hard to imagine there is a price that will make sense to both parties.

The price you'd have to pay is likely to be extremely high due to the value at risk and level of uncertainty, and yes insurance companies would also be modelling their exposure and stop selling at some point. A single tanker, for example, could almost certainly find a price at Lloyds.

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @07:45PM (#19066964)
As have been pointed out by others, insurance companies are more than happy to cover acts of war in exchange for higher premiums.

Some insurance policies cover acts of god (extremely rare disasters), some don't. They are priced accordingly. I'm sure it is no different with acts of war or anything else.

Insurance companies pretty consistently report ~5% profit margins. Surely if they were simply stealing, their margins would at least be reaching Google levels?

Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by lazyasciiart on Saturday February 02, 2019 @08:40PM (#19067223)
I don't think low margins is a good way to define not-theft. Golden goose, you know.
Re:Insurance Company Says NotPetya Is an “Act of War”, Refus... by jaredklewis on Saturday February 02, 2019 @10:22PM (#19067618)
Fair enough. Though I guess I just don't see how the argument that insurance companies are "bad guys" has any legs.

Yes, insurance companies only want to pay out when they are contractually obligated to do so. That is patently obvious. If insurance companies paid out when they weren't, insurance would be much more expensive than it is now.

If an insurance company is unsure a situation is contractually covered, they will not pay, and a court will decide the case. Once such ambitious cases are clarified, all future parties benefit.

I don't see anything shady or underhanded about any of this. Especially since it is all basically part of the definition of what an insurance company is!