Signal Scanner · DEFENCE, SECURITY & RESILIENCE · 2 September 2026

Deniable Sabotage Falls Between the War Clause and the Terrorism Pool

The Lloyd's market is drafting which hostile acts do not count as war while state terrorism pools stop at certified terrorism, leaving state-linked sabotage of European infrastructure uninsured by default into 2027. Exposed: infrastructure operators, defence suppliers, lenders, treasuries.

Europe's security services now describe deniable sabotage, not invasion, as the threat they meet daily: Germany's domestic intelligence agency put Russia, China and Iran at the head of the campaign in June, and a Congressional Research Service count reached at least 151 reported Russian operations in Europe since February 2022. The consensus response is physical: cable patrols, drone walls, resilience statutes. Beneath it sits a quieter problem. The instrument that turns a severed cable into a recoverable loss was written for peace and for declared war, and the attacks arrive between them. The Lloyd's market is drafting where that line falls; the state backstops built for terrorism stop short of it. Who carries the peril in the middle is a 2027 decision.

Signal Identification

A regulatory pivot inside private markets rather than in statute. The definition of war for cover purposes, unchanged in the marine market since the years after 1945, is being redrafted by the Lloyd's Market Association with an independent panel proposed to rule on it, while state-backed terrorism pools respond to certified terrorism, not state-linked sabotage. The signal is the gap between the two.

Time horizon: 1-3 years (LMA wording decision and first grey-zone claims disputes 2026-2027; backstop redesign around the end-2027 TRIPRA expiry)
binds 1-2 yrs202620272028
Plausibility band: Medium–High
LowMediumHigh
Geographic / Jurisdictional Scope: United Kingdom and the London market as the drafting venue; Germany, the Baltic, North Sea and Black Sea littorals as the exposure; spillover to the United States (TRIPRA, courts), EU-27 supervisors and the Ukraine defence supply chain
PrimaryUK / London marketGermanyBaltic & North SeaBlack Sea littoral
SpilloverUS (TRIPRA, courts)EU-27 supervisorsUkraine supply chain
Sectors exposed:
Energy and grid operatorsSubsea cable and pipeline ownersPorts and offshore platformsDefence-supply manufacturersPolitical violence and war underwritersReinsurersInfrastructure lendersFinance ministries and terrorism pools

What's Changing

The private boundary moves first. The Lloyd's Market Association is reviewing the Five Powers exclusion, the post-1945 marine clause that cancels cover if war breaks out between the US, UK, France, China or Russia. Draft wordings list scenarios that would not, on their own, trigger it: cyberattacks, drone incursions and undersea sabotage. The LMA is weighing an independent panel to rule on whether a conflict counts as war and has not decided whether to publish (Insurance Business UK, 19/06/2026). The precedent is Merck's NotPetya dispute, settled in 2024 for a reported $1.4 billion after a US court read the war exclusion to require actual military action.

The public boundary stops earlier. Pool Re, the UK's government-backed reinsurer, typically responds to certified acts of terrorism rather than the greyer category of state-linked sabotage or acts of war. That distinction went live in August, when a Kremlin-linked adviser said British factories supplying Ukraine could face "semi-military" action from "unknown sources", days after a state-linked cyber intrusion had knocked a UK power generation facility offline for four days (Insurance Business UK, 25/08/2026). In the US, Marsh credits TRIPRA with the terrorism market's stability and notes it expires at the end of 2027 (Marsh, 18/03/2026).

Private capacity is thin where it is needed. Howden Re's July renewal analysis put global political violence and terrorism premium at around US$1.5 billion against insured loss estimates approaching double that, with many reinsurers declining risks tied to critical infrastructure such as airports, refineries, desalination plants and ports (Reinsurance Business, 02/07/2026). EIOPA's July dashboard flagged uncertainty around war- and trade-related coverages and raised cyber risk to high (EIOPA, 30/07/2026).

Where the peril lands: four bands of hostile act and who pays

PEACETIME DECLARED WAR Crime and certified terrorism all-risk property cover Pool Re / TRIPRA backstop State-linked deniable sabotage cyberattacks, drone incursions, undersea sabotage, arson THE GAP: operator carries it Casualties equal to an armed attack LMA draft threshold independent panel to rule War between the five powers Five Powers clause cover cancelled PV and terrorism premium ~US$1.5bn insured loss estimates near US$3bn TRIPRA expires end-2027 per-risk capacity $1-4bn Clause drafted, not yet published (June 2026) Volume of hostile acts in the red band: at least 151 reported Russian operations in Europe, Feb 2022 to Mar 2026; one study found Russian hybrid attacks in Europe quadrupled from 2023 to 2024 (CRS, 11 Aug 2026). NotPetya precedent: war exclusion read to require actual military action; settled 2024 for a reported $1.4bn.

