topics schadenspiegel - Munich Re

TOPICS SCHADENSPIEGEL

The magazine for claims managers Issue 2/2015

Transport risks in the age of digitalisation The growing digitalisation of global supply chains presents a variety of new challenges for the insur ance industry. Do such innovative technologies actually improve safety or is it merely a case of new risks replacing old ones? PAGE 6

Aviation Why volcanic ash damages jet engines

Autonomous vehicles Who is liable for road accidents?

Smart homes New types of losses are a challenge for insurers

Editorial Dear Reader, Transport and logistics are key areas in today’s age of globalised markets. This issue of Schadenspiegel takes a look at the risks and losses involved. Does digitalisation of the transport sector increase safety or are new risks emerging just as the old risks disappear? How are loss scenarios affected when state-of-the-art technologies come up against ageing infrastructure or natural catastrophes? What are the implications for liability losses of widespread digital monitoring and control systems? Outside the transport sector, the globalisation of markets and digitalisation of all areas of life are causing a shift in risks and producing new requirements for claims management. Losses due to business interruption are also becoming increasingly significant. We demonstrate how claims handling can meet these challenges, taking traditional mining and refinery losses as well as property covers for modern smart homes as examples. The development of losses caused by storm damage in central Europe in recent years illustrates the fundamental importance of loss prevention: global warming may not necessarily increase the frequency of severe thunderstorms and tornadoes, but those that do occur cause significantly more severe losses than in the past. Finally, in an interview, Ken Feinberg explains what is important when indemnifying the victims of all kinds of disasters, based on his experience following the terrorist attacks of 11 September 2001 and the Deepwater oil disaster. We hope you enjoy reading this issue of Schadenspiegel.

Tobias Büttner Head of Corporate Claims at Munich Re

NOT IF, BUT HOW

Munich Re Topics Schadenspiegel 2/2015

1

Transport risks in the age of digitalisation The trend towards digitalisation has long since reached the logistics sector. Digitalised process flows help to make the transport of passengers and goods more efficient and optimise supply chains. Several traditional transport risks have consequently become less important. However, the growth of digitally managed transport routes is creating new challenges for the insurance industry and claims management.

2


6

Contents

Volcanic ash accumulates in jet engines as they fly through ash clouds.

22

TRANSPORT RISKS IN THE AGE OF DIGITALISATION AVIATION New technologies, new risks Modern collision avoidance systems enhance safety and change the situation regarding risk and liability. CASUALTY Liability for autonomous vehicles How is the insurance industry reacting to new driver assistance systems? TRANSPORT Pipelines on rails Oil shipments by rail are increasing. Rail operators and suppliers frequently lack sufficient insurance cover. AVIATION Volcanic ash in jet engines Airlines are allowed to fly through ash clouds provided the ash concentration is low. This could prove risky in the long run.

6

14

16

22

The mining sector has its own set of special risks. An industry-wide initiative launched in 2014 is helping to improve claims settlement.

34

NATURAL HAZARDS Thunderstorms over Germany Tornadoes rarely cause any significant damage in Germany. But there are always exceptions. BUSINESS INTERRUPTION Efficient but vulnerable Competitive pressure and shorter product cycles are proving a major challenge for insurers.

24

30

PROPERTY Digging deeper 34 Things have improved in the mining insurance sector since an alliance was formed in 2014 between mining companies, insurers and other stakeholders: the Mining Insurance Group (MIG). INTERVIEW Responding to unique catastrophes Ken Feinberg, Special Master of the 9/11 Victim Compensation Fund, talks about his experience with ad hoc compensation schemes. PROPERTY Just how safe are smart homes? New types of losses and complex claims settlement are a challenge for insurers.

40

44

Editorial 1 News4 Column 49 Imprint Munich Re Topics Schadenspiegel 2/2015

3

NEWS

KNOWLEDGE IN DIALOGUE 2016

COOPERATION

NEW PUBLICATION

New client seminars

Autonomous and connected vehicles

The history of Munich Re

The new client seminar programme “Knowledge in dialogue 2016” is now available. We will again be offering our international clients an extensive programme of seminars and workshops in the coming year. The available courses will cover not only all the important classes of insurance business but also specialist topic areas such as financial lines insurance or enterprise risk management. Contact your Client Manager for further information.

New developments in automobile technology, such as autonomous and connected cars, will have a profound impact on society and insurance business. The University of Michigan’s Mobility Transformation Center (MTC) researches precisely these developments. “Munich Re has agreed to become a cooperation partner of MTC in order to support their efforts to develop the foundations of a commercially viable ecosystem of connected and automated vehicles. Our objective is to better understand and manage the opportunities and potential risks that accompany these new technologies”, explains Mike Scrudato, who was instrumental in helping to set up this cooperation.

It did not take long for Munich Re to become global market leader after the company was founded in 1880. But even today, the general public knows little about Munich Re. The first book detailing the history of the company from its beginnings through to the 1980s was published in October. It shows how the business of managing risks has changed over the years. At the same time, it is also a story of globalisation and highlights the setbacks and obstacles encountered in this process. It also gives a detailed account of the company’s role during the Third Reich.

>> More information from your Client Manager

>> Johannes Bähr, Christopher Kopper:

>> Follow our expert Mike Scrudato on Twitter: @mjsdado3

Follow us on social media Why not follow us and keep up with the topics that are being talked about in the insurance industry? Check out our extensive range of interesting articles and fascinating videos. Or stay fully up to date with live tweets from company and industry events.

4

>> twitter.com/munichre >> facebook.com/munichre >> youtube.com/user/munichrevideo >> linkedin.com/company/munich-re >> xing.com/companies/munichre >> plus.google.com/ 115897201513788995727


“Munich Re: Die Geschichte der Münchener Rück 1880–1980” (The history of Munich Re 1880–1980), C. H.

Beck, 2015

NEWS

The Tianjin port explosions – How satellites and drones will improve claims management of large losses Tobias Büttner

The use of innovative technologies and applications such as satellites and drones will have a major impact on claims management – as recently demonstrated in Tianjin, China. On 12 August 2015, two explosions in the port of Tianjin where chemicals were being stored caused many fatalities and destroyed buildings and goods within a 5-km radius. Access to the area of the explosion had been restricted from the beginning. One aspect makes this large loss event ground-breaking: the extensive use of satellite and drones technology to support claims management.

Combination of satellite and drone data might lead to a better understanding of loss events and their causes Data from satellite and drones revealed that the explosion crater (100 metres in diameter) in Tianjin was situated outside the housed storage areas. This led to the conclusion that the chemicals responsible for the explosion must have been stored in the open. Existing standards of storage obligations help to reduce the chances of such an event happening again, provided of course that such standards are complied with.

Satellite pre- and post-event data support effective change detection Prior to the event, a satellite had taken detailed pictures of the areas later affected. Four days later, another satellite captured further images and information. The data of both satellites provided a comprehensive collection of all affected cars, containers and buildings, offering valuable information about the extent and, to a certain point, degree of damage. Combining this spatial knowledge with data mining and webcrawling methods could establish the link to the individual insureds affected. Data from drones complement satellite data Information provided by satellites was supported by spatial data captured by copter drones with a resolution (depending on the flight altitude) of just a few centimetres. These data can actually fill the gap in loss assessments where available satellite data are either too poor in terms of resolution or simply too cost-intensive.


5

AVIATION

New technologies, new risks Modern collision avoidance systems promise to increase safety and reduce pilot workload. Meanwhile, the allocation of risk and liability between the various stakeholders in air traffic is changing, as product liability claims assume greater importance and the operators’ risk declines.

Roland Küsters and Anna Masutti

With international air traffic constantly increasing and congestion tipped to double over the next 20 years, stakeholders in air traffic management (ATM), such as pilots, airport operations centres, meteor ology service providers and military operations centres, all rely more than ever on accurate, consist ent and timely information. Lack of interconnection a problem Given the growing number of flight operations, today’s air traffic control systems could very soon reach their limits. The large number of legacy systems and appli cations is the main shortcoming. Developed for a variety of users over the years, these systems and applications feature customised communication pro tocols and interfaces which have to be managed and maintained independently of one another.

The global increase in air traffic places new demands on the stakeholders involved in air traffic management, such as pilots, operations centres and weather services. Munich Re Topics Schadenspiegel 2/2015

7

AVIATION New systems are needed if system-wide interoper ability is to improve and permit seamless information access and exchange. Critical information must be organised and delivered flexibly. To this end, the Euro pean Commission has launched the Single European Sky ATM Research Programme (SESAR). Its objective is to standardise and synchronise air traffic manage ment throughout Europe. Such solutions as System Wide Information Management (SWIM) and the Air borne Collision Avoidance System (ACAS) are a step in this direction. Similar efforts to modernise air traffic management are also under way in the US, with the Next Generation Air Transportation System (NextGen). SWIM – The internet of air traffic management information The concept of SWIM entails a complete change in information management. The present product- centric approach in which data are typically locked up in certain applications will make way for an open approach. All parties receive the same air traffic management information through standard data exchange formats. The real-time web-based systems include the following data: −−Aeronautical – information resulting from the assembly, analysis and formatting of aeronautical data −−Flight trajectory – the detailed route of the aircraft defined in four dimensions (4D), so that the time component is taken into account in determining the position of the aircraft −−Airport operations – the status of different aspects of the airport, including approaches, runways, taxi ways, gate and turnaround information −−Meteorological – information on the current and future state of the earth’s atmosphere, where this is relevant for air traffic −−Air traffic flow – the network management informa tion necessary to understand the overall air traffic and air traffic services situation −−Surveillance – positioning information from radar, satellite navigation systems, aircraft data links, etc. Such a system initially benefits the airlines when planning their flights. If the level of ATM automation can also be increased, air traffic controllers will be able to focus more on monitoring and contingency planning. Human error – particularly in the form of data entry errors – could be reduced.

8


Even greater safety is promised by the next generation of on-board Traffic Collision Avoidance Systems (TCAS), also known as Airborne Collision Avoidance Systems (ACAS). The first version of such a system dates back to 1993, when the US declared airborne traffic collision avoidance systems mandatory for all aircraft carrying passengers in its airspace. Aircraft with 10 to 30 seats had to be equipped with an ACAS I. It alerts the crew to other aircraft crossing their course. ACAS II was prescribed for aircraft with more than 30 seats; it additionally provides so-called resolution advisories recommending alternative routes and directs pilots to climb, descend or level off. In 2003, ACAS II became mandatory in all passenger and cargo aircraft. Today, there are approximately 25,000 ACAS II-equipped aircraft worldwide. ACAS X – Enhanced collision avoidance The system has proved highly effective and has suc cessfully prevented nearly all critical mid-air collisions encountered. However, it cannot detect aircraft with out transponder equipment or aircraft with inopera tive transponders. Moreover, the system depends on receiving correct information regarding the altitude of an aircraft on a potential collision course and on whether the pilots actually implement the recom mended alternatives advised by the system. In addi tion, ACAS II is not compatible with new operational concepts aimed at meeting the requirements of both SESAR and NextGen. Too many alerts would be gen erated. ACAS X could help to improve the situation: pegged for implementation no later than 2025, it will include both general aviation and unmanned aircraft. The system optimises the flow of traffic by making the best possible use of the prescribed minimum separa tion and spacing between aircraft. A new system logic and the integration of sensor data from several sources ensures timely identification of potential col lision risks both vertically and laterally, and notifies the pilot accordingly. ACAS I and II rely solely on transponder-based surveillance, while ACAS X will also be able to use satellite-based navigation and Automatic Dependent Surveillance Broadcast (ADS-B) functionality, as well as radar, infrared and electro-optical surveillance systems. Air traffic controllers will additionally be able to see the alternative routes recommended by the system (resolution advisories) on their screens. This is not the case at present.

