The insurance industry offers many types of coverages intended to protect businesses as well as individuals. While the extent of regulation varies by state and by line of insurance, state insurance regulators oversee the provision of insurance; for example, states may approve the rates (prices) insurers may charge and require insurers to cover certain events. In order to ensure the availability of terrorism coverage after September 11, Congress enacted TRIA to temporarily provide some property/casualty insurers some reimbursement for insured losses, including workers’ compensation losses, resulting from specific acts of terrorism. Insurance can be grouped into three main types: property/casualty, life, and health. Property/casualty insurance includes several types of insurance. Commercial property/casualty insurers cover physical losses to property, business interruptions or loss of use of buildings due to property damage, and also legal liability related to the maintenance of the property and business operations. Workers’ compensation insurance is considered a separate category of commercial property/casualty insurance, and the insurers provide employers protection against work-related disability and death. In addition, with certain exceptions, almost all employers are required to provide some form of workers’ compensation insurance to cover employer liability for workers who are killed, injured, or disabled on the job from any cause. Personal lines of property/casualty insurance include policies for homeowners and automobile coverage. Homeowners insurance provides coverage for physical losses to the home, its contents, and additional living expenses for the owner while the home is uninhabitable. Life insurers sell either individual or group policies that provide benefits to designated survivors after the death of an insured. Health insurers cover medical expenses resulting from sickness and injury. States have primary responsibility for regulating the insurance industry in the United States, and state insurance regulators coordinate their activities in part through NAIC. The degree of oversight of insurance varies by state and insurance type. In some lines of insurance, such as workers’ compensation, insurers may file insurance policy forms with state regulators, who help determine the extent of coverage provided by a policy by approving the wording of policies, including the explicit exclusions of some perils. According to an NAIC representative, while practices vary by state, state regulators generally regulate prices for personal lines of insurance and workers’ compensation policies but not for group life or commercial property/casualty policies. In most cases, state insurance regulators perform neither rate nor form review for commercial property/casualty insurance contracts because it is presumed that businesses have a better understanding of insurance contracts than the average personal lines consumer. However, reinsurers—companies that provide insurance to insurers—generally are not required to get state regulatory approval for the terms of coverage or the prices they charge. Terrorism attacks, particularly including those using NBCR weapons, could result in catastrophic losses. Each type of weapon—nuclear, biological, chemical, and radiological—represents different methods of attack. Further, many different agents can be used to carry out a biological, chemical, or radiological attack. See table 1 for general descriptions of each type of weapon and examples of available agents. The agents used to undertake NBCR attacks have differing characteristics and properties and would affect people and property in myriad ways. Of the four types of NBCR attacks, a nuclear bomb would be the most likely to result in fires of any consequence. The intense heat produced by the nuclear explosion and subsequent reactions could produce extensive fires located throughout the area of detonation. While the detonation of a dirty bomb (conventional explosives used to disperse radioactive material) could result in blast damage, the resulting fire damage likely would be confined to the immediate area. However, the detonation of both nuclear and dirty bombs would release radioactive materials, resulting in the need to decontaminate buildings and provide immediate healthcare. The distance these radioactive agents disperse from the original detonation site would depend on many factors, including the strength of the explosive and meteorological conditions. While the release of chemical and biological agents is significantly less likely to result in fires of any consequence, the agents also have the potential to contaminate buildings and make them unusable for long periods. These agents could be released within buildings or outdoors, with chemical agents more likely than biological agents to result in immediate harm to humans. All NBCR attacks, depending on size of the explosion or the quantity of the agent, have the potential to result in fatalities, injuries, or illness. After the events of September 11, when certain coverage for terrorism events disappeared, Congress passed TRIA. This law created a temporary program that effectively functions as reinsurance—for the commercial property/casualty and workers’ compensation insurance industries only. Under TRIA, the federal government would reimburse insurers in these lines for 90 percent of their losses, up to a specified level, after the insurers paid a deductible. The program also would cover losses caused by NBCR attacks, if insurers had included this coverage in an insurance policy. However, coverage of NBCR attacks, as with other terrorist attacks, would have to meet the program’s criteria to trigger reimbursements. TRIA requires certain insurers to “make available” coverage for terrorist events that the Secretary of the Treasury has certified as committed by individuals acting on behalf of a foreign person or interest. Commercial property/casualty insurers must offer terrorism coverage to their policyholders, although they could impose an additional charge. Policyholders have the option of not purchasing the coverage and adding a terrorism exclusion to their policies. If policyholders chose to purchase the terrorism coverage for their property/casualty policies, insurers then could not add any additional exclusions or conditional language to the policies. In December 2005, Congress extended many of the same provisions of the original statute in the Terrorism Risk Insurance Extension Act of 2005, but increased the required amount insurers would have to pay in the aftermath of a terrorist attack. While deliberating the extension of TRIA, Congress considered whether to cover additional lines of coverage, such as group life insurance, and set a lower deductible that applied only to NBCR terrorist events. However, Congress did not enact these changes. The TRIA extension, which continues to apply only to the commercial property/casualty industry, is set to expire on December 31, 2007. Several commonly accepted principles underlie insurers’ ability to determine whether to offer coverage for a particular risk and at what price. Ultimately, the decision becomes a question of whether sufficient information exists for insurers to accurately estimate potential losses. According to standard insurance theory, four major principles contribute to the ability of insurers to estimate and cover future losses: the law of large numbers, measurability, fortuity, and the size of the potential losses. However, measuring and predicting losses associated with NBCR risks can be particularly challenging for a number of reasons, including lack of experience with similar attacks, difficulty in predicting terrorists’ intentions, and the potentially catastrophic losses that could result. Nevertheless, models have been developed that attempt to assist insurers in evaluating terrorist and NBCR risks. However, many insurers and other insurance experts continue to believe that there is an insufficient basis for estimating the probable frequency of terrorist attacks, including NBCR attacks. Four principles generally underlie an insurance company’s willingness to provide insurance for a particular risk or type of risk. Each contributes to the insurer’s ability to