Compiled from Insurance Business UK (19 June and 25 August 2026), Reinsurance Business (2 July 2026), Marsh (18 March 2026) and the Congressional Research Service (11 August 2026).

Disruption Pathway

Stage one, through 2027, is definitional: whether or not the LMA publishes, underwriters will price the named scenarios explicitly, and the first grey-zone claim of size will be adjusted against wordings that name them. Stage two, 2027 to 2028, is the public test: TRIPRA's end-2027 expiry and any move by HM Treasury on Pool Re's remit decide whether state-linked sabotage enters a certified backstop or stays with the insured. Stage three is allocation: who carries a peril the market will not pool: through premium, balance sheet or statute.

Stress concentrates in three places: operators of energy, data and port infrastructure on the Baltic, North Sea and Black Sea littorals, whose all-risk policies exclude the peril their governments now rank first; defence-supply manufacturers publicly attached to Ukraine, now a named target class; and courts, since a London panel's finding that an act was not war may carry little weight in New Jersey (Insurance Business UK, 19/06/2026). Two adaptations follow: standalone sabotage covers in smaller lines with higher attachment points, the form new MGAs and syndicates already take (Reinsurance Business, 02/07/2026); and pressure to certify state-linked sabotage inside Pool Re and TRIPRA-type schemes, which turns a wording question into a fiscal one.

Why This Matters Now

Boards of infrastructure operators, their lenders and the ministries that depend on them should treat the war clause as a resilience document: a cable or a peaker plant is only as resilient as the capital that rebuilds it, and that capital is retreating where the threat assessment concentrates. CFOs should map every programme, property, business interruption, cyber, marine and political violence, against the three scenarios the LMA drafts name, and establish which policy responds before an event rather than during a claim. Governments should decide whether deniable sabotage of critical infrastructure is a peril the market prices, a peril the state certifies, or a peril nobody carries; the present position is the third, by default.

Decision-action posture for this signal: Prepare — the LMA wording is drafted but unpublished and the public backstops come up for decision around the end-2027 TRIPRA expiry, leaving one renewal cycle to reposition programmes before the gap is priced.

Counter-Argument

The strongest objection is that the market is soft and capital abundant, so the gap will be filled by product rather than by the state. Guy Carpenter reported property catastrophe rate on line down around 16% globally at 1 July, with abundant reinsurer capacity (Guy Carpenter, 01/07/2026), and the same renewal saw new MGAs and syndicates enter political violence (Reinsurance Business, 02/07/2026). On this reading the LMA exercise is housekeeping.

The objection describes the wrong market. Property capital is not political violence capital, and the class the sources describe runs at premium around half its loss estimates while declining the very occupancies at issue. Taken together, the sources suggest capacity will price the peril where it is small and discrete and step back where it is systemic, the shape a state campaign takes.

Implications

This catalyses durable change. Once a market body writes down which hostile acts are not war, that list becomes the reference for every court, regulator and treasury that follows; past LMA wordings, including its sanctions clause, shaped practice well beyond Lloyd's (Insurance Business UK, 19/06/2026). The inflection window is 2027, when TRIPRA reaches expiry and the first claims adjusted under the new drafts reach dispute. Specialist political violence writers gain; littoral operators and manufacturers publicly attached to Ukraine carry the residual. Marsh's account of public-private partnerships as the anchor of the terrorism market states what sabotage now lacks (Marsh, 18/03/2026).

Early Indicators to Monitor

Disconfirming Signals

Strategic Questions

Keywords

Five Powers clause; war exclusion; grey-zone aggression; state-linked sabotage; Pool Re; TRIPRA; political violence insurance; critical infrastructure; Lloyd's Market Association; hybrid warfare; undersea cables

Bibliography

Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.

This Signal Scan is one component of a Shaping Tomorrow intelligence cycle on Defence, Security & Resilience. Every monitored topic also includes monthly Change Trackers that assess what is materially shifting in momentum, and a quarterly Decision Intelligence briefing that converts the cycle into board-level strategic implications. Cycles may also close with Action Triggers, an end-of-cycle synthesis that reads across the three formats and surfaces patterns no single deliverable carries on its own. Continuous intelligence on this topic is available as a Single-Topic or Multi-Topic programme.

Discuss a Tailored Programme

Prepared by Shaping Tomorrow: 2 September 2026