AVIATION ACAS X is expected to reduce the risk of collisions and minimise unnecessary advisories, thus reducing pilot workloads. The system allows a reduction in spacing between aircraft and enables aircraft to fly the safest and most economical path. Shorter soft ware update cycles are expected to reduce implemen tation costs. Collisions due to conflicting information On 1 July 2002, the weakness of the ACAS II system used at that time (no aircraft-to-ground communica tion of the recommended alternative route (resolution advisory)) led to one of the worst accidents in German civil aviation, with 71 fatalities. A Tupolev TU-154M operated by Bashkirian Airlines (BAL) collided in midair over Überlingen with a Boeing 757-200 operated by DHL Airways. The installed ACAS II systems issued recommended alternatives to both aircraft. While the Tupolev was advised to climb, the DHL Boeing was advised to descend. The DHL pilot followed the rec ommendation and started his descent. Unfortunately, the Tupolev’s captain had received prior instructions to descend from a controller at the Zurich Air Traffic Control Centre. The pilots followed the instructions from the Air Traffic Control Centre and disregarded the recommended alternative. At this point, it is impor tant to note that the conditions and opportunity for a reversal of the recommended alternative were availa ble during the 23-second window before the collision.

Legal investigation exposes shortcomings The criminal proceedings following the accident high lighted organisational weaknesses. The court ruled that the air traffic controllers and managers who had been found guilty had in fact had the opportunity to remedy the defects. The civil judgement for product liability, concluded in Barcelona in 2012 (Audiencia Provincial de Barcelona, Sección 17, sent. 230/2012), stressed the malfunctioning of ACAS II version 7. Two main product defects were alleged against the manu facturer of the ACAS system: 1. The system did not reverse the recommended alternatives due to reasons intrinsic to the system. Although a software update correcting the prob lems in version 7 was already available, the system design remained faulty and was deemed to have a construction defect. The product did not comply with the minimum requirements established by the US aviation authority FAA. 2. The ACAS Pilot’s Manual did not clearly indicate that priority must be given to ACAS orders in the event of conflicting instructions: FAA regulations at the time indicated that recommended alternative warnings from an ACAS were obligatory. In the event of a conflict between a recommended alter native and an ATC order, as was the case here, the crew must always follow the ACAS instructions (an omission by the manufacturer). This constitutes an “instruction error”, or breach of the manufacturer’s duty to warn. When assessing the legal basis in the ruling against the designer and manufacturer of ACAS II, the court found that the delay in processing information con stituted a malfunction. If the system had been able to refresh data every second (bearing in mind the 23-second window available before collision), the recommended alternative could have been reversed and the accident avoided.

Parts of the wreckage being prepared for removal following a mid-air collision between two aircraft over Überlingen near Lake Constance, Germany, on 1 July 2002. A total of 71 people lost their lives and wreckage destroyed several homes. Munich Re Topics Schadenspiegel 2/2015

9

AVIATION

Current and future air traffic management systems To improve safety and efficiency in the future, air traffic management information must be organised and provided through flexible means that support system-wide interoperability, secured seamless information access and information exchange.

Air Traffic Management TODAY Current air traffic information management systems are composed of a wide variety of legacy systems and applications for point-to-point com munication between various users, most notably pilots, air traffic controllers and operation service providers.

Flow Management Centre

Military Operation Centre Meteorological Service Provider

Air Navigation Service Provider / Air Traffic Control

Airport

Airline Operation Centre

10


Vehicles

AVIATION Air traffic management information shared Aeronautical Information resulting from the assembly, analysis and formatting of aeronautical data Meteorological Information on the past, current and future state of the earth’s atmosphere relevant for air traffic Surveillance Positioning information from radar, satellite navigation systems, aircraft data links, etc.

Flight trajectory The detailed route of the aircraft defined in four dimensions (4D), so that the position of the aircraft is also defined with respect to the time component.

Aerodrome operations The status of different aspects of the airport, including approaches, runways, taxiways, gate and aircraft turnaround information.

Capacity and demand Information on the airspace users’ service needs, access to airspace and airports, and the aircraft already using it.

Air traffic flow The network management information necessary to understand the overall air traffic and air traffic services situation.

Flight-critical information and data

Air Traffic Management TOMORROW Future systems will cover all air traffic manage ment information and provide the same informa tion at the same time to all parties. Everyone involved will share a common situational aware ness and access to the same, consistent and accurate flight information via web-based sys tems.


11

AVIATION

New anti-collision technologies promise to increase safety and ease the pressure on pilots.

The court experts’ investigation during the appeal proceedings revealed that potential accidents had already been predicted in 2000. In addition, it was found that non-reversal of recommended alternatives had already contributed to another serious accident in Yaizu (Japan) in 2001. The court concluded that the Überlingen accident and other incidents could have been avoided, had the upgraded version 7.1 of ACAS II been installed.

Future cover concepts must include the following aspects:

In its concluding remarks, the court stated: “... the final and actual cause of the airplane accident in Überlingen was the TCAS [ACAS] II system and its defects“.

−−Cyber extortion

What it means from an insurance perspective Efforts to improve air traffic safety in the context of SESAR and NextGen will also impact product liability. As automation increases, the number of human errors when controlling aircraft and monitoring airspace will dwindle; at the same time, however, it will also create new opportunities for human error elsewhere. Liabil ity risks will change accordingly: system manufactur ers’ product liability is likely to increase, while the operators’ risk decreases. The insurance industry must respond to these changes and develop solutions miti gating the claims burden due to system malfunctions.

12


−−Damage to digital assets −−Non-physical business interruption and extra expenses −−Reputational risk

−−Privacy liability −−Confidentiality liability −−IT liability −−Crisis management costs, including notification expenses, forensic expenses, public relations costs, credit monitoring and other assistance costs Better protection against cyber attacks Future system-wide information management will extend access to flight data and information to air craft and other participants in the system. Such data consequently become a major risk factor within the system. Highly interoperable and interconnected air traffic management systems, for instance, are exposed to higher cyber risks. This makes it even more impor tant for the new generation of air traffic management systems to ensure data and information security and to heighten awareness of the risks. Cyber-related fail ures could become more frequent and more serious.

AVIATION TCAS/ACAS Communication Airborne collision avoidance systems mon itor the airspace around an aircraft and warn pilots of a threat of a mid-air collision with other aircraft equipped with a corresponding active transponder. If a risk of collision is established by ACAS, a resolution advisory, such as “climb” or “descend”, will be generated.

TCAS Communication

The greatest challenge for the new generation of air traffic management systems will be to strike an opti mum balance between efficiency and security. In 2014, data security specialists from the Ponemon Institute investigated the impact of cyber attacks on the GPS systems of a major US airline. The aircraft fleet was subsequently grounded. This scenario implied that such an attack could cost US$ 1.35bn per year. At present, standard aviation hull and aircraft liability policies only cover cyber risks in the event of accidents. As a rule, such policies are limited to per sonal injury and property damage. Software malfunctions, hacker attacks against air craft, and flight data spoofing are areas of high risk for system and component manufacturers. Breaches of flight data integrity and security pose the greatest threat. Malfunctioning software or erroneous flight data can lead to serious consequences as aircraft nav igation and air traffic management become increas ingly automated. Product liability risks will grow accordingly. It remains to be seen whether legislation will evolve in step with improving technology. Regardless of the direction taken by court rulings and regulatory devel opments, the insurance industry must respond swiftly and present targeted solutions.

OUR EXPERTS Roland Küsters is an Under writer/Legal Counsel for aviation in the Special and Financial Risks Unit. [email protected]

Anna Masutti is Senior Partner at the LS Lexjus Sinacta Law Firm in Italy and Professor of Air Law at the University of Bologna. [email protected]


13

CASUALTY

Liability for autonomous vehicles Thanks to driver assistance systems, semi-automated vehicles are already being driven on our roads. It seems likely that it is only a matter of time before fully automated vehicles are also rolling off the assembly lines. How will these developments affect liability for claims due to road accidents?

Ina Ebert

Up to now, many national legal systems stipulate that each vehicle must have a driver. This requirement is based primarily on the 1968 Vienna Convention on Road Traffic, which has 76 signatory countries worldwide, including almost all European states. Article 8 of the Convention states: “Every moving vehicle or combination of vehicles shall have a driver.” In 2014, however, this regulation was modified to permit automated vehicles, provided drivers can deactivate or override assistance systems at all times. As soon as this is implemented in national legal systems, the way will be clear for fully automated vehicles. However, at least one person must still be on board to take control of the vehicle if necessary. At the same time, a number of countries have set out the requirements for testing automated vehicles on public roads. This ensures that certain safety standards are maintained and that victims can be indemnified if an accident occurs. Fully automated vehicles can now therefore be tested under everyday conditions. More, fewer or different risks? The majority of road accidents are caused by human error. At first glance, this would suggest that automated vehicles are safer than those driven (only) by humans: automated vehicles do not drive under the influence of alcohol or drugs, do not fall asleep, cannot be distracted, observe speed limits and maintain minimum distances. At the same time, however, automating vehicles also creates new risks. On the one hand, driver assistance systems can perform many routine tasks more effectively than a human driver. For example, optimum braking, keeping in lane or judging the distance to other road users. On the other hand, they do not possess all the skills at the disposal of an experienced

14


Automated vehicles can frequently better judge the distance to other road users than drivers can.

human driver – at least not yet. This is particularly evident in complex situations where a quick reaction is needed and the driver has to choose between several hazards. Even the best program for controlling driver assistance systems cannot predefine every potential set of circumstances arising on the road. To complicate matters further, numerous legal systems have to be taken into account when programming extensive automation of vehicles: after all, vehicles regularly cross national borders. Even standardising legal requirements in the EU or between US states is difficult, lengthy and will probably never be entirely comprehensive. On a global scale, such standardisation is unlikely to be realised in the foreseeable future. Consequently, the vehicle itself must detect when it crosses a national border and adapt its driving behaviour in accordance with the local legal system.

CASUALTY Finally, errors in the programs controlling the driver assistance systems can cause accidents which would not have occurred had they not been in use. Also, the more automated vehicles are connected to other systems, the higher the impact of typical cyber risks. Hackers, for instance, could access the on-board computer and cause an accident. Or the data collected by an on-board computer to control a vehicle could be accessed and misused by unauthorised parties. Who is liable in the case of an accident? Whenever automated vehicles are involved in road accidents, the question of liability arises. The vehicle keeper’s liability is not affected by the vehicle’s automation. In the event of a faulty driver assistance system, however, it is supplemented by the manufacturer’s liability. That the manufacturer of a vehicle is held liable after a road accident is nothing new. Such cases of product liability have, for instance, been brought when the liability cover of the keeper of the vehicle which caused the accident was inadequate, a situation which is not improbable following serious road accidents in the United States. Or if numerous similar accidents occur due to defects in a large number of vehicles. However, it may be assumed that as driver assistance systems become more widespread, manufacturers worldwide would be exposed to liability claims much more frequently than in the past. Modifying the duty of care As long as vehicles are not fully automated or at least legally require the physical presence of a human driver, the driver’s duties of care will have to be modified: When does not using installed driver assistance systems qualify as negligence? And in which situations would it be negligent for a driver to let the driver assistance system make decisions instead of taking control personally? These questions could well lead to uncertainties for many years: due to the innumerable constellations possible, the decision as to when a certain form of behaviour constitutes negligence can never be exhaustively defined by law. Instead, this will invariably remain a matter of case law which can only develop gradually, after a sufficient number of different cases have been decided by the higher courts.