measure and predict, with a reasonable degree of accuracy, the likely frequency of occurrence and the probable severity of losses that will result from each occurrence. In the ideal situation, when all these factors are satisfied, the insurer can add other expenses and profits to the expected losses and determine a price that is appropriate to the risk. Insurers may still decide to offer insurance for risks that deviate from the “ideal.” However, as one or more of the factors vary from the ideal, the ability of the insurer to estimate future losses decreases, the risk increases, and the insurer’s capital is more exposed to inadequate prices for the coverage that the insurer offers. These principles are The law of large numbers must apply. There must be a sufficiently large number of homogeneous units exposed to random losses, both historically and prospectively, to make the future losses reasonably predictable. This principle works best when there are large numbers of losses with similar characteristics spread across a large group. For example, an automobile insurer could analyze annual data on the frequency and severity (cost) of accidents and the characteristics of drivers (gender or age) involved in the accidents to predict expected losses for certain types of drivers, and thus set premiums adequate to cover these losses. The greater the experience with losses, the better the insurer would be able to estimate both the frequency and the severity of future losses, based on what happened in the past. The loss must be definite and measurable. The insurer must be capable of determining whether a loss has taken place, and setting a dollar value on the amount of the loss. The loss must be fortuitous or accidental. That is, the loss must result from chance and not be something that is certain to happen. To the extent that a future loss approaches certainty, an insurer would have to charge the full value of the loss plus an additional amount for the expenses incurred. The loss must not be catastrophic. That is, the losses should not affect a very large percentage of an insurance company’s policyholders at the same time, for example, in a limited geographic area. Alternatively, a catastrophic loss is one that is extraordinarily large relative to the amount of exposure in an insurance pool. When applied to NBCR terrorist risks, these principles can help explain why NBCR risks are so challenging for insurers. Most importantly, because so few NBCR attacks have occurred, the pool of experience in the United States is very limited, and the law of large numbers does not help insurers to measure and predict the frequency and severity of future losses. One of the reasons many insurers we interviewed had concerns about insuring NBCR risks was the small number of historical events that could be used as a basis for predicting the future frequency and severity of these risks. However, several of the academic experts we interviewed also noted that a limited number of historical events did not automatically make a risk uninsurable. For example, insurers have covered risks related to commercial satellites for which there has been a very limited record of losses; however, several of the experts noted that for commercial satellites the prospective loss is measurable and documentation is available to assess their safeguards. In addition to the inapplicability of the law of large numbers, insurers also told us that they are not able to fully measure the costs of NBCR terrorist risks (that is, the potential severity). Because certain types of NBCR attacks could have long-term or uncertain consequences, insurers may not be able to measure, or even clearly identify, their prospective losses. Almost all of the insurers we interviewed indicated uncertainties about the scope of potential losses as a factor contributing to difficulties in insuring NBCR risks. For example, according to America’s Health Insurance Plans (AHIP), a national trade association for health insurers, some NBCR attacks could produce latent illnesses such as cancer. The costs to health insurers would not be immediate but would occur in the years to come. In addition, representatives of insurers and an insurance broker with knowledge of the property/casualty market told us that they believed the costs of some NBCR events would be uncertain because of difficulties in estimating how much time would pass before buildings were successfully decontaminated (for example, after an anthrax attack) or before anyone would even be willing to enter contaminated locations (for example, after a nuclear attack) to assess the damage, making the areas unusable for a long time. Moreover, losses must be fortuitous or accidental. By definition terrorist events, including NBCR, are deliberate and do not occur by chance. As we previously reported, unlike storms and accidents, terrorism involves an adversary with deliberate intent to destroy, and the probabilities and consequences of a terrorist act are poorly understood and difficult to predict. In other words, even if an extensive history of NBCR terrorism experiences existed, without the element of randomness, it would not necessarily be indicative of the future frequency and severity of terrorist events. Likewise, according to the American Academy of Actuaries and the Insurance Information Institute, predicting terrorist risks is particularly difficult because the attacks are not random; they are intentional, and the attack characteristics are not likely to be constant, as terrorists adjust their strategies. Finally, insurance experts told us that NBCR risks could represent the potential for catastrophic (severe) losses because of the concentration of risks that could face either a particular insurer or the industry. Most of the academic experts we interviewed stressed that the potential for catastrophic losses, rather than the lack of reliable data on the frequency and severity of NBCR risks, made insurers reluctant to insure them. Several of these experts observed that in Florida, where the risk of hurricanes is both greater and more predictable than NBCR terrorism risks, insurers were leaving the state because of their exposure to catastrophic losses, perhaps more so than the unpredictability of the risk. An NBCR event, like a natural catastrophe, could result in catastrophic losses if it created significant losses to a high proportion of insureds in a particular geographic area. Should these events take place in urban areas that serve as major places of employment, they could result in tremendous exposure for lines of insurance providing coverage for workers, such as health or workers’ compensation. In addition, as explained by representatives of the New York Department of Insurance, because NBCR risks have the ability to cut across many lines of insurance in a concentrated geographic area, large insurance companies that typically cover several lines of insurance could find it very difficult to diversify their risk portfolios. According to the American Academy of Actuaries, the prospect of catastrophic losses from an NBCR event could be far larger than insurers could sustain without impairing their ability to continue providing all other insurance coverages. The prospect of catastrophic risk poses additional problems because insurers, like most businesses, generally have two major objectives. First, they expect to make a profit for their owners. Second, they plan to survive so as to operate in the future. Several of the academic experts we interviewed questioned the incentive insurers would have to insure risks, such as catastrophic NBCR attacks, that might jeopardize their financial soundness and profitability. If an insurer were faced with the potential for a catastrophic loss—that is, one that threatened its solvency or its survival—the insurer would be less likely to be willing to provide insurance, or at a minimum, the insurer would limit its exposure to the extent that it could. The larger and more uncertain the estimates of projected losses, the less likely an insurer would be willing to voluntarily insure the risk. Moreover, insurers could have another disincentive to insuring catastrophic risks for which they might not be adequately capitalized—the prospect of receiving a low