    [Senate Hearing 116-121]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 116-121

          THE REAUTHORIZATION OF THE TERRORISM RISK INSURANCE PROGRAM

    =======================================================================

                                    HEARING

                                   before the

                                  COMMITTEE ON
                       BANKING,HOUSING,AND URBAN AFFAIRS
                              UNITED STATES SENATE

                         ONE HUNDRED SIXTEENTH CONGRESS

                                 FIRST SESSION

                                       ON

     EXAMINING THE STRUCTURE AND OPERATION OF THE TERRORISM RISK INSURANCE
       PROGRAM REAUTHORIZATION (TRIP), AND EXPLORING THE IMPACTS OF THE
       LEGISLATIVE CHANGES INCLUDED IN THE 2015 TRIP REAUTHORIZATION AND
              DEVELOPMENTS IN THE TERRORISM RISK INSURANCE MARKET

                                   __________

                                 JUNE 18, 2019

                                   __________

      Printed for the use of the Committee on Banking, Housing, and Urban Affairs

     [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                    Available at: https: //www.govinfo.gov /

                              ______

                 U.S. GOVERNMENT PUBLISHING OFFICE
    39-540 PDF            WASHINGTON : 2020

                COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS

                          MIKE CRAPO, Idaho, Chairman

    RICHARD C. SHELBY, Alabama           SHERROD BROWN, Ohio
    PATRICK J. TOOMEY, Pennsylvania      JACK REED, Rhode Island
    TIM SCOTT, South Carolina            ROBERT MENENDEZ, New Jersey
    BEN SASSE, Nebraska                  JON TESTER, Montana
    TOM COTTON, Arkansas                 MARK R. WARNER, Virginia
    MIKE ROUNDS, South Dakota            ELIZABETH WARREN, Massachusetts
    DAVID PERDUE, Georgia                BRIAN SCHATZ, Hawaii
    THOM TILLIS, North Carolina          CHRIS VAN HOLLEN, Maryland
    JOHN KENNEDY, Louisiana              CATHERINE CORTEZ MASTO, Nevada
    MARTHA McSALLY, Arizona              DOUG JONES, Alabama
    JERRY MORAN, Kansas                  TINA SMITH, Minnesota
    KEVIN CRAMER, North Dakota           KYRSTEN SINEMA, Arizona

                         Gregg Richard, Staff Director

                          Joe Carapiet, Chief Counsel

                    Brandon Beall, Professional Staff Member

                    Laura Swanson, Democratic Staff Director

               Corey Frayer, Democratic Professional Staff Member

                          Cameron Ricker, Chief Clerk

                          Shelvin Simmons, IT Director

                        Charles J. Moffat, Hearing Clerk

                              Jim Crowell, Editor

                                      (ii)

                                C O N T E N T S

                                  ----------

                             TUESDAY, JUNE 18, 2019

                                                                       Page

    Opening statement of Chairman Crapo..............................     1
        Prepared statement...........................................    20

    Opening statements, comments, or prepared statements of:
        Senator Brown................................................     2
            Prepared statement.......................................    21

                                   WITNESSES

    Tarique Nageer, Terrorism Placement and Advisory Leader, Marsh...     3
        Prepared statement...........................................    22
        Responses to written questions of:
            Senator Menendez.........................................    96
            Senator Warren...........................................    99
            Senator Jones............................................   104
            Senator Sinema...........................................   106
    Howard Kunreuther, Ph.D., Professor of Decision Sciences and
      Public Policy and Co-Director of the Wharton Risk Management
      and Decision Processes Center, The Wharton School, University
      of Pennsylvania................................................     5
        Prepared statement...........................................    68
        Responses to written questions of:
            Senator Menendez.........................................   109
            Senator Warren...........................................   109
            Senator Jones............................................   111
            Senator Sinema...........................................   112
    Baird Webel, Specialist in Financial Economics, Congressional
      Research Service...............................................     7
        Prepared statement...........................................    79
        Responses to written questions of:
            Senator Menendez.........................................   113
            Senator Warren...........................................   113
            Senator Jones............................................   117
            Senator Sinema...........................................   118

