Terrorism Risk Insurance: Overview and Issue Analysis for the 116th Congress
Released: 2019-04-26T00:00:00

Introduction

Prior to the September 2001 terrorist attacks on the United States, insurers generally did not exclude or separately charge for coverage of terrorism risk. The events of September 11, 2001, changed this as insurers realized the extent of possible terrorism losses. Estimates of insured losses from the 9/11 attacks are more than $45 billion in current dollars, the largest insured losses from a nonnatural disaster on record. These losses were concentrated in business interruption insurance (34% of the losses), property insurance (30%), and liability insurance (23%).

Although primary insurance companies—those that actually sell and service the insurance policies bought by consumers—suffered losses from the terrorist attacks, the heaviest insured losses were absorbed by foreign and domestic reinsurers, the insurers of insurance companies. Because of the lack of public data on, or modeling of, the scope and nature of the terrorism risk, reinsurers felt unable to accurately price for such risks and largely withdrew from the market for terrorism risk insurance in the months following September 11, 2001. Once reinsurers stopped offering coverage for terrorism risk, primary insurers, suffering equally from a lack of public data and models, also withdrew, or tried to withdraw, from the market. In most states, state regulators must approve policy form changes. Most state regulators agreed to insurer requests to exclude terrorism risks from commercial policies, just as these policies had long excluded war risks. Terrorism risk insurance was soon unavailable or extremely expensive, and many businesses were no longer able to purchase insurance that would protect them in future terrorist attacks. In some cases, such insurance is required to consummate various transactions, particularly in the real estate, transportation, construction, energy, and utility sectors. Although the evidence is largely anecdotal, some were concerned that the lack of coverage posed a threat of serious harm—such as job loss—to these industries, in turn threatening the broader economy.

In November 2002, Congress responded to the fears of economic damage due to the absence of commercially available coverage for terrorism with passage of the Terrorism Risk Insurance Act (TRIA). TRIA created a three-year Terrorism Insurance Program to provide a government reinsurance backstop in the case of terrorist attacks. The TRIA program was amended and extended in 2005, 2007, and 2015. Following the 2015 amendments, the TRIA program is set to expire at the end of 2020. (A side-by-side of the original law and the three reauthorization acts is in Table 1 .)

The executive branch has been skeptical about the TRIA program in the past. Bills to expand TRIA were resisted by then-President George W. Bush's Administration, and previous presidential budgets under then-President Obama called for changes in the program that would have had the effect of scaling back the TRIA coverage. The current Administration has not called for specific changes to TRIA, but has indicated that it is "evaluating reforms…to further decrease taxpayer exposure."

The insurance industry largely continues to support TRIA, as do commercial insurance consumers in the real estate and other industries that have formed a "Coalition to Insure Against Terrorism" (CIAT). However, not all insurance consumers have consistently supported the renewal of TRIA. For example, the Consumer Federation of America has questioned the need for the program in the past.

Although the United States has suffered attacks deemed "terrorism" since the passage of TRIA, no acts of terrorism have been certified and no payments have occurred under TRIA. For example, although the April 2013 bombing in Boston was termed an "act of terror," by the President, the insured losses in TRIA-eligible insurance from that bombing did not cross the $5 million statutory threshold to be certified under TRIA. (See precise criteria under the TRIA program below.)

Goals and Specifics of the Current TRIA Program

The original TRIA legislation's stated goals were to (1) create a temporary federal program of shared public and private compensation for insured terrorism losses to allow the private market to stabilize; (2) protect consumers by ensuring the availability and affordability of insurance for terrorism risks; and (3) preserve state regulation of insurance. Although Congress has amended specific aspects of the original act, the operation of the program generally usually follows the original statute. The changes to the program have largely reduced the government coverage for terrorism losses, except that the 2007 amendments expanded coverage to domestic terrorism losses, rather than limiting the program to foreign terrorism.