Liability and ”nudging” Further legal aspects concerning automated vehicles could become increasingly important, particularly in highly litigious jurisdictions such as the United States: automated vehicles are supposed to relieve and help the driver. Among other things, by noting the destinations customarily targeted by the driver and his habits. But what if the driver intends to use the vehicle for illegal purposes? Or if the vehicle supports the driver’s unhealthy or illegal habits, for instance by drawing the attention of an alcoholic to the fact that there is a shop selling alcoholic beverages in the neighbourhood? Outlook Most legal obstacles for automated vehicles will be overcome in the next few years. In spite of this, however, not everything that is technically possible is ever likely to be unconditionally permitted on public roads. Particularly in the early days, there will be extensive legal uncertainty in the case of accidents involving automated vehicles. At the same time, however, it will be many years before automated vehicles are introduced and become widespread, due not only to technical reasons and the costs associated with this technology, but also and not least on account of the public acceptance required. Lawmakers and courts will consequently have sufficient time to consider the legal problems associated with automated vehicles and to prepare a solution. What is important is that the insurance industry must also develop the required know-how in good time to be able to respond to this development appropriately.

Trade-off by the on-board computer Programming driver assistance systems for situations in which a crash appears unavoidable is also a legally difficult matter. Not uncommonly, two risks have to be weighed up and a decision made in a split second. While human drivers act intuitively, driver assistance systems have to be programmed in advance to deal with such situations. This is simple enough when damage to the car has to be weighed against destruction of a human life. But what if the driver assistance system has to choose between running over several pedestrians or risking serious injury to the people inside the vehicle under its control?

OUR EXPERT Prof. Dr. Ina Ebert specialises in liability law and emerging risks, and is Munich Re’s Leading Expert for l iability and insurance law in Corporate Claims. [email protected]


15

TRANSPORT

Pipelines on rails In terms of the number of accidents and victims, trains are one of the safest forms of transport. In US freight traffic, however, the spike in the number of oil shipments by rail has not been without its consequences: in 2013, more oil leaked into the environment due to accidents than in the entire preceding forty years.

Stefan Klein and Rainer Hanselmann

Rail is not only a sustainable and eco-friendly form of transport, but also one of the safest. The risks associated with rail transport have steadily declined over the years, thanks to technical advances and modern safety systems. It is therefore all the more regrettable when accidents occur because trains or infrastructure do not reflect the state of the art, particularly when human error is a contributory factor.

cally reduces the train’s speed when travelling too fast and also prevents collisions. Although the US Congress ruled, in its 2008 Rail Safety Improvement Act, that PTC was to be introduced in long-distance and regional transport by the end of 2015, the actual number of systems installed has fallen behind schedule. The NTSB is confident that nationwide introduction of PTC would make rail transport safer.

Modern control system improves safety

The safety of a means of transport can be measured by the number of accidents, victims or size of claims within a specified period of time. However, correctly assessing the accident risk involves more than just a comparison of absolute figures. This data must be considered in relation to the number of passengers carried and the distance covered or a combination of both (passenger kilometres).

In Philadelphia on 12 May 2015, a speeding regional Amtrak train derailed in a bend (travelling at 164 km/h on a stretch with an 80-km/h speed limit). Eight people died and more than 200 were injured. The exact cause of the incident is still being investigated (as at November 2015), especially regarding the question of whether the train driver was distracted by his smartphone. According to the National Transportation Safety Board (NTSB), the accident could have been avoided if the train had been equipped with the control system PTC (Positive Train Control). It automati-

Rail-bound shipments of oil are set to increase. Forecasts of up to 675 freight trains each with 100 rail tankers every single day are no exaggeration. Munich Re Topics Schadenspiegel 2/2015

17

TRANSPORT

The train that derailed near Missoula (Montana), USA, on 3 July 2014 was carrying three Boeing fuselages as cargo.

Accumulation of major events in 2013 Fortunately, both the number of accidents and the number of fatalities have been declining for several years in Europe and the United States. In Europe, the International Union of Railways (UIC) recorded 1,662 accidents with 958 fatalities in 2013. Over 7% were attributable to derailments and 1.9% to collisions with other trains. Accidents involving people on the tracks or at crossings accounted for more than 60%. Despite the positive trend in recent years, the UIC has warned against the danger of being lulled into a false sense of security. As 2013 has shown, a few events are all it needs to send the number of victims spiralling (Fig. 1). In this case, four accidents were all it took: in Austria in January, and then in France, Spain and Switzerland all in July.

An accident in Santiago di Compostela in northwest Spain on 24 July 2013 claimed the highest number of lives when a high-speed train operated by the railway company RENFE derailed after taking a curve too fast. A total of 79 people were killed in the worst railway accident since the ICE crash in Eschede, Germany, in 1998. At the time of the accident near Santiago de Compostela, the driver of the derailed train had made a phone call and entered the stretch of track with an 80-km/h speed limit at a speed of 192 km/h just a few kilometres short of Santiago de Compostela. Runaway train destroys part of a small town A completely different type of accident – also in July 2013 – caused an outcry in North America. A freight train carrying oil derailed in the Canadian town of Lac Mégantic. It caught fire and exploded in the centre of town, causing a catastrophe and extensive losses. A total of 47 people lost their lives and 40 buildings – half the town centre – were destroyed.

Fig. 1: Train collisions and derailments: Number of events and victims Number of victims 400 353 300 249 200

177

148 100 0

100 65

41

136 48

115

158

170

157

107

138

34

2006 2007 2008 2009 2010 2011 2012 2013

18


This graph shows the huge impact of the above-mentioned accidents in 2013 on the number of victims (total deaths and serious injuries, not including suicides). Source: UIC Safety Database Report 2014, p. 3

TRANSPORT Around 10.50 p.m., the train driver had parked the train on a downhill slope in Nantes, Quebec, about 11 km outside Lac Mégantic, and applied the hand brakes on all five locomotives, as well as on two other wagons. All engines except that of the lead locomotive were shut down.

Fig. 2: Carloads of crude oil shipped by rail in the United States

Railway regulations stipulate that hand brakes alone must be capable of holding a train. However, in this case the train was situated on a slope and could only be held in position by the additional use of the lead locomotive’s air brakes. In the course of the night, firefighters responding to an emergency call (a fire was assumed to have broken out when the lead locomotive, which was still in operation, was seen to be smoking) shut down the engine of the lead locomotive, in the mistaken belief that it was not required in order to maintain the train’s position. As a result, the pressure in the brake system gradually decreased. Since the applied hand brakes on the five engines and two wagons did not suffice to hold the train by themselves, it began to move in the direction of Lac Mégantic. It reached a top speed of over 100 km/h before derailing near the town centre at 1.15 a.m. Almost all the wagons were damaged and 6 million litres of crude oil escaped, exploded or caught fire.

200K

In Canada and the United States, the accident triggered a debate over the safety of rail tankers. NTSB experts have long been pointing out that the steel shell of the DOT-111 rail tankers involved at Lac Mégantic, which account for 69% of all US rail tankers and 80% of the Canadian rail tankers, is extremely unstable in the event of an accident. Although the US Department of Transportation issued new standards governing the construction of rail tankers in May 2015, transitional periods of up to ten years were agreed for older vehicles, depending on their design and the type of hazardous material carried. Major increase in oil shipments Exposure has increased exponentially in recent years. As fracking has boomed, more and more oil is being transported by rail because many of the oil fields are located far from the pipeline network. Transport volumes have increased from largely negligible levels in 2008 to almost a million barrels per day (bpd) at the end of 2013. At the same time, the number of oil-related accidents has risen dramatically (Fig. 3). Oil terminals for rail transport are increasingly being built not only in North Dakota, the oil fracking centre, but also in Texas, Colorado, Oklahoma and Wyoming. Canadian operations focus on the provinces of Alberta and Saskatchewan. The trend towards more rail-bound oil shipments is likely to continue as pipeline projects

400K 300K

100K 0K 2005

2013

Fig. 3: Crude oil spilled in rail accidents (gallons) 1.2m 900K 600K 300K 0K 2005 2013 Source: Association of American Railroads, Pipeline and Hazardous Materials Safety Administration

designed to transport the fracking oil from North Dakota to the refineries have so far come to nought. Oil Change International, an organisation promoting a switch from fossil fuels, considers an increase in transport capacities to 5 million bpd to be possible in the long term. Since the trains take nine days on average to reach their destinations, this would mean that 45 million barrels of oil are being transported by rail right across the US every single day. That is equivalent to 675 freight trains with 100 rail tankers each. Although the fracking boom has temporarily lost momentum amid tumbling oil prices, the trend is expected to continue in the medium term. It is being driven above all by dwindling traditional oil deposits and a bid by the US to boost its energy self-sufficiency.


19

TRANSPORT Numerous liability coverages at risk This is not without consequences for underwriting. One problem is that loss experience to date is a very inadequate reflection of the actual exposure. What is more, numerous liability coverages for the parties directly or indirectly involved in these transports are at risk. In addition to rail and network operators, these include the manufacturers of tracks, wagons and signalling systems, as well as forwarding companies and oil firms.

If a freight train laden with oil were to derail in a densely populated region, the US East Coast in particular could well sustain an insured overall loss far in excess of most usual sums insured today. In addition to property losses, this could include (partly limited) personal injury, environmental damage, clean-up costs, and business interruption coverages for a large number of companies. Although various products covering these risks are already available in the US, the industry is still reluctant to purchase such coverages.

On track for safety The 2013 Lac Mégantic incident brought the safety of transporting hazardous materials by rail sharply into focus. Some insights from rail transport risk experts Lois Gardiner, from AON Global Risk Consulting, and Thomas Hayes from the US logistics group Watco Companies.

OUR EXPERTS

Schadenspiegel: The accident at Lac Mégantic certainly was a warning signal. What lessons have been drawn from it?

How well is the industry prepared to respond to an incident? Is the financial capacity adequate? Is there a need for extended liability insurance?

Lois Gardiner: The railroads have all made significant safety improvements in many areas, and train accident rates are at an all-time low for Class 1 railways. But despite the role of technology in improving the risk profile, the human factor remains a key component in safety management systems. This incident further demonstrated that human error is something we have to continue to focus on.

20

Some outdated tank cars commonly used to transport crude oil are known to be prone to puncture and explosion in derailment incidents. How do you assess the decision of the US Department of Transportation to phase them out over a ten-year period? Gardiner: I think it’s an excellent decision and one the railways wanted to have happen. In fact, if it could be done more quickly, this would improve the risk profile for everyone, including the shippers. In most cases, the shippers own the railcars, so they too have exposure and should consider liability implications for using cars that are not compliant with the proposed standard.


Lois Gardiner CMA, FCIP, FRM Director Western Canada, Aon Global Risk Consulting Aon Risk Solutions Thomas Hayes Assistant General Counsel and Director of Claims. Watco Companies, LLC

Thomas Hayes: Having an emergency response plan is important. As for the financial capability, that is part of the reason you purchase insurance. While you plan to not have any incidents, the unfortunate reality is that an incident will occur and you need to prepare. As for insurance, the rail industry is a niche market, so the carriers that serve it are prepared to handle the complexity of a claim. Besides property cover, a number of

TRANSPORT Measured against the development of transport volumes in recent years, the rail industry and its suppliers are still inadequately covered in this sector. Despite the caps applied in some cases for personal injury, the coverages available following a major accident will be far from sufficient to settle all claims – a classic case of underinsurance. Government intervention may be required to cushion the blow of such a disaster.

