Merck & Co., Inc. v. Ace American Insurance Company

NOT FOR PUBLICATION WITHOUT THE APPROVAL OF THE APPELLATE DIVISION SUPERIOR COURT OF NEW JERSEY APPELLATE DIVISION DOCKET NO. A-1879-21 A-1882-21 MERCK & CO., INC. and INTERNATIONAL INDEMNITY LTD., Plaintiffs-Respondents, v. ACE AMERICAN INSURANCE COMPANY, ALLIANZ GLOBAL RISKS US INSURANCE APPROVED FOR PUBLICATION COMPANY, GENERAL SECURITY INDEMNITY May 1, 2023 COMPANY OF ARIZONA, APPELLATE DIVISION HOUSTON CASUALTY COMPANY, LIBERTY MUTUAL FIRE INSURANCE COMPANY, LIBERTY MUTUAL INSURANCE COMPANY, QBE INSURANCE CORPORATION, SYNDICATE NOS. 609, 1200, 1686, 1886, 1919, 1955, 2003, 4444, 4472 and 5555, and CONSORTIUM 9536 AT LLOYD'S, LONDON, WESTPORT INSURANCE CORPORATION, XL INSURANCE AMERICA, INC., ASSICURAZIONI GENERALI S.P.A., HANNOVER RÜCK SE, HELVETIA SCHWEIZERISCHE VERSICHERUNGSGESELLSCHAFT AG, and MÜNCHENER RÜCK VERSICHERUNGSGESELLSCHAFT, Defendants, and ASPEN INSURANCE UK LIMITED, HDI GLOBAL INSURANCE COMPANY, NATIONAL UNION FIRE INSURANCE COMPANY OF PITTSBURGH, P.A., SYNDICATE NO. 1183 AT LLOYD'S LONDON, ZURICH AMERICAN INSURANCE COMPANY, MAPFRE GLOBAL RISKS, COMPAÑIA INTERNACIONAL DE SEGUROS Y REASEGUROS S.A., and VIENNA INSURANCE GROUP AG, Defendants-Appellants. __________________________________ Argued February 8, 2023 - Decided May 1, 2023 Before Judges Currier, Mayer and Enright. On appeal from an interlocutory order of the Superior Court of New Jersey, Law Division, Union County, Docket No. L-2682-18. James E. Rocap, III (Steptoe & Johnson LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for appellant National Union Fire Insurance Company of Pittsburgh, PA (Walsh Pizzi O'Reilly Falanga LLP, and James E. Rocap, III, attorneys; James L. Brochin, Liza M. Walsh, James E. Rocap, III, Marc D. Haefner, and Selina M. Ellis, on the joint briefs). Philip C. Silverberg argued the cause for appellants Aspen Insurance UK Limited, HDI Global Insurance A-1879-21 2 Company, Syndicate No. 1183 at Lloyd's London, Mapfre Global Risks, Compañía Internacional de Seguros y Reaseguros SA, Vienna Insurance Group AG, and Zurich American Insurance Company (Mound Cotton Wollan & Greengrass LLP, attorneys; Philip C. Silverberg, Bruce Kaliner (Mound Cotton Wollan & Greengrass LLP) of the New York bar, admitted pro hac vice, Hilary M. Henkind (Mound Cotton Wollan & Greengrass LLP) of the New York and Massachusetts bars, admitted pro hac vice, Maegan McAdam, William D. Wilson, and Craig R. Rygiel, on the joint briefs). Mark W. Mosier (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for respondents (Dughi, Hewit & Domalewski PC and Mark W. Mosier, attorneys; Anna P. Engh (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, Mark D. Herman (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, Mark W. Mosier and Russell L. Hewit, on the brief). Laura A. Foggan (Crowell & Moring LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for amicus curiae American Property Casualty Insurance Association (Eckert Seamans Cherin & Mellott, LLC, attorneys; Robert P. Zoller and Michael A. Alberico, on the brief). Sherilyn Pastor argued the cause for amici curiae The New Jersey Hospital Association, The National Association of Manufacturers, The Pharmaceutical Research and Manufacturers of America, The Product Liability Advisory Council, Inc., and The Restaurant Law Center (McCarter & English, LLP, attorneys; Sherilyn Paster, on the brief). Genova Burns LLC, attorneys for amicus curiae New Jersey Association of Counties (Angelo J. Genova, A-1879-21 3  William F. Megna, and Lawrence Bluestone, of counsel and on the brief). Reed Smith LLP, attorneys for amicus curiae United Policyholders (Nicholas M. Insua, on the brief). Lowenstein Sandler LLP, attorneys for amicus curiae Insurance Law Scholars (Lynda A. Bennett, Andrew Reidy (Lowenstein Sandler LLP) of the District of Columbia and Massachusetts bars, admitted pro hac vice, Joseph Saka (Lowenstein Sandler LLP), of the District of Columbia, Maryland and Texas bars, admitted pro hac vice, and Rosemary Loehr (Lowenstein Sandler LLP) of the Colorado bar, admitted pro hac vice, on the brief). Greenberg Dauber Epstein & Tucker, PC, attorneys for amici curiae International Law Scholars, and Former Government Officials, Professor Chimene I. Keitner, Professor Rebecca Crootof, Professor David Sloss, and Professor Mary Ellen O'Connell (Edward J. Dauber, on the brief). The opinion of the court was delivered by CURRIER, P.J.A.D. On leave to appeal, we consider whether plaintiff Merck & Co., Inc. 1 (plaintiff or Merck) is entitled to insurance coverage under the "all risks" property insurance policies issued by defendants after a cyberattack infected and damaged thousands of plaintiff's computers in its global network. Defendants denied coverage under the "Hostile/Warlike Action" exclusion 1 Plaintiff International Indemnity Ltd. is a captive insurance company wholly owned by Merck. A-1879-21 4 included in all their policies. The trial court granted plaintiffs' summary judgment motions, finding the exclusion did not apply to plaintiffs' claims. 