cyber risks in shipping 5th Asia Marine insurance conference Hong kong, November 2017

Latitude brokers Independent Marine Retail and Reinsurance Brokers Hong Kong, Singapore and Seoul 4 Founding Partners Andrew Brooker, Founding Partner Marine Insurance industry since 1991 in London, Singapore and Hong Kong: Sinclair Roche & Temperley (London lawyers), WK Webster (Cargo consultants), Marsh London & Singapore, Board Director of FP Marine 2006-2013

Cyber risks in shipping Everyone in shipping is at risk – to greater or lesser degrees, so… Why aren’t more policies being bought? Even after successful attacks close to home: AP Moller-Maersk ransomware attack: 17 APM container terminals forced to stop all loading/discharging No cargo bookings for 11 days 1500 software systems shutdown Disrupted operations in: container ships, port and harbor tugs, drilling and oil production offices around the world Total cost to Maersk – USD200,000,000- USD300,000,000 Fedex victim of NotPetya resulting in loss of data and subsequent loss of income Total cost estimated by Fedex - USD300,000,000

Cyber risks landscape Clause 380 Business Interruption Risk consultants Clause 380 Losses paid, unrecoverable Social Engineering Fraud Fake President Fraud Corporate Governance Counterparty risk Cargo theft Software Reinstallation Ransomware Costs of advising clients Legal costs Assured Cyber at Sea training Social Media & PR D&O cover Privacy Ordinance Business Interruption Counterparty Onboarding procedures IT Department Malware Fines Third Party Liability E-commerce Regulatory oversight Loss of Hire Accounting functions

Current insurance solutions Insurance policies required: Clause 380 buy back H&M Clause 380 buy back War Clause 380 buy back Loss of Hire Non-Marine Cyber Risks with amendments Non-marine Cyber Liability with amendments Non-Marine Commercial Crime policy with amendments Delay Insurance (new cyber option announced last week) P&I insurance still lacks certainty of cover (neither an exclusion, nor a peril) Specialist response consultants still not part of the cover available Marine insurance industry isn’t, yet, providing a single, purpose built, cover for the core cyber risks

opportunity Marine market K&R had similar traits: Operators had no prior experience of the risk Everyone trading through GoA was exposed Vessel hardening advice driven by BIMCO Insurance complimented risk management requirements, demanded improvements Insurance required armed guards. First minimum number, then experience, then accreditation/contract form Insurance gave access to response consultants Necessity led to improved risk management, led to fewer losses The marine market responded to a real, evolving, threat and created fit for purpose policies that worked.

Response consultant Marine market 24/7 emergency contact details Full authority from underwriters to manage: IT Forensic Data Reconstruction Business Interruption Legal PR Clients can handle all of the above individually….theoretically

Response consultant Marine market IT Forensic Severity assessment Ransom – to pay or not to pay? No conflict of interest with IT dept – solution focused Data Reconstruction Aggregation of experience from other attacks Advice on quickest resolution Business Interruption/ACOW Same underwriters on both aspects – recovery and BI Forensic accounting

Response consultant Marine market Legal Ransom payment legality Specialist cyber lawyers in each jurisdiction Response to regulators/stock exchange Core contract positions post-cyber attack PR Reputation management Advisory to clients (BI management) Particularly relevant in a highly competitive environment How long will it take a shipping company to find all the above experts in the middle of an attack? Where does a shipping operator start?

opportunity Marine market Create a marine product for the shipping industry: A risk management solution as well as financial protection Based upon existing risk management guidelines – eg BIMCO, Cyber at Sea Remove non-marine terms that are marine loopholes Include access to a response consultant! Include basic, clear, cover for onshore risks of: First party loss; Counterparty liability; BI/ICOW; Response consultants And the many things a clever underwriter will offer in a product that is needed by everyone and purchased by few…

THANK YOU