- Home
- Report n°3: summary
Report n°3: Summary
Financial protection of critical infrastructure - uncertainty, insurability and terrorism risk, June 2005
The critical infrastructures at issue
The emergence of a broader spectrum of vulnerabilities (terrorism, sabotage, local conflict, natural disaster) and the growing interdependence of economic activities make large vital networks (water supply, electricity, energy, telecommunications, physical transport, emergency, health, information, banking and financial services, etc.) particularly vulnerable. And yet, these networks are the very backbone of economic and social activity in any country. Since they are increasingly interdependent and they operate on a just-in-time basis, failures can have disastrous consequences for a very large number of people and business concerns. In Europe, the debate on the protection of large-scale critical infrastructures, aside from purely technological matters, is still in its infancy. In spite of several particularly destabilizing events, optimism still reigns. In France, apart from a few notable exceptions(1), collective action adapted to the new scale of risk is limited. There is cause for concern that the situation will not improve unless there is some call for action at national level. On the other side of the Atlantic, in the United States, the matter has been at the top of the national agenda since 1996. In 1997, President Clinton set up the President's Commission on Critical Infrastructure Protection, with a substantial operating budget. With the public and private sectors working jointly, the goal was to gain more insight into the major vulnerabilities that the country might have to cope with, and to prepare for such situations(2). The movement in favor of new public-private partnerships continued and was recognized as being in the national interest(3).
In an interview with the newspaper Le Monde in 2003, I had previously made this point when I emphasized that: "September 11 only served to bolster this movement with, for example, the creation of the National Infrastructure Advisory Council (NIAC). Composed of 24 members, most of them CEOs of private companies (American Airlines, Cisco, Intel, DuPont, Pfizer...), representatives of academia and of the government, this council is an official think-tank on the security of large critical infrastructures. NIAC reports directly to the President of the United States."(4).
(1) For a collective initiative launched in partnership with 30 countries after the anthrax crisis, see Lagadec and Michel-Kerjan (to be published).
(2) The Clinton Administration's Policy on Critical Infrastructure Protection: Presidential Decision Directive 63.May 22,1998.
(3) See for example: Office of the President (2003) ;The National Academies (2002), 9/11 Commission (2004). For an analysis of the strategic issues involved in the creation and development of national public-private partnerships in the United States, see Erwann Michel-Kerjan (2003-a).
(4) Erwann Michel-Kerjan (2003), « Aux Etats-Unis, la menace terroriste reste dans tous les esprits » (In the United States, the terrorist threat is still present in everyone's thoughts), Journal Le Monde, June 13.
Financial protection
As is the case for banking and financial services, however, large-scale infrastructures are not simply major technical networks; they would be better described as the supporting structures of the economic and social continuity of a country. In this respect, one particular network has a special role to play to guarantee the continuity of a country in the grip of disaster, and that is insurance because it provides for the financial protection of victims. For that matter, this is probably a clearer point of convergence between European and American approaches for the protection of large vital networks.
In fact, in most industrialized countries, insurance is one of the principal instruments for risk management(5). Without this possibility of transferring the risk to insurance companies (they themselves transfer all or part of their exposure to reinsurance companies or to financial markets operating on an even larger scale at global level), many activities would certainly not have reached their existing level of development. The price of insurance can therefore be viewed as a good indicator of the level of risk of certain activities. For instance, it would seem fair that a young inexperienced driver should pay a higher insurance premium - other things being equal - than a motorist who has been driving his car regularly for ten years without ever having the slightest accident. In the same way, smokers or those who practice so-called high-risk sports (rock climbing for example) pay a higher life-insurance premium than other people, since their level of risk a priori is higher than average. In both cases, the principle of risk-sharing ex ante in exchange for the payment of a pre-determined premium is based on sound knowledge of the risk associated to such activities (car insurance, life insurance) for which there is a great deal of historical data regarding claims.
For many actuaries, an important limitation for the creation of an insurance market to cover a particular risk, is the non-applicability of the "law of large numbers "which guarantees that insurers can count on an almost certain level of compensation to be paid out(6). This law, in its present form as applicable to insurance, can be stated as follows: for a sequence of random variables the correlation of which is not above certain limits, the variance of the average becomes as small as is required, provided the number of variables is sufficiently large. Thus for insurance purposes, the greater the number of aggregated policies, the more it authorizes, other things being equal, a prospect of sure prediction on average(7). One of the central issues at stake in the financing of catastrophic risk is to determine a similar risk-sharing approach, but for events with extreme loss potentialities and relatively less frequency. Those are precisely the two factors which are a source of great difficulty for insurers.
