Recent tensions in Eastern Europe are increasing the level of concern about cyber security. With the U.S. working to counter the tensions, a more prominent bullseye has been placed on cyber infrastructure, but not just for the U.S. 

Cyberattacks are not new and have escalated since the COVID-19 pandemic, which sent a great majority of the workforce to remote offices, by and large secluded from the protection of corporate information security measures. In 2013, Target stores were subject to a cyberattack on their credit card system. Colonial Pipeline was crippled for 5–6 days in 2021 following a cyber ransomware attack. CNA Financial was also hit with a cyber ransomware attack in March 2021, paying $40 million to the ransomware operators to release locked-up computers and files, and CNA’s own cyber insurance did not fully recover the losses. 

Reports are coming fast that both large and small companies should be ramping up their efforts to prepare for the possibility of increased cyberattacks as tension in Eastern Europe continues. Are we close to seeing a cyber “war”? 

A cyberwar is _____.

Govinfo.gov reports that on September 30^th, 2015, the Committee of Foreign Affairs of the House of Representatives convened to address the growing threats to U.S. national security as it pertains to cyberspace. At the time, the term “cyberwar” was considered a new term, and it was said that the Pentagon counts cyberspace as the fifth domain of warfare alongside land, air, sea, and space. All of the experts who presented to the committee agreed that the Law of Armed Conflict applies in cyberspace. Unfortunately, the Committee did not come to a definitive conclusion on what cyber “war” means. 

Source: https://www.govinfo.gov/content/pkg/CHRG-114hhrg96817/html/CHRG-114hhrg96817.htm

So, what is cyber “war,” or, better yet, what could it be? That’s a great question, and still, there appears to be no concrete definition of what constitutes “cyberwar.” The term is broadly ambiguous (and contested by some), but many articles, scholars, and the U.S. government tend to dance around the term and discuss more how current laws might apply to a “cyber war.” In general, cyber “war” is thought to be an act that causes disruption or destruction, which may lend cause to a use of force.

What could a cyber “war” 

mean for individuals? 

Many intelligence and security officials are urging Americans to consider how to protect themselves from cyberattacks. The threat of cyberattacks to individuals specifically is low, but the increasing threat to mass infrastructure is high, which means the impact on us as individuals will be collateral damage simply because our lives are so dependent on technology.   

Individuals can now take the time to lighten any temporary blow. Anyone in the Midwest who is used to tornado season, in the North/North East under blizzard conditions, or in the Gulf Coast area during hurricane season understands what a temporary impact due to an emergency or disaster looks like. Consider the same emergency preparedness, but fine-tune it to technology: 

• Back up important files onto external drives.
• Turn on MFA (multi-factor authentication) wherever possible to ensure that only you log into your devices and sites.
• Reduce time on public Wi-Fi or use a VPN (a virtual private network) when accessing public Wi-Fi.
• With the possibility of supply chain disruption:
  • Seek local resources like local farms and small businesses that source locally.
  • Have a small emergency supply, and understand that hoarding supplies is not practical or sustainable. (Let’s not hoard the toilet paper again!)
• Have cash on hand—don’t rush the banks; just have some cash on hand in case of a temporary disruption.
• An emergency radio could come in handy, along with solar flashlights or other similar emergency devices,

Personal Cyber Insurance/Protection

We’ve all been aware of the threats to identity theft for a number of years, but a cyber threat is more than just identity theft, as our lives have become ever more connected and dependent upon technology. Cyber extortion, ransomware that infiltrates expensive personal devices (phones, tablets, and computers), cyberbullying, cyber scams, deep fakes of an individual’s physical identity, and much more are all part of a person’s or family’s exposure to cyber risk. According to the FBI’s 2020 IC3 Report, phishing email scams represent an adjusted loss of over $54 million.

Homeowners or Renters policies are not likely to be much help. The newest edition of the Homeowners Policy (ISO HO 00 03 03 22) flat out excludes loss to business data stored in computers, credit cards, EFT cards, and virtual currency (regardless of the name it’s known by). There is also some limited coverage for securities and accounts, which might be maintained on computer software. Coverage does vary by carrier, so if a carrier does offer coverage, it most likely must be added to the policy. It is likely quite limited, and it certainly does not represent coverage for all the types of cyber risks an individual may face. However, understand that even if coverage is present or can be purchased, the cause of the loss must be one covered by the policy, and war (even undeclared war) is expressly excluded. 

Personal cyber coverage is newer to the personal insurance market, even though cyber insurance has been present in the commercial or business insurance market space for a number of years. In the past, individual or personal cyber coverage may have only been accessible to or thought useful for high-value or high-net-worth clients, but this is changing. A quick web search for personal cyber insurance will offer several possibilities for obtaining coverage at generally affordable prices. 

Cyber coverage for individuals will vary greatly between insurance carriers, so reviewing the contract terms and agreements along with the advertised and stated coverages is important. One might generally expect coverage to help with counseling, access to technology restorative services, or reimbursement related to the financial impact of a covered loss. But, again, be sure to review coverage terms carefully and understand that your (business or personal) insurance, even if it is cyber insurance, is not likely to cover events that are triggered by “acts of war,” which is why it is ever more critical to take steps toward reducing or managing your personal risk in this arena.