Y2K Rears Its Head One More Time

In the late 1990s, in the run up to Jan. 1, 2000, insurers deployed Y2K or “electronic date recognition” exclusions into a multitude of insurance policies. The logic made sense: The Y2K date change was a known risk and something that firms should have worked to eliminate, and, if Armageddon did materialize, well, that’s not something that the insurance industry wanted to cover anyway. Sixteen years later, one would expect to find Y2K exclusions only in the Lloyds of London “Policy Wording Hall of Fame.” But no so fast. Electronic date recognition exclusions are still frequently included in a variety of insurance contracts, even though it’s doubtful that many folks have given them more than a passing glance while chuckling about the good old days. And now is the time to take a closer look. Last month, various cybersecurity response firms discovered that a new variant of the Shamoon malware was used to attack a number of firms in the Middle East. In 2012, the original version was used to successfully attack Saudi Aramco and resulted in its needing to replace tens of thousands of desktop computers. Shamoon was used shortly thereafter to attack RasGas, and, most notoriously, the malware was used against Sony Pictures in late 2014. Shamoon has caused hundreds of millions of dollars of damages. The new version, Shamoon v2, changes the target computer’s system clock to a random date in August 2012 -- according to research from FireEye, the change may be designed to make sure that a piece of software subverted for the attack hasn't had its license expire. This change raises issues under existing electronic date recognition exclusions because many are not specifically limited to Jan. 1, 2000; they instead feature an “any other date” catch all. For example, one of the standard versions reads, in part: “This Policy does not cover any loss, damage, cost, claim or expense, whether preventative, remedial or otherwise, directly or indirectly arising out of or relating to any change, alteration, or modification involving the date change to the year 2000, or any other date change, including leap year calculations, to any such computer system, hardware, program or software and/or any microchip, integrated circuit or similar device in computer equipment or non-computer equipment, whether the property of the Insured or not.” See also: Insurance Is NOT a Commodity!   By our estimation, this exclusion is written broadly enough to exclude any losses resulting from a Shamoon v2 attack, if indeed the malware’s success is predicated on the change in system dates to 2012. Given that the types of losses that Sony and Saudi Aramco suffered can be insured, firms shouldn’t be caught off guard. We advise a twofold approach: Work with your insurance broker to either modify language or consider alternative solutions; and ensure that your cybersecurity leaders are monitoring your systems for indicators of compromise, including subtle measures like clock changes.