All posts by Jeff Dunsavage

Insurance Industry

2019 Hurricane Season: “Slightly Above Average”

Leave a comment

Colorado State University’s Department of Atmospheric Science released a summary of the 2019 Atlantic hurricane season today.

Seven of the named storms lasted 24 hours or less – the most on record with such short longevity.

The 2019 season yielded 18 named storms, six of which became hurricanes, including three major ones (Category 3 or higher, with maximum sustained winds of at least 111 mph). While 18 is quite a bit more than the seasonal average of 12 , seven of the named storms lasted 24 hours or less – the most on record with such short longevity.

“The season ended up slightly above average when looking at integrated metrics, such as accumulated cyclone energy, that account for frequency, intensity and duration of storms,” said Dr. Phil Klotzbach, research scientist in the Department of Atmospheric Science, non-resident scholar at the Insurance Information Institute (I.I.I.), and lead author of the report. “We generally forecast a near-average season, so we slightly under-predicted overall levels of Atlantic hurricane activity.”

Dorian: most destructive

Of the three major hurricanes, Dorian was the most destructive. Forming in late August, it devastated the northwestern Bahamas at Category 5 intensity, causing over 60 fatalities and economic losses that could be as much as $7 billion, according to a recent Artemis report. It then made landfall near Cape Hatteras, North Carolina, as a Category 1 hurricane and later caused significant damage in the Atlantic Provinces of Canada. Insurance broker Aon estimates the economic value of the damage Dorian inflicted on the United States at approximately $1.2 billion.

Hurricane Humberto, forming in September, caused much less damage than Dorian, as it remained hundreds of miles offshore. Nevertheless, it caused large swells across the U.S. East Coast and resulted in one fatality when a man drowned due to a rip current in North Carolina. Another man was reported missing in St. Augustine, Florida after the storm. Bermuda officials reported that no fatalities occurred on the island during Humberto’s passage.

Hurricane Lorenzo became a Category 5 hurricane in the central subtropical Atlantic – the farthest east Cat 5 Atlantic formation on record. It generated 49-foot waves, with an occasional rogue wave nearing 100 feet, sending swells to both sides of the Atlantic. Lorenzo caused 10 fatalities.

She nearly didn’t get a name

The most destructive storm to hit the continental United States in the 2019 season almost didn’t have a name. Two hours before dumping 40 inches of rain in some parts of Texas, Tropical Storm Imelda was just “a tropical depression,” Dr. Klotzbach said. Imelda was upgraded to a named storm 90 minutes before landfall, but it proceeded to deluge southeast Texas, causing at least $2 billion in economic damage and at least five deaths, according to Aon.

“From a wind perspective, Imelda was practically a non-event,” Dr. Klotzbach continued. “But the rain it brought made it the most expensive tropical cyclone to hit the United States during the 2019 season.”

The 2019 Atlantic hurricane season began on June 1 and ends officially on November 30. Colorado State’s full summary and verification report is available here.

 

Business Insurance, Business Risk, Health & Safety

Despite Safer Skies, Aviation Claims Rise: What’s Up With That?

Leave a comment

 Flying has never been safer.

You’re more likely to die from being attacked by a dog than in an airline accident (see chart).

Today’s aircraft contain more sophisticated electronics and materials than those flying in the 1960s. When they bump into each other or come down too hard, they cost more to repair.

And yet, according to a recent Allianz Global Corporate & Specialty (AGCS) report, the aviation sector’s insurance claims continue to grow in number and size.

The report – Aviation Risk 2020 – says 2017 was the first in at least 60 years of aviation in which there were no fatalities on a commercial airline. The year 2018, in which 15 fatal accidents occurred, ranks as the third safest year ever.

Of more than 29,000 recorded deaths between 1959 and 2017, the report says, fatalities between 2008 and 2017 accounted for less than 8 percent – despite the vast increase in the number of people and planes in the air since 1959.

So, what gives?

Safety is expensive

Some of the reasons for the increased claims are good ones: Safer aircraft cost more to repair and replace when there are problems.

The report analyzed 50,000 aviation claims from 2013 to 2018, worth $16.3 billion, and found “collision/crash incidents” accounted for 57 percent, or $9.3 billion. Now, this may sound bad, but the category includes things like hard landings, bird strikes, and “runway incidents.”

The AGCS analysis showed 470 runway incidents during the five-year period accounted for $883 million of damages.