To simplify, two conditions must be verified for a risk to be considered insurable. Firstly, the capacity to identify and quantify (or at least to evaluate partially) the probability of an event occurring, and the amount of associated loss incurred should it occur. The second is the capacity to establish a premium scale which is a reflection of the level of risk (thereby limiting the incidence of so-called adverse selection). If both these conditions are verified, the risk may be considered insurable. This does not, however, signify that it is a profitable activity for an insurance company, and it may well decide that it will not cover the risk. This is the case in particular if it turns out that it is impossible to establish an insurance price level for which the insurer will have sufficient demand and income to cover the costs incurred by the activity (development, marketing, collecting premiums, compensation on claims) therefore adding up to a level of profit viewed as sufficient. In such a case, insurers may prefer not to cover certain risks, certain types of individuals or firms, unless obliged to do so by law. This may seem rather obvious, but it is one of the fundamentals of insurance: the sector guarantees continuity of economic and social activity, but requires minimum profitability for those involved.
(5) Described in simple terms, insurance guarantees as a counterpart for the ex ante payment of a relatively small sum (premium), protection against substantial loss in terms of the policyholder's capacity to pay. By the transfer of all or part of his exposure to more broadly based financial structures with greater capacity for diversification (therefore less vulnerable to that risk; an insurer for instance) an agent (individual or business entity ) is relieved of a risk that he would have difficulty in coping with on his own if it ever materialized.
(6) The notion underlying this law (meaning physical law, rule) was first introduced by the works of Pascal, Bernoulli and Laplace, later by those of Poisson.
(7) This effect of large numbers is very useful but nevertheless is not strictly necessary to the act of insuring. Paul Samuelson demonstrated that risk sharing (taking on a certain proportion of a given risk for each of the parties) can be more fundamental for reducing risk than the repetition of identical and independent risks. See P. Samuelson (1963). Several recent publications discuss Samuelson's work; see for example S.A.Ross (1999) or E. Peköz (2002).
Insurance and extreme events
In this context, an analysis of large-scale risks, such as major natural disasters or mass terrorism, must be undertaken in a very special way. The economic and social development of a country or of a region depends on uninterrupted access to essential needs.
However, such catastrophic events are capable of inflicting considerable human and financial loss, with irreversible social repercussions, thus significantly curtailing the prospects of sustainable development for the afflicted sectors of activity. Furthermore, such large-scale risks, or interactions between these various categories of risk, also carry the essential attributes of collective ills, within the meaning of the economic theory of non-rivalry and non-exclusion i.e. everyone is potentially under threat, and the threat for some does not necessarily lessen the threat for others. Finally, such risks impose definite restrictions on insurers because they constitute a potential for very substantial losses which could lead to ruin, and they are highly uncertain and ambiguous (within the meaning of uncertainty and ambiguity in decision theory). For those reasons, the creation and implementation of adequate financial coverage for such events are increasingly a subject for national consideration well beyond the scope of the insurance industry alone(8). It is worth noting that the series of hurricanes which devastated the coast of Florida last August and September caused almost 25 billion dollars' worth of insured amounts, and contributed to making 2004 into the most costly year in the whole history of global insurance and reassurance.
Nevertheless, the large-scale attacks on the United States on the morning of September 11, 2001 remain to date the most costly event in the entire history of the industry. These attacks and later ones, including the events in Madrid on March 11, 2004, have served to highlight several essential issues regarding the insurability of catastrophic risk. An analysis of terrorism as part of the problem of "Protection of critical Infrastructures "shows that terrorism is now a recognized source of acute risks(9), those which are closest to the outer limit of insurability. And this is true, we believe, to an extent which no other risk raises. It therefore seemed pertinent, in the framework of the research supported by Wharton, Polytechnique and the Institut Veolia Environnement, to further analyze the issue of uncertainty and insurability through the emblematic example of large-scale terrorism.
The 2001 terrorist attacks were unprecedented in a country at peace: first of all by the number of deaths to be deplored following the collapse of the twin towers of the World Trade Center, the aircraft crashes onto the Pentagon and in Pennsylvania, and fatalities within the ranks of the emergency services, altogether more than three thousand dead.
Unprecedented also because the targets were not only public properties representing governmental power or public security (the Pentagon, airspace), but also private property destroyed by private commercial aircraft. In view of the impact of such attacks of a new kind, the act of terrorism - in a multiplicity of possible forms - has become a new source of "large-scale damage".
These events have had a very singular resonance effect and have raised a multitude of questions as regards the nature of terrorism today, the responsibility of governments to guarantee the security of their citizens, the impact of their foreign policies, inter alia. More specifically, and focusing on the subject of this report, they have also highlighted the issue of the financial liability of governments and of the private sector to guarantee compensation for victims (personal and corporate). The question of financing the consequences of such events - and therefore of ex ante risk-sharing - then emerges as a central issue, and we focus our analysis of terrorism on that aspect.
(8) Let us take note here of a crucial point. Insurance is no more than one type of financial instrument that a company can use to ensure coverage; there are others such as self-insurance, debt emission, or equity issue.(Doherty,2000).
(9) The notion of "acute risks "complements the notion of "diffuse risk ";the latter may appear effectively over a fairly long period of time, sometimes several years (pollution of air or of the soil, physical exposure to certain types of asbestos or so-called "development" risks).