                  Additional Material Supplied for the Record

    Letter submitted by the Mortgage Bankers Association.............   120
    Prepared statement of the American Property Casualty Insurance
      Association (APCIA)............................................   123
    Letter submitted by the Coalition To Insure Against Terrorism
      (CIAT).........................................................   131
    Prepared statement of the National Association of Mutual
      Insurance Companies (NAMIC)....................................   133
    Prepared statement of the National Association of Professional
      Insurance Agents...............................................   146
    Prepared statement of the Reinsurance Association of America.....   148
    Prepared statement of the Independent Insurance Agents & Brokers
      of America.....................................................   150
    Letter submitted by the Wholesale & Specialty Insurance
      Association....................................................   153

                                     (iii)

          THE REAUTHORIZATION OF THE TERRORISM RISK INSURANCE PROGRAM

                                  ----------

                             TUESDAY, JUNE 18, 2019

                                           U.S. Senate,
              Committee on Banking, Housing, and Urban Affairs,
                                                        Washington, DC.
        The Committee met at 10:39 a.m. in room SD-538, Dirksen
    Senate Office Building, Hon. Michael Crapo, Chairman of the
    Committee, presiding.

                OPENING STATEMENT OF CHAIRMAN MIKE CRAPO

        Chairman Crapo. The hearing will come to order.
        Today we are joined by three witnesses who have evaluated
    and written extensively on the Terrorism Risk Insurance
    Program, including Mr. Tarique Nageer, Terrorism Placement and
    Advisory Leader with Marsh; Dr. Howard Kunreuther, the Co-
    Director of the Wharton Risk Management and Decision Processes
    Center; and Mr. Baird Webel, Specialist in Financial Economics
    with the Congressional Research Service.
        The terrorist attacks on September 11, 2001, devastated
    U.S. citizens, households, and businesses. In the wake of those
    attacks, Congress passed and the President signed into law the
    Terrorism Risk Insurance Act of 2002 to establish the Terrorism
    Risk Insurance Program, or TRIP, and to stabilize the market
    for terrorism risk insurance.
        Since then, Congress has reauthorized the program three
    different times in 2005, 2007, and 2015.
        My goal in each reauthorization was to build on existing
    data to find ways for the private insurance industry to absorb
    and cover the losses for all but the largest acts of terror,
    ones in which the Federal Government would likely be forced to
    step in were the program not there.
        Congress made several improvements to the program during
    the 2015 reauthorization. First, it increased the program
    trigger from $100 million to $200 million in increments of $20
    million each year. Second, it increased aggregate retention
    amount of $2 billion each year eventually to an amount that
    will be based on average insurer deductibles; and third, it
    decreased the coinsurance rate from 85 percent to 80 percent in
    1 percent increments each year.
        That bill garnered overwhelming bipartisan support in the
    Senate with a vote of 93 to 4.
        The Program is once again set to expire on December 31,
    2020. Well ahead of that expiration date, the Banking Committee
    has already started meeting with key stakeholders and is
    exploring whether there are additional balanced reforms to
    improve the program and reduce taxpayer exposure without having
    a material negative effect on the cost and take-up rates for
    terrorism coverage.
        In 2018, the Treasury Department issued a report on the
    program's effectiveness, which also discussed key developments
    in the marketplace for terrorism risk insurance.
        In addition to Treasury concluding in the report that the
    program has accomplished its principle goals identified in
    TRIA, Treasury also observed that private reinsurance of
    terrorism risk has significantly increased under the program,
    and there is now increased private reinsurance capacity for the
    exposures that remain wholly with the private market under
    TRIP.
        Each of today's witnesses have written extensively on the
    program's effectiveness, structure, and market developments.
        In 2018, Dr. Kunreuther coauthored a report on the program,
    which found that, overall, TRIA has worked well. It has
    stabilized a very disrupted market in the aftermath of 2001,
    making terrorism insurance widely available and affordable.
    Take-up rates among enterprises, small and large, are rather
    high, and premiums, a few percentage points of what firms pay
    for their property insurance, even though cost and take-up
    rates vary widely by size, industry, geography, and line of
    business.
        In its 2019 Terrorism Risk Insurance Report, Marsh
    discussed take-up rates as well as cost, geographic, and
    corporate trends in terrorism risk insurance in the United
    States as well as globally.
        Marsh emphasized in the report that the Federal backstop
    created by TRIA and reauthorized as TRIPRA, along with similar
    public-private mechanisms that exist in other countries,
    remains crucial to the continued stability and health of the
    property terrorism insurance market.
        Finally, the Congressional Research Service has published
    numerous reports, including one as recently as April 2019,
    providing a comprehensive overview of the program, its history,
    statutory changes in past reauthorizations, and key
    considerations for this Congress.
        During this hearing, I look forward to hearing more about
    specific considerations in evaluating the program's
    effectiveness, how the program has evolved over time, how the
    marketplace has responded to changes to the program made by
    Congress in previous reauthorizations, what additional room
    exists to further reduce taxpayer exposure, and how market
    participants may react to changes in different program levers.
        Again, I thank each of the witnesses for joining us today
    to share your perspectives and your research.
        Senator Brown.