Engine costs more than the plane

Today’s aircraft contain far more sophisticated electronics and materials than those flying in the 1960s. When they bump into each other or come down too hard, they cost more to repair.

“We recently handled a claim where a rental engine was required while the aircraft’s engine was repaired,” said Dave Watkins, regional head of general aviation, North America, at AGCS. “The value of the rental engine was more than the entire aircraft.”

When entire fleets have to be grounded – the report cites the 2013 grounding of the Boeing Dreamliner for lithium-ion battery problems and the more recent fatal crashes involving the Boeing 737 Max – costs can really soar. Boeing reportedly has set aside about $5 billion to cover costs related to the global grounding of the 737 Max.

Even after a fix is found, the task of retrofitting a fleet takes considerable time – and, in the aviation industry, time truly is money.

Liability awards take off

Compounding the claims associated with the costs of safer flight, the report says, liability awards have risen dramatically.

“With fewer major airline losses,” Watkins said, “attorneys are fighting over a much smaller pool and are putting more resources into fewer claims, pushing more aggressively for higher awards.”

Today’s aircraft carry hundreds of passengers at a time. With liability awards per passenger in the millions, a major aviation loss could easily result in a liability loss of $1 billion or more.

Auto Insurance, Homeowners Insurance, Legal Environment

Florida’s AOB Crisis: A Social-Inflation Microcosm

Leave a comment

Never heard of “social inflation”? It’s a fancy term to describe rising litigation costs and their impact on insurers’ claim payouts, loss ratios, and, ultimately, how much policyholders pay for coverage.

The number of auto glass AOB lawsuits statewide in 2013 was over 3,800; by 2017, that number had grown to more than 20,000.

While there’s no universally agreed-upon definition, frequently mentioned aspects of social inflation are growing awards from sympathetic juries and a trend called “litigation funding”, in which investors pay plaintiffs to sue large companies – often insurers – in return for a share in the settlement.

Less discussed are state initiatives that inadvertently invite costly abuse. Florida’s assignment of benefits crisis is an excellent example.

Assignment of benefits (AOB) is a standard insurance practice and an efficient, customer-friendly way to settle claims. As a convenience, a policyholder lets a third party – say, an auto glass repair company – directly bill the insurer.

Easy.

In Florida, however, legislative wrinkles have spawned a crisis.

The state’s “David and Goliath” law was meant to level the playing field between policyholders and economically powerful insurers. It lets plaintiffs’ attorneys collect fees from the insurer if they win their case – but not vice versa. If the insurer wins, the plaintiff owes the insurer nothing.  This creates an incentive for attorneys to file thousands of AOB-related suits because there is no limit on the fees they can collect and no risk. Legal fees can dwarf actual damages paid to the policyholder – sometimes tens of thousands of dollars for a single low-damage claim.

AOBs are an efficient, customer-friendly way to settle claims…. In Florida, however, legislative wrinkles have spawned a crisis.

This type of arrangement is unique to Florida. And, despite efforts to contain it through reforms to the state’s personal injury protection (PIP) program, the abuse has spread beyond its origins in the southern part of the state and to other lines than personal auto and homeowner’s insurance. More than 153,000 AOB suits were filed in Florida in 2018 – a 94% increase from about 1,300 five years earlier.

Contributing to the crisis is the ease with which unscrupulous contractors can “find” damage unrelated to an insured incident or overbill for work done and file a claim. Florida statutes let policyholders assign benefits to a third party without insurer consent – which limits the insurer’s ability to monitor a claim to make sure costs aren’t inflated.

A measure signed into law by Gov. Ron DeSantis earlier this year aimed to curb AOB litigation by putting new requirements on contractors and letting insurers offer policies with limited AOB rights, or none at all.  However, it excludes auto glass repairs. The number of auto glass AOB lawsuits statewide in 2013 was over 3,800; by 2017, that number had grown to more than 20,000.

Florida’s experience provides an ongoing study into how hard it can be to stuff the social inflation genie back into its bottle.

For more details, see I.I.I.’s white paper, “Florida’s Assignment of Benefits Crisis: Runaway Litigation Is Spreading, and Consumers are Paying the Price”.

Cyber Risk

Are Cyberrisk Insurers This Decade’s Mortgage-Securities Investors?

Leave a comment

An awkward moment during  Advisen’s Cyber Risk Insights 2019 conference last week:

Are cyber insurers falling down on the job, as many say lenders, regulators, and rating agencies did before the 2008 financial crisis?

