Insurance Without Limits
When we think of energy, we tend to think in terms of limits.
As in, there is a limited volume of greenhouse gasses that the earth’s atmosphere can absorb; there is only so much coal; how deep must we drill the deepest hole until we find out that there is no more oil?
But what if energy resources and the future human endeavors they power were truly limitless?
That seems to be the spirit of the collaboration between Swiss Re Corporate Solutions, the corporate insurance division of the Zurich-based insurer and reinsurer Swiss Re, and Solar Impulse, an ambitious project to build and fly a solar-powered plane around the world.
Launched on its global trip in 2012 by Swiss explorer Bertrand Piccard and his partner, businessman Andre Borschberg, Solar Impulse, insured by Swiss Re Corporate Solutions, is within weeks of achieving its goal.
As of early July, the plane was in Seville, Spain and was preparing to embark on the last two legs of a 17-leg around-the-world trip, with the goal of landing at its starting point in Abu Dhabi.
Light as a small family car, but with the wingspan of a Boeing 747, the plane is powered only by solar panels on the surface of its enormous wings and has an insured value of $12.5 million.
For Juerg Trueb, a Zurich-based head of environmental and commodity markets for Swiss Re Corporate Solutions, the partnership with Solar Impulse is an example of the speed at which technology is advancing, and the imperative on the part of insurance companies that they keep pace with that change.
If you go beyond the symbol, these are the tangible things that we do and that resonate in the context of Solar Impulse.– Juerg Trueb, head of environmental and commodity markets for Swiss Re
After all, in providing aircraft liability, hull and personal accident insurance for the plane’s two-man crew, the insurer is in essence underwriting a prototype, a craft for which there is no loss history because its kind has never been seen before.
“Solar Impulse stands for the dream to power a plane by renewable energy,” Trueb said.
“It’s a symbol for technology innovation and clean energy production and a sustainable business that allows us to both prosper and conserve nature,” Trueb said.
That notion of sustainability, is something Swiss Re Corporate Solutions and its parent company puts into action, not only in the types of projects it insures, solar and offshore wind farms, for example, but in the degree of sustainability engrained in its investment portfolio.
“If you go beyond the symbol, these are the tangible things that we do and that resonate in the context of Solar Impulse,” Trueb said.
In addition to the awards it’s won for sustainable business practice and ethics, Swiss Re, through its Swiss Re Foundation, has for more than decade funded the International ReSource Award for Sustainable Watershed Management, which carries with it a $150,00 prize awarded by an international jury.
Solar Impulse already owns an aviation record for the longest continuous flight by a solar plane. In 2015, it flew from Nagoya, Japan to Hawaii. That flight lasted 117 hours and 52 minutes and covered about 4,473 miles.
Of course Solar Impulse isn’t the only solar-powered craft making news this summer. Juno, NASA’s solar-powered space probe, entered Jupiter’s orbit in early July, after a voyage of some 1.8 billion miles over five years.
Protecting ‘Flying Computers’
Last summer, more than 1,400 LOT Polish Airlines passengers were stranded at Warsaw Chopin Airport, the country’s largest airport. Ten flights were cancelled and a dozen more grounded after a probable cyber attack crashed flight-planning computers.
Airline travel is considered one of the safest ways to get around, but attacks on the networks that keep travelers flying can have reverberating effects across the industry.
To prevent this, risk and insurance experts are planning ways to build in protections in case hackers access data networks, onboard computers or navigation systems to cause business disruptions or damage to life and property.
“Aircraft really are flying computers,” said Brad Meinhardt, managing director, aviation practice at Arthur J. Gallagher & Co. “The importance and integrity of cyber is absolutely tantamount because airplanes will be flying closer and closer to each other with the same degree of safety.”
Automation helped airlines fly 3.5 billion customers on 34 million flights last year, according to the International Civil Aviation Organization (ICAO). And yet, all these linked networks and technology advances also create new opportunities for criminals.
“We make mistakes in underestimating how clever our opponents are,” said Jon Haass, associate professor, cyber security and intelligence at Embry-Riddle Aeronautical University College of Security and Intelligence.
Is a Cyber Attack Possible?
While aviation experts believe today’s systems are secure from simple hacking, Eric Donofrio, XL Catlin’s chief underwriting officer, aerospace, in the Americas region, foresees more sophisticated attempts down the road.
“I would imagine people are going to try,” Donofrio said.
ICAO formed a cyber security task force four years ago to develop a set of international standards and industry best practices that account for all of the technology changes in the aviation industry. The United Nations agency will present its findings this September in Montreal.
When considering some of the most vital technology advances in aviation, experts see a few vulnerabilities. First, air navigation is facing the most significant changes because of the increased reliance on GPS for data.
