The Association of Average Adjusters (AAA) has published a discussion paper highlighting concerns over insurance coverage for vessel groundings where GPS spoofing may be a contributing factor, particularly under Hull & Machinery (H&M) policies containing cyber exclusions.
The AAA’s Advisory and Dispute Resolution facility has raised questions about how emerging cyber threats intersect with traditional marine risks, noting that the growing use of cyber exclusion clauses, such as LMA5403, has created legal ambiguity around claims linked to spoofing.
“GPS spoofing is where false positioning signals mislead a vessel’s navigation systems giving misreported positions which have the potential to cause a grounding,” said Chris Kilbee, Chair of the AAA.
“A vessel grounding caused, or contributed to, by GPS spoofing would normally be covered under a traditional Hull & Machinery insurance policy but the increasing inclusion of cyber-exclusion clauses has now muddied the waters.”
The LMA5403 clause excludes losses “directly or indirectly caused by or contributed to, by or arising from the use or operation, as a means for inflicting harm, of any computer or electronic system.” The AAA notes that this wording introduces uncertainty, as insurers must demonstrate both that an electronic system was used and that it was intended to cause harm.
Determining the intent behind spoofing incidents is often difficult, especially in politically sensitive or high-risk regions. The AAA suggests that reliance on exclusion clauses based solely on the occurrence of spoofing is unlikely to be sufficient; insurers would need to demonstrate both causality and malicious intent to deny cover.
“The additional difficulty in determining whether spoofing was intended to cause harm potentially means that insurers face a much higher bar in evidencing that harm was intended by the spoofing actor. This introduces a significant grey area in claims assessment, where causation, crew conduct, and cyber attribution intersect,” Mr Kilbee added.
“GPS manipulation is no longer a theoretical risk and it’s not always clear who is behind it or why. This creates a tension between traditional coverage expectations and the application of broadly drafted cyber exclusions. In this context, stakeholders across the shipping and insurance sectors are encouraged to closely review policy wordings and understand the legal thresholds required to engage or avoid exclusions in the event of a digitally influenced casualty.”
The paper also highlights the role of cyber buy-back clauses, which allow for cover to be reinstated where cyber exclusions might otherwise apply. These clauses could prove critical in grounding cases where spoofing is suspected but attribution remains unclear.
The AAA is encouraging shipowners and insurers to carefully review policy wordings and understand the evidentiary thresholds that may apply in casualty investigations involving digital interference.
