Back in 1979, the economist Mark Skousen published a book on maintaining the security of financial data. He was worried about relentless information collection he reckoned that 50 files of various sorts were being kept on each American. The inherent risks seemed pretty obvious to him.
In his section on companies, he added something pretty prescient: businesses should not stop at maintaining burglar alarms, employing night-watchmen and watching for "new employees working as spies for the competition", they should also be aware that much of their valuable information was now stored on computers.
It would "pay to ask your computer company specifically about unwarranted intrusion into sensitive information", he says. Forty years on, he has been proved very right.
Subscribe to MoneyWeek
Subscribe to MoneyWeek today and get your first six magazine issues absolutely FREE
We are in a world with an endlessly rising number of interconnected devices (and a lot more than 50 files on each person). There is no company or product that doesn't have cyber risk attached to it. So much so that if you ask a corporate chieftain about the biggest threat to his business, they probably shouldn't say Brexit or global growth, they should say cyber risk. The growing list of governments refusing to do business with Huawei bear witness to its relevance and danger.
Political and economic risk are slow moving enough that a quality company can cope, but a cyber problem can leave you helpless instantly: shipping group Maersk's systems were shut down for a full ten days following the 2017 NotPetya malware attack, at a total cost of about $300m. A company also risks the loss of commercially sensitive data, becoming the victim of cyber extortion, and huge fines for personal data breaches, to say nothing of the legal costs and brand damage.
This is not news to company boards: a survey by insurance consultancy Mactavish found 43% of UK respondents reporting that their company had suffered at least one cyber attack in the prior two years.
The insurance industry isn't set up to cope
But the odd thing is that, while most companies have cyber security on their minds, not very many are specifically insuring themselves against a systems breach. The market is growing fast: up 100% in the past year, according to the Association of British Insurers. Even so, a mere 9% of UK companies (rising to 25% in the financial sector) have specific cyber insurance.
In the US, the number is only slightly higher but is still low Dan Truman of speciality insurance firm Axis Capital puts it at about 30%, thanks in part to many states' early adoption of strict rules on reporting data breaches. Maersk did not have standalone cyber insurance one imagines this has now been rectified.
So why the foot-dragging? In the Mactavish survey, 37% say the risk isn't "serious enough"; 30% say the insurance is too expensive; some 35% argue it is "unfit for purpose"; and 22% "do not trust the insurer to pay out". The first two are silly; the second two have some merit. The utility of cyber insurance should improve as data improves and the industry gains a better understanding of the risk; the payout problem might not.
Parts of cyber risk are easily insurable, says the Association of British Insurers' Joseph Ahern. These include hackers, low level ransom attempts and data-collecting malware. Other bits are not. There is a legal battle under way between confectionery firm Mondelez and insurer Zurich, which is refusing to pay on the NotPetya attack, arguing that the damage came from a "hostile or warlike action".
The insurance industry works on the basis that bad things happen to a few people at a time. When really bad stuff happens to a large number of people at once, it struggles. The industry either goes bust or gets out of the market. Then, the government has to step in.
During and after the Second World War, the UK War Damage Commission stepped in to pay for damage to buildings and land. In the wake of the 1993 Irish republican bombing of the Baltic Exchange, the UK government created pool reinsurance to underwrite terrorist damage. The US set up the Terrorism Risk Insurance Program after the September 2011 attacks. More recently, the UK created Flood Re for homes in flood-prone areas.
Dan Hyde, author of Cyber Security: Law and Practice, doesn't expect Zurich to win the Mondelez case proving the incident was warlike will be extremely tricky. But the questions won't go away.
If North Korea and Russia are sponsoring cyber attacks across the West as a type of unprovable warfare, and if this represents a long-term persistent threat in a world where many companies share a digital architecture, that might make much of cyber risk uninsurable. You can see why the insurance industry wants to test who pays. And you can see why governments might not (after the 2008 financial crisis, they are not keen on providing backstops to the financial industry).
This fight is going to run. In the meantime, companies must look for standalone cyber coverage they really understand: Mondelez was claiming on its general insurance. A night-watchman is never going to be enough again.
This article was first published in the Financial Times
Merryn Somerset Webb started her career in Tokyo at public broadcaster NHK before becoming a Japanese equity broker at what was then Warburgs. She went on to work at SBC and UBS without moving from her desk in Kamiyacho (it was the age of mergers).
After five years in Japan she returned to work in the UK at Paribas. This soon became BNP Paribas. Again, no desk move was required. On leaving the City, Merryn helped The Week magazine with its City pages before becoming the launch editor of MoneyWeek in 2000 and taking on columns first in the Sunday Times and then in 2009 in the Financial Times
Twenty years on, MoneyWeek is the best-selling financial magazine in the UK. Merryn was its Editor in Chief until 2022. She is now a senior columnist at Bloomberg and host of the Merryn Talks Money podcast - but still writes for Moneyweek monthly.
Merryn is also is a non executive director of two investment trusts – BlackRock Throgmorton, and the Murray Income Investment Trust.
House prices are falling in London but how does it compare to the rest of the UK?
Advice The capital remains the most expensive part of the UK to buy a property, but it isn’t being as badly hit by the housing market slump. Where are London house prices heading?
By Marc Shoffman Published
Will a Santa Rally provide festive cheer for investors this year?
News Equities often get a seasonal boost during December - will there be a Santa Rally in 2023?
By Marc Shoffman Published
How to fight cyber-crime in your small business
Advice There are five key areas for owners of small businesses to focus on when fending off digital attacks.
By David Prosser Published
Why our rickety internet infrastructure needs an upgrade
Briefings The internet is an increasingly essential part of international infrastructure. Recent events have shown that it is also vulnerable to collapse.
By Simon Wilson Last updated
The WannaCry virus is huge news for cybersecurity stocks – and bitcoin
Features The WannaCry ransomware attack is a wake-up call. It has huge implications for cybersecurity – and for bitcoin. John Stepek explains why, and how to profit from improving computer security.
By John Stepek Published