Terrorism Loss Sharing Criteria

To meet the first goal, the TRIA program creates a mechanism through which the federal government could share insured commercial property and casualty losses with the private insurance market. The role of federal loss sharing depends on the size of the insured loss. For a relatively small loss, there is no federal sharing. For a medium-sized loss, the federal role is to spread the loss over time and over the entire insurance industry. The federal government provides assistance up front but then recoups the payments it made through a broad levy on insurance policies afterwards. For a large loss, the federal government is to pay most of the losses, although recoupment is possible (but not mandatory) in these circumstances as well. The precise dollar values where losses cross these small, medium, and large thresholds are uncertain and will depend on how the losses are distributed among insurers. For example, for loss sharing to occur, an attack must meet a certain aggregate dollar value and each insurer must pay out a certain amount in claims—known as its deductible. For some large insurers, this individual deductible might be higher than the aggregate threshold set in statute, meaning that loss sharing might not actually occur until a higher level than the figure set in statute.

The criteria under the TRIA program in 2019 are as follows:

1. An individual act of terrorism must be certified by the Secretary of the Treasury, in consultation with the Secretary of Homeland Security and Attorney General; losses must exceed $5 million in the United States or to U.S. air carriers or sea vessels for an act of terrorism to be certified. 2. The federal government shares in an insurer's losses due to a certified act of terrorism only if "the aggregate industry insured losses resulting from such certified act of terrorism" exceed $180 million (increasing to $200 million in 2020). 3. The federal program covers only commercial property and casualty insurance, and it excludes by statute several specific lines of insurance. 4. Each insurer is responsible for paying a deductible before receiving federal coverage. An insurer's deductible is proportionate to its size, equaling 20% of an insurer's annual direct earned premiums for the commercial property and casualty lines of insurance specified in TRIA. 5. Once the $180 million aggregate loss threshold and 20% deductible are met, the federal government would cover 81% of each insurer's losses above its deductible until the amount of losses totals $100 billion. 6. After $100 billion in aggregate losses, there is no federal government coverage and no requirement that insurers provide coverage. 7. In the years following the federal sharing of insurer losses, but prior to September 30, 2024, the Secretary of the Treasury is required to establish surcharges on TRIA-eligible property and casualty insurance policies to recoup 140% of some or all of the outlays to insurers under the program. If losses are high, the Secretary has the authority to assess surcharges, but is not required to do so. (See " Recoupment Provisions " below for more detail.)

Initial Loss Sharing

The initial loss sharing under TRIA can be seen in Figure 1 , adapted from a Congressional Budget Office (CBO) report. The exact amount of the 20% deductible at which TRIA coverage would begin depends on how the losses are distributed among insurance companies. In the aggregate, 20% of the direct-earned premiums for all of the property and casualty lines specified in TRIA totaled approximately $42 billion in 2017, according to the latest data collected by the Treasury Department. TRIA coverage is likely, however, to begin well under this amount as the losses from an attack are unlikely to be equally distributed among insurance companies.

Recoupment Provisions

The precise amount TRIA requires the Treasury to recoup after the initial loss sharing is determined by the interplay between a number of different factors in the law and insurance marketplace. The general result of the recoupment provisions is that, for attacks that result in under $37.5 billion in insured losses, the Treasury Secretary is required to recoup 140% of the government outlays through surcharges on property and casualty insurance policies. For events with insured losses over $37.5 billion, the Secretary has discretionary authority to recoup all the government outlays and may be required to partially recoup the government outlays depending on the size of the attacks and the amount of uncompensated losses paid by the insurance industry. (See the Appendix for more information on exact recoupment calculations.)

If the requirement for recoupment is triggered, TRIA requires the government to recoup all payments prior to the end of FY2024. Because the last reauthorization of TRIA occurred in January 2015, such recoupment would be completed within a 10-year timeframe following the previous reauthorization. For an attack causing significant insured loses, however, this requirement could result in high surcharges being applied for a relatively short time. The recoupment surcharges are to be imposed as a percentage of premiums paid on all TRIA-eligible property and casualty insurance policies, but the Secretary has the authority to adjust the amount of the premiums taking into consideration differences between rural and urban areas and the terrorism exposures of different lines of insurance.