The radio navigation system pilots mostly use today is run from very high frequency omnidirectional radio range receivers (VORs), a ground-based electronic system that reaches up to 200 miles. The stations send out radio signals and essentially create highways in the sky. These operate individually, so trying to take out all VORs today would be very difficult, Donofrio said.
A new GPS-based system with wider reach is replacing VORs. The Federal Aviation Administration plans to decommission about half of the 967 VORs in the United States by 2020, and keep the other half as a backup navigation system in the event of a GPS outage.
As aviation operators phase out VORs and move over to new GPS-based technology, that GPS system may become a significant cyber vulnerability, Donofrio said.
When Malaysia Airlines Flight 370 disappeared over the Indian Ocean in 2014, some in the public were surprised to learn that air traffic controllers often don’t know where a plane is because radar can’t reach it along several stretches of the route.
That will soon change when the aviation industry begins using a much more precise surveillance technology called Automatic Dependent Surveillance – Broadcast (ADS-B), which will allow air traffic controllers to know exactly where every plane is, even over vast oceans.
“There are many places on the globe where terrestrial coverage is spotty and that’s why we are trying to have the system run off satellite,” Haass said. “But the ‘attack surface’ increases with a more complex system.”
ADS-B uses GPS technology to determine an aircraft’s location, airspeed and other data, and broadcasts that information to a network of ground stations, which relay the data to air traffic control displays and nearby aircraft.
“ADS-B is a technological improvement over the limitation of radar, but if a hacker could hack in, conceivably the GPS system, in the extreme, could be shut down – there’s almost a single point of data,” Donofrio said. “In the future, we might have a bigger problem, but right now that scenario is a bit dramatic.”
“We would like to see cyber security included right there at the design stage when they develop new systems.” — Jon Haass, associate professor, cyber security and intelligence, Embry-Riddle Aeronautical University College of Security and Intelligence
Oftentimes, the areas that are most vulnerable to hackers are not so dramatic – such as employees with weak computer passwords or malware in an email. Third parties that have access to aviation systems or cloud providers may also present vulnerabilities.
And, while ADS-B is meant to make aviation systems more efficient and safer, it lacks a good authentication system to verify that the person working on either end is who they claim to be, said Haass.
Another emerging risk is the abundant use of electronic flight bags. These devices — which contain software and store sensitive flight information — are carried around the world and can be hacked at any point along the way, such as a pilot’s hotel room.
Portable devices are also used extensively around airports to remotely prepare baggage handling, weigh baggage and board contents onto the planes, among other things. Even if those devices work off a private network and require a security password, they may still become a target for hackers, Haass said.
“We would like to see cyber security included right there at the design stage when they develop new systems,” Haass said. “It’s easier to fix it at the beginning, although it adds expense and time.”
Cyber Market Continues to Evolve
The aviation industry includes about 1,400 commercial airlines, 4,130 airports and 173 air navigation services providers. And they all carry risk.
“Aviation insurance is one of the most comprehensive insurance coverages in the world,” said Meinhardt.
Yet, cyber coverage remains a complication.
Cyber risks may be excluded or limited in aviation insurance policies. For example, certain network business interruption exposure may not be covered under existing policies.
“Cyber liability is something our clients should consider,” Meinhardt said.
Another reason to consider cyber liability insurance is because vendors that do business with aviation businesses often demand it, he said
Some aviation industry insurers have shied away from cyber products because the data and modeling tools that are commonplace for understanding catastrophic property exposures often do not exist for cyber risk in a specific industry, such as aerospace and aviation.
The burgeoning market offers only a handful of stand-alone products. That market will continue to evolve but development will bring challenges, with many concepts and wordings yet to be tested.
Cyber: The Overlooked Environmental Threat
“Cyber breach” conjures fears of lost or ransomed data, denial of service, leaked corporate secrets and phishing scams.
But in a world where so many physical operations are automated and controlled by digital technologies, the consequences of cyber attacks extend far beyond the digital realm to include property damage, bodily injury, and even environmental pollution.
Industrial companies that deal with hazardous materials — like power plants, refineries, factories, water treatment facilities or pipelines — are heavily dependent on automated technology to maximize their efficiency. Other sectors use technology to control HVAC systems, power and utilities, placing their properties at risk as well.
Cyber risks like theft of personally identifiable data have been highly publicized in recent years, but physical risks like pollution sparked by a cyber breach may not be as obvious.
“It’s significant to lose 100,000 customers’ Social Security numbers,” said William Bell, Senior Vice President, Environmental, Liberty International Underwriters, “but can you imagine if a waste treatment facility’s operations get hacked, gates open, and thousands of tons of raw sewage go flowing down a local river?”
In many industrial complexes, a network of sensors gathers and monitors data around machinery efficiency and the flow of the materials being processed. They send that information to computer terminals that interpret the data into commands for the hardware elements like motors, pumps and valves.