2 In considering the plain language of the exclusion, and the context and history of its application, we conclude the Insurers did not demonstrate the exclusion applied under the circumstances of this case, namely, that this cyberattack was a "hostile" or "warlike" action as contemplated under the exclusion. Therefore, we affirm. I. Merck is a multinational pharmaceutical company based in New Jersey. Plaintiffs instituted suit against multiple insurers and reinsurers seeking declaratory judgment that Merck was entitled to coverage under twenty-six "all risk" property policies for losses caused by a June 2017 malware/cyberattack known as NotPetya. 3 From June 1, 2017 to June 1, 2018, Merck's property insurance program included the "all risks" property policies in a three-layer structure, with $1.75 billion in total limits above a $150 million deductible. The eight Insurer's 2 Many of the defendants resolved their claims with plaintiffs during the discovery period and the pendency of the appeal. At the time of oral argument before this court, there were eight remaining defendants/appellants. We refer to appellants as "the Insurers". 3 The name NotPetya derived from the distinction of the malware from another ransomware known as "Petya." A-1879-21 5 policies insured percentages of coverage in one, two or all three of the layers. In total, the parties dispute $699,475,000 in coverage or just under forty percent of Merck's total coverage for the policy period. Each of the 2017-2018 policies included two coverage clauses and one exclusion significant to this appeal. Section 5, entitled "LOSS OR DAMAGE INSURED" states: This policy insures against all risks of physical loss or damage to property, not otherwise excluded in this policy, while at an Insured Location except as hereinafter excluded. Physical loss or damage shall include any destruction, distortion or corruption of any computer data, coding, program or software except as excluded specifically in clause 6.M., Electronic Date Recognition Exclusion, [4] and as hereinafter excluded. Section 7, entitled "COVERAGE," includes subsection C, entitled "COMPUTER SYSTEMS—NON PHYSICAL DAMAGE." It states: In addition to the coverage provided herein, this Policy covers the Actual Loss Sustained and Extra Expense incurred by the Insured during the Period of Interruption directly resulting from the failure of the Insured's Electronic Data Processing Equipment or Media to operate, provided such failure is the direct result of a malicious act directed at the NAMED INSURED. 4 Clause 6.M does not apply to Merck's NotPetya claim. A-1879-21 6  The hostile/warlike action exclusion was also included in each of the 2017-2018 policies, under Section 6, entitled "LOSS OR DAMAGE EXCLUDED." Section 6 excludes damage arising from twenty specific causes or events. Section 6 (A)(1) provides that "[t]his policy does not insure" against: Loss or damage caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack: (a) by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval, or air forces; (b) or by military, naval, or air forces; (c) or by an agent of such government, power, authority, or forces[.] A. On June 27, 2017, a malware known as NotPetya infected Merck's computer and network systems. Prior to that date, someone had gained access to the computer systems of a Ukrainian company that had developed an accounting software called M.E. Doc used by Merck and other companies in Ukraine. The NotPetya malware was delivered into the accounting software. Merck explained the malware attack in its "IT Compliance Investigation Interim Summary Report": A-1879-21 7  Merck and other companies doing business in the Ukraine use a trusted third-party application called M.E. Doc for processing and transmission of invoice, tax, and other financial data to the Ukrainian government. Based on third-party analysis, Merck understands that prior to April 14, 2017, threat actors gained access to the M.E. Doc vendor's source code and software update distribution infrastructure for the M.E. Doc system. Using this access, the threat actors built backdoors into M.E. Doc software updates that allowed for the threat actors to access customer systems using M.E. Doc software. Using these backdoors, the threat actors established a command and control infrastructure capable of sending, receiving, and executing code on the networks of companies using M.E. Doc software without detection through anti-virus or other malware detection tools or sensors. Threat actors directed