               OPENING STATEMENT OF SENATOR SHERROD BROWN

        Senator Brown. Thank you, Mr. Chairman, for holding the
    Committee's first hearing on the reauthorization of the
    Terrorism Risk Insurance Program. It expires the end of next
    year, after the lapse at the end of 2014. We all understand we
    need to start early enough to make sure it does not happen
    again.
        TRIA is critical to keeping our economy healthy. It is not
    just a program that helps in the event of a terrorist attack.
    Businesses rely on this insurance in order to get access to
    credit, even in healthy economic times. Without Government
    assistance, the insurance market would be unable to provide
    affordable insurance to these businesses, including small
    businesses, across our country.
        While TRIA was initially designed to be temporary after 9/
    11, both parties have agreed several times since then that
    there is value in keeping it. People may hear the word
    ``terrorism'' and think this does not apply to their community,
    that only businesses in places like New York and Washington or
    big national landmarks would need to worry about insuring
    against terrorism.
        But, unfortunately, terrorism is not confined to big
    cities, and the groups perpetrating it do not only come from
    abroad. Ohio communities that have faced threats from white
    supremacist groups know all too well this is a risk we all
    contend with.
        That is why I am glad we have been able to work on it in a
    bipartisan way. We agree there are some issues that the free
    market just cannot solve on its own. This is one of them. It is
    an example of the kind of successful Government intervention
    that is only possible when we come together as a country.
        Some in Congress would prefer the United States not make
    these kind of guarantees, whether it is for worker pensions,
    whether it is for Social Security, whether it is for mortgages
    and affordable housing or for health care or food for low-
    income families, or this issue for protections against economic
    destruction after terrorist attacks. Some politicians just are
    not interested in coming together on behalf of Americans that
    live in Mansfield or Cleveland or Boise or Idaho Falls.
        I disagree and think the Terrorism Risk Insurance Program
    is emblematic of our ability to use Government to make the
    economy work better for everybody, especially during difficult
    times. As we look at other issues on this Committee, I hope we
    will remember the success of this program and our capacity to
    use Government to solve tough problems when we decide that is
    what we want to do.
        In the last bipartisan authorization of TRIA, we worked to
    strike a balance, which seems to work well. By increasing the
    program trigger to $200 million, by gradually reducing the
    Government's share in the losses, we have made the program
    efficient without decreasing access to coverage. We have an
    opportunity to make the program even stronger by creating
    certainty in the marketplace through a long-term extension of
    the program, and I emphasize long term. I hope we can work
    together to do that.
        Chairman Crapo. Thank you, Senator Brown.
        We will now proceed to our witnesses, and I will ask you to
    please give your oral remarks in the order I introduced you and
    again ask you to remember to watch that clock so that we can
    stay to your 5 minutes allocated and get to the Senators'
    questions.
        With that, Mr. Nageer.