Program Administration

The administration of the TRIA program was originally left generally to the Treasury Secretary. This was changed somewhat in the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. The act created a new Federal Insurance Office (FIO) to be located within the Department of the Treasury. Among the duties specified for the FIO in the legislation was to assist the Secretary in the administration of the Terrorism Insurance Program.

TRIA Consumer Protections

TRIA addresses the second goal—to protect consumers—by requiring insurers that offer TRIA-covered lines of insurance to make terrorism insurance available prospectively to their commercial policyholders. This coverage may not differ materially from coverage for other types of losses. Each terrorism insurance offer must reveal both the premium charged for terrorism insurance and the possible federal share of compensation. Policyholders are not, however, required to purchase coverage under TRIA. If a policyholder declines to purchase terrorism coverage, the insurer may exclude terrorism losses. Federal law does not limit what insurers can charge for terrorism risk insurance, although state regulators typically have the authority under state law to modify excessive, inadequate, or unfairly discriminatory rates.

Preservation of State Insurance Regulation

TRIA's third goal—to preserve state regulation of insurance—is expressly accomplished in Section 106(a), which provides that "Nothing in this title shall affect the jurisdiction or regulatory authority of the insurance commissioner [of a state]." The Section 106(a) provision has two exceptions, one permanent and one temporary (and expired): (1) the federal statute preempts any state definition of an "act of terrorism" in favor of the federal definition and (2) the statute briefly preempted state rate and form approval laws for terrorism insurance from enactment to the end of 2003. In addition to these exceptions, Section 105 of the law also preempts state laws with respect to insurance policy exclusions for acts of terrorism.

Coverage for Nonconventional Terrorism Attacks

The TRIA statute does not specifically include or exclude property and casualty insurance coverage for terrorist attacks according to the particular methods used in the attacks, such as nuclear, biological, chemical, and radiological (NBCR) and cyber terrorism risks. Such nonconventional means, however, have the potential to cause losses that may or may not end up being covered by TRIA and have been a source of particular concern and attention in the past.

Nuclear, Biological, Chemical, and Radiological Terrorism Coverage

Some observers consider a terrorist attack with some form of NBCR weapon to be the most likely type of attack causing large scale losses. The current TRIA statute does not specifically include or exclude NBCR events; thus, the TRIA program in general would cover insured losses from terrorist actions due to NCBR as it would for an attack by conventional means. The term insured losses , however, is a meaningful distinction. Except for workers' compensation insurance, most insurance policies that would fall under the TRIA umbrella include exclusions that would likely limit insurer coverage of an NCBR event, whether it was due to terrorism or to some sort of accident, although these exclusions have never been legally tested in the United States after a terrorist event. If these exclusions are invoked and do indeed limit the insurer losses due to NBCR terrorism, they would also limit the TRIA coverage of such losses. Language that would have specifically extended TRIA coverage to NBCR events was offered in the past, but was not included in legislation as enacted. In 2007, the Government Accountability Office (GAO) was directed to study the issue and a GAO report was issued in 2008, finding that "insurers generally remain unwilling to offer NBCR coverage because of uncertainties about the risk and the potential for catastrophic losses." In the past, legislation (e.g., H.R. 4871 in the 113 th Congress) would have provided for differential treatment of NBCR attacks under TRIA, but such legislation has not been enacted.

Cyber Terrorism Coverage

Concern regarding potential damage from cyber terrorism has grown as increasing amounts of economic activity occur online. The TRIA statute does not specifically address the potential for cyber terrorism, thus, there was uncertainty about such attacks would be covered in the same manner as terrorist attacks using conventional means. In 2016, state insurance regulators introduced a new Cyber Liability line of insurance, raising questions as to whether coverage under this line would be covered under TRIA, or whether it would not be covered under the law's exclusion of "professional liability" insurance. The Department of the Treasury released guidance in December 2016 clarifying that "stand-alone cyber insurance policies reported under the 'Cyber Liability' line are included in the definition of 'property and casualty insurance' under TRIA."

Despite Treasury's guidance, cyber terrorism coverage remains a particular concern. The Treasury Department devoted a specific section of the latest report on TRIA to cyber coverage, reporting that 50% of standalone cyber insurance policies (based on premium value) included terrorism coverage. The take-up rate for those choosing cyber coverage that is embedded in policies covering additional perils was 54%. These rates are similar to, but slightly lower than, the 62% take-up rate for general terrorism coverage found across all TRIA-eligible lines.

