CYBER RISKS IN SHIPPING 5 TH ASIA MARINE

LATITUDE BROKERS Independent Marine Retail and Reinsurance Brokers Hong Kong, Singapore and Seoul 4 Founding Partners Andrew Brooker, Founding Partner Marine Insurance industry since 1991 in London, Singapore and Hong Kong: Sinclair Roche & Temperley (London lawyers), WK Webster (Cargo consultants), Marsh London & Singapore, Board Director of FP Marine 2006 -2013 © 2014 Copyright Latitude Brokers

CYBER RISKS IN SHIPPING Everyone in shipping is at risk – to greater or lesser degrees, so… Why aren’t more policies being bought? Even after successful attacks close to home: AP Moller-Maersk ransomware attack: 17 APM container terminals forced to stop all loading/discharging No cargo bookings for 11 days 1500 software systems shutdown Disrupted operations in: container ships, port and harbor tugs, drilling and oil production offices around the world Total cost to Maersk – USD 200, 000 - USD 300, 000 Fedex victim of Not. Petya resulting in loss of data and subsequent loss of income Total cost estimated by Fedex - USD 300, 000 © 2014 Copyright Latitude Brokers

CYBER RISKS LANDSCAPE Risk consultants Clause 380 Fake President Fraud Corporate Governance Ransomware Costs of advising clients Social Media & PR D&O cover Privacy Ordinance Malware Business Interruption IT Department Third Party Liability E-commerce Regulatory oversight © 2014 Copyright Latitude Brokers Legal costs Assured Cyber at Sea training Fines Software Reinstallation Cargo theft Counterparty risk Counterparty Onboarding procedures Losses paid, unrecoverable Social Engineering Fraud Loss of Hire Accounting functions

CURRENT INSURANCE SOLUTIONS Insurance policies required: • • Clause 380 buy back H&M Clause 380 buy back War Clause 380 buy back Loss of Hire Non-Marine Cyber Risks with amendments Non-marine Cyber Liability with amendments Non-Marine Commercial Crime policy with amendments Delay Insurance (new cyber option announced last week) • P&I insurance still lacks certainty of cover (neither an exclusion, nor a peril) Specialist response consultants still not part of the cover available Marine insurance industry isn’t, yet, providing a single, purpose built, cover for the core cyber risks © 2014 Copyright Latitude Brokers

MARINE MARKET OPPORTUNITY K&R had similar traits: • • Operators had no prior experience of the risk Everyone trading through Go. A was exposed Vessel hardening advice driven by BIMCO Insurance complimented risk management requirements, demanded improvements Insurance required armed guards. First minimum number, then experience, then accreditation/contract form Insurance gave access to response consultants Necessity led to improved risk management, led to fewer losses The marine market responded to a real, evolving, threat and created fit for purpose policies that worked. © 2014 Copyright Latitude Brokers

MARINE MARKET RESPONSE CONSULTANT 24/7 emergency contact details Full authority from underwriters to manage: • IT Forensic • Data Reconstruction • Business Interruption • Legal • PR Clients can handle all of the above individually…. theoretically © 2014 Copyright Latitude Brokers

MARINE MARKET RESPONSE CONSULTANT • IT Forensic • Severity assessment • Ransom – to pay or not to pay? • No conflict of interest with IT dept – solution focused • Data Reconstruction • Aggregation of experience from other attacks • Advice on quickest resolution • Business Interruption/ACOW • Same underwriters on both aspects – recovery and BI • Forensic accounting © 2014 Copyright Latitude Brokers

MARINE MARKET RESPONSE CONSULTANT • • Legal • • Ransom payment legality Specialist cyber lawyers in each jurisdiction Response to regulators/stock exchange Core contract positions post-cyber attack PR • • • Reputation management Advisory to clients (BI management) Particularly relevant in a highly competitive environment How long will it take a shipping company to find all the above experts in the middle of an attack? Where does a shipping operator start? © 2014 Copyright Latitude Brokers

MARINE MARKET OPPORTUNITY Create a marine product for the shipping industry: • • A risk management solution as well as financial protection Based upon existing risk management guidelines – eg BIMCO, Cyber at Sea Remove non-marine terms that are marine loopholes Include access to a response consultant! Include basic, clear, cover for onshore risks of: • First party loss; • Counterparty liability; • BI/ICOW; • Response consultants And the many things a clever underwriter will offer in a product that is needed by everyone and purchased by few… © 2014 Copyright Latitude Brokers