     STATEMENT OF TARIQUE NAGEER, TERRORISM PLACEMENT AND ADVISORY
                             LEADER, MARSH

        Mr. Nageer. Good morning, Chairman Crapo, Ranking Member
    Brown, and Members of the Committee. My name is Tarique Nageer,
    and I am the Terrorism Placement Leader at Marsh. I do
    appreciate the opportunity to speak with you today about this
    topic.
        For our company, like many others, the impact of terrorism
    is deeply personal. Marsh & McLennan lost 295 colleagues and
    scores of business associates on 9/11.
        As a leading risk advisor in the insurance market, Marsh &
    McLennan has a unique perspective on the Terrorism Risk
    Insurance Program.
        Terrorism remains an evolving, expanding, and ever present
    risk, which underlies the importance of this program and
    ensuring the continued stability and health of the property and
    casualty terrorism insurance market.
        We have seen a decline in both the frequency and severity
    of terrorist incidents in the United States over the last
    several years, and there have been no certified terrorism
    losses in the United States since TRIA was originally passed in
    2002, but we cannot afford to be complacent. The Federal
    backstop created by TRIA restored insurance capacity during the
    critical post-9/11 period.
        We at Marsh strongly support its reauthorization and
    modernization, including enhancing the existing public-private
    partnership.
        Today my testimony will include four main areas. First,
    findings from the Marsh's 2019 Terrorism Risk Ins Report once
    again highlighted that terrorism risk is not only a big-
    business or big-city issue. Education entities with the most
    frequent buyers of terrorism insurance in 2018, while companies
    in hospitality, gaming, health care, life sciences, and
    nonprofits all landed in the top 10 of buyers. These
    organizations can be found anywhere, from small college towns
    to urban city centers.
        The uptake for TRIA coverage and property policies averaged
    62 percent in 2018. Clearly, a wide array of industries depend
    on the program to thrive and protect their workforce as they
    continue to purchase terrorism coverage at a high rate.
        Second, I would like to provide an overview of the current
    state of the terrorism insurance market. While there have been
    no significant insured losses in recent years and the industry
    is well capitalized, the access to terrorism insurance is still
    dependent on insurer's preference, appetite, and aggregate
    constraints. There is a strong possibility that if the Federal
    backstop ceases to exist, we could see a dominant effect of
    increased pricing across multiple insurance lines, not just
    terrorism, with a likely result of a major marketplace
    disruption.
        Third, I will speak about how TRIA plays an integral role
    in the availability and affordability of workers' compensation
    insurance. The impact of TRIA on the workers' compensation
    market makes clear that as long as the Federal backstop remains
    in place, there should be adequate capacity for workers'
    compensation terrorism coverage. Because of its State-regulated
    nature, workers' compensation policies cannot limit or exclude
    coverage for perils such as terrorism or nuclear, biological,
    chemical, or radiological, commonly known as NBCR.
        NBCR events can lead to very large human life and economic
    losses, but coverage is not typically included in reinsurance
    contracts.
        In 2014, the uncertainty around TRIA led some insurers to
    step back from insuring industries with high employee
    concentrations in certain cities. As insurers began to review
    policies extending beyond 2020, their willingness to insure
    risks in high-profile areas will likely decrease again, thus,
    leaving large populations of employees vulnerable.
        Finally, we are already seeing an impact on policies that
    extend beyond 2020, with some insurers either seemingly
    unwilling to offer terrorism coverage beyond the expiration of
    TRIPRA or increase in prices to cover the additional risks to
    their portfolios.
        Without a decision to reauthorize or extend, we expect to
    see sunset provisions on policies and higher costs as we move
    closer to December 31, 2020.
        In Marsh's view, this legislation is a model public-private
    partnership that is instrumental in maintaining a vibrant
    marketplace by allowing insurers to provide adequate limits of
    terrorism insurance to the business community at affordable
    prices. A seamless
    renewal process with a robust reauthorization will keep the
    marketplace sustainable.
        We encourage decisions to be made with a full understanding
    of the shifts and the nature of terrorism and how they can
    affect organizations and insureds alike.
        Finally, thank you again to the Committee for holding this
    hearing 18 months in advance of the program's scheduled
    expiration. Time is of the essence, and I look forward to your
    questions.
        Thank you.
        Chairman Crapo. Thank you.
        Dr. Kunreuther.

     STATEMENT OF HOWARD KUNREUTHER, Ph.D., PROFESSOR OF DECISION
                     SCIENCES AND PUBLIC POLICY AND
        CO-DIRECTOR OF THE WHARTON RISK MANAGEMENT AND DECISION
          PROCESSES CENTER, THE WHARTON SCHOOL, UNIVERSITY OF
                              PENNSYLVANIA