Background on Terrorism Insurance

Insurability of Terrorism Risk

Stripped to its most basic elements, insurance is a fairly straightforward operation. An insurer agrees to assume an indefinite future risk in exchange for a definite current premium. The insurer pools a large number of risks such that, at any given point in time, the ongoing losses will not be larger than the current premiums being paid, plus the residual amount of past premiums that the insurer retains and invests, plus, in a last resort, any borrowing against future profits if this is possible. For the insurer to operate successfully and avoid failure, it is critical to accurately estimate the probability of a loss and the severity of that loss so that a sufficient premium can be charged. Insurers generally depend upon huge databases of past loss information in setting these rates. Everyday occurrences, such as automobile accidents or natural deaths, can be estimated with great accuracy. Extraordinary events, such as large hurricanes, are more difficult, but insurers have many years of weather data, coupled with sophisticated computer models, with which to make predictions.

Many see terrorism risk as fundamentally different from other risks, and thus it is often perceived as uninsurable by the private insurance market without government support for the most catastrophic risk. The argument that catastrophic terrorism risk is uninsurable typically focuses on lack of public data about both the probability and severity of terrorist acts. The reason for the lack of historical data is generally seen as a good thing—few terrorist attacks are attempted and fewer have succeeded. Nevertheless, the insurer needs some type of measurable data to determine which terrorism risks it can take on without putting the company at risk of failure. As a replacement for large amounts of historical data, insurers turn to various forms of terrorism models similar to those used to assess future hurricane losses. Even the best model, however, can only partly replace good data, and terrorism models are still relatively new compared with hurricane models.

One prominent insurance textbook identifies four ideal elements of an insurable risk: (1) a sufficiently large number of insureds to make losses reasonably predictable; (2) losses must be definite and measurable; (3) losses must be fortuitous or accidental; and (4) losses must not be catastrophic (i.e., it must be unlikely to produce losses to a large percentage of the risks at the same time). Terrorism risk in the United States would appear to fail the first criterion as terrorism losses have not proved predictable over time. Losses to terrorism, when they occur, are generally definite and measurable, so terrorism risk could pass under criteria two. Such risk, however, also likely fails the third criterion due to the malevolent human actors behind terrorist attacks, whose motives, means, and targets of attack are constantly in flux. Whether it fails the fourth criterion is largely decided by the underwriting actions of insurers themselves (i.e., whether the insurers insure a large number of risks in a single geographic area that would be affected by a terrorist strike). Unsurprisingly, insurers generally have sought to limit their exposures in particular geographic locations with a conceptually higher risk for terrorist attacks, making terrorism insurance more difficult to find in those areas.

International Experience with Terrorism Risk Insurance27

Although the U.S. experience with terrorism is relatively limited, other countries have dealt with the issue more extensively and have developed their own responses to the challenges presented by terrorism risk. Spain, which has seen significant terrorist activity by Basque separatist movements, insures against acts of terrorism via a broader government-owned reinsurer that has provided coverage for catastrophes since 1954. The United Kingdom, responding to the Irish Republican Army attacks in the 1980s, created Pool Re, a privately owned mutual insurance company with government backing, specifically to insure terrorism risk. In the aftermath of the September 11, 2001, attacks, many foreign countries reassessed their terrorism risks and created a variety of approaches to deal with the risks. The UK greatly expanded Pool Re, whereas Germany created a private insurer with government backing to offer terrorism insurance policies. Germany's plan, like the United States' TRIA, was created as a temporary measure. It has been extended since its inception, most recently until the end of 2019. Not all countries, however, concluded that some sort of government backing for terrorism insurance was necessary. Canada specifically considered, and rejected, creating a government program following September 11, 2001.

Previous U.S. Experience with "Uninsurable" Risks

Terrorism risk post-2001 is not the first time the United States has faced a risk perceived as uninsurable in private markets that Congress chooses to address through government action. During World War II, for example, Congress created a "war damage" insurance program and it expanded a program insuring against aviation war risk following September 11, 2002. Since 1968, the National Flood Insurance Program has covered most of the insured flooding losses in the United States.

