Week 8 Studio: Not Petya
Wired published a long-form article about NotPetya, and the way the shipping company Maersk dealt with the attack. Since Wired has a paywall, I put a PDF of the article in the “Files” section of Canvas. This article is much shorter than the Mirai one – only about 30 pages. I recommend reading it before class.
Optional: A report from Maersk’s CISO, written in 2025: https://www.infosecurity-magazine.com/news/infosec2025-lessons-maersk-ciso/
The article for today is about Maersk, the shipping company. It does a good job describing the damage that NotPetya did to a single company, and from the article the $300M costs that Maersk reported can be understood. Maersk was not the only company affected. As highlighted in the article, other companies also reported large costs to deal with it: FedEx reported $400M in losses; French construction company Sait-Gobain reported $384M in losses; Modelez (the parent of Nabisco and Cabury candies) reported $188M in losses; Ricklitt Benckiser (owner of Lysol cleaning spray and Durex condoms) reported $129M in losses.
Another company – Merck Pharmaceuticals – reported $870M in losses! However, they had an insurance policies with the insurance companies. They tried to handle the information asymmetry by buying cyber-insurance to cover them in case of a cyberattack. After NotPetya, they filed insurance claims, asking the insurance companies to pay them back for their losses.
The insurance companies all denied the claim! They claimed that the insurance contract had an exclusion clause for “acts of war”, and that NotPetya was an act of war – it was an act of the Russian government against Ukraine (before the actual war started). The insurance claimed that they did not need to pay their insurance claims because of this.
Merck filed a lawsuit against 20 different insurance companies for denying their claims. A court in New Jersey ruled that NotPetya was not excluded by the insurance contract’s “acts of war” clause, and that ruling was upheld on appeal. Finally, at the beginning of 2024, Merck agreed to settle with the insurance companies.
Since these rulings, insurance companies have started updating their cyber-insurance contracts to be much more specific about acts of war and which cyber-attacks are and are not included as part of the insurance.
Understanding the Case
Let’s understand the case. We have a couple of processes that we use now to understand cases like this.
First, let’s go through our actors and motivations. Go though the information linked above, and make a list of the relevant actors and think about what their motivations are. Do you think this was an act of war?
Second, let’s use our policy worksheet to think through the larger issues around this. The basic question is how to deal with large, correlated attacks like this. The worm spread through a number of different companies at the same time. What are the information economics issues that might make defending against attacks like this difficult? Are there reasons why these companies were vulnerable to such an attack? Is insurance a good solution?
Policy Challenge(s)
Two cybersecurity scholars (Bruce Schneier and Josephine Wolff) published an article about a public policy proposal to deal with cyberattacks like this. They propose to create a government-run “Cyber-insurance backstop”: https://www.schneier.com/blog/archives/2024/02/a-cyber-insurance-backstop.html
Read that article, and think about it. They describe a specific problem: insurers can’t handle it when lots of big companies get attacked all at the same time. Schneier and Wolff propose a new public policy to handle this situation. Do you think this proposed policy will work? Why or why not?