War exclusions and cyber insurance under Estonian law

Estonia was the target of one of the first large-scale state-linked cyber campaigns in 2007 and has since been at the forefront of cyber defence in NATO and the EU. Its geopolitical position also makes war and hostile act exclusions a practical, not theoretical, question for property, cyber, political risk, marine and life insurers. This guide explains how Estonian insurance contract law treats war exclusions, with particular attention to cyber operations. War and geopolitical risk is one of the focus areas of the author's practice.

1. War exclusions as genuine exclusions

Traditional war exclusions ("war, invasion, acts of foreign enemies, hostilities or warlike operations, civil war, rebellion...") describe objective perils independent of the policyholder's conduct. Applying the Supreme Court's test (an analytical conclusion; the Court has not ruled on a war exclusion), they are genuine risk exclusions, not obligations of the policyholder, so the fault and causation filter of § 452 lg 2 of the Law of Obligations Act (võlaõigusseadus, VÕS) does not apply.¹² Their application depends on:

• clear wording (VÕS § 37 lg 3 on surprising terms; § 39 lg 1 on interpretation against the insurer);¹
• proof: the insurer must prove that the loss falls within the exclusion;
• causation as defined in the clause: "directly or indirectly caused by" language extends the exclusion, but its scope is interpreted in the light of its purpose.

War exclusions concern the core definition of the insured risk and are therefore, in principle, exempt from the fairness test of VÕS § 42 lg 1 (§ 42 lg 2), provided they are clear.

2. The cyber problem: attribution and scale

Applied to cyber incidents, traditional war exclusions raise difficult questions:

• Is a cyber operation "war" or a "hostile act"? Without kinetic hostilities, a court must decide whether a malicious cyber operation by a state or state-sponsored group falls within terms drafted for physical warfare. An Estonian court would interpret unclear language against the insurer (§ 39 lg 1).
• Attribution. States rarely acknowledge cyber operations. Attribution by governments (for example joint statements by EU or NATO states) is evidence, but the insurer bears the burden of proving the facts of the exclusion before a civil court.
• Collateral damage. Malware spreading globally (as in widely reported 2017 incidents) may affect insureds who were not targeted. Whether such losses are excluded depends on the wording.

3. Market cyber war clauses

The London market developed model clauses for cyber war and state-backed cyber operations (the LMA 5564–5567 series and similar clauses), and Lloyd's Market Bulletin Y5381 of 17 August 2022 requires standalone cyber-attack policies written at Lloyd's to contain a suitable clause excluding liability for losses arising from state-backed cyber-attacks, at inception or renewal from 31 March 2023 (Lloyd's, Market Bulletin Y5381). These clauses typically:

• exclude losses arising from war (with or without declaration) and from cyber operations carried out in the course of war;
• exclude cyber operations that have a major detrimental impact on the functioning of a state or on its security or defence capabilities;
• provide attribution mechanisms based primarily on attribution by the government of the state in which the affected computer system is located, with fallback rules on inferences;
• carve back cover for "bystanding" systems in some versions.

Under Estonian law, these clauses are likely to be treated as genuine exclusions. Points to watch:

1. Transparency. Complex definitions must be understandable to the policyholder; key terms such as "major detrimental impact" and "essential service" should be defined.
2. Attribution clauses. A clause that makes government attribution conclusive may be viewed as a contractual evidence rule; such agreements are permitted in principle (TsMS § 230 lg 1), but in standard terms vis-à-vis consumers or SMEs they may be tested under VÕS § 42.³
3. Interaction with NIS2 duties. Essential and important entities must notify significant incidents under the Cybersecurity Act (küberturvalisuse seadus, KüTS) § 8; their reports and the authorities' findings may become evidence on attribution.⁴

4. Property and terrorism

Property policies in Estonia usually exclude war and often terrorism, with terrorism cover available as an extension. Losses from drones, sabotage of infrastructure or hybrid attacks raise the question whether the event is "war", "hostile act", "terrorism", "sabotage" or "malicious damage", each potentially treated differently in the wording.

5. Life and accident insurance

War exclusions in life and accident insurance affect Estonians serving in the Defence Forces or volunteering in the Defence League, as well as those travelling to conflict zones. The semi-mandatory rules of VÕS § 427 lg 1 apply to many life and accident provisions; whether a war exclusion in life insurance can be relied on against a beneficiary depends on its clarity and on whether it was properly incorporated.

6. Drafting recommendations for Baltic risks

1. Use a clear, modern war and cyber war clause rather than a 1930s-era war exclusion.
2. Define the threshold for state-backed cyber operations and provide a bystander carve-back if commercially intended.
3. Provide a transparent attribution mechanism and address the burden of proof.
4. Align war, terrorism, sabotage and malicious damage definitions across property, cyber and business interruption sections.
5. Consider Estonian translations for consumer and SME policies.

Related pages

• Cyber claims in Estonia
• Sanctions and insurance
• Exclusions vs obligations
• Breach coach for cyber incidents
• Policy wording review

References