OUR EXPERTS Dr. jur. Stefan Klein has 20 years of experience in P&C primary insurance and reinsurance. Since 2010, he has been Head of the Claims Department in the Global Clients/North America Division at Munich Re, Munich. [email protected]

Rainer Hanselmann is a lawyer with over 20 years’ experience in the industry. Since 2014, he has been Head of the Casualty Claims Department in the Global Clients/North America Division at Munich Re, Munich. [email protected]

liability covers also come into play. The Environmental Protection Agency might also be brought in to investigate the clean-up process if hazardous materials are involved, which may trigger your pollution liability coverage. The railroad insurance industry continues to bring new products to the table to address the needs. It’s important to have continuous communication and strategy meetings with your insurance brokers.

US freight trains are currently moving more crude oil than ever. Is rail a viable long-term strategy or are pipelines the safer option? How effective do you consider the increased regulatory activity? Gardiner: This is debatable either way. The AAR has published information demonstrating that there is very little difference between the two. The issue is that pipeline losses are larger, with more environmental exposure, whereas railway losses are more dramatic, although smaller and with less damage. In any case, the pipeline industry cannot afford to build the necessary infrastructure, given the changing face of oil development. But railways have to continue to improve and invest in safety.

Many lessons were learned from Lac Mégantic, but you must remember that even prior to the incident, 99.8% of all crude rail shipments arrived safely at their destination. Hayes: One thing’s for sure, no matter which side of the table you’re on: movement of the product is safe, if you have the right people, train them effectively and make sure the safety measures are relentlessly followed.

US crude oil production Millions of barrels per day 9.5 9.0 8.5 8.0 7.5 7.0

As fracking has boomed, more and more oil is being transported by rail because many of the oil fields are located far from the pipeline network.

6.5 6.0 5.5 5.0 4.5 4.0

’91 ’92 ’93 ’94 ’95 ’96 ’97 ’98 ’99 ’00 ’01 ’02 ’03 ’04 ’05 ’06 ’07 ’08 ’09 ’10 ’11 ’12 ’13 ’14 ’15 ’16

Source: Association of American Railroads


21

AVIATION

Volcanic ash in jet engines In 2010, aviation flight rules were relaxed, and airline operators are now allowed to fly in ash clouds with low contamination. But this might not be safe in the long run: accumulated ash in jet engines over a longer period of time could result in property damage that might not be covered in traditional covers. Also, operators still face non-damage business interruptions due to ash-related grounded flights. Munich Re supports the aviation industry with innovative cover concepts that go beyond traditional policies. Ulla Norrhäll

There are over 500 active volcanoes in the world and on average twelve volcanic eruptions a year. In 2010, the Eyjafjallajökull eruption in Iceland affected not only the aviation industry but also the entire global economy. The ash cloud almost entirely paralysed air traffic over Europe in some of the most congested airspace in the world. Since the danger posed to airplanes by volcanic clouds was not well understood at that time, the guidance used worldwide from the International Civil Aviation Organisation (ICAO) was to avoid any amount of ash. The guidance actually stated: “In case of volcanic ash regardless of ash concentration: Avoid. Avoid. Avoid.” Since it was not an option to fly around the ash clouds, more than 100,000 commercial flights had to be cancelled during the eruption phase. The loss from the Eyjafjallajökull eruption, US$ 1.8bn for the airlines alone according to IATA estimates, was substantial – and uninsured. With business interruption, aviation insurance policies usually only come into effect when preceded by damage to the insured object. This was not the case here. Even five years later, virtually no air-

line is covered for the financial consequences from non-damage business interruptions, such as revenue losses and the cost of providing care to passengers. Relaxed aviation rules Hit hard financially after the Iceland eruption, aircraft operators demanded to decide by themselves where and when to fly based on their own safety risk assessment. In response, the aviation rules were cut back and ash contamination was divided into different contamination zones. Since mid-2010, continuously updated volcanic ash charts identify and forecast three specific ash contamination levels in the airspace; coloured in cyan (low contamination), grey (medium contamination) and red (high contamination). Airlines are now permitted to fly in the zones of low contamination. This resulted in smaller areas being closed, and for shorter lengths of time. The zonation scheme gives the impression that flying in areas of low contamination is “safe” – but that is not neces sarily true for the jet engines.

Effects of volcanic ash on jet engines

Fan

A partially eroded turbine blade after being exposed to volcanic ash. Source: Munich Re

Erodes metal

Compressor

Fuel nozzle Clogs fuel system and cooling system

Combustion chamber

Clogs fuel system and cooling system

22


Turbine

AVIATION

London Montreal

VAAC region boundaries Active volcanoes Major air routes

Anchorage

Tokio

Source: ICAO Guardian Washington

Darwin

How the world’s flight routes traverse volcanic risks

Wellington

Toulouse

Buenos Aires

Volcanic ash is extremely hard and abrasive Volcanic ash is a product of explosive volcanic eruptions; the ash contains more than 50% silica particles, an extremely hard and abrasive material. Since the melting point of the particles is well below the core temperatures in jet engines, there is a high potential for ingested ash to melt and to resolidify within the turbines. The result could be a rapidly increased static burner and compressor discharge pressure, which, in the most severe cases, might lead to engine surge and a loss of thrust. Volcanic ash accumulates continuously within jet engines as they fly through ash clouds. Thus, a long flight through a low contamination zone may do more damage than a short flight in a high contamination zone. Since the airline operator is responsible for approving flights through ash clouds, and not the authorities as it used to be, such risks need to be evaluated closely in airlines’ risk management process. Increased repair costs classified as “wear and tear”

Solutions beyond the traditional hull and liability policy Given the mandatory grounding of aircraft due to volcanic ash, flight disruptions or restrictions and any necessary related repair costs would also not be covered under a traditional hull and liability policy. Although in 2015 alone there were eruptions in Chile, Japan, Bali and Russia, which all resulted in only minor disruptions, the next large event might be closer than many operators are financially prepared for. Munich Re offers customised coverage solutions for corporates that also want to insure against ”nondamage” business interruption losses. In 2010, a NASA-led research programme was initiated, supported by engine manufacturers such as Boeing, Rolls Royce, General Electric and Pratt & Whitney. “Injection of ash into engine” tests have been carried out, with the results due to be published in early 2016. By analysing the data, the ICAO and others will learn more about safer flying and whether the current guidelines are too restrictive or not.

The problem with accumulated ash in aircraft engines is the high uncertainty regarding the jet engines’ tolerance to ash, which varies tremendously by engine and is not easy to measure without pulling the engine apart – something that is simply impossible for oper ators with prescheduled flights. Should volcanic ash from a single incident result in the loss of an aircraft, an airline would be covered as normal under its traditional hull and liability policy. However, physical damage from prolonged or cumulative exposure to volcanic ash conditions may not be covered, as it would likely be deemed just as “wear and tear”. Airlines would have to bear the repair costs themselves.

OUR EXPERT Ulla Annica Norrhäll works as an Aviation Claims Lawyer at Munich Re, Munich, predominantly advising on legal issues and claims handling. She is a member of the International Union of Aviation Insurers (Legal and Claims Study Group). [email protected]


23

NATURAL HAZARDS

Thunderstorms over Germany Tornadoes in Germany are more common than you might think, although they rarely cause any great damage. However, two storms in 2015 were so strong that not even solid stone walls were able to withstand their power.

Jan Eichner

In spring and summer, it is not unusual for Germany to experience an inflow of warm, humid air masses from the southwest. When these air masses encounter colder air from the north and there are suitable wind shear conditions in place, they trigger a selfamplifying convection process: the warm, humid air rises to colder layers where it condenses and releases energy, causing this air to rise higher still and form thunderclouds. The enormous amounts of energy released into the atmosphere create thunderstorms, or severe convective storms as meteorologists prefer to call them. In their most extreme form, known as supercells, these storms not only bring lightning, hail, torrential rain and violent gusts, but can even spawn tornadoes.

Europe also affected Tornadoes are most commonly associated with the US Midwest: in the world-famous Tornado Alley. This region extends from Texas in the south through Oklahoma, Kansas and Nebraska to South Dakota and Iowa in the north, running more or less parallel to the Rocky Mountains. In total, an average of 1,300 to 1,400 such whirlwinds are registered each year in the United States. In Germany too, tornadoes are a more prevalent phenomenon than is commonly thought, with 20 to 60 occurrences a year based on figures from the German Meteorological Service. According to the European Severe Weather Database (ESWD), between 300 and 400 confirmed tornadoes are recorded each year for the whole of Europe. Considering that the above-mentioned tornado region in the US is almost 20 times the size of Germany, the frequency per unit area is almost as high in Germany as in the United States. However,

A thunderstorm over a field in Bad Krozingen, Germany, on 13 May 2015. Munich Re Topics Schadenspiegel 2/2015

25

NATURAL HAZARDS Fujita Scale and Enhanced Fujita Scale F Scale

EF Scale F0/EF0 Light damage: Peels surface off some roofs; some damage to gutters or siding; branches broken off trees; shallow-rooted trees pushed over.

F0 50–110 km/h

F1 120–170 km/h

F2 180–240 km/h

F3 250–320 km/h

EF0 90–130 km/h

EF1 135–175 km/h

EF2 180–220 km/h

EF3 225–265 km/h

EF4 270–310 km/h

F4 330–410 km/h

EF5 >315 km/h

F5 420–510 km/h

F1/EF1 Moderate damage: Roofs severely stripped; mobile homes overturned or badly damaged; loss of exterior doors; windows and other glass broken.

F2/EF2 onsiderable damage: C Roofs torn off well-constructed houses; foundations of frame homes shifted; mobile homes completely destroyed; large trees snapped or uprooted; light-object missiles generated; cars lifted off ground.

F3/EF3 Severe damage: Entire storeys of well-constructed houses destroyed; severe damage to large buildings such as shopping malls; trains overturned; trees debarked; heavy cars lifted off the ground and thrown; structures with weak foundations blown away some distance.

F4/EF4 Devastating damage: Well-constructed houses and whole frame houses completely levelled; cars thrown and small missiles generated.

F5/EF5 Incredible damage: Strong frame houses levelled off foundations and swept away; automobile-sized missiles fly through the air in excess of 100 m; steel-reinforced concrete structure badly damaged; high-rise buildings have significant structural deformation. Source: Storm Prediction Center, NOAA

26


NATURAL HAZARDS in Germany most of these local tornadoes do not achieve anything like the destructive force needed to cause the same sort of devastation witnessed each year in the US (thanks to the frequently more robust construction found in Germany). Besides which, many of these storms are confined to undeveloped areas, such as fields and forests. Series of tornadoes in May In 2015, however, at least two tornadoes were so strong that even solid stone walls were unable to withstand them. A series of at least five tornadoes occurred on the evening of 5 May, one of which, in Bützow near Rostock in Mecklenburg-Western Pomerania, developed such force that it caused two deaths and left 30 injured by flying debris, destroyed 16 houses and damaged more than 100 cars. All in all, it caused losses totalling more than €30m. At least three tornadoes occurred in southern Germany on 13 May, one in the Waldshut district in the southern Black Forest, another near Constance in Baden-Württemberg and the third in Affing near Augsburg in Bavaria. The latter cut a swathe of destruction over 16 km long and about 150 metres wide, injuring nine people and damaging or partly destroying some 230 buildings, as well as causing losses assumed to be around €50m. The two strongest tornadoes (Bützow and Affing) reached wind speeds of more than 250 km/h, which places them as category F3 on the Fujita or F Scale (a wind speed-based system developed by and named after T. Theodore Fujita in 1971).