malicious versions of the M.E. Doc software to existing M.E. Doc customers using the standard M.E. Doc update method. Merck received the malicious updates through its server located in Ukraine, which automatically conducts periodic checks for new versions of the M.E. Doc software for updating purposes. As a result of these compromised updates, prior to June 27, 2017, threat actors could send instructions and retrieve reconnaissance information from companies' infected systems through command-and-control capabilities. Such transmissions were disguised as legitimate, routine checks for M.E. Doc updates. According to the parties' experts, Once on a system or network, NotPetya would attempt to encrypt certain data on the system, rendering the data inaccessible and preventing most users from recovering their files, and once complete, would leave the infected system in an inoperable state. A-1879-21 8  After encrypting data on an infected system or network, NotPetya displayed a message offering to provide a decryption key to recover the data in return for payment of a ransom, presenting itself as ransomware. Victims of NotPetya paid thousands of dollars within hours . . . . NotPetya's propagation within networks was rapid and extensive and crossed many national borders. Within ninety seconds of the initial infection, approximately 10,000 machines in Merck's global network were infected by NotPetya; about 20,000 machines were infected within five minutes. Ultimately, over 40,000 machines in Merck's network were infected. Merck contends the malware "caus[ed] production facilities and critical applications to go offline and create[ed] massive disruptions to Merck's operations, including its manufacturing, research and development, and sales operations." The NotPetya malware spread to at least sixty-four different countries, including Russia. Among the companies infected by NotPetya were "a number of leading Russian companies, including Russia's largest oil producer, Rosneft; one of Russia's top lenders, Home Credit bank; and Evraz, a Russian steel manufacturing and mining company." NotPetya also infected the systems of other multinational companies. While the attack caused property damage, there was no evidence the NotPetya malware caused bodily injury or death. A-1879-21 9  B. In July 2017, Merck submitted a notice of loss to the Insurers for the NotPetya damage. The Insurers responded with a reservation of rights letter. In March 2018, the Insurers sent another reservation of rights letter, this time expressly raising the hostile/warlike action exclusion. Defendant National Union did not join in this reservation of rights letter. Merck filed its complaint on August 2, 2018. On August 20, 2018, most of the Insurers denied coverage for Merck's NotPetya-related claims based on the hostile/warlike action exclusion. The Insurers noted that Kroll Cyber Security (Kroll), their "cyber consultant," had concluded that Merck's systems were infected with NotPetya, which was "introduced into Merck through a server located in its Ukraine office that was running M.E. Doc (a tax software application used by Merck and other companies operating in Ukraine)." Kroll also concluded, "with high confidence, that the NotPetya cyber-attack was very likely orchestrated by actors working for or on behalf of the Russian Federation." 5 On the same day, National Union sent Merck a reservation of rights letter, stating that "[b]ased on Kroll's findings and the publicly avai lable 5 The parties disputed attribution for the cyberattack. The trial court did not need to reach that issue in granting partial summary judgment. A-1879-21 10 information on the NotPetya cyber-attack," National Union reserved its rights based on the "WAR AND TERRORISM EXCLUSION" in its policy. It is undisputed that this exclusion is materially identical to the hostile/warlike action exclusions contained in the other Insurers' policies. II. Between April and September 2021, following extensive discovery, the parties filed numerous motions and cross-motions for summary judgment or partial summary judgment on a variety of issues, including the applicability o f the hostile/warlike action exclusion. On December 6, 2021, the trial court granted plaintiffs' motion for partial summary judgment, finding the hostile/warlike action exclusion did not apply to exclude coverage for Merck's losses caused by NotPetya. In its written opinion, the court analyzed the applicable contract-interpretation legal principles and case law. The court concluded: Given the plain meaning of the language in the exclusion, together with the foregoing examination of the applicable caselaw, the court unhesitatingly finds that the exclusion does not apply. As [p]laintiff[s] correctly note[] in [their] brief, no court has applied a war (or hostile acts) exclusion to anything remotely close to the facts herein. The evidence suggests that the language used in these policies has been virtually the same for many years. It is also self-evident, of course, that both parties to this contract are aware that cyber attacks of various forms, sometimes from private sources and sometimes from nation-states[,] A-1879-21 11  have become more common. Despite this, Insurers did nothing to change the language of the exemption to reasonably put this insured on notice that it intended to exclude cyber attacks. Certainly they had the ability to do so. Having failed to change the policy language, Merck had every right to anticipate that the exclusion applied only to traditional forms of warfare. Given the rules of construction, Merck's position that they did not anticipate that the exclusion would be applied to acts of cyber based attacks reasonably shows that the expectation of the insured was that the exclusion applied only to traditional forms of warfare. Accordingly, the [c]ourt finds that the exclusion is not applicable under the facts presented. We granted the Insurers leave to appeal. We also granted the following groups and entities leave to appear as amicus curiae: American Property Casualty Insurance Association (American Property); New Jersey Association of Counties; United Policyholders; the New Jersey Hospital Association, the National Association of Manufacturers, the Pharmaceutical Research and Manufacturers of America, the Product Liability Advisory Council, Inc., the Restaurant Law Center (collectively the Amici Companies); Insurance Law Scholars, and individual "law professors and former government lawyers" Chimène I. Keitner, Rebecca Crootof, David L. Sloss, and Mary Ellen O'Connell (collectively, the Individual Lawyers). A-1879-21 12  III. On appeal, the Insurers assert the trial court erred in concluding the hostile/warlike exclusion did not apply to the NotPetya cyberattack. Amici American Property, the "primary national trade association for home, auto, and business insurers," agrees with the Insurers' position and contends that damage caused by any unfriendly action of any nature undertaken by a "nation-state" falls under the plain meaning of the hostile/warlike action exclusion. The other amici urge this court to uphold the trial court's ruling. The New Jersey Association of Counties is "a non-partisan organization that provides a unified and proactive voice for county governments in New Jersey." It contends that accepting the Insurers' interpretation of the hostile/warlike exclusion "would operate to change the settled meaning of war exclusions and . . . also threaten to undo the policy interpretation rules that local governments have historically relied upon" to ensure adequate insurance coverage. United Policyholders is "a dedicated advocate and information resource for individual and commercial insurance consumers throughout the entire United States." It contends the trial court "correctly interpreted the war exclusion based on its plain language" and "correctly adhered" to "established principles of New Jersey insurance law." A-1879-21 13  The Amici Companies are "associations composed of companies engaged in various businesses or industries in New Jersey and elsewhere," that "rely significantly upon insurance policies to provide coverage for their various risks and they rely on New Jersey law that protects their insurance rights." The companies urge this court to affirm the trial court's ruling because "the Insurers' proposed interpretation and application of policies' standard - form War Exclusions, if adopted, could have far-reaching, detrimental impact on the many insurance products that policyholders buy to protect themselves from risks in this and other states." Insurance Law Scholars is "a group of law professors from across the country whose area of academic focus is insurance law," giving them "a special interest and expertise in and substantial exposure to questions involving commercial property insurance policies, war-exclusion clauses, and insurance claims for cyber-related losses." It submits that the trial court's decision should be affirmed because it was "supported by the drafting history of war exclusions" and because the Insurers "failed to use readily available insurance policy provisions that would have excluded or limited the coverage provided for cyber-related events." The Individual Lawyers are "law professors and former government lawyers with expertise in international law and the laws of war, who have an A-1879-21 14 interest in the proper characterization of various types of malicious cyber activity." They argue that "[t]he terms 'war' and 'hostilities' are terms of art that have long been understood as describing the use of armed