The closest previous analog to the situation with terrorism risk may be the federal riot reinsurance program created in the late 1960s. Following large scale riots in American cities in the late 1960s, insurers generally pulled back from insuring in those markets, either adding policy exclusions to limit their exposure to damage from riots or ceasing to sell property damage insurance altogether. In response, Congress created a riot reinsurance program as part of the Housing and Urban Development Act of 1968. The federal riot reinsurance program offered reinsurance contracts similar to commercial excess reinsurance. The government agreed to cover some percentage of an insurance company's losses above a certain deductible in exchange for a premium paid by that insurance company. Private reinsurers eventually returned to the market, and the federal riot reinsurance program was terminated in 1985.

The Terrorism Insurance Market

Post-9/11 and Pre-TRIA

The September 2001 terrorist attacks, and the resulting billions of dollars in insured losses, caused significant upheaval in the insurance market. Even before the attacks, the insurance market was showing signs of a cyclical "hardening" of the market in which prices typically rise and availability is somewhat limited. The unexpectedly large losses caused by terrorist acts exacerbated this trend, especially with respect to the commercial lines of insurance most at risk for terrorism losses. Post-September 11, insurers and reinsurers started including substantial surcharges for terrorism risk, or, more commonly, they excluded coverage for terrorist attacks altogether. Reinsurers could make such rapid adjustments because reinsurance contracts and rates are generally unregulated. Primary insurance contracts and rates are more closely regulated by the individual states, and the exclusion of terrorism coverage for the individual insurance purchaser required regulatory approval at the state level in most cases. States acted fairly quickly, and, by early 2002, 45 states had approved insurance policy language prepared by the Insurance Services Office, Inc. (ISO, an insurance consulting firm), excluding terrorism damage in standard commercial policies.

The lack of readily available terrorism insurance caused fears of a larger economic impact, particularly on the real estate market. In most cases, lenders prefer or require that a borrower maintain insurance coverage on a property. Lack of terrorism insurance coverage could lead to defaults on existing loans and a downturn in future lending, causing economic ripple effects as buildings are not built and construction workers remain idle.

The 14-month period after the September 2001 terrorist attacks and before the November 2002 passage of TRIA provides some insight into the effects of a lack of terrorism insurance. Some examples in September 2002 include the Real Estate Roundtable releasing a survey finding that "$15.5 billion of real estate projects in 17 states were stalled or cancelled because of a continuing scarcity of terrorism insurance" and Moody's Investors Service downgrading $4.5 billion in commercial mortgage-backed securities. This picture, however, was not uniform. For example, in July 2002, The Wall Street Journal reported that "despite concerns over landlords' ability to get terrorism insurance, trophy properties were in demand." CBO concluded in 2005 that "[TRIA] appears to have had little measurable effect on office construction, employment in the construction industry, or the volume of commercial construction loans made by large commercial banks," but CBO also noted that a variety of economic factors at the time "could be masking positive macroeconomic effects of TRIA."

After TRIA

TRIA's "make available" provisions addressed the availability problem in the terrorism insurance market, as insurers were required by law to offer commercial terrorism coverage. However, significant uncertainty existed as to how businesses would react, because there was no general requirement to purchase terrorism coverage and the pricing of terrorism coverage was initially high. Analyzing the terrorism insurance market in the aftermath of TRIA is challenging as well since there was no consistent regulatory reporting by insurers until P.L. 114-1 required detailed reporting, which Treasury began in 2016. Before this time, data on terrorism insurance typically stemmed from insurance industry surveys or rating bureaus. In examining the terrorism insurance market since TRIA, it is also important to note that no terrorist attacks have occurred that reached TRIA thresholds, thus property and casualty insurance has not made any large scale payouts for terrorism damages.

