From piracy to maritime cybercrime

With the development of information and communication technologies, maritime crime is changing and adapting with new forms of piracy emerging and adopting unprecedented methods and means of action.

Marine transport, the connected sector par excellence, increasingly uses information systems and online applications to ensure the smooth flow of ships and goods, and is therefore becoming more vulnerable.

Today, the sector represents an ideal target for hackers. Among the methods employed by the latter are those that are particularly damaging in this field, namely:

• phishing,
• theft of passwords for purposes of intrusion and manipulation,
• ransomware, where ransom demands are made after the ship's information system has been infected and taken over.

As a consequence of this state of affairs, insuring ships against cyber risk is of crucial importance, all the more so as this extremely evolving risk is difficult to pin down.

Since the 2000s, the digitization of maritime activities has intensified, with shipboard personnel required to take care to steer their vessels safely into port, taking into account not only the weather and sailing conditions, but also the invisible threat of a potential IT security breach.

This is why today's experts use the French neologism "marétique" (combining the sea and information technology) to refer to all the IT and electronic systems used in the management and automation of all sea-related activities (marine, river and port).

Insurance up against maritime cybercrime

Marine insurers are bumping against the complexity of the mechanisms and tools designed to prevent pirate attacks. Given the limited history of this type of risk, actuaries find it difficult to define and set rates and conditions.

Despite the fact that a multitude of private organizations are publishing statistics on maritime cybercrime, there is no standardized methodology for uniformly mapping this type of risk and its impact on a national and international scale.

It remains, nonetheless, very true that the risk of maritime piracy [5] is a major issue for companies using this mode of sea transport. Acts of piracy are becoming increasingly frequent, and can have disastrous financial consequences.

Maritime cybercrime: type of coverage

Given the particular context described above, companies are looking for insurance coverage that includes maritime piracy, especially when the vessel is called upon to cross dangerous zones.

Marine insurance and war risks

Coverage for acts of maritime piracy [6] may be included in the marine insurance policy, but is generally provided under the war risks policy. Under certain conditions, war risk insurance is designed to offset economic losses caused by war and other forms of political violence.

Kidnap and Ransom (K&R) insurance

The persistence of acts of piracy, sometimes followed by kidnapping of the crew, led Lloyd's of London to develop a new product in 2008, "Kidnap and Ransom (K&R)". This is an insurance policy underwritten by shipowners, oil companies and other international firms whose vessels use dangerous sea areas. This type of coverage is better adapted to marine risks and to the booming ransom demands required by pirates.

In addition to "ordinary" hull and cargo risks, and war risks, K&R insurance is similar to a damage policy. It responds to a ransom demand, the maximum amount of which is specified in the contract. This amount varies according to the size of the vessel and the nature of the cargo.

The underwriting and pricing parameters for this coverage (K&R) are fairly strict, fluctuating according to the size and speed of the vessel. Insuring a ship against piracy can cost between 0.03% and 0.1% of the total value of the vessel.

The amount of the premium also depends on the sea areas crossed and the speed of the vessel. Some insurers require the presence of security guards on board to reduce the premium. In the event of a claim, the K&R insurer covers all costs incurred as a result of the kidnapping. In addition, a certain amount of coverage is granted to reimburse the costs of consultants specializing in crisis management and kidnap situations.