Panelists recalled how, in the early days of cyber, insurers often sought more information to write policies than clients could (or wanted to) provide. So, they started asking for less.

Most attendees remembered the “old days.” Many nodded. They understood.

The awkwardness came when one audience member observed that insurers “still chase market share” despite lacking complete policyholder risk information. “That sounds a lot like mortgage-backed securities before the financial crisis!”

Are cyber insurers falling down on the job, as many say lenders, regulators, rating agencies, and investors did before the 2008 financial crisis and subsequent recession?

The analogy may sound fair, but it falls apart on examination.

Mortgages and the financial crisis

In the early 2000s, it was easy to get a mortgage. Lenders would bundle loans to be sold as mortgage-backed securities. The theory: Few people would stop making payments and risk losing their homes. The rest would pay, and the security would deliver a fair return.

This made sense when lenders did their job. But too many abandoned their standards. Because they could sell them, lenders had no stake in whether the mortgages were paid.

Regulators and rating agencies, it has been argued, didn’t ask enough questions about the securities the loans supported. This gave investors more confidence than the investments warranted. When loans that should never have been made in the first place defaulted, the resulting dislocation of the homebuying and financial markets ushered in the Great Recession.

Where the analogy breaks down

Cyber insurers understand the risks they’re taking and price their policies accordingly. In fact, a recent I.I.I./J.D. Power survey found two of the top four reasons small companies choose not to buy cyber coverage are that it costs too much and contains too many exclusions.

Unlike the lenders and borrowers and investment banks in the early oughts, insurers have skin in the game. If they write bad business, they can’t simply pass it along to some naïve investor.

They also have a stake in customer relationships. They aren’t pushing policies, pricing them to sell, and hoping for the best. They’re working with clients to understand and address the clients’ vulnerabilities.

Cyber insurers understand the risks they’re taking and price their policies accordingly…. They also have a stake in customer relationships.

Seventy percent of small companies that bought cyber said their insurer helps with risk mitigation (up from 65 percent last year), according to the I.I.I./J.D. Power survey.  At the Advisen event, I heard insurers and policyholders discussing how they can address these perils. Policyholders clearly wanted insurers to do more than write policies and pay claims, and the insurers were listening.

Conversations like these, and the spirit of transparency and shared responsibility they reflect and promote, are essential to staving off and mitigating the impact of cyberattacks. Insurers and insureds, together, are visibly seeking solutions to a real and growing problem.

The people behind the financial crisis quietly created problems in pursuit of opportunities, studiously unmindful of the collateral damage they were generating.

Cyber Risk

Cyber Insurance: Why Do Small Firms Do Without?

Leave a comment
Small-business owners know cyber risk threatens them – but many still are dubious about cyber insurance. Why?

Smaller businesses seem to be getting the message that cyber risk isn’t just something for big companies to worry about; nevertheless, many still balk at buying cyber insurance, according to a new survey from the Insurance Information Institute (I.I.I.) and J.D. Power.

The 2019 Small-Business Cyber Insurance and Security Spotlight found that 12 percent of survey respondents experienced at least one cyber incident in the past year, up from 10 percent in 2018.  Nearly 71 percent said they are “very concerned” about cyber incidents, up from 59 percent, and 75% said they believe the risk of being attacked is growing at an alarming rate, up from 70 percent last year.

Two of the top four reasons cited for not buying cyber coverage are within insurers’ control.

Respondents with cyber insurance increased this year, to 35 percent from 31 percent; but of the 44 percent who said they don’t have cyber coverage and the 21 percent who didn’t know if they do, 64 percent said they don’t plan to buy it in the next 12 months.

Why the hesitation?

Why are many smaller firms so reluctant to insure against a threat they recognize to be real and growing?

The top two reasons given were: cost (42 percent) and the belief that the companies’ risk profiles don’t warrant coverage (35 percent). Twenty-seven percent said they believe they handle cyber risk sufficiently well internally, and 17 percent cited “too many exclusions” as a reason for not buying coverage. For the non-insurers in the audience, “exclusions” are provisions in an insurance agreement that limit the scope of coverage.

So, in other words, two of the top four reasons cited by insureds for not buying cyber coverage – cost and exclusions – are within insurers’ control.

As David Pieffer, head of J.D. Power’s property and casualty insurance practice, put it:

“Given small companies’ growing awareness and concerns about cyberrisk, insurers and agents and brokers might be able to increase their overall support of this market by addressing the issues of affordability and coverage limitations that seem to be an obstacle to purchasing.”