rating from a rating agency. We interviewed representatives from three rating agencies, two of whom said they generally viewed NBCR risks as not insurable because of their potential for catastrophic losses. For example, a representative from one credit rating agency said that if his company considered existing potential exposure to NBCR risks when analyzing commercial property/casualty insurers, they might have to downgrade ratings due to the magnitude of potential losses. Because the frequency and severity of NBCR risks are difficult to measure, insurers have turned to techniques and processes that they have applied to other catastrophic risks. As we previously reported, insurers have come to rely on computer models and modeling firms to assist them in estimating the frequency and severity of catastrophic events and the probable losses that they might face. Since Hurricane Andrew in 1992, insurers have recognized the challenges associated with insuring low-frequency, high- cost risks such as natural disasters and increasingly have turned to the use of computer models to better estimate the expected frequency and severity of the risks. After September 11, the owners of these models developed them to estimate the effects of man-made, or terrorist, events as well. However, as noted by the Insurance Information Institute and other insurance experts, estimating the incidence of terrorism is fundamentally different and vastly more difficult than forecasting natural catastrophes, where insurers can learn much about the frequency and severity of events through historical claim data, meteorological and geological records, and increases in scientific knowledge. In view of the limited history of NBCR attacks in the United States, representatives of the modeling firms reported to us that they generally have relied on panels of terrorism experts to assess threats posed by terrorists. While these experts do not have access to current classified data, they use their judgment and expertise to assess the probability (that is, the future occurrence or frequency) of future terrorist attacks. For example, the experts assess the likelihood of terrorists targeting urban areas, based on population density and perceived importance, as well as well-known buildings within those areas. Moreover, the experts also consider the level of difficulty of using weapons of different sizes and capacities as a way of estimating the potential severity of terrorist attacks. The modeling firm representatives reported that they use a number of statistical techniques to convert the subjective opinions of their experts and the characteristics of NBCR weapons into quantified estimates of the frequency and severity of potential losses. While we did not assess the capabilities of these models, we have noted in a previous report that some federal agencies, even with access to classified data, have difficulty including in their risk assessments the relative probability of various terrorist threat scenarios. Representatives of insurers and insurance brokers also said that they generally had little confidence in the ability of models to estimate the frequency of future terrorist attacks, and the American Academy of Actuaries noted that while there has been some development of terrorism models since September 11, quantification of terrorism exposure still was extremely difficult. The Academy also noted that the probabilities associated with the occurrence of a terrorist attack have remained somewhat judgmental and a key source of uncertainty. Representatives of insurers told us that the models can be useful in simulating scenarios for particular NBCR attacks in specified locations, allowing them to estimate the potential severity of possible losses for specific events. Using available engineering, scientific, and demographic research, the models can estimate insured potential losses for the portfolios of individual insurers. Several insurers and brokers said that they found models, including those that they may have created themselves, useful in managing insurers’ exposure to terrorism risks. Finally, insurance experts and representatives of insurers and reinsurers we interviewed agreed that difficulties in predicting NBCR events, as well as the prospect for catastrophic losses, make these risks difficult to insure. However, as noted by several of the experts from academia, even though a risk may not satisfy all the principles of insurability, insureds may be able to find some amount of coverage. Several experts noted that insurability is not simply an issue of extremes—that is, either insurable or uninsurable. Rather, as specifically noted by one, the insurability of events should be viewed as a continuum, with some events such as NBCR being on the extreme end of the continuum. Insurers’ exposure to NBCR risks varies widely by line of insurance, and insurers offering coverage face challenges in pricing. In view of the underlying difficulties in insuring NBCR risks, property/casualty insurers generally have tried to exclude such events from their coverage. However, for reasons that vary somewhat by line of insurance, workers’ compensation, life, and health insurers generally offer coverage for NBCR events. Insurance industry representatives told us that most property/casualty insurers have used long-standing policy exclusions to limit coverage of NBCR events, although experience with these types of exclusions suggests that they could be challenged in court. Representatives of property/casualty insurers said that these risks continue to be unattractive to insure because of difficulties in predicting the frequency and severity of these risks, the potential for large and uncertain losses, and the limited amount of private reinsurance. Despite similar concerns and subsequent difficulties in setting prices due to lack of reliable historical data, coverage for workers’ compensation, life, and health insurance generally is available on the market. In large part, insurers provide this coverage, particularly workers’ compensation, because they are required to by states, or because the coverage (for example, life insurance) does not readily lend itself to excluding one type of risk. Nevertheless, insurance and state regulatory officials expressed particular concerns about whether the prices set for workers’ compensation insurance would cover potential losses, should a major NBCR event occur. Representatives of life and health insurers told us that generally their prices did not reflect their potential exposure to NBCR risks. Unlike workers’ compensation, life, and health insurers, insurers selling property/casualty insurance largely have excluded NBCR risks from their policies. Since Congress passed TRIA, the supply of commercial property/casualty insurance for conventional terrorism appears to have increased, yet insurance policies covering NBCR risks have remained in short supply. In its most recent survey of terrorism insurance in the commercial property/casualty industry, Treasury found that the percentage of insurers that reported that they wrote some coverage for terrorism using conventional weapons (that is, not NBCR) increased from 73 percent in 2002 to 91 percent in 2003 and 2004. In contrast, the percentage of insurers that reported covering NBCR risks in some of their policies remained about the same during that general period and was significantly smaller—about 35 percent. Moreover, as explained by Treasury officials, the 35 percent represented insurers that offered any kind of coverage for NBCR risks, meaning that an insurer would be counted as offering NBCR coverage even if it offered only one policy for one type of NBCR risk. Representatives of insurance and insurance brokerage companies also told us there was a very limited supply of NBCR coverage in the commercial property/casualty marketplace. Representatives of the three largest brokerage firms that find property/casualty insurance coverage for large commercial businesses told us that insurers offering terrorism coverage exclude NBCR risks. According to representatives of insurers, exclusions for NBCR risks are contained in policies offered by commercial property/casualty insurers underwriting in regulated insurance markets and also are contained in