        Mr. Kunreuther. Chairman Crapo, Ranking Member Brown, and
    Members of the Committee, I very much appreciate the
    opportunity of testifying on the reauthorization of the
    Terrorism Risk Insurance Program. My name is Howard Kunreuther.
    I am the James G. Dinan Professor of Decision Sciences and
    Public Policy at the Wharton School, University of
    Pennsylvania, and Co-Director of the Wharton Risk Management
    and Decision Processes Center.
        The Center was founded in 1985, with a mission to examine
    alternative strategies for dealing with low-probability, high-
    consequence events, based on an understanding of the decision
    processes of individuals, firms, and public-sector agencies.
        As Chairman Crapo pointed out, we have produced several
    studies on the 2015 renewal of TRIA undertaken in consultation
    with key interested parties from the public and private sectors
    and other academic research institutions that are cited in my
    written testimony.
        Given the limited time that I have available and the
    comments that Chairman Crapo has made and Representative Brown
    as well as my colleague here, Mr. Nageer, I want to focus on
    really a following question that was alluded to by Chairman
    Crapo: What modifications to the current public-private
    partnerships should be considered in the renewal of TRIA?
        In developing these proposals, it is useful, in our
    opinion--and I will speak for a number of us at the Wharton
    Risk Center--to focus on the individual decision processes and
    our systematic biases that have been well documented by
    psychologists and behavioral economists, are discussed in our
    book ``The Ostrich Paradox: Why We Underprepare for
    Disasters,'' written with my Co-Director, Robert Meyer.
        Let me highlight five of these biases and indicate where
    they could be used and addressed with respect to the renewal of
    TRIA: first, myopia, the tendency to focus on short-time
    horizons when appraising immediate costs and the potential
    benefits of protective investments; amnesia, the tendency to
    forget too quickly the lessons of past disasters; optimism, the
    tendency to underestimate the likelihood that losses will occur
    from future hazards; simplification, the tendency to
    selectively attend to only a subset of relevant facts when
    making choices involving risk; and finally, herding, the
    tendency to base our choices on the observed actions of others
    who may not know a great deal more than we know ourselves in
    dealing with these low-probability events.
        I will focus on four areas very briefly in the remaining
    time to highlight how they may play a role.
        First, incentivizing cost-effective mitigation measures by
    firms, something that TRIA does not do today. To overcome the
    myopia bias, one could consider long-term mitigation loans, the
    way FEMA has done with respect to the flood problem, and at the
    same time have insurers offer premium discounts if the claims
    are going to be lower by firms investing in these mitigation
    measures.
        Second, Federal protection against catastrophic losses.
    Now, in our view, in my view, it is important that the Federal
    Government cover NBCR, losses from future terrorist attacks,
    given the potential catastrophic losses and recoup their
    expenditures under TRIA. Currently, it is ambiguous as to
    exactly what will happen, although they have the intent to do
    that.
        Now, the point I want to make here is Congress and the
    stakeholders should not exhibit an optimism bias or an amnesia
    bias by feeling it will not happen to the United States because
    it has not occurred to day.
        Third, behavior of insurers and Congress after a terrorist
    attack. Will premiums significantly increase and future
    coverage decrease by insurers who might exhibit the
    simplification bias and focus on worst-case scenarios rather
    than thinking about likelihood as well? What will Congress do
    if insurers significantly raise their premium so that many
    commercial firms feel they cannot afford to purchase insurance
    protection?
        On that basis, there is a suggestion that insurers consider
    a multi-year policy, a 2- or 3-year policy, so they keep this
    for more than just the 1 year and for that reason actually are
    in a position to deal with this afterwards.
        Finally, dealing with interdependencies. There are a lot of
    events, like cyber, that are interdependent and have, can cause
    potentially catastrophic losses. Treasury and the private
    insurers should integrate and interact with each other on that
    issue.
        So, in conclusion, Congress and other key stakeholders
    should examine how countries cope with terrorism risk to
    determine whether these approaches merit consideration for the
    United States.
        And on that note, let me conclude my comments here and look
    forward to a dialogue with you afterwards.
        Thank you.
        Chairman Crapo. Thank you.
        Mr. Webel.