This automation technology can control, for example, the flow of pipelines, the level of water or waste held in a reservoir, or the gates that hold in and control the release of vast quantities of sewage and other process materials. Hackers who want to cause catastrophe could hijack that system and unleash damaging pollutants.
And it’s already happened.
In 2000, a hacker caused 800,000 liters of untreated sewage to flood the waterways of Maroochy Shire, Australia. In 2009, an IT contractor, disgruntled because he was not hired full-time, disabled leak detection alarm systems on three off-shore oil rigs near Long Beach, Calif.
Just last year, cyber attackers infiltrated the network of a German steel mill through a phishing scam, eventually hacking into the production control system and manipulating a blast furnace so it could not be shut down. The incident led to significant property damage.
According to a leading industrial security expert and executive director of the International Society of Automation, “Today’s operational technologies—such as sensors, SCADA systems, software and other controls that drive modern industrial processes—are vulnerable to cyber attack. The risk of serious damage or compromise to power and chemical plants, oil and gas facilities, chemical and water installations and other vital critical infrastructure assets is real.”
“The hacks could come from anywhere: a teenager looking for entertainment, a disgruntled worker, or more sophisticated criminals or terrorists,” Bell said. “There are certainly groups out there with political and ideological motivations to wreak that kind of havoc.”
“We are working to bring the cyber component of environmental risk to the forefront. Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”
— William Bell, Senior Vice President, Environmental, Liberty International Underwriters
The cleanup cost of an environmental disaster can climb into the hundreds of millions, and even if a cyber breach triggered the event, a cyber policy alone will not cover the physical and environmental damage it caused.
The risk is even more pointed now, as resource conservation becomes increasingly important. Weather related catastrophe modeling is changing as both flooding and drought become more severe and frequent in different regions of the U.S. Pollution of major waterways and watersheds could have severe consequences if it affects drinking water sources, agriculture and other industrial applications that depend on this resource.
Managing the Risk
Unfortunately, major industrial corporations sometimes address their environmental exposure with some hubris. They trust in their engineers to remove the risk by designing airtight systems, to make a disaster next to impossible. The prospect of buying environmental insurance, then, would be superfluous, an expression of doubt in their science-backed systems.
Despite the strongest risk management efforts, though, no disaster is 100 percent avoidable.
“We are working to bring the cyber component of environmental risk to the forefront,” Bell said. “Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”
The focus on network security and data protection has distracted industry leaders from strengthening operational technology security. Energy, manufacturing and other industrial sectors lack best practice standards when it comes to securing their automated processes.
After the Homeland Security Act of 2002, the Department of Homeland Security began comprehensive assessments of critical infrastructure’s cyber vulnerability, working with owners and operators to develop solutions. It also offers informational guides for private companies to do the same. The National Institute of Standards and Technology also continues work on its cyber security framework for critical infrastructure. Although this helps to establish some best practices, it does not completely mitigate the risk.
Many businesses don’t see themselves as a target, but they need to look beyond their own operations and property lines. They could be an attractive target due to their proximity to densely populated areas or resources such as waterways and highways, or nationally or historically significant areas. The goal of a cyber terrorist is not always to harm the target itself, but the collateral damage.
The Role of Insurance
“Environmental liability is still by and large viewed as a discretionary purchase,” Bell said, “but the threat of a cyber attack that can manipulate those systems and ultimately lead to a pollution incident is added incentive to buy environmental coverage.”
Liberty International Underwriters’ environmental coverage could respond to many pollution conditions set off by a cyber breach event.
“Property damage, bodily injury and cleanup of any pollution at or emanating from a covered property would likely be taken care of,” Bell said. “The risk is not so much the cyber exposure but the consequence of the attack. The resulting claims and degradation to the environment could be severe, especially if the insured was a target chosen because of their unique position to have a large effect on the local population and environment.”
LIU also offers dedicated Cyber Liability insurance solutions designed to manage and mitigate the cost of responding to a cyber attack and any resultant loss of data and associated liability. Coverage includes proactive data breach response services designed to help organizations comply with regulatory requirements and prevent data breaches.
LIU’s loss control managers are also on hand to conduct assessments of insureds’ properties and facilities to examine potential environmental impacts. They can educate brokers on the importance of enhancing cyber security to prevent an environmental accident in the first place.
“People are relying more and more on their systems, automaton is increasing, and the risk is growing,” Bell said. “We’re all focused on protecting data, but the consequences of a cyber breach can be much farther reaching than data alone.”
To learn more about Liberty International Underwriters’ environmental coverages and services, visit www.LIU-USA.com.
Liberty International Underwriters is the marketing name for the broker-distributed specialty lines business operations of Liberty Mutual Insurance. Certain coverage may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds. This literature is a summary only and does not include all terms, conditions, or exclusions of the coverage described. Please refer to the actual policy issued for complete details of coverage and exclusions.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.