stand-alone terrorism insurance policies offered by specialty insurers in the nonregulated market. A representative of one of the specialty insurers with whom we spoke said the company offered very limited amounts of NBCR coverage, typically for one or two of the risks. For example, this company would offer $10 million of biological and chemical coverage for certain commercial properties, but the insurer would not provide coverage above that threshold. Representatives of insurance and insurance brokerage companies we interviewed said that even though TRIA would cover NBCR losses incurred by an insurer the same as it would any other covered terrorist losses, little coverage for NBCR risks was available because commercial property/casualty carriers largely viewed NBCR risks as uninsurable. According to representatives of two large commercial property/casualty insurers, both of whom underwrote insurance in states with localities considered at higher risk for a terrorist attack, the current structure of TRIA offered little incentive to cover NBCR losses, even though TRIA would provide coverage for some insured NBCR events. For example, they said that because their companies offered workers’ compensation insurance in areas at higher risk for terrorism, the companies were less likely to increase their level of exposure to NBCR events by also offering NBCR coverage in their commercial property and general liability policies. Under TRIA, the more business an insurer writes, the larger its deductible; and the more lines of insurance an insurer writes, the more it is exposed to losses from a catastrophic event. In addition, because of uncertainties surrounding the frequency and severity of NBCR events as well as the enormity of potential losses, representatives of insurers we interviewed said that they would have difficulty setting prices to cover such losses, even using information from the modeling firms. These representatives also expressed concerns about the potential insured losses of an NBCR event being largely undeterminable for many years after the event occurred. Such an event could have many long-term consequences— for example, the extent and duration of remediation for a contaminated building, the resulting business interruption to the policyholder, and any related litigation involved. Finally, as confirmed by representatives of the Reinsurance Association of America, private reinsurance—the risk- spreading mechanism that insurers typically use to reduce their potential losses—provided very limited amounts of coverage for NBCR risks in the property/casualty market. Property/casualty insurers long have sought to limit their exposure to certain perils, such as flood, that they consider uninsurable. Property/casualty insurers have written exclusions related to nuclear hazard risk into their standard policies for decades, generally to protect themselves from losses related to nuclear power plant accidents. Representatives of insurance companies and brokerage firms agreed that existing nuclear hazard exclusions were broad enough to likely exclude any losses resulting from nuclear and radiological events, including a terrorist attack. According to these same insurance industry representatives, property/casualty insurance contracts issued prior to September 11 did not specifically include references to losses from the terrorist release of biological and chemical agents. Rather, Insurance Services Office (ISO) officials told us that the standard contracts they provided for industry use contained language that excluded coverage for losses caused by pollution and contamination. For instance, the pollution exclusion was developed to exclude coverage for the release of many different types of substances— from asbestos to pesticides—that could cause harm to people and the environment. Representatives of some of the insurers we interviewed believed that their pollution and contamination exclusions also might allow property/casualty insurers to exclude losses caused by biological and chemical agents released by a terrorist. However, representatives of one insurance broker we interviewed suggested that pollution and contamination exclusions could be challenged in the courts if a biological or chemical event were to occur. Courts determine whether a particular substance is or is not a pollutant based upon, among other things, the language in the policy, the facts and circumstances of the case, and the law of the jurisdiction. As a result, the language of the standard pollution exclusion might be susceptible to broad interpretation by the courts. In other words, some uncertainty exists, even in the insurance industry, about how effectively the pollution and contamination exclusions would protect insurers against losses from a NBCR terrorist attack. In addition to disputes over the exclusion of NBCR risks in policies, there are other situations where the extent of property/casualty insurers’ coverage of such events could depend on judicial or other determinations. Cause of loss. According to standard nuclear exclusions, commercial policies would not cover damage caused by a nuclear blast. However, regardless of any exclusions, according to information provided by NAIC, approximately 16 states (including New York) require property/casualty insurers to cover losses from a “fire following” an event, irrespective of the cause of fire. A national security expert told us that in the case of a nuclear bomb detonation, once the property was destroyed, insurers could dispute the extent to which fire (covered in fire following states) or the blast (excluded by the nuclear exclusion) caused the damage. In other contexts, disputes over the cause of loss often have been litigated. For example, many homeowners who suffered losses in Hurricane Katrina have filed lawsuits challenging property/casualty insurers’ determinations about the cause of their losses. Certified as a terrorist act. The Congressional Budget Office (CBO) has suggested that some NBCR events might not be readily identified as terrorist acts, as defined by TRIA, and therefore coverage—both for insurers and for their policyholders—would be unclear. For example, the persons or person who in 2001 mailed letters contaminated with anthrax that killed several people and sickened many more remain(s) unknown. However, should TRIA not be renewed in 2007, this particular determination would not apply. In addition, homeowners’ insurers, part of the personal property/casualty market, have long-standing exclusions in their policies, similar to the exclusions contained in commercial property/casualty policies. According to representatives of two large homeowners’ insurers, the exclusions limited their exposure to NBCR risks. While these representatives also told us they have not excluded conventional terrorist events from their policies, they said their companies generally manage their exposure to any terrorism risks by diversifying their portfolios. The 2005 Treasury study reported that less than 3 percent of policyholders from a range of industries reported purchasing NBCR coverage in their commercial property/casualty insurance policies. Further, although purchase rates for NBCR insurance do not necessarily reflect overall demand, a major reason for not purchasing NBCR insurance given by the survey respondents was that they did not believe they were at risk for an NBCR event. While the Treasury study did not break down purchase rates for NBCR insurance by industry sector, another study of the market for terrorism insurance conducted by insurance brokers found that companies in the real estate, financial, and health care sectors had the highest rates for purchasing terrorism insurance. Although the brokerage firm study does not specifically address the demand for NBCR insurance, we consider demand for terrorism insurance generally to be a reasonable approximation of where demand for NBCR insurance might exist. For instance, demand for terrorism insurance may be strong in the real estate sector because terrorism coverage typically is required as part of a commercial business loan transaction, according to the Mortgage Bankers Association. However, representatives of the Mortgage Bankers Association also said lenders generally do not require