Risk-mitigation support may help

Closely related to cost is the question of value. What do insureds get for their premium dollar?

Among the respondents with cyber coverage, 70 percent said their insurer helps with cyberrisk mitigation, up from 65 percent in 2018. Fifty-one percent said their insurer offers contingency planning for data breaches, up from 40 percent, and 53 percent said their insurer will assess their vulnerability to data breaches, up from 51 percent.

“We’re seeing more insurers work with commercial customers to mitigate risks – in particular, with small and mid-size businesses,” said Sean Kevelighan, I.I.I. president and CEO. “We know many of the large cyber incidents can be sourced back to a smaller business or vendor, and, thus, it’s increasingly critical to assist in loss prevention measures that can make the customer more resilient, while also reducing claims and damages.”

It’s hard to say based on the data, but perhaps such insurer involvement plays as significant a role in small companies’ increased adoption of cyber insurance as does their growing anxiety about cyber perils. As companies increasingly see cyber insurers as trusted risk-management partners – not just writers of policies and payers of claims – perhaps take up rates will accelerate.

Cyber Risk

Bridging the Cyber Insurance Data Gap

Leave a comment

 

 

Cyber risks are opportunistic and indiscriminate, exploiting random system flaws and lapses in human judgment.

Underwriting cyberrisk is beyond difficult. It’s a newer peril, and the nature of the threat is constantly changing – one day, the biggest worry is identity theft or compromise of personal data. Then, suddenly it seems, everyone is concerned about ransomware bringing their businesses to a standstill.

Now it’s cryptojacking and voice hacking – and all I feel confident saying about the next new risk is that it will be scarier in its own way than everything that has come before.

This is because, unlike most insured risks, these threats are designed. They’re intentional, unconstrained by geography or cost. They’re opportunistic and indiscriminate, exploiting random system flaws and lapses in human judgment.  Cheap to develop and deploy, they adapt quickly to our efforts to defend ourselves.

“The nature of cyberwarfare is that it is asymmetric,” wrote Tarah Wheeler last year in a chillingly titled Foreign Policy article, In Cyber Wars, There Are No Rules.  “Single combatants can find and exploit small holes in the massive defenses of countries and country-sized companies. It won’t be cutting-edge cyberattacks that cause the much-feared cyber-Pearl Harbor in the United States or elsewhere. Instead, it will likely be mundane strikes against industrial control systems, transportation networks, and health care providers — because their infrastructure is out of date, poorly maintained, ill-understood, and often unpatchable.”

This is the world the cyber underwriter inhabits – the rare business case in which a military analogy isn’t hyperbole.

We all need data — you share first

In an asymmetric scenario – where the enemy could as easily be a government operative as a teenager in his parents’ basement – the primary challenge is to have enough data of sufficiently high quality to understand the threat you face. Catastrophe-modeling firm AIR aptly described the problem cyber insurers face in a 2017 paper that still rings true:

“Before a contract is signed, there is a delicate balance between collecting enough appropriate information on the potential insured’s risk profile and requesting too much information about cyber vulnerabilities that the insured is unwilling or unable to divulge…. Unlike property risk, there is still no standard set of exposure data that is collected at the point of underwriting.”

Everyone wants more, better data; no one wants to be the first to share it.

As a result, the AIR paper continues, “cyber underwriting and pricing today tend to be more art than science, relying on many subjective measures to differentiate risk.”

Anonymity is an incentive

To help bridge this data gap, Verisk – parent of both AIR and insurance data and analytics provider ISO – yesterday announced the launch of Verisk Cyber Data Exchange.  Participating insurers contribute their data to the exchange, which ISO manages – aggregating, summarizing, and developing business intelligence that it provides to those companies via interactive dashboards.

Anonymity is designed into the exchange, Verisk says, with all data aggregated so it can’t be traced back to a specific insurer.  The hope is that, by creating an incentive for cyber insurers to share data, Verisk can provide insights that will help them quantify this evolving risk for strategic, model calibration, and underwriting purposes.

Disaster Resilience

Tapping the insurance ecosystem for insights

Leave a comment

I had the pleasure last week of attending “Data in the New: Transforming Insurance” – the third annual insurtech-related thought leadership event held by St. John’s University’s Tobin Center for Executive Education and School of Risk Management.