However, classifying tornadoes according to categories is not without its snags, as it is very difficult to precisely measure the actual wind speeds involved. To achieve this, a so-called dual polarisation radar would have to be installed at or at least near the location of the storm. This special Doppler radar uses the polarised microwaves reflected by the raindrops, ice and dust particles circulating in the tornado vortex to determine its forward speed. During the season for severe thunderstorms, professional US storm chasers – often with the financial backing of local weather TV stations – use such modern and extremely expensive mobile equipment (Doppler On Wheels, known as DOW for short) to chase after supercell thunderstorms in their specially equipped vehicles on the lookout for potential tornadoes. Despite this, however, their pickings are fairly lean: only between 20 and 30 of the more than a thousand US tornadoes each year can be analysed in this way. Enhanced Fujita Scale in the US As most European storm chasers do not have access to such sophisticated equipment, it would be sheer luck for a mobile Doppler radar to be in the right place when a tornado strikes. Classifying a gale-force wind according to the F Scale is therefore a highly imprecise – even arbitrary – affair and can in most cases only be achieved by analysing damage data to establish the wind speeds involved.

The remains of a house after the wall and roof were torn off following the hurricane in Bütznow, Germany, on 5 May 2015.


27

NATURAL HAZARDS Tornadoes in Germany since 1980

F3 (15) F2 (128) F1 (270) F0 (137) unrated (484)

Confirmed tornado reports in Germany since 1980 in the ESWD database. The Bützow and Affing tornadoes are circled. Category F3 tornadoes can thus be expected every 2–3 years and F4 no more than once in 30 years. All tornadoes whose wind speed cannot be inferred on the basis of loss data are classed as “unrated”. Source: www.eswd.eu on 28 August 2015

This is where the Enhanced Fujita Scale (EF Scale) comes into play, according to which windstorms have been classified in the US since 2007. It is based on a formula which assesses 28 loss indicators for the building stock and vegetation, and thus provides an indirect indication of the wind speed. Structural engineering experience has shown that certain damage patterns can occur at lower wind speeds than indicated in the F Scale. More pronounced differences between the two scales (see page 26) are particularly evident for extreme values (EF3 and upwards).

28


Clearly, the indicators based on building stock damage depend on the local building codes and materials in use. The masonry commonly used for building construction in Germany is less vulnerable to the destructive forces of a tornado than the timber constructions frequently found in the US. In order to transfer the EF Scale to Germany or central Europe, all 28 parameters relating to the building stock would have to be adjusted or redefined. In the meantime, it has been suggested that tornadoes should not be classified purely on the basis of wind speed but rather on more loss-relevant factors such as kinetic energy and impact force. Engineers and scientists are working on this subject, but a final consensus has not yet been reached.

NATURAL HAZARDS Difficult to establish pure tornado losses

Outlook

Another problem with classifying tornadoes is that they almost always occur together with other destructive forms of severe thunderstorms such as hail or gale-force winds. It is therefore rarely possible to determine the loss portion solely attributable to the tornado. However, one thing holds true: the stronger a tornado is, the greater its share of the overall loss caused by the severe thunderstorm.

Climate change causes the atmosphere to absorb more water vapour, fuelling severe convective storms. Yet the number of severe thunderstorms in the US has not increased in recent decades. The number of tornadoes also appears to have remained constant. What has been observed, however is an increase in the severity of the thunderstorms, especially severe thunderstorms with tornado potential in the form of supercells. There is not yet any statistical evidence of such a development in central Europe. However, there is reason to believe that climate change is more likely to lead to an increase in the severity rather than in the frequency of thunderstorms in Europe as well. To shed further light on the subject, Munich Re has launched a cooperation initiative with the European Severe Storm Laboratory (ESSL) to help improve our understanding of present and future exposure to severe thunderstorms in Germany and central Europe.

The costliest tornado losses in the United States were caused by two supercell outbreaks in spring 2011, with several hundred tornadoes per storm event, including several EF4s and even a few EF5s. Together with hail and flash floods, these two events caused overall losses amounting to over US$ 21bn, including insured losses of more than US$ 14bn. Despite improved alerts, 528 people lost their lives in these two storms. The most severe tornado loss in Germany occurred in Pforzheim in 1968. Within the space of three minutes, the F4 tornado damaged around 2,300 buildings and destroyed hundreds of cars. More than 200 people were injured and three killed. The property loss was estimated at DM 125m, which could well be equivalent to a billion-dollar loss in today’s values. Although the mean probability of a tornado rated as category F3 or higher occurring in Germany is only about once every two years (there are around 30 per year in the US), the loss potential must be considered high on account of the greater building density (as compared to the US).

OUR EXPERT Dr. Jan Eichner is Head of Munich Re’s NatCatSERVICE in Geo Risks Research/Corporate Climate Centre. A qualified physicist, his work includes the analysis of emerging risks and risks of change. [email protected]


29

BUSINESS INTERRUPTION

Modern manufacturing processes: Efficient but vulnerable Growing competitive pressure and shorter product cycles have forced many sectors to optimise the efficiency of their manufacturing processes and to increasingly embrace a global division of labour. Industry and the insurance sector need to take account of the new business interruption scenarios these developments bring. Stefan Feldhütter

In a bid to hold their own against the global competition, firms have been progressively cutting their unit costs in recent years. There are a number of ways for them to achieve this. Supply chains, for example, can be streamlined by making use of a small number of highly qualified and specialised suppliers. This has created oligopolies or monopolies for certain products, such as highly specialised microelectronic components. Many such suppliers are geographically concentrated in industrial estates where the joint use of infrastructure yields further cost benefits. Clearly, the potential accumulation following natural catastrophes can be considerable. What is more, companies often work on a just-in-time or just-in-sequence basis as an efficient way of supplying the steadily increasing variety of models and versions their customers demand. Reduced stock levels and reserve production capacities help to cut costs.

Increasingly networked manufacturing processes also require a much more intensive exchange of data between all parties, dramatically increasing their dependence on internet availability, along with the risk of data loss, theft and manipulation. As companies focus on core competences with high added value, the percentage of components manufactured in-house frequently declines. This trend has now culminated in “fabless manufacturing”, a process in which the manufacturers of smartphones, for example, completely outsource their production and concentrate on development and sales/marketing only. This is closely linked to the worldwide division of labour. Based on exploiting the cost benefits of individual production sites, this p henomenon greatly increases transport volumes between the individual production locations. Last but not least, sales channels are concentrated in the hands of a small number of partners who market large shares of the total production output. Numerous recent events have shown that these changes can have severe consequences when supply chains are disrupted, highlighting the increased susceptibility of companies to business interruptions.

BI losses are looming ever larger in industrial property covers as complex manufacturing processes become more and more vulnerable. Munich Re Topics Schadenspiegel 2/2015

31

BUSINESS INTERRUPTION Fig. 1: Business interruption and CBI losses along smartphone manufacturers’ supply chain Supply flow 2nd tier supplier TSMC, Taiwan chip producer

1st tier supplier

Smartphone assembler

EQ DAMAGE BI LOSS

CBI LOSS

Shortage of hard drives following flood The Tohoku earthquake in March 2011 affected many manufacturers of microelectronic components in Japan and disrupted supply chains, prompting numerous companies to transfer parts of their production to industrial estates in Thailand. The intention was to make supply chains and production less vulnerable to natural hazard events. The floods which then inundated several of these industrial estates from July of that year onwards showed that these transfers had not actually minimised the risk to supply chains. Substantial losses crippled the factories responsible for producing half the world’s hard drives, including those of the two world market leaders. This created an international shortage of hard drives, often referred to as the hard drive crisis. Failure of a chip supplier In March 2013, an earthquake caused severe damage to the manufacturing plant of the Taiwan Semiconductor Manufacturing Company (TSMC). The company is the world’s only manufacturer of a series of highly specialised chips for smartphones. As a result, a Chinese company performing the final assembly of the smartphones ran out of the chips required. Several OEM smartphone manufacturers were affected by this disruption to the supply chain for their devices. Capsizing of a motor tanker The vulnerability of modern supply chains is not only evident in the industrial centres of Southeast Asia with their frequently high exposure to natural hazards. Problems can also arise on heavily frequented waterways. In early 2011, the motor tanker Waldhof with a cargo of sulphuric acid capsized en route from Ludwigshafen to Antwerp and caused massive disruption to shipping on the Rhine for several weeks. Companies located both upriver and downriver of the

32


OEM company Smartphone manufacturer Smartphone manufacturer

In addition to the direct business interruption loss suffered by TSMC, the contract smartphone assembly company and several of the smartphone manufacturers employing it also sustained an indirect (contingent) business interruption loss (CBI loss).

CBI LOSS

incident were affected by this disruption in the transport of their raw materials and products; none of these suppliers or customers had suffered a physical loss. Changes in demand for insurance Changes in many companies’ manufacturing processes shift their business interruption risks from the production facilities to the supply chains and sales channels. This leads to higher demand for business interruption covers which include risks associated with the supply chain. Whether or not the supply chain is part of the company initially plays a secondary role only from the company’s point of view, as the consequences are similar. In the case of multi-stage supply chains, the entire supply and distribution chain should naturally be covered where necessary. Coverage is also often now required for supply chain disruptions which were not caused by property damage (e.g. disruptions in air traffic due to volcanic ash). At the same time, shorter product life cycles and economies of scale require higher contribution margins to be generated and hence also higher sums insured for business interruption. Losses on the rise For well over a decade, the growing vulnerability of complex manufacturing processes has been reflected in the steadily increasing share of BI losses in industrial property covers. Very large losses in particular are associated with an especially high BI share (Fig. 2). This development has prompted several insurers to analyse BI risks associated with the supply chain in more detail than was previously the case. Their analysis also includes the companies’ own risk management. However, uniform standards are only gradually becoming established in the various industries.

BUSINESS INTERRUPTION Fig. 2: Business interruption loss shares of overall loss BI share (%) 60

Moving average (2001–2004) Moving average (2005–2007) Moving average (2008–2011)

50 40 30

Development of the share of BI losses in relation to overall losses for the global claims experience of a large industrial insurer.

20 10

Source: Munich Re

0 500,000 5,000,000 50,000,000

Analysis of exposure The first step towards minimising the BI risk is to analyse the existing exposure. To this end, the products and product groups with the highest contribution margin must be identified first, as they are particularly relevant for BI covers. Their manufacturing process is analysed with regard to potential disruptions. Capacity utilisation and possible technical reserves and redundancies within individual production locations must be taken into account, as well as the relationship between individual company locations (interdependencies, interactions). In addition to the perils commonly covered by business interruption insurances in the company concerned, such as fire, natural hazards and machinery breakdown, there is also growing demand for BI insurance cover for external influences. The next step is to identify potential contingent business interruption losses (CBI losses). External factors able to influence production and distribution must be analysed for this purpose. This analysis includes external supply chains (from the supplier’s subcomponent to the end product) as well as the sales channels to the customer. Once the weak points have been identified, the next step is to check whether they can be remedied by technical or organisational means and at an economically viable cost. In many cases, this analysis shows that measures taken in the past to cut costs (by lowering stock levels, reducing technical reserves) have in fact increased the BI risk. Measures designed to increase a company’s resilience to business interruptions would in many cases swallow up all the savings made. The mostly conflicting interests of risk management and controlling/cost management are very much in evidence here.