NBCR coverage, because little or no coverage is available. In addition, a few of the academic experts we interviewed suggested that some individuals and businesses might not purchase NBCR coverage under the assumption that the federal government would cover losses from an NBCR attack, as the government agreed to do for some personal and commercial property losses resulting from Hurricane Katrina. However, several risk managers we interviewed from the hospitality and transportation industries, as well as commercial property owners, all reported a willingness to buy NBCR coverage in the private market. These managers expressed frustration at not being able to purchase insurance for NBCR risks, which they said they could do little to prevent or mitigate, particularly because an NBCR attack would be an intentional act. One of the risk managers that we interviewed noted that his company could not find enough NBCR coverage for even one building, so the company used a captive to self-insure against NBCR risks. Should an NBCR event occur, workers’ compensation, life, and health insurers would be responsible for covering loss of life and medical treatment for injuries because they generally provide coverage for these events. Following September 11, NAIC issued guidance stating its member state regulators believed terrorism exclusions were “not necessary” or were “inappropriate” for workers’ compensation, life, and health insurance policies, with exceptions limited to cases where insurers could demonstrate they would become insolvent from offering the coverage. According to an NAIC representative, regulators did not perceive exclusions as necessary because they presumed these insurers were diversifying their risks in these lines by insuring individuals across the country. Workers’ compensation insurers must cover losses from NBCR events that occur at the workplace, including related illnesses and injuries. According to multiple sources, applicable state laws generally require workers’ compensation insurers to cover nearly all perils, including those from NBCR risks. In addition, according to representatives of the National Council on Compensation Insurance (NCCI), an organization that prepares insurance rate (price) recommendations for workers’ compensation, under state workers’ compensation laws, employers are responsible for covering unlimited medical costs and a portion of lost earnings for injuries or illnesses that occur during the course of employment, regardless of the cause. While workers’ compensation insurers generally are not permitted to exclude any perils from coverage, insurer representatives advised us that any surcharges they may be permitted to charge for NBCR exposure likely would not cover potential losses. According to NCCI representatives, recognizing that workers’ compensation insurers have exposure to terrorism losses, at least 36 states, including the District of Columbia, have allowed workers’ compensation insurers to file rates that include an additional surcharge (an average of 2 cents per $100 of employee payroll) for terrorism risk. NCCI developed this statewide surcharge based on the results of a model, as a way for insurers that underwrite in states that belong to NCCI to cover potential losses from terrorism, including those from NBCR weapons. While representatives of NCCI were reasonably satisfied that the surcharges were actuarially sound, in the District of Columbia—where insurers may file the NCCI-developed terrorism surcharge—regulators did not believe that the surcharge was actuarially sound because of assumptions made in the model about localities designated to be at higher risk for terrorist events. Moreover, the willingness of state regulators that do not participate in NCCI to approve terrorism surcharges in workers’ compensation may vary. For example, we obtained information from two large states that do not participate in NCCI and have geographic areas considered at higher risk for terrorism— New York and California. In New York, regulators have allowed workers’ compensation insurers to file an additional surcharge for terrorism. However, representatives of the New York Compensation Insurance Rating Board (Rating Board) told us that the terrorism surcharge the Rating Board developed does not distinguish between conventional and NBCR risks. They did not believe that the Rating Board could justify a higher surcharge to cover NBCR risks because of the limited historical data on NBCR attacks and further, if the Rating Board did, the cost would be so high that businesses would probably find it unaffordable. In contrast, California regulators have not permitted insurers to file rates with additional surcharges specifically for terrorism, including NBCR risks. California regulatory officials told us that they would reject any terrorist or NBCR risk surcharges because they thought such rate justifications were not based on recognized actuarial methods. Representatives of workers’ compensation insurers we interviewed said that factors unique to workers’ compensation also made it difficult for them to cover NBCR risks. First, as they explained, unlike some other lines of insurance, workers’ compensation insurance covers losses beyond the expiration date of the policy. The representatives told us their most expensive claims typically came from workers who were disabled from illness or injury because they were entitled to lost wages as well as medical expenses. For NBCR events, quantifying medical expenses could be especially challenging because some illnesses or disabilities might not manifest until much later or could be difficult to trace to a workplace occurrence. For example, representatives of workers’ compensation insurers told us that in the case of smallpox, it might be difficult to determine whether the worker contracted the illness at work or elsewhere. In addition, these representatives told us that they may be further constrained in their ability to adjust their price for specific geographic risks. Representatives of NCCI told us that terrorism surcharges must be applied equally throughout a state, thus the terrorism surcharge did not reflect that employers in certain areas, such as urban areas where employees might be more concentrated, had a greater exposure to terrorist events. Despite the exposure of workers’ compensation insurers to NBCR risks, representatives of private market insurers and two public insurance funds told us that the availability of private reinsurance for these risks was limited. Therefore, they explained that they largely would rely on TRIA to cover NBCR risks. As representatives of the private insurers explained, many of their private-market reinsurance policies specifically excluded NBCR risks, or to the extent coverage was available, reinsurers offered it at prices they could not afford. Representatives of the New York State Insurance Fund told us that they had not purchased reinsurance because they viewed the high costs of reinsurance for their market as unaffordable. As a result, should a large NBCR attack occur, these representatives said that their fund might have to turn to the state to help pay claims. In contrast, representatives of the California State Compensation Insurance Fund said that they were willing to pay higher prices based on available capacity for reinsurance for NBCR risks. The American Council of Life Insurers officials, as well as representatives of life insurers we interviewed, told us they believed that most states do not allow for terrorism or NBCR exclusions in life insurance policies. In two of the states specifically included in our review—New York and California—state insurance law and implementing regulatory policy prohibited both individual and group life insurance policies from excluding NBCR or other terrorism events. On the other hand, regulatory officials from the third jurisdiction we included in our review, the District of Columbia, told us that they did not have any legal requirements that life insurers cover NBCR events and that several group life insurers recently filed policies with exclusions for NBCR risks. While group life insurers have exposure to NBCR risks, representatives of group life insurers that provide coverage nationwide told us that charging