To distill the insights I collected would take far more than one blog post.  Speakers, panelists, and attendees spanned the insurance “ecosystem” (a word that came up a lot!) – from CEOs, consultants, and data scientists to academics, actuaries, and even a regulator or two to keep things real. I’m sure the presentations and conversations I participated in will feed several posts in weeks to come.

Herbert Chain, executive director of the Center for Executive Education of the Tobin College of Business, welcomes speakers and attendees.
Just getting started

Keynote speaker James Bramblet, Accenture’s North American insurance practice lead, “set the table” by discussing where the industry has been and where some of the greatest opportunities for success lie. He described an evolution from functional silos (data hiding in different formats and databases) through the emergence of function-specific platforms (more efficient, better organized silos) to today’s environment, characterized by “business intelligence and reporting overload”.

Accenture’s James Bramblet discusses the history and future of data in insurance.

“Investment in big data is just getting started,” Jim said, adding that he expects the next wave of competitive advantage to be “at the intersection of customization and real time” – facilitating service delivery in the manner and with the speed customers have come to expect from other industries.

Jim pointed to several areas in which insurers are making progress and flagged one – workforce effectiveness – that he considers a “largely untapped” area of opportunity. Panelists and audience members seemed to agree that, while insurers are getting better at aggregating and analyzing vast amounts of data, their operations still look much as they have forever: paper based and labor intensive. While technology and process improvement methodologies that could address this exist, several attendees said they found organizational culture to be the biggest obstacle, with one citing Peter Drucker’s observation that “culture eats strategy for breakfast.”

Lake or pond? Raw or cooked?

Paul Bailo, global head of digital strategy and innovation for Infosys Digital, threw some shade on big data and the currently popular idea of “data lakes” stocked with raw, unstructured data. Paul said he prefers “to fish in data ponds, where I have some idea what I can catch.”

Data lakes, he said, lack the context to deliver real business insights. Data ponds, by contrast, “contain critical data points that drive 80-90 percent of decisions.”

Stephen Mildenhall, assistant professor of risk management and insurance and director of insurance data analytics at the School of Risk Management, went as far as to say the term “raw data” is flawed.

“Deciding to collect a piece of data is part of a structuring process,” he said, adding that, to be useful, “all data should be thoroughly cooked.”

Innovation advice

Practical advice was available in abundance for the 80-plus attendees, as was recognition of technical and regulatory challenges to implementation. James Regalbuto, deputy superintendent for insurance with the New York State Department of Financial Services, explained – thoroughly and with good humor – that regulators really aren’t out to stifle innovation. He provided several examples of privacy and bias concerns inherent in some solutions intended to streamline underwriting and other functions.

Perhaps the most broadly applicable advice came from Accenture’s Jim Bramblet, who cautioned against overthinking the features and attributes of the many solutions available to insurers.

“Pick your platform and go,” Jim said. “Create a runway for your business and ‘use case’ your way to greatness.”

Health & Safety

Trip Coverage: It’s Not Just About Cancellations

Leave a comment

As I’ve written previously, many who travel for pleasure think little, if at all, about the risks associated with their destinations and plans. Travel insurance, such folks believe, is to cover the cost and inconvenience of trip cancellations and lost luggage.

Who wants to think about illness, accidents, and – you know, the other thing – when going on holiday?

You don’t buy travel insurance for the best-case scenario. It’s when the worst happens you will likely regret not having it.

Industry numbers seem to bear this out. A recent report by the U.S. Travel Insurance Association (USTIA) found Americans spent nearly $3.8 billion on travel insurance in 2018, up nearly 41 percent from 2016.  However, trip cancellation/interruption coverage accounted for nearly 90 percent of the benefits purchased. Medical and medical evacuation benefits accounted for just over 6 percent.

Most common claim, but…

Indeed, trip cancellation is the most common claim paid on travel policies (or so I’m told – insurers hold their claims data close to the vest). Assuming this is the case, one might be tempted to roll the dice when it comes to occurrences that seem less likely – say, an automobile accident, a bad fall, or a heart attack or stroke.

Last week’s story about a 22-year-old Briton fighting for his life after falling from a hotel balcony in Ibiza got me thinking about value of the “post-departure benefits” of travel insurance. According to the article, the young man had insurance, though it wasn’t clear what kind of coverage he’d bought. The article did say his parents are soliciting funds on line to help with expenses.