Loss ($)

Companies often attempt to transfer the higher BI risk associated with streamlined, cost-optimised production to the insurers. Any such transfer must be preceded by qualified analysis of the BI risk. This analysis must identify and assess technical or commercial approaches which reduce the risk of default and establish an appropriate price for the additional risk carried. Outlook The changes that have swept through industrial manufacturing processes are likely to be irreversible to a large extent. The underlying reasons are too compelling, the advantages too convincing. In future, companies and insurers must analyse and assess the associated additional risks in more detail in order to arrive at an effective and appropriate mode of risk management. Transfer to the insurance industry may prove to be the most viable solution from an economic perspective for risks which cannot be technically or organisationally minimised without breaking the bank. The development of such customised solutions requires an open, partnership-based relationship between all parties in order to make the individual exposures sufficiently transparent.

OUR EXPERT Stefan Feldhütter is a graduate in technical physics and industrial engineering. He works as a risk consultant for issues relating to business interruption in Munich Re’s Loss Control Engineering Unit. [email protected]


33

PROPERTY

Digging deeper to improve mining claims resolution A series of extremely large and complex losses in the mining sector in 2007/2008 and their subsequent difficult resolution sparked the idea of forming an industry-wide initiative to improve cooperation between mining companies, insurance carriers and other stakeholders: the Mining Insurance Group (MIG).

Günter Becker, Martina Christ, Andre Knoerchen, Andrew Weare

Mining risks come with their own set of special challenges. Yet traditionally insurers have not dedicated a specific line of business to mining, unlike with oil & gas risks for example. Insurance policies for mining risks have been derived from policy forms for “ordinary” property risks in other industries, with mining-specific addenda endorsed to provide for more – or less – clarity. But product development has clearly failed to hold pace with the needs and risks of this booming industry. The mining loss events of 2007 and 2008 made this discrepancy painfully apparent. In September 2007, there was a breakdown of a crusher in the processing plant of a copper mine in the Andes. As there was no second crushing facility on the site, the expected downtime for repair and the resultant loss of production implied a potential loss in the hundreds of millions

of US dollars. The mine had multiple owners and several different insurance carriers. To add to the complexity, one of the insureds was hit by flood losses in Australia during the same policy period, in January and February 2008. This drove up the potential for total claims to the range of one billion US dollars. During the protracted claims settlement process – the most complex claim took until June 2012 to be settled in mediation – the measures employed in claims handling and settlement, stemming from “ordinary property” claims, proved insufficient for complex mining claims. Insurance buyers and underwriters alike were very dissatisfied with the expectations on the one side and the deliverables on the other.

Mining is a sector with its own special set of risks, which were not adequately handled for a very long time. Munich Re Topics Schadenspiegel 2/2015

35

PROPERTY In early 2012, a global broking house invited interested parties from the mining insurance community to investigate ways to make claims negotiations less cumbersome. This initiative attracted the interest of some 70 professionals from all corners of mining insurance to gather in London in late January 2012. Risk managers, insurers and reinsurers, brokers, loss adjusters, lawyers and other service providers entered into two days of open and lively discussion about an appropriate mining insurance product. Although the interests of individual stakeholders continued – and continue – to differ, all agreed that something had to change. In the very first meeting, a steering group was formed to facilitate the creation of what is now MIG – the Mining Insurance Group. During the two years between the launch of the initiative and the official first Annual General Meeting of the non-incorporated association in February 2014, a considerable amount of work was put into the two initial objectives, claims handling and bespoke policy wording for mining. The Mining Insurance Group (MIG) The Mining Insurance Group (MIG) is a non-commercial undertaking organised by a committee drawn from professionals with extensive experience of mining risks and claims. It is a cooperative forum enabling ongoing improvements in the underwriting, risk management and claims processes, along with the exchange of views, experiences and dissemination of knowledge. MIG was established by mining companies, risk managers, underwriters, claims adjusters, brokers and other service providers involved in risk management and insurance-related activities in the mining industry. >> M ore information at www.mininginsurancegroup.com

The MIG Claims Protocol A key aim identified in the early days of the MIG initiative was the introduction of a claims protocol. Generally found in insurance programmes for large and international risks in different lines of business, claims protocols set out a detailed procedure that the stakeholders involved in claims handling should follow. It was agreed that the protocol should be specifically tailored to mining risks, independent of their size, to overcome challenges including distrust and lack of communication between the stakeholders, lack of transparency, wasted resources due to overreliance on experts and drawn-out claim resolution. The MIG initiative formed a Working Group for Claims Protocols, led by Munich Re and made up of participants from the different stakeholder groups, including insurance buyers. Specifically, Munich Re’s industrial insurance specialist unit CIP was instrumental in developing the wording and claims protocol. The Working Group for Claims Protocols identified four guiding principles for best practice claims handling. – Efficiency – Transparency – Fairness – Mutual cooperation The final version of the MIG Claims Protocol is characterised by five important features. – Pre-agreed, neutral loss adjuster – Agreed loss management plan – Inclusion of realistic target times – Transparent communication of issues – Resolution procedure as the “circuit breaker“ A neutral loss adjuster One of the main improvements to the mining claims process established in the MIG Claims Protocol is the appointment of a pre-agreed, neutral loss adjuster. The loss adjuster is a named individual responsible for facilitating an efficient, transparent and fair dialogue between the relevant stakeholders, using a project management approach throughout the entire claims process. The adjuster’s main tools are the use of agreed samples for requests for information and loss management plans as well as efforts by the relevant stakeholders to work towards realistic target times for the delivery of their tasks. One of the parties’ mutual commitments is to inform counterparts early of any significant issues that may evolve during the adjusting process. This should begin with a detailed notification, followed by peri

36


PROPERTY

The Baralaba Mine, flooded by the Dawson River.

odic discussions. In the event that the claims process does not progress as envisaged, dialogue between the stakeholders comes to an impasse or the adjustment process stalls, the Claims Protocol sets out a resolution procedure with a neutral third party acting as the “circuit breaker”. Alternative options for dispute resolution, such as arbitration, remain open. Applying the Claims Protocol – as either a binding part of the insurance contract or as a best practice – lowers costs for claim resolution, enhances financial outcomes for all parties and helps to foster sustain able relationships between the stakeholders. Given these advantages, it is not surprising that the MIG Claims Protocol has already been implemented in insurance programmes for several mining companies.

In addition to drafting a claims protocol, developing special policy wordings for mining was also high on MIG’s agenda. Andrew Weare, a member of the wording group, talks about the excellent progress the initiative has made in this area. Back in 2012, prior to joining Munich Re and whilst still working as a wordings broker, I was asked to get involved in the MIG initiative. In those early stages, I anticipated a protracted and difficult road ahead. After all, how can you expect consensus in a room filled with different underwriters, brokers, insureds, lawyers and adjusters each coming at the issue from their own opposing and self-interested position? One of the first meetings was at Munich Re’s offices in Munich. Back then the wording group was comparatively small, as most attendees had opted for the claims protocol group. But this did not mean that the debate was any less passionate, with each participant eager to unpack a list of issues, recommendations and demands. Despite the obvious differences in perspectives represented, it was clear that this group’s members were all professionals with a common dissatisfaction in the fl awed policy wordings that had produced uncertainty of coverage and expensive disputes. The bluster and bombast soon gave way to reasoned debate and the will to work as a team. Such was the hopeful start of a new and influential force in mining insurance wordings. From those early beginnings in Munich, many more meetings have taken place and the wordings participation has grown considerably. Original group members have come and gone, become friends or even switched employers. But as a group, we have retained a collective and growing commitment to our goal of clarity, transparency and certainty in policy wordings, knowing that this is as much desired by insurance buyers as it is by underwriters. Munich Re Topics Schadenspiegel 2/2015

37

PROPERTY

Two years later at the most recent meeting in London, I was happy to be presenting the product of the drafters’ efforts. Some months earlier, a group of four underwriters and brokers had been invited to produce a suitable form based on the ISR Mark IV Policy.

This slim document is not just a milestone in the work of MIG. It’s living proof that diversity of participation and opposing positions can create a forum where industry issues can be fiercely debated, understood and, ultimately, resolved.

We had locked ourselves away and distilled the wider group’s contributions into the first MIG form with clauses tailored for the Australian mining market.

A forum for open dialogue MIG was an idea founded upon an honest and open discussion of the issues associated with the mining insurance industry and, in particular, buyers’ dissatisfaction with insurers’ response to complex major losses. MIG acted as a “circuit breaker” between insurance buyers, sellers and associated service providers, allowing a forum for open dialogue on the issues and acting as an objective mechanism for solutions with all stakeholders having a say. Despite a largely self-insurance strategy, BHP Billiton proudly remains associated with the insurance market and has made a conscious decision to actively lead, contribute and support the Mining Insurance Group for the benefit of all mining insurance

stakeholders. It fully supports MIG and was an early adopter of the Claims Protocol, which is actively used to adjust losses to their captive and for the insurance placement for their joint venture partners. It also supports the introduction of a stand ard mining insurance wording, which could be used as an option for insur ance buyers where cover is intended to be clear and concise. BHP Billiton is delighted that Munich Re has taken a leadership role in MIG and itself remains committed to MIG’s journey to helping the industry “collaborate, learn and create”.

Matthew Frost is Vice President, Risk Finance at BHP Billiton, the world’s largest natural resource company. He has had a more than 30-year career in insurance and risk management w orking on three different continents. He is Vice Chairman of MIG.

OUR EXPERTS

38


Günter Becker heads the Mining Section in Corporate Insurance Partner (CIP) and has hands-on industry experience as a mining engineer and twenty years’ underwriting experience. He is Chairman of MIG. [email protected]

Dr. Andre Knoerchen heads the New Risk Solutions Team in CIP. Prior to this, he was Head of Claims in CIP, where he was responsible for energy, mining, engineering, casualty and special enterprise risk claims. [email protected]

Martina Christ is a legal consultant for CIP Claims, specialising in the engineering, energy and casualty lines of business. Since 2009, Martina has worked on some of the largest mining claims in the industry. [email protected]

Andrew Weare is In-house Counsel in CIP and advises their Mining and Oil & Gas Teams on wordings and other legal matters. He has over 20 years of experience in the international insur ance and reinsurance marketplace. [email protected]

How good is your claims management ?

Changing weather risks are having a major impact on the insurance industry. Insurers today need to find ways to manage major losses and expedite recovery. Two new publications from our Knowledge Series can help you find the answers to these questions. In “Claims management following natural catastrophes” we examine the major weather-related natural catastrophes of recent years and present conclusions that help insurers to optimise their contingency planning and claims management. “Severe weather in Eastern Asia” presents an in-depth analysis of the changed exposure situation in East and Southeast Asia. These two publications are available in English as a download from our client portal connect.munichre.com or from your Client Manager. For further information, please contact your Client Manager. NOT IF, BUT HOW


39

CASUALTY

Ken Feinberg: Responding to unique catastrophes Ken Feinberg – Special Master of the 9/11 Victim Compensation Fund and Administrator of the BP Fund after Deepwater Horizon – talks about his experience with ad hoc compensation schemes following major catastrophes over the last 30 years. During his visit to Munich Re, he summed up his main considerations in an interview with Christian Fuhrmann, Chief Executive Global Clients/North America 1 at Munich Re.