higher rates to insureds at potentially greater risk for an NBCR event would be difficult. This is because of the way the insurers typically price coverage and their inability to determine which employers would be at greater risk for an NBCR event. Life insurers price their products based on mortality tables derived from experience with prior insurance contracts and calibrated for the effects of certain individual characteristics such as a smoking habit, or group characteristics such as occupation type. However, representatives of life insurers said that these tables do not take into account a greater number of deaths that could occur as a result of a terrorist or NBCR act. Furthermore, these representatives told us that they have difficulty determining whether a particular employer or group would be more or less at risk for death from an NBCR event because they traditionally have not tracked the geographic locations of individuals covered by their policies. However, whether losses from a large NBCR attack would be catastrophic for life insurers was unclear and could depend on the extent to which their portfolios were diversified. Representatives of national life insurers told us that they have a broad portfolio of exposure nationwide, which helps them diversify their risks. In the event of a large NBCR attack in which up to one million insured people died, representatives of the American Council of Life Insurers told us that most large life insurers probably would be able to pay the death claims. However, these representatives also said that small or medium-size group life insurers that received a significantly high number of death claims following an NBCR attack might be unable to pay claims and become insolvent, and that state guarantee funds would have to levy an assessment on the remaining insurers in the states to pay the claims. Notwithstanding their belief that they could survive an NBCR attack, representatives of the two national insurers we interviewed were concerned about the companies’ exposure to catastrophic NBCR losses. These representatives particularly were concerned because their companies generally insure all the employees of a given company. These employees could be concentrated in one geographic location, and the insurance companies could be liable for huge losses if an NBCR event led to widespread casualties in one area. In addition, life insurers do not have access to TRIA. Representatives of two group life insurers we interviewed said that their companies either had not found reinsurance for NBCR risks or the costs were very high relative to the amount of insurance that could be purchased. We also spoke with representatives of a large group life reinsurer who said their company provided some coverage for NBCR events, although the company limited this exposure to $100 million per event. Although many health insurers cover groups of individuals concentrated geographically, representatives of AHIP and two national group health insurers told us that determining overall exposure to NBCR risks was challenging. Further, they explained that state regulation of NBCR coverage was not the primary reason they covered terrorism risks, and AHIP could not provide us documentation of regulatory requirements for NBCR coverage. Nevertheless, insurance regulatory officials from two states with localities at higher exposure to terrorism risks—California and New York—told us they have not allowed health insurance policies to exclude medical expenses related to illness or injury sustained from an NBCR event. In contrast, regulatory officials in the District of Columbia told us that they did not have any requirements that health insurers cover NBCR events. Representatives of two national group health insurers we interviewed described the difficulties they would have in attempting to set actuarially sound prices for health risks from NBCR terrorist events. First, representatives of health insurers said that they typically price health coverage based on experience with their insured populations and without knowing the likely impact of NBCR risks, they could not develop actuarially sound prices for such a risk. Further, the representatives explained they tend to limit policy coverage by procedure or by individual, rather than by the source of the illness. For example, a representative of one health insurer told us that while the company did develop prices for other low-frequency, high-cost claims such as liver transplants, they could only do so because of prior experiences. Second, uncertainties over the long-term health effects of NBCR attacks, such as the need for psychological counseling or cancer treatment, make it difficult for insurers either to exclude NBCR attacks from their coverage or charge additional prices for their coverage. A report from the American Academy of Actuaries, as well as representatives from AHIP, noted that harm from NBCR events could be widespread and persist for years, and in the years subsequent to the attack, it would be difficult to identify the source of the illness. According to representatives of one insurer, this also would make direct attribution of an expense to an NBCR attack difficult. Further, these representatives said that the ultimate costs of medical treatment would be unknown, as some factors such as whether hospitals would remain open and sufficient vaccines would be available, were controlled by local public health responders. Finally, similar to life insurance, representatives of one health insurer told us they often lack information about the specific geographic locations of their insured populations, further limiting their ability to conduct risk-based pricing for events such as NBCR attacks. Representatives of the health insurance industry told us private reinsurance for their coverage of catastrophic events generally was very limited. AHIP representatives told us that catastrophic reinsurance for health insurers was in short supply, expensive, and generally focused on covering large costs incurred by individuals, rather than large costs incurred by groups of individuals potentially exposed to the same risks. Representatives from health insurers also said that reinsurance was costly, but they had not specifically sought out coverage for NBCR risks. As is the case for life insurers, health insurers do not have access to TRIA. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Ranking Minority Member of the House Financial Services Committee, other interested members of Congress, and NAIC. We also will make copies available to others upon request. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions on this report, please contact me at 202-512-8678 or williamso@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. Our objectives were to discuss (1) commonly accepted principles of insurability and whether nuclear, biological, chemical, and radiological (NBCR) risks are measurable and predictable and (2) whether private insurers currently are exposed to NBCR risks and the challenges they face in pricing such risks. As part of our review, we conducted interviews in California, New Jersey, New York, Massachusetts, and Washington, D.C. We conducted our review from February 2006 through September 2006 in accordance with generally accepted government auditing standards. To identify commonly accepted principles of insurability and whether NBCR risks are measurable and predictable, we reviewed standard insurance references to identify principles that underlie insurers’ evaluations of the insurability of risks. We primarily relied upon Fundamentals of Risk and Insurance, but consulted additional references for consistency of explanation. To determine the insurability of NBCR risks, we applied these principles based on information we collected about the market for, and nature of, NBCR terrorism risks. To enhance our understanding of the market for NBCR insurance, and factors that insurers might consider when deciding whether to offer this insurance, we consulted insurance experts, including the American Academy of Actuaries, the Insurance Information Institute, and insurance experts from academia, and a crosssection of insurers representing different lines of insurance. Moreover, we obtained information about how