“Globally, an estimated 37 million unintentional falls requiring medical treatment occur each year” write researchers in the journal Injury Epidemiology, citing 2018 World Health Organization (WHO) data. Unsurprisingly, alcohol consumption was found to be a major risk factor in these falls.

During one three-month period in 2018, the BBC reported, citing the Association of British Travel Agents, “11 British holidaymakers have been reported as falling from a balcony – with eight of them in their teens or 20s.” In March 2019, a Missouri man fell from the balcony of a Florida hotel where he was vacationing. In the same month, a Michigan teen on vacation in Cancun fell to his death.

Think you’re too smart, careful, or abstemious to fall from a balcony? Well, the most common cause of injury and death on vacation isn’t falls. It is – you guessed it – automobile accidents. According to a WHO and World Bank report, “deaths from road traffic injuries account for around 25% of all deaths from injury”.

According to the Centers for Disease Control and Prevention (CDC) 1.3 million people are killed and 20-50 million injured in crashes worldwide annually. The CDC says 25,000 of those deaths involve tourists.

There are things you can’t predict

Or maybe you avoid a fall or a crash and wind up in a situation like New Yorker Steve Lapidus, who credits his $79 travel insurance policy with saving his life when he became seriously ill while on vacation in Italy. Steve was in a coma for several days with sepsis and pneumonia and given 50/50 odds of surviving. But, after six-and-a-half weeks of medical care, doctors cleared him to fly home.

Man who fell ill during overseas trip says Richmond travel insurance company saved his life

The problem was, he couldn’t walk and needed special care and a specially modified plane. Lufthansa built a special pod within one of its commercial flights.

That $79 policy covered the entire $70,000 bill.

Plan for the best – insure for the worst

No one wants to buy insurance. Who on Earth would choose to buy a product that, under the best possible circumstances, they never use?

But you don’t buy insurance for the best-case scenario. It’s when the worst happens that you will likely regret not having it.

 

 

 

Cyber Risk, Terrorism Risk

Wedding Big Rigs to IoT: What Could Possibly Go Wrong?

Leave a comment

“We went out again. We got maybe six steps before lights blared in our faces. It had crept up, big wheels barely turning on the gravel. It had been lying in wait and now it leaped at us, electric headlamps glowing in savage circles, the huge chrome grill seeming to snarl.”

Transportation and logistics companies are now among the top-targeted industries by computer hackers

When Stephen King wrote Trucks – a tale of big rigs, pickups, and earth movers coming suddenly to life and terrorizing people they had trapped in a diner – he didn’t speculate about how or why they’d been incited to malevolence. Aliens? The Soviets? Who cared? It was the 1970s, and all he needed to do was deliver a solid horror yarn.

I loved that story when I read it in high school – mainly because it scared the daylights out of me and yet I knew for sure it couldn’t happen. Could it? Nah!

Today I read an article about “platooning”, in which “a lead vehicle wirelessly assumes control over the throttle and braking of one, two, or more vehicles following along behind it. In many scenarios, the drivers in a platoon continue to steer their vehicles and can disengage from the convoy at any time, but the first vehicle determines the speed and braking maneuvers of the entire platoon. Because the follower trucks maintain constant communication with the lead vehicle and have synchronized acceleration and braking, platooning trucks can maintain much shorter distances between themselves as they travel.”

Bam! I was right back in that 1970s diner inside Stephen King’s warped, brilliant, and quite possibly prophetic brain.

From there I time traveled forward to Bastille Day 2017 in Nice, France, where 84 people were killed when a radicalized individual plowed a 20-ton truck into a crowd waiting to watch a fireworks display. The previous December, CNN reminded me, 12 people were left dead and 48 injured when a tractor trailer was driven into a Berlin Christmas market.

“Platooning, which is based on vehicle-to-vehicle (V2V) communications, has been shown to increase the fuel efficiency of both the lead and following vehicles, saving fleet operators money and reducing carbon dioxide emissions,” the article in Verisk’s Visualize insurance news and thought leadership site tells me comfortingly. It cites a German pilot program in which truck platooning generated fuel savings of 3 to 4 percent. Platooning could lead to huge cost savings for businesses and consumers.

Who doesn’t love fuel efficiency?

And then I read an article in Today’s Trucking that began:

“When Harold Sumerford’s phone rang at 2:30 a.m. on April 2, he knew the news couldn’t be good. But he figured it was probably the safety department – not the CFO telling him the company’s entire computer system was down from a ransomware attack.”