Christian Fuhrmann: Ken, you have organised many of the most comprehensive compensation schemes in the US. How do you proceed when you are asked to distribute hundreds of millions or even billions of dollars to thousands of victims? Ken Feinberg: Over time I have developed almost a checklist of how to tackle such an assignment. The first question is always: How much money is available and where does it come from? After 9/11, there was so much political pressure to generously compensate the victims that the government was willing to pay as much as necessary. Resources were endless. After Deepwater Horizon, BP came up with US$ 20bn up front and told me, if that´s not enough, we´ll give you more.

40

Next on the list is eligibility: Who is eligible to file a claim? This is relatively easy if you compensate for death and bodily injury, like after 9/11. It is a lot more complicated if it is about economic loss. After Deepwater Horizon, most of the claims were for loss of income. We had to draw the line somewhere. You have to find criteria. The further away the claimant is from the scene of the catastrophe, the more evidence was needed. After all, we received claims from all 50 US states and about as many foreign states, as far away as Europe. Regarding losses after Deepwater Horizon, the absence of sufficient proof rendered over half of all claims ineligible. Then you have to come up with a method to calculate awards: usually not too difficult regarding economic losses. By the way, asking for tax forms as proof helps to limit the amounts people claim. Estimating the loss is more difficult when you compensate for death, for injury, for pain and suffering. With thousands of victims, don´t even try to come up with individual solutions. Streamline the process. With an ad hoc scheme, you want to avoid litigation.


Look at what people would on average receive for certain injuries when litigating and then award as much. Or slightly more. Latent claims are even more difficult to calculate. But if you give people the choice between a best-estimate lump sum now and the chance to come back later and give evidence of a higher loss, the vast majority will accept the lump sum. After you have clarified all this, how do you move on? Due process is essential. People who have lost a loved one or were seriously injured do not simply want money. They want to talk. Let them. They want to be heard. Listen. You have to deal with the emotion. A lot of emotion. After 9/11, I held 950 private hearings with families of victims. I hardly acted as a lawyer in these hearings. Rather as a psychologist, a counsellor. Keep in mind, you will never receive gratitude or appreciation for what you are doing from the victims, no matter how much compensation you pay out to them. These people have lost a loved one or have suffered catastrophic injury. You can help them but you cannot make them happy.

CASUALTY

Kenneth Feinberg is best known for being the Special Master of the 9/11 Victim Compensation Fund and the Administrator of the Gulf Coast Claims Facility after the Deepwater Horizon incident. He has also been involved in a multitude of other compensation schemes, including Agent Orange, Dalkon shield and GM ignition claims. Ken Feinberg has a law firm in Washington DC, regularly teaches law at various law schools in the US and is the author of the books “What is Life Worth?”, published in 2005, and “Who gets What?”, published in 2012.

How do you achieve this transparency? By involving all who might be affected from the very beginning. This starts with the design of the programme. Invite input from everyone – victims, experts, the public. Listen to them. Show you care about what they have to say. Make sure everyone understands how the programme works. Who gets what, when and how. You say ad hoc schemes are about avoiding litigation. How do you ensure that people don´t take the money and sue anyway? Be very generous in compensating and make everyone who receives compensation sign a full release. If you compensate claimants for any loss they had, there is no reason for them to sue anyone afterwards. Also, never ever leave a programme open for a long time. If you want people to opt into your compensation scheme voluntarily, set a clear time limit for bringing claims. Claimants are usually sceptical when such a scheme is offered and only come forward at the last minute.

Paying out enormous amounts of money to thousands of claimants within a limited time period leads to moral hazard. How serious is this problem? Not as serious as one might think. Of course there are always a number of dubious or even downright fraudulent claims. After Deepwater Horizon, for instance, 18,000 of the 1.2 million claims we received were suspicious. However, if you process claims in a sensible way, you will be able to identify most of them and declare them ineligible. If the compensation scheme you have in place works well, fraud and corruption are a minor annoyance, not a big worry.

What is the role of the internet and social media in the context of ad hoc compensation schemes? When you want as many victims of a catastrophe as possible to join your programme, modern media can help to spread the word. Social media can support you in reaching out to the claimants, in making your programme transparent, in establishing trust. Of course, you will also catch the attention of a few people who will bring bogus claims. But if you have the right programme in place, you can handle this.


41

CASUALTY You have shown that ad hoc com‑ pensation schemes can be very successful. Should they be used more often? Ad hoc compensation schemes will always be the rare exception. And rightfully so. To make such a scheme a success, it has to be very generous. The 9/11 fund is the best example of this. After 9/11, such a fund was the right thing to do. But a compensation scheme like this won´t happen again, ever. 9/11 was an unprecedented event that called for generous compensation. Even though the taxpayer paid for it, there was no political opposition against the fund. But even then, victims of other catastrophes found it difficult to understand why they were not equally compensated. Bad things happen to good people every day. It is very rarely justified to favour one group of victims over all the others who suffered similar losses.

If you had to give the insurance industry one more piece of advice, what would that be? I have little experience with insurers. I usually get involved very early on, very soon, sometimes only days after the catastrophe. Insurers normally only appear on the scene when I am done. However, looking back, the one piece of advice would probably be: try to get even better at predicting future catastrophes. Not just natural catastrophes. Also improve your methods to anticipate litigation risks. Learn as much as you can about the US tort and litigation system. Some attempts to model liability risks have already been developed, based on making use of new data to predict the next big toxic tort or pharma ceutical risk. This might still be in an infant stage. It will probably never work for all kinds of liability risks. But anything that helps you understand how liability risks develop into mass litigation is good for your industry.

OUR EXPERT Christian Fuhrmann is Head of Global Clients/North America 1 and an expert on P&C insurance and reinsurance general management. [email protected]

42


Risk, Liability & Insurance

Our “Risk, Liability & Insurance” series explores fundamental issues of liability law and its significance for the insurance industry. Analysing the effect social influences have on insurance and tort law practice is an important part of this process. The publications in this series are now available in a brand new format: −−Non-objectifiable diseases −−Compensation for pain and suffering −−Tort law and liability insurance −−Asbestos – Anatomy of a mass tort −−Employers’ liability for occupational illness and injury To obtain a copy of any of these publications, visit our client portal connect.munichre.com or contact your Client Manager. NOT IF, BUT HOW


43

PROPERTY

Just how safe are smart homes? Clever control systems, intelligent central heating, smart surveillance and security lighting systems: the homes of the future can think for themselves. However, not all manufacturers place enough focus on the quality and security of their devices – some of which have not undergone long-term testing – or on the reliability of data transmission. Claims departments will therefore have to adapt to new types of damage and more complex loss assessment.

Controlling home technology such as heating, water and lighting at the click of a mouse offers convenience, but you might just be leaving the door wide open to intruders.

44


PROPERTY

Eckhard Schäper

It is indeed a brave new world. In the smart buildings of the future, the central heating will communicate with your smartphone, the fridge will order milk when you run out, and the shutters will close automatically if a storm is on the horizon. The smart home industry is booming. In Germany alone, 5.1 million households will have installed a smart home system by 2020, according to consultancy firm Mücke, Sturm & Company. Manufacturers promise both convenience and security, as devices can be controlled remotely via radio link or internet apps and are also designed to detect and prevent potential damage. Many insurers are therefore looking at the potential impact of this new technology on property damage business. Mücke, Sturm & Company predicts that the use of smart technology in Germany could lead to an €80 million reduction in claims. The consultancy firm believes the German insurance sector could benefit to the tune of €340 million by 2020. Tomorrow’s buildings may be smart, but are they safe? Will the smart homes of the future really be able to reduce claims so drastically as to significantly change property damage business? Or will claims stay more or less constant in the coming transition years given the fact that this technology is complex and not yet tried and tested? Will frequency losses fall, but new types of damage emerge which are more costly and much more complex to settle? The smart homes concept appeals to a number of different client groups. In industry, intelligent buildings with built-in sensors, control units and interfaces are more advanced; for homeowners improving security is paramount, while tenants are more likely to purchase systems that help reduce energy consumption. All smart home technology can be controlled via radio within the building and via the internet from anywhere in the world. This also makes it possible for third parties to take control of home automation systems from the outside.

Smart homes as a mass-produced article As it stands, only very few devices communicate with one another in smart homes. The intelligent lighting system can be operated via a smartphone app, the CCTV system uses a different app, and the heating can be turned up from your office and sends you a text message if there is a problem. The individual components vary widely in terms of price, quality and security. Cheap components from the Far East are becoming increasingly popular. These devices have not necessarily been subjected to long-term testing and only comply with the most basic security requirements – if any – and yet they are connected to the internet 24/7. Simple plug and play devices, which users can install themselves, are of particular concern in terms of technical vulnerability. These devices are designed to be user-friendly enough to be installed and operated by less technically adept users. Important safeguards often fall by the wayside as they are either not included by developers or would be too complicated for home users. Most devices come with a generic password (e.g. 12345), which is rarely changed by users. Vulnerabilities in the individual components leave the door wide open to third parties who are able to manipulate the devices from outside the home and spy out data and behaviour patterns. Insurers will soon be asking themselves if they can rely on policyholders to properly install and operate the components and comply with provisions such as secure passwords and network security, or whether it would be better to include this requirement in their policies. Humans are the weak link in the chain Interaction between smart technology and users of all intelligence levels will lead to tricky cases for claims and legal departments. Let us imagine that you turn on the sauna using its app on the way home from work. A towel lying on the sauna heater catches fire. This raises legal questions concerning negligence leading to a loss event, risk aggravation as a result of manipulation and/or defective programming, and possible recovery. But who would you bring an action against? The company that installed the sauna, the producer of the app or a cyber criminal? The current legislative framework would make recovery very difficult.


45

PROPERTY And it is not only the human factor that poses a weakness. The technology’s security also leaves a lot to be desired. US consultancy firm Synack tested 16 smart home systems that were already on the market in the spring of 2015. Only one of the systems proved impossible to crack using commonplace hacking tools. But even devices which are supposedly less critical in terms of security, such as smart coffee machines, could pose new loss potential if, for example, a hacker were able to turn on the machine via the internet and, in so doing, cause a fire. In this case, one would have to ascertain whether a third party turned on the machine unlawfully or whether it was simply a case of the policyholder forgetting to turn the machine off.

Claims departments need to invest more in expertise Dr. Eberhard Witthoff, Head of Claims in Munich Re’s Germany Asia Pacific Africa Division, talks about the impact of smart home technology on claims management.

Schadenspiegel: Will smart homes lead to a reduction in frequency losses or will they give rise to complex new loss patterns?

Electronic protection against burglary Simple do-it-yourself smart home starter kits are available for under €200. The kits generally come with one or two electronic motion sensors. But these give users a false sense of security. Even if they work as intended, they can only send a notification that a break-in is taking place: they cannot do anything to prevent it. Thieves are only prevented from breaking in by physical means – not by burglar alarms. Sophisticated security concepts always consist of a combination of physical and electronic components.

Dr. Eberhard Witthoff: Smart homes could only reduce frequency losses if the vast majority of households were equipped with smart home technology and the appropriate sensors. Temperature sensors, for instance, could be used to switch on heating systems automatically and prevent the numerous cases of frost damage that we so regularly encounter. The technology exists, but it will take some time for it to permeate today’s households to any significant extent.

Security requirements for various devices

Fire alarm system Locking systems, control of windows and shutters with burglary protection Washing machine, kitchen stove

Burglar alarm system

Roller shutters without burglary protection, awnings, etc. Heating, air conditioning Fridge

The more important a device is in terms of security, the higher the security requirements.