NBCR terrorist risks are measured and predicted from three firms that specialize in modeling terrorism and other catastrophic events for insurers (modeling firms). We chose these three firms because they are among the best known in the insurance industry. Representatives of these firms provided us with and identified the types of information they incorporate into their computer models, the methods that they use to estimate the potential frequency and severity of terrorist attacks with NBCR weapons, and the reasons they believe their products are of assistance to the insurance industry. We did not evaluate the ability of the models to predict the frequency and severity of NBCR or other catastrophic risks. For additional perspective, we also obtained descriptions of the types of data available to model insured losses from natural disasters, such as hurricanes, from a modeling firm and presentations made at a catastrophe modeling conference. Finally, to obtain a broad understanding of the characteristics of NBCR weapons and the types of damage they could cause, we consulted several sources of information. We interviewed representatives from RAND, a nonprofit research organization with a focus on national security issues, and reviewed RAND publications. In addition, we interviewed representatives of the U.S. Department of Homeland Security and reviewed reports. In addition, to identify the characteristics of biological, chemical, and radiological weapons, we used information from our own reports. To assess whether insurers are exposed to NBCR events, we identified lines of insurance that could be affected in the event of an NBCR terrorist attack: life, health, workers’ compensation, commercial property/casualty, and homeowners insurance. Our information about insurer exposure in each of these lines came from multiple sources. For an overview of the market nationwide, we interviewed representatives of three of the largest commercial insurance brokers and national insurance trade organizations—the American Council of Life Insurers, representing life insurers; America’s Health Insurance Plans, representing health insurers; the Property Casualty Insurance Association of America, representing property/casualty insurers; the Reinsurance Association of America, representing reinsurance companies; and the Association of Bermuda Insurers and Reinsurers, representing off-shore specialty insurers and reinsurers. In addition, we interviewed representatives from Independent Insurance Agents and Brokers of America, an association of independent insurance agents and insurance brokers nationwide. Information from these trade associations helped provide a broader context for information we obtained from individual insurers and reinsurers and gave us some perspective on exposure for small and medium-sized insurers, insurers that we did not interview. To obtain information on specific insurers’ exposure to NBCR risks, we interviewed knowledgeable representatives of a total of 12 insurers, writing either one or several lines of insurance addressed by our study. Although the time frames of our report only permitted us to obtain information from selected insurers, we believe that these insurers were knowledgeable based on their broad exposure for their respective lines of insurance nationwide and their knowledge of markets at higher risk for terrorism. To select insurers to interview, we obtained 2004 market share data based on direct written premiums from the Insurance Information Institute and Moody’s, the most recent available data at the time of our review. Seven of the insurers we interviewed that provide coverage in the property/casualty, workers’ compensation, life, and health insurance lines held a significant portion of the insurance industry’s market share nationwide. In addition, we interviewed the state workers' compensation insurance funds for New York and California, which serve as insurers of last resort for employers that cannot find workers’ compensation coverage in the private market. Collectively, the private insurers and state funds held the following shares of the markets, by line of insurance: 16 percent of the commercial property/casualty insurance market, 34 percent of the homeowners insurance market, 38 percent of the workers’ compensation insurance market, 18 percent of the life insurance market, and 13 percent of the health insurance market. In addition, market shares for the private market insurers were among the highest in six states with localities considered by the Insurance Services Office (ISO)—a national organization that prepares insurance rate (price) recommendations and related policies for property/casualty insurers—to be at higher risk for terrorist events (including NBCR events). These insurers usually numbered among the top five insurance providers for their respective lines of insurance in these six states. Depending on the competitiveness of the state market for each insurance line, this market share generally represented anywhere from 2 to 30 percent of the local market. For commercial property/casualty insurance, we also interviewed three specialty insurers, recommended to us by insurance brokers. Specialty insurers are not regulated by state insurance departments but provide stand-alone terrorism insurance coverage that may or may not include NBCR risks. Finally, to learn more about the availability of NBCR reinsurance coverage, we interviewed representatives of three reinsurers that provide insurance for insurers in the commercial property/casualty market and the group life market, including one reinsurer that focuses its coverage on specific risks such as NBCR events. Two of the reinsurers, as measured by revenue, are among the top three reinsurers in the United States. To identify state requirements regarding NBCR coverage, we met with and received documentation from the National Association of Insurance Commissioners (NAIC) for a national regulatory perspective as well as insurance regulators in California, New York, and the District of Columbia for individual states’ regulations. We selected these states and the District of Columbia because they were among the jurisdictions that have localities considered at high risk for terrorist attacks. Representatives of NAIC were able to provide us with all of the states’ legal requirements for property/casualty insurers’ coverage of fire following events; however, NAIC did not collect information that would allow us to determine a state’s requirements for coverage of NBCR events in workers’ compensation, life, and health insurance. State regulators in California, New York, and the District of Columbia provided us with information about their requirements for NBCR coverage for life and health policies issued in their respective states. We gathered information on state workers’ compensation requirements for providing NBCR coverage and for pricing this coverage from the National Council on Compensation Insurance—representing 34 states including the District of Columbia—and from workers’ compensation rating boards and researchers in New York and California. In the time frames of our study, we could not review all of the state requirements for each of the lines of insurance included in our study. Therefore, for circumstances in which NAIC could not provide us specific state requirements, we relied on national trade associations or information provided by national insurance carriers, particularly for requirements for life and health insurance. To learn about permissible policy exclusions, we met with ISO and reviewed their standard policies (forms) for commercial property, general liability, and homeowners insurance, including terrorism endorsements. While individual insurer’s use of these forms may vary, ISO’s forms contain standard policy language. We identified language in these policies that could address issues related to NBCR events, including the nuclear hazard exclusion and the pollution exclusion. We also obtained information about factors that could affect the interpretation of ISO forms from insurers and insurance brokers. In addition, we identified examples of court cases involving disputes over language pertaining to the pollution exclusion in insurance contracts. Interviews with insurance