force between rival states," that "[t]he U.S. government has been careful not to broaden the legal definitions of these categories, despite the advent of various types of malicious cyber activity," and that interpreting the NotPetya attack as the Insurers urge would be inconsistent with international law. IV. We "review a grant of summary judgment de novo, applying the same standard as the trial court." Norman Int'l, Inc. v. Admiral Ins. Co., 251 N.J. 538, 549 (2022) (quoting Woytas v. Greenwood Tree Experts, Inc., 237 N.J. 501, 511 (2019)). Thus, we consider "whether the competent evidential materials presented, when viewed in the light most favorable to the non - moving party in consideration of the applicable evidentiary standard, are sufficient to permit a rational factfinder to resolve the alleged disputed issue in favor of the non-moving party." Brill v. Guardian Life Ins. Co. of Am., 142 N.J. 520, 523 (1995). Summary judgment must be granted "if the pleadings, depositions, answers to interrogatories and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact challenged A-1879-21 15 and that the moving party is entitled to a judgment or order as a matter of law." R. 4:46-2(c). "If there is no genuine issue of material fact, we must then 'decide whether the trial court correctly interpreted the law.'" DepoLink Ct. Reporting & Litig. Support Servs. v. Rochman, 430 N.J. Super. 325, 333 (App. Div. 2013) (citations omitted). A. "A court's interpretation of an insurance contract is a determination of law." Cypress Point Condo. Ass'n, Inc. v. Adria Towers, L.L.C., 441 N.J. Super. 369, 375 (App. Div. 2015), aff'd, 226 N.J. 403 (2016). "We afford no special deference to a trial court's interpretation of the law and the legal consequences that flow from the established facts." Ibid. (citing Manalapan Realty, L.P. v. Twp. Comm. of Manalapan, 140 N.J. 366, 378 (1995)). We begin our review by applying well-established contract interpretation principles. "Insurance policies are reviewed using contract principles," and "will be enforced as written when [their] terms are clear in order that the expectations of the parties will be fulfilled." Norman Int'l, 251 N.J. at 552 (quoting Mem’l Props., LLC v. Zurich Am. Ins. Co., 210 N.J. 512, 525 (2012)). Policies must be construed "as a whole and effect given to every part thereof." Herbert L. Farkas Co. v. N.Y. Fire Ins. Co., 5 N.J. 604, 610 (1950). A-1879-21 16 Terms in an insurance policy "are given their 'plain and ordinary meaning.'" Norman Int'l, 251 N.J. at 552 (quoting Mem'l Props., 210 N.J. at 525). Generally, the insured must establish whether a particular claim falls within the basic terms of the policy. IMO Indus. Inc. v. Transamerica Corp., 437 N.J. Super. 577, 624 (App. Div. 2014). Once it is shown that a claim falls within a policy's scope of coverage, the insurer bears the burden of establishing that an exclusionary provision of the policy applies. Norman Int'l, 251 N.J. at 552; see United Rental Equip. Co. v. Aetna Life & Cas. Ins. Co., 74 N.J. 92, 99 (1977) ("When an insurance carrier puts in issue its coverage of a loss under a contract of insurance by relying on an exclusionary clause, it bears a substantial burden of demonstrating that the loss falls outside the scope of coverage."). Insurance policy exclusions must be construed narrowly. Princeton Ins. Co. v. Chunmuang, 151 N.J. 80, 95 (1997). Accord Ariston Airline & Catering Supply Co. Inc. v. Forbes, 211 N.J. Super. 472, 478 (Law Div. 1986) (quoting Pan Am. World Airways, Inc. v. Aetna Cas. & Surety Co., 505 F.2d 989, 1000 (2d Cir. 1974)) (noting that "[t]he experienced all risk insurers should have expected the exclusions drafted by them to be construed narrowly against them and should have calculated their premiums accordingly"). A-1879-21 17  "On the other hand, 'clauses that extend coverage are to be viewed broadly and liberally.'" Villa v. Short, 195 N.J. 15, 24 (2008) (quoting Gibson v. Callaghan, 158 N.J. 662, 671 (1999)). In short, "[p]rinciples of insurance contract interpretation 'mandate [a] broad reading of coverage provisions, [a] narrow reading of exclusionary provisions, [the] resolution of ambiguities in the insured's favor, and [a] construction consistent with the insured's reasonable expectations.'" Hampton Med. Grp., P.A. v. Princeton Ins. Co., 366 N.J. Super. 165, 172 (App. Div. 2004) (latter four alterations in original) (quoting Search EDP, Inc. v. Am. Home Assurance Co., 267 N.J. Super. 537, 542 (App. Div. 1993)). "If there is any doubt, uncertainty or ambiguity in the phraseology of a policy, or if the phraseology is susceptible to two meanings, the construction favoring coverage must be adopted." Ibid. (quoting Aetna Ins. Co. v. Weiss, 174 N.J. Super. 