Coffee machine

Security relevance of the device

46


PROPERTY

At the same time, however, more complex new loss patterns will no doubt emerge alongside the more familiar loss scenarios. In a classic case of breaking and entering, for instance, the front door frequently displays signs of violent entry. This would not be in evidence if unauthorised persons had “hacked” their way into an electronically activated locking system that is opened via a smartphone or keypad. Establishing the cause of loss will be more difficult in such cases. Exactly how will establishing the cause of loss change and what experts will be needed for claims management in the future? One aspect to be clarified in future will be whether the loss has been caused by a physical defect, such as a fault attributable to the manufacturer or system, or if the cause lies in the digital realm, i.e. the software and its control. This conflict could also lead to more recoveries. Standards of care will naturally also have to be reassessed. Can I rely on my sauna being properly preheated or the washing machine being correctly controlled via an app during my absence? When does gross negligence come into play here?

To clarify the causes of complex losses, insurers will ultimately need a deeper insight into selected data flows. Loss adjusters should then be in a position to analyse system data, for instance. This calls for further training and the development of know-how in claims departments, as well as for greater involvement of external IT experts if necessary.

Dr. Eberhard Witthoff, Head of Claims in Munich Re’s Germany Asia Pacific Africa (GAPA) Division.

What approach should property insurers and their claims departments take in future if they wish to harness these challenges and translate them into business opportunities? Insurers should play a much greater and more active part in shaping the loss prevention and minimisation process than they do at present. Quite apart from monetary benefits, customers are increasingly looking for rapid, hands-on assistance following a claim. Hence the importance of improving the link between claims management, product development and sales.

The selection of smart home systems available in stores may be large and inexpensive, but should not be seen as a replacement for the security precautions that property insurers insist on. They usually lack important security features such as surveillance systems to prevent sabotage and an adequate emergency power supply to ensure the system can continue to function in the event of a power failure. Only certified burglar alarm systems that have been designed and installed by professionals should be used, and these can easily cost thousands of euros. Those choosing to open their front door with a smartphone must assume that digital burglars can do the same. While policyholders have thus far been able to point to a door that has been forced open as evidence of a break-in, smart home burglary investigations will need to be conducted with a fine-tooth comb in future – and it will no doubt be more difficult for policyholders to prove that a break-in has taken place. Hence the recommendation to favour mechanical components over electronic devices and the comfort and convenience that they bring.

Claims departments must invest more in expertise and build up highquality expert networks to settle complex claims. The new trend in claims management will be to step up prevention with the aid of more sensor systems. This explains why more and more insurers are in contact with the suppliers of modern home technology. For the insurers, this is an opportunity to position themselves as problem solvers and security partners for the customer.

Leaving the door wide open As yet there are no overarching standards, but the future of smart homes will clearly be defined by the interaction between various systems and components. A multitude of devices can communicate with their environment via a whole host of interfaces. Operating statuses and error messages are communicated in real time; technical system data can be read and manipulated from afar. In the future, more and more heating and drinking water pump systems will communicate with other parts of the pipeline system and will exchange data with users’ mobile devices via local area networks and WiFi. It is here that security can easily be breached, as the interfaces required for system support and maintenance offer hackers and others a number of weak points.


47

PROPERTY Building automation systems are the preferred target In intelligent buildings, walls are no longer sliced open in order to lay cables throughout. Modern control systems link devices to a hub. Technology and standards vary from one country to the next. In Germany, “EIB/ KNX bus” has become the leading standard for smart homes. Given that all smart home functions are controlled via this bus and can be controlled remotely via a smartphone, the systems are open to a myriad of possible avenues of attack. As a rule, the greater the demands on security, the more limited is the functionality. Therefore if one switch is to control all the lights in a building, a hacker could do the same. If outsiders gain access to the EIB/KNX bus, they can take control of the whole building – and cause a great deal of damage. Members of the cyber security industry – hackers included – are well aware of the weaknesses of the KNX bus. When the bus standard was drawn up over ten years ago, little value was placed on security, and security products for the EIB/ KNX bus are still a niche product that are rarely used. Stand-alone solutions: Even devices that are not connected to the net are vulnerable Not many people know that even devices that are not connected to the internet and the user via radio communication equipment are susceptible to attack. The attacker simply has to be in the building and, for example, attach a transmitting device to the cabling of a motion sensor that is linked to the building automation system. The transmitter communicates with an external computer, and the building’s technical equipment is under the control of an outsider.

Clear framework conditions and technical regulations are necessary in order to guarantee the security and reliability of the devices. The State Criminal Police Office of North Rhine-Westphalia, VdS Schadenverhütung GmbH, the SmartHome Initiative Deutschland e.V. and the Institute for Internet Security at the Westphalian University of Applied Sciences in Gelsenkirchen are just some of the teams in Germany working on this. They aim to raise awareness, among owners of smart homes and those responsible for designing, building and installing smart systems, by means of a number of brochures. What lies ahead for insurers? Insurers are initially set to gain from smart homes thanks to clear benefits in the areas of early warning and loss avoidance. Sensors help to give timely indications of potential loss events, thus reducing risk accumulation and minor claims. Ideally, the insurer’s claims management team would be involved from the very beginning, providing advice and know-how to prevent potential losses. At the same time, however, increased technical complexity will make it more difficult and more expensive to establish the validity of claims and to settle them. This is because, in addition to technical failure, insurers will also have to examine whether the loss was the result of an operating error or a targeted attack. More technical expertise is therefore necessary, as are risk models and business models geared towards innovation and new approaches to risk management, pricing and product design that enable insurers to become solution finders for their clients, moving away from basic policies and towards solutions that are tailored to clients’ individual risk management. This requires excellent networks between claims management, product development and sales. As yet we do not have enough indicative claims experience in the area of smart homes, but the brave new world is just around the corner. Now is the time to act to help shape the future.

OUR EXPERT Eckhard Schäper is a fire safety engineer and an expert on burglary/theft for Corporate Claims at Munich Re. [email protected]

48


COLUMN

Transport risks in the age of digitalisation Tobias Büttner, Head of Corporate Claims at Munich Re [email protected]

The digitalisation trend has long since spread to the logistics sector. Digitalised process flows help to optimise supply chains and make the transport of goods and passengers more efficient. As a consequence, a number of traditional transport risks are becoming less relevant. However, the increasingly digitalised control of many transport routes also presents new challenges for both the insurance industry and claims management. The global exchange of goods and the growing mobility of large sections of the population mean that transport facilities must be constantly expanded throughout the world. More and more goods and passengers have to be transported more quickly, more flexibly and more costefficiently by land, sea and air in order to arrive at their destination exactly on schedule. At the same time, climate and environmental concerns are becoming increasingly important factors when selecting a mode of transport. Meanwhile, supply chain members are also coming under growing pressure to take account of specific individual and regional needs. The internet can help providers of transport services respond to these developments. For instance, digitalisation enables them to utilise the capacity of freight container vessels and trucks more efficiently.

“Big data” analysis makes it easier to optimise the value chain, from needs analysis through route planning to navigation. What is more, the Internet of Things is steadily diminishing the importance of the primary cause of risk – namely human error on the part of the people involved in the transport process. Before long, semiautonomous self-driving trucks will be ready to take over part of the overland transportation of goods. The advancing digitalisation of air traffic control will help to improve the safety of air traffic. Entire transport routes will in fact be relegated to the virtual sphere if goods can be made available via 3D printers and data or software are provided via the Cloud. While traditional perils are on the decline, the new technologies have spawned new causes of risk. The optimised utilisation of transport capacities, for instance, will push up the concentration of values – a trend which is already being fuelled by the increasing size of ships, aircraft and trucks. Above all, however, the transport sector’s growing dependence on the internet will also expose it to the entire gamut of cyber risks, from potential business interruption due to failure of the World Wide Web, through loss of data or inaccessibility of the Cloud, to carefully targeted hacker attacks on the relevant data.

The insurance industry must now take account of the changed risks associated with digitalisation by tailoring existing insurance solutions to meet the altered needs of all concerned. This could lead to an extension of combined first- and thirdparty liability coverage concepts, but will probably also be reflected in the pricing of the various lines of insurance affected. For this to succeed, however, it is essential that insurers’ know-how keeps pace with the advancement of new technologies in the transport sector. Transport insurance is therefore just one more domain with a vital need for greater cyber expertise in the insurance industry, also and most particularly in the field of claims management.


49

© 2015 Münchener Rückversicherungs-Gesellschaft Königinstrasse 107 80802 München Germany Tel.: +49 89 38 91-0 Fax: +49 89 39 90 56 www.munichre.com Münchener Rückversicherungs-Gesellschaft (Munich Reinsurance Company) is a reinsurance company organised under the laws of Germany. In some countries, including in the United States, Munich Reinsurance Company holds the status of an unauthorised reinsurer. Policies are underwritten by Munich Reinsurance Company or its affiliated insurance and reinsurance subsidiaries. Certain coverages are not available in all jurisdictions. Any description in this document is for general information purposes only and does not constitute an offer to sell or a solicitation of an offer to buy any product. Responsible for content Dr. Tobias Büttner Dr. Paolo Bussolera Prof. Dr. Ina Ebert Dr. Achim Enzian Prof. Dr. Peter Höppe Dr. Stefan Klein Arno Studener Olaf Köberl Dr. Eberhard Witthoff Editor Corinna Moormann Group Communications (address as above) Tel.: +49 89 38 91-47 29 Fax: +49 89 38 91-7 47 29 [email protected]

Picture credits p. 1: Gerhard Blank p. 2: Getty images/Magnilion p. 3 left: Getty images/Mangiwau pp. 3 right, 34: Matt Mawson/Corbis pp. 4 left and right, 39, 43: Munich Re p. 5: picture alliance/AP Photo/Ng Han Guan pp. 6, 7: Volker Möhrke/Corbis p. 9: picture alliance/dpa/Stefan Puchner pp. 10, 11, 12: Illustration C3 p. 13 top: Getty images/Michael Phillips pp. 13 middle, 15, 21, 29, 33, 38 bottom, 42, 47, 48: Foto Meinen p. 13 bottom: LS Lexjus Sinacta p. 14: shutterstock/chombosan p. 16: Getty images/Paul Taylor p. 18: picture alliance/dpa/Wiley E. Waters Whitewater Rafting p. 20 left: AGRC p. 20 right: Watco Companies, LLC p. 22: DLR p. 23: Foto Ruck Zuck p. 24: picture alliance/dpa/Patrick Seeger p. 26: Storm Prediction Center, NOAA p. 27: picture alliance/dpa/Jens Büttner p. 30: Getty images/Cultura Travel/Mick Ryan p. 37: Daniel Munoz/Reuters/Corbis p. 38 top: BHP Billiton p. 41: Orla Conolly p. 44: Getty images/Thomas Barwick p. 49: Kevin Sprouls Printed by Gotteswinter und Aumaier GmbH Joseph-Dollinger-Bogen 22 80807 München Germany Additional copies are available at a nominal fee of €8. Please send your order to [email protected] All rights reserved.

ISSN 0940-8878

>> Read Topics Schadenspiegel wherever and whenever you want: Register for our free newsletter on our homepage to access the latest issue of Topics Schadenspiegel (English or German). www.munichre.com/en/schadenspiegel You will also find us at: twitter.com/munichre facebook.com/munichre plus.google.com/115897201513788995727 youtube.com/user/munichrevideo linkedin.com/company/munich-re xing.com/companies/munichre

50


© 2015 Munich Reinsurance Company Königinstrasse 107, 80802 Munich, Germany Order number 302-08792

NOT IF, BUT HOW