The initial consumer reaction to the terrorism coverage offers was relatively subdued. Marsh, Inc., a large insurance broker, reported that 27% of their clients bought terrorism insurance in 2003. This take-up rate, however, climbed relatively quickly to 49% in 2004 and 58% in 2005. Marsh reported that, since 2005, the overall take-up rate has remained near 60%, with Marsh reporting a rate of 62% in 2017. The Treasury reports based on industry data calls have found similar or higher take-up rates. For 2017, Treasury found that the take-up rate based on premium volumes was 62%, whereas based on policy counts, the rate was 78%.

The price for terrorism insurance has appeared to decline over time, although the level of pricing reported may not always be comparable between sources. The 2013 report by the President's Working Group on Financial Markets, based on survey data by insurance broker Aon, showed a high of above 7% for the median terrorism premium as a percentage of the total property premium in 2003, with a generally downward trend, and more recent values around 3%. The trend may be downward, but there has been variability, particularly across industries. For example, Marsh reported rates in 2009 as high as 24% of the property premium for financial institutions and as low as 2% in the food and beverage industry. In the 2013 Marsh report, this variability was lower as 2012 rates varied from 7% in the transportation industry and the hospitality and gaming industry to 1% in the energy and mining industry. In 2017, Marsh found rates varying from 10% in hospitality and gaming to 2% in energy and mining and construction industries. The 2018 Treasury report, based on lines of insurance, not on industry category, found premiums varying from 6.1% in excess workers' compensation to 1.4% in ocean marine in 2017.

Treasury found that the total premium amount paid for terrorism coverage in 2017 was approximately $3.65 billion, or 1.75%, of the $209.15 billion in total premiums for TRIA-eligible lines of insurance. Since the passage of TRIA, Treasury estimates that a total of approximately $38 billion was earned for terrorism coverage by non-related insurers, with another $7.4 billion earned by captive insurers (which are insurers who are owned by the insureds).

In general, the capacity of insurers to bear terrorism risk has increased over the life of the TRIA program. The combined policyholder surplus among all U.S. property and casualty insurers was $686.9 billion at the end of 2017 compared to $408.6 billion (inflation adjusted) at the start of 2002. This $686.9 billion has been bolstered by the estimated $38 billion in premiums paid for terrorism coverage over the years without significant claims payments. The policyholder surplus, however, backs all property and casualty insurance policies in the United States and is subject to depletion in a wide variety of events. For example, extreme weather losses could particularly draw capital away from the terrorism insurance market, because events such as hurricanes share some characteristics—low frequency and the possibility of catastrophic levels of loss—with terrorism risk.

Evolution of Terrorism Risk Insurance Laws

Table 1 presents a side-by-side comparison of selected provisions from the original TRIA law, along with the reauthorizing laws of 2005, 2007, and 2015.

Appendix. Calculation of TRIA Recoupment Amounts

Table A-1 contains illustrative examples of how the recoupment for the government portion of terrorism losses under TRIA might be calculated in the aggregate for various sizes of losses. The total amount of the combined deductibles in the table is simply assumed to be 30% of the insured losses for illustrative purposes. (The actual deductible amount is, as detailed above, based on the total amount of premiums collected by each insurer.) Without knowing the actual distribution of losses due to a terrorist attack, it is impossible to know what the actual total combined deductible amount would be. Table conclusions with regard to recoupment, however, hold across different actual deductible amounts.

The specific provisions of the law define the "insurance marketplace aggregate retention amount" (Column F) for 2019 as the lesser of $37.5 billion or the total amount of insured losses (Column A). The "mandatory recoupment amount" (Column G) is defined as the difference between $37.5 billion and the aggregate insurer losses that were not compensated for by the program (i.e., the total of the insurers' deductible (Column B) and their 19% loss share (Column C)). If the aggregate insured loss is less than $37.5 billion, the law requires recoupment of 140% of the government outlays (Column H). For insured losses over $37.5 billion, the mandatory recoupment amount decreases, thus the Secretary would be required to recoup less than 133% of the outlays. Depending on the precise deductible amounts, the uncompensated industry losses (Column D) may eventually rise to be greater than $37.5 billion, which would then mean that the mandatory recoupment provisions would not apply. The Secretary would still retain discretionary authority to apply recoupment surcharges no matter what level uncompensated losses reached.