292, 296 (App. Div. 1980)). "Exclusionary clauses are presumed valid if they are 'specific, plain, clear, prominent and not contrary to public policy.'" Mem'l Props., 210 N.J. at 528 (quoting Chunmuang, 151 N.J. at 95). "If the terms used in an exclusionary clause are ambiguous, 'courts apply the meaning that supports coverage rather than the one that limits it.'" Ibid. (quoting Flomerfelt v. Cardiello, 202 N.J. 432, 442 (2010)). A-1879-21 18  Where, however, the terms of an exclusion are clear and unambiguous, "a court should not engage in a strained construction to support the imposition of liability." Ibid. (quoting Flomerfelt, 202 N.J. at 442); see also Walker Rogge, Inc. v. Chelsea Title & Guar. Co., 116 N.J. 517, 529 (1989) (noting that "courts should not write for the insured a better policy of insurance than the one purchased"). As our Supreme Court has explained: [C]ourts must be careful not to disregard the "clear import and intent" of a policy's exclusion, and we do not suggest that "any far-fetched interpretation of a policy exclusion will be sufficient to create an ambiguity requiring coverage." Rather, courts must evaluate whether, utilizing a "fair interpretation" of the language, it is ambiguous. [Flomerfelt, 202 N.J. at 442 (citations omitted).] B. Against this backdrop we turn to the policy and exclusion at issue. As stated, at the time of NotPetya, Merck was insured under twenty-six "all risks" property insurance policies. We have stated that an all risk insurance policy "creates a 'special type of insurance extending to risks not usually contemplated, and recovery under the policy will generally be allowed . . ., in the absence of fraud or other intentional misconduct of the insured, unless the policy contains a specific provision expressly excluding the loss from coverage.'" Victory Peach Grp., Inc. v. Greater N.Y. Mut. Ins. Co., 310 N.J. A-1879-21 19 Super. 82, 87 (App. Div. 1998) (quoting 43 Am. Jur. 2d Insurance § 505 (1982)). Merck's claim for coverage for damages incurred as a result of NotPetya was covered under Sections 5 and 7 of the Insurers' policies unless excluded under a specific provision. The Insurers invoked the hostile/warlike action clause as that exclusion. The Insurers assert summary judgment should have been granted in their favor because the exclusion "is clear and unambiguous, and it plainly applies to the NotPetya attack." Although they concede the word "warlike" might not be applicable, they assert the word "hostile" should be read in the broad est possible sense, as meaning "adverse," "showing ill will or a desire to harm," "antagonistic," or "unfriendly." According to the Insurers, any action that "reflects ill will or a desire to harm by the actor" falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power, in this case the Russian Federation. However, the plain language of the exclusion does not support the Insurers' interpretation. The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the A-1879-21 20 policy precluded coverage for damages arising out of a government action motivated by ill will. V. Although there is no precedent considering the hostile/warlike action exclusion, our Supreme Court has consistently required the need for plain language pertinent to the situation to permit the enforcement of an exclusion. For example, in Mem'l Props., the allegations against the insureds, the owner and manager of a cemetery and crematory, were that the remains of certain bodies in their care had been unlawfully dissected and that tissue, bone, and organs had been illegally harvested and sold. 210 N.J. at 516-17. The Court addressed the question of whether an "'improper handling' exclusionary clause, barring coverage for bodily injury or property damage arising from specified acts and omissions including '[f]ailure to bury, cremate or properly dispose of a deceased body'" applied to preclude coverage for the claims. Id. at 517. The Court held that "[t]he conduct of which [the insureds] [we]re accused—participation in a common undertaking to dissect and remove body parts from the decedents without legal authorization—falls squarely within the parameters of the clause." Id. at 528. Because none of the asserted causes of action were "independent of the illegal harvesting allegations," the exclusion at A-1879-21 21 issue "plainly encompasse[d] all of the claims asserted" against the insu reds. Id. at 528-29. Similarly, in United Rental, the Court noted that the insurance policies at issue excluded "those losses occasioned by the lifting of any load which exceeded the registered lifting or supporting capacity of any machine otherwise within the scope of coverage." 