Sumerford is CEO of J&M Tank Lines. According to the article, it took four days for his company to begin functioning after the attack, “and during those four days, they weren’t able to bill any customers or enter anything into the system.”

Granted, this is a far cry from having the entire fleet go on a murderous rampage, but the Internet of Things is still young.  It hasn’t been long since researchers demonstrated that they could remotely do everything from altering a big rig’s  instrument panel to triggering unintended acceleration or disabling brakes.

“These trucks carry hazardous chemicals and large loads,”  Bill Hass, one of the researchers from the University of Michigan’s Transportation Research Institute, told Wired. “If you can cause them to have unintended acceleration…I don’t think it’s too hard to figure out how many bad things could happen with this.”

J&M’s experience, according to Today’s Trucking, was “just one example of a rapidly growing problem with cybersecurity in the trucking industry. Transportation and logistics companies are now among the top-targeted industries by computer hackers.”

According to an article in ZDNet published just a few weeks ago, “Hackers are deploying previously unknown tools in a cyberattack campaign targeting shipping and transport organisations with custom trojan malware. Identified and detailed by researchers at Palo Alto Networks’ Unit 42 threat intelligence division, the campaign has been active since at least May 2019 and focuses on transportation and shipping firms operating out of Kuwait in the Persian Gulf.”

This as everyone I know seems to be panting with enthusiastic anticipation for vehicles that drive themselves!

Look, I’m no Luddite. I appreciate the benefits offered by and realized through interconnectivity.

But I also have a front row seat observing the difficulties people who assess and quantify risk for a living experience in getting and keeping their heads around the ever-changing world of cyberrisk.  As data and “stuff” become increasingly intertwined and the risks surrounding them are less clearly defined, is it so unreasonable to suggest that pushing humans out of the driver’s seat at this moment isn’t the only or best path to traffic safety, low prices, and reducing our collective carbon footprint?

Business Risk, Catastrophes, Cyber Risk, Emerging Risks, Terrorism Risk

Intent and ability distinguish cyberrisk from natural perils

Leave a comment

Cyberrisk is often compared with natural catastrophe-related threats, but a recent study by global reinsurer Guy Carpenter and analytics firm CyberCube suggests a better analogy is with terrorism.

“Probability is assessed in terms of intent and capability.”

The report – Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study – quotes Andrew Kwon, lead cyber actuary for Zurich: “Extending the lessons learned from property cats to the cyber space is intuitive and logical, but cyber continues to be a unique force unto itself. A hurricane does not evolve to bypass defenses; an earthquake does not optimize itself for maximum damage.”

This passage resonated as I read it because a few hours earlier I’d been reading a FreightWaves article about risks posed to international shipping by digitalization and pondering the fact that the same technology that helps vessels anticipate and avoid adverse weather also subjects them – and the goods they transport – to a panoply of new risks.

The FreightWaves article quotes U.S. Navy Captain John M. Sanford – who now leads the U.S. Maritime Security Department within the National Maritime Intelligence Integration Office – describing how the NotPetya virus inflicted $10 billion of economic damage across the U.S. and Europe and hobbled company after company, including shipping giant Maersk, in 2017.

Sanford said Russian military intelligence was behind the hacker group that spread NotPetya to damage Ukraine’s economy. The virus raced beyond Ukraine to machines around the world, crippling companies and, according to an article in Wired, inflicting nine-figure costs where it struck.

“Maersk wasn’t a target,” Sanford said. “Just a bystander in a conflict between Ukraine and Russia.”

Collateral damage.

The FreightWaves article describes how supply chains, ports, and ships could be disrupted more intentionally through GPS and Electronic Chart Display and Information System (ECDIS) systems onboard ships, or even via a WiFi-connected printer: “Pirates working with hackers could potentially access a ship’s bridge controls remotely, take control of the rudder, and steer it toward a chosen location, avoiding the expense and danger of attacking a vessel on the high seas.”

The Carpenter/CyberCube report identifies parallels in the deployment of “kill chain” methodologies in both conventional and cyber terrorism: “Considering terrorism risk in terms of probability and consequence, probability is assessed in terms of intent and capability.”

As our work and personal lives become increasingly interconnected through e-commerce and smart thermostats and we look forward to self-driving cars and refrigerators that tell us when the milk is turning sour, these considerations might well give us pause.

Hurricanes, earthquakes, fires, and floods might be scary, but at least we never had to worry that they were out to get us.