<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@宋体";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:#1F497D'>Hi all,<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:#1F497D'>When can we have a conclusion for EV insurance issues? My insurance broker is chasing me to renew 2015 insurance now. I need to decide if we renew it or not.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:#1F497D'>Thanks.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Best Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Richard<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Ryan Sleevi<br><b>Sent:</b> Friday, December 19, 2014 10:07 AM<br><b>To:</b> Phillip<br><b>Cc:</b> Dean Coclin; CABFPub<br><b>Subject:</b> Re: [cabfpub] Breach Insurance<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p><br>On Dec 18, 2014 5:31 PM, "Phillip Hallam-Baker" <<a href="mailto:philliph@comodo.com">philliph@comodo.com</a>> wrote:<br>><br>> On Dec 18, 2014, at 6:50 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>> wrote:<br>>><br>>> Isn't the skin in the game from insurers to ensure that they can find as many ways as possible to disqualify the policy, rather than actually secure the insured?<br>><br>> I have yet to meet an insurer who will take that approach when issuing a policy.<o:p></o:p></p><p>That is the whole point of actuaries - to determine the risk the insurer takes on and the odds of payment, which is then applied to what the market will purchase and possible reward - at least within the unregulated spheres of insurance.<o:p></o:p></p><p>> Though I will accept that they are likely to do so in the case that a claim is brought. But even that is a losing game in the long run.<o:p></o:p></p><p>I don't know what you envision as "the long run", but if it there is significant portion of short-term gain until the industry figures out what to expect of insurers, any sensible company will take it.<o:p></o:p></p><p>That is, work hard to deny every claim - until you no longer find people willing to purchase/demanding better protections - then offer them.<o:p></o:p></p><p>> The pre-eminent position of Lloyds of London was established by Cuthbert Heath's famous cable in the wake of the 1906 San Francisco earthquake: “pay all of our policyholders in full, irrespective of the terms of their policies”.<br>><o:p></o:p></p><p>And that's great for 1906, but I think it falls far short of being relevant today.<o:p></o:p></p><p>>> After all, the article shows that the Cyberbreach insurance Target had was "useless", in as much as the claims were disqualified because of actions of the insured. This is exactly what we saw of DigiNotar as well - the insurance claim was denied because of actions of DigiNotar<br>><br>> In the case of DigiNotar it seems that none of the browser providers noticed that the audit did not apply to the WebPKI system so it is hardly surprising that the insurance was not applicable as well.<br>><br>> One of the reasons for establishing the BR rules is precisely the fact that there was a lot of inconsistency in the application of the rules and uncertainty as to what the rules were or the purpose.<br>><br>>> Indeed, in the history of events that have done the most to undermine the faith in the CA ecosystem, they have been systemic issues that any insurance agency - especially when looking at large scale liability as proposed by 141 - would seek to use to disqualify the policy and reject the claim.<br>><br>> If the thieves broke in by picking the lock on the door should we fit a stronger lock or take the door off its hinges and let everyone in?<o:p></o:p></p><p>Yes, but let's not pretend our lovely garden hedge is fit to keep out the Mongolian horde, nor our quarter-meter deep most enough to keep out foreign legions.<o:p></o:p></p><p>Or, perhaps a more pop-culture reference, let us not assume that from the lack of tiger attacks in Britain that tiger repelling rocks are a sensible mitigation strategy.<o:p></o:p></p><p>><br>> I am not averse to going through a complete redesign of the system of WebPKI controls. But just removing random controls because the purpose is not immediately apparent seems like a very bad approach to me.<o:p></o:p></p><p>No, the purpose is quite apparent. We have had lengthy discussions of purpose, both past and present.<o:p></o:p></p><p>The question is whether the proposal is fit for purpose, or indeed, whether the purpose is relevant to the threats we face and the mitigations we employ.<o:p></o:p></p><p>More to the topic at hand, I think it is entirely relevant to see what examples there are where this insurance was meaningful for any situation similar to the attacks we have seen in the past decade. This is just another example of where the insurance was not meaningful.<o:p></o:p></p></div></body></html>