experts and representatives of three major rating agencies provided additional perspective on insurer willingness to offer NBCR coverage. We selected insurance experts from academia based on their knowledge of insuring for catastrophes, including terrorist acts. We met with representatives of three rating agencies that provide ratings on insurers’ financial strength and abilities to meet ongoing obligations to policyholders. To learn more about supply and demand for NBCR insurance in the commercial property/casualty industry, we reviewed the U.S. Department of the Treasury’s (Treasury) 2005 “Report to Congress, Assessment: The Terrorism Risk Insurance Act of 2002” and discussed the findings with Treasury staff responsible for its contents. In this report, Treasury reports on results from a series of surveys of commercial property/casualty insurers and policyholders. One survey asked insurers whether they wrote coverage for terrorism risks and whether they wrote any policies that included coverage for any one of the NCBR risks. Another survey asked policyholders from a range of industries whether they purchased NBCR terrorism risk coverage and if not, asked them to identify the reasons. We were limited in our ability to use policyholders’ reported purchase rates for NBCR coverage as a signal for approximating overall demand because of the low response rates to these questions. Because a number of surveyed policyholders did not provide this information, there is a risk that those who did not respond differed from those who did, which could lead to bias in the survey results. To supplement Treasury’s data on demand for NBCR coverage in the commercial property/casualty insurance market, we reviewed surveys of the terrorism insurance market conducted by Marsh—a large insurance broker—in 2005 and 2006 as well as by Moody’s, a rating agency, in 2005. We also interviewed three risk managers from large companies who purchase commercial property/casualty insurance policies in the real estate, hospitality, and transportation industries, and interviewed representatives of two national associations representing a range of consumers and commercial businesses. The information from both the surveys and the interviews about the availability of NBCR coverage is limited to the specific brokerage clients and individual companies, and cannot be generalized to all policyholders in the United States. Nonresponse rates and other sources of potential error also may limit the use of data from these two surveys. Lawrence D. Cluff was the Assistant Director. In addition, Joseph A. Applebaum, Sonja J. Bensen, Katherine C. Bittinger, Carl Ramirez, Linda Rego, Barbara M. Roesmann, and Elizabeth Walat made key contributions to this report. Insurance Sector Preparedness: Insurers Appear Prepared to Recover Critical Operations Following Potential Terrorist Attacks, but Some Issues Warrant Further Review. GAO-06-85. Washington, D.C.: November 18, 2005. Catastrophe Risk: U.S. and European Approaches to Insure Natural Catastrophe and Terrorism Risks. GAO-05-199. Washington, D.C.: February 28, 2005. Terrorism Insurance: Effects of the Terrorism Risk Insurance Act of 2002. GAO-04-806T. Washington, D.C.: May 18, 2004. Terrorism Insurance: Effects of the Terrorism Risk Insurance Act of 2002. GAO-04-720T. Washington, D.C.: April 28, 2004. Terrorism Insurance: Implementation of the Terrorism Risk Insurance Act of 2002. GAO-04-307. Washington, D.C.: April 23, 2004. Catastrophe Insurance Risks: Status of Efforts to Securitize Natural Catastrophe and Terrorism Risk. GAO-03-1033. Washington, D.C.: September 24, 2003. Catastrophe Insurance Risks: The Role of Risk-Linked Securities and Factors Affecting Their Use. GAO-02-941. Washington, D.C.: September 24, 2002. Terrorism Insurance: Rising Uninsured Exposure to Attacks Heightens Potential Economic Vulnerabilities. GAO-02-472T. Washington, D.C.: February 27, 2002. Terrorism Insurance: Alternative Programs for Protecting Insurance Consumers. GAO-02-199T. Washington, D.C.: October 24, 2001. Terrorism Insurance: Alternative Programs for Protecting Insurance Consumers. GAO-02-175T. Washington, D.C.: October 24, 2001.

Summary: Terrorists using unconventional weapons, also known as nuclear, biological, chemical, or radiological (NBCR) weapons, could cause devastating losses. The Terrorism Risk Insurance Act (TRIA) of 2002, as well as the extension passed in 2005, will cover losses from a certified act of terrorism, irrespective of the weapon used, if those types of losses are included in the coverage. Because of a lack of information about the willingness of insurers to cover NBCR risks and uncertainties about the extent to which these risks can be and are being insured by private insurers across various lines of insurance, GAO was asked to study these issues. This report discusses (1) commonly accepted principles of insurability and whether NBCR risks are measurable and predictable, and (2) whether private insurers currently are exposed to NBCR risks and the challenges they face in pricing such risks. GAO collected information from and met with some of the largest insurers in each line of insurance, associations representing a broader cross section of the industry and state insurance regulators. GAO makes no recommendations in this report. Insuring NBCR risks is distinctly different from insuring other risks because of the potential for catastrophic losses, a lack of understanding or knowledge about the long-term consequences, and a lack of historical experience with NBCR attacks in the United States. Measuring and predicting NBCR risks present distinct challenges to insurers because the characteristics of the risks largely diverge from commonly accepted principles used in determining insurability. According to these common principles, when assessing insurability, the risk generally must (1) have past occurrences sufficient in number and homogeneous enough (invoking the "law of large numbers") to enable insurers to accurately predict future losses, (2) be definite and measurable in terms of dollar value, (3) occur by chance, and (4) not result in catastrophic losses for the insurer. While the condition of insurability or uninsurability is not an absolute, NBCR risks generally fail to meet most or all of these principles of an insurable risk. Indeed, insurance experts GAO interviewed said that the potential severity of NBCR risks alone could diminish the willingness of some insurers to insure NBCR risks. Although NBCR risks may not fully satisfy the principles of insurability, there are enough variations in exposure across lines of insurance that some insurers or some lines of insurance may have no willingness to offer coverage for NBCR, while others may choose to offer coverage for some or all of the risks. For example, even with TRIA, property/casualty insurers generally have attempted to limit their exposure to NBCR risks by excluding nearly all NBCR events from coverage, both for commercial property/casualty and homeowners. According to industry representatives, property/casualty insurers believe they have excluded NBCR coverage by interpreting existing exclusions in their policies to apply to NBCR risks, but some of the exclusions could be challenged in courts. Unlike property/casualty insurers, however, workers' compensation, life, and health insurers are exposed to NBCR risks and generally have not excluded them from coverage for a variety of reasons. Specifically, workers' compensation insurers generally offer NBCR coverage because many states limit the exclusion of perils for workers' compensation. Conversely, while life and health insurers may not always be required to insure NBCR risks, they generally face other challenges in segregating and excluding NBCR risks. However, representatives of workers' compensation, life, and health insurers expressed concerns that the prices they currently charge may not cover their potential exposures to NBCR risks, sometimes because of regulatory limitations, and generally because of difficulties in measuring and pricing for NBCR losses. Given the challenges faced by insurers in providing coverage for, and pricing, NBCR risks, any purely market-driven expansion of coverage is highly unlikely in the foreseeable future.