74 N.J. at 95. The Court noted that proving the applicability of the exclusion was a "demanding standard," but the insurer "succeed[ed] in clearly showing that the loss fell within the terms of the exclusionary clause" with unrebutted proof and an admission by the insured that the accident injuring the plaintiff was caused by a crane in an overloaded condition. Id. at 100; see also Norman Int'l, 251 N.J. at 546, 555- 56 (broad and unambiguous language excluding any claim "in any way connected with" insured's "operations" or "activities" in designated counties in New York applied to claim for injury to Home Depot worker using blind - cutting machine supplied and maintained by insured); Villa, 195 N.J. at 26 (holding that the phrase "an insured" was not ambiguous and included all persons who could make a claim under the policy and noting courts "will not search for ambiguities where there are none"); Am. Motorists Ins. Co. v. L-C- A Sales Co., 155 N.J. 29, 41-42 (1998) (exclusion for claims "arising out of and in the course of employment" clearly and unambiguously precluded A-1879-21 22 coverage for wrongful discharge claim, which "unquestionably arose out of and in the course of [the plaintiff's] employment, as did the essential factual allegations on which the cause of action was predicated"); Abboud v. Nat'l Union Fire Ins. Co. of Pittsburgh, Pa., 450 N.J. Super. 400, 407-08 (App. Div. 2017) (finding no ambiguity in "insured vs. insured" exclusion in a directors and officers liability policy that expressly disallowed coverage for claims raised by either an executive of the company or the company itself). In each of these cases, the scope of the exclusion was clear and specific, and the conclusion that the circumstances at issue fell within that scope was evident. None of the cases held that words in an exclusion should be interpreted using the broadest dictionary definition available, as the Insurers contend. Coverage could only be excluded here if we stretched the meaning of "hostile" to its outer limit in an attempt to apply it to a cyberattack on a non- combatant firm that provided accounting software updates to various non - combatant customers, all wholly outside the context of any armed conflict or military objective. But that approach would conflict with our basic construction principles requiring a court to narrowly construe an insurance policy exclusion. The specific, plain, clear, and prominent meaning of, and the clear import and intent of, a word or phrase in an exclusion does not equate to A-1879-21 23 its broadest possible interpretation, but rather its narrowest. See Chunmuang, 151 N.J. at 95; Flomerfelt, 202 N.J. at 442; Mem'l Props., 210 N.J. at 528. We agree with the trial court that the plain language of the exclusion did not include a cyberattack on a non-military company that provided accounting software for commercial purposes to non-military consumers, regardless of whether the attack was instigated by a private actor or a "government or sovereign power." We have addressed the exclusion in terms of the presented circumstances before us. And we have found the Insurers have not satisfied their burden to show it could be fairly applied to the NotPetya cyberattack. That is the scope of our review. Therefore, we decline the Insurers' request to delineate the exact scope of what cyberattacks might be encompassed under the hostile/warlike exclusion. VI. A. We also consider the history of the war exclusion. Here, all of the experts agreed that insurance policies have included standard-form coverage exclusions known as "war exclusions" for centuries. Merck's expert stated that "[a]s early as the eighteenth century, the war exclusion was introduced by insurers in the London-based Lloyd's market to exclude 'war risks' from marine A-1879-21 24 coverage policies in response to increasing war-related risks in the shipping trade." Similar language was used in "war exclusions" appearing in policies issued in both the United States and the United Kingdom. The experts concurred that the phrase "hostile or warlike action," or similar variants, have appeared in war exclusions since the 1950s. The Insurers' representatives agreed that property policies always contain an exclusion similar to the hostile/warlike action exclusion. B. As we have stated, there is no precedent interpreting the exact language at issue here and no cases that involve a cyberattack. However, the few cases cited by the parties reinforce our conclusion that similar exclusions have never been applied outside the context of a clear war or concerted military action and they do not support the Insurers' arguments. In Diamond Shamrock Chems. Co. v. Aetna Cas. & Sur. Co., 258 N.J. Super. 167, 179, 197 (App. Div. 1992), we considered the scope of coverage and whether liability policies issued to Diamond Shamrock, one of the manufacturers of the herbicide Agent Orange, covered liability for pollution discharges in the United States caused by Diamo