     STATEMENT OF BAIRD WEBEL, SPECIALIST IN FINANCIAL ECONOMICS,
                     CONGRESSIONAL RESEARCH SERVICE

        Mr. Webel. Thank you.
        Mr. Chairman, Ranking Member, Members of the Committee,
    thank you for the opportunity to testify today. My name is
    Baird Webel. I am a Specialist in Financial Economics at the
    Congressional Research Service.
        As a note for members of the audience who may not be
    familiar with the CRS, we are a division of the Library of
    Congress. Our role is to provide objective, nonpartisan
    research and analysis. CRS takes no position on the
    desirability of any specific policy nor advocates for any
    specific policy outcome.
        I have been at CRS at this role since 2003, so I have seen
    the reauthorizations of TRIA since, and I would like to talk
    about three broad things that Congress has faced as we have
    done reauthorization in the past.
        The first question that it faced is, basically, is a
    Federal terrorism program needed? TRIA was passed a little more
    than a year after the terrorist attacks in September 11, 2001.
    It was passed as a specifically temporary 3-year program, and
    by temporary, I do not mean that there was an expiration date,
    just an expiration date of 2005. The statute itself in two
    places says this is a temporary program.
        As the end of previous reauthorizations have come up,
    Congress has successively seen the need to reauthorize the
    program to give the private market additional time to face the
    threat of terrorism losses, and I think a significant point in
    this is the difficulty in estimating terrorist events going
    forward and the losses from these events. The industry has been
    largely successful at rebuilding capital, but making estimates
    of future terrorism losses remains exceedingly difficult.
        What Congress has done in the TRIA reauthorizations is
    basically affect the second aspect that I would talk about,
    namely how private insurers should share in funding terrorism
    risk with the Federal Government.
        There are basically three different levers in the program
    that have been used in this sense. There is a deductible, and
    essentially, it is a two-stage deductible.
        There is a program trigger, which is an aggregate amount of
    losses that the entire industry will incur before Federal
    funding occurs.
        There is an individual insurer deductible which is set
    essentially based on the written premium for each insurer, a
    rough proximate size of its exposure to the terrorism market
    that must be cleared before Federal funding occurs.
        And then after this, after these deductibles, there is an
    insured loss share compensation, and this is essentially a
    copay. So that once you clear the deductibles, there is a
    varying amount--there has been a varying amount of the share
    that the Government will cover.
        Finally, there are terrorism loss spreading premiums. These
    are somewhat unusual in the insurance world in the sense that
    when we all purchase homeowners insurance or auto insurance, we
    pay our premiums upfront. In this case, the premiums are set to
    be after the fact, and so that depending on the exact loss
    levels, there will be a premium placed on insurance policies
    going forward to recoup the amount for the Government.
        All of these over the life of TRIA have been adjusted in
    various ways to increase the private-sector exposure to
    terrorism risk.
        And the third broad aspect that I would talk about is, What
    exactly should a Federal terrorism insurance program cover?
        Right now, TRIA basically works through the private
    insurance market. Private insurance policies that are covered
    under the lines that are specified in TRIA--the private
    insurers are required to make terrorism coverage available
    under essentially the same terms and conditions for other types
    of insurance. So if you are going to cover loss from a fire,
    for example, from an accident, the insurer has to offer
    coverage for a fire due to loss from terrorism, but the
    insureds are not required to purchase this policy.
        And the terms and conditions that apply to this are the
    same--it is the same for an accidental cause as it is for a
    terrorist cause, and this becomes particularly important in the
    realm of nuclear, chemical, biological, radiological, because
    most private insurance policies will exclude NCBR events,
    regardless of the source. So if a policy excludes a chemical
    spill from an accident from a train, it will exclude a chemical
    spill caused by a terrorist attack, and I think this is
    particularly significant because those are the terrorist
    attacks that could cause the most damage. And I am not certain
    that people realize to what degree these NCBR events would not
    be covered.
        So, with the end of the 5 minutes, I will be happy to take
    any future questions.
        Thank you.
        Chairman Crapo. Thank you, Mr. Webel, and I appreciate each
    of you. You all stayed within your 5 minutes. I appreciate
    that.
        Mr. Webel, I will start with you. It is very important to
    me that the two major objectives will be achieved. One is that
    TRIA continually benefit and stabilize the marketplace, and the
    other is that we minimize taxpayer exposure.
        What factors do you look at to indicate whether TRIA has
    been effective and to measure its potential future success in
    achieving these objectives?
        Mr. Webel. I think that the take-up rate for terrorism
    policies is really important because you can see, for example,
    in the flood insurance program that you get flood disasters
    where a lot of people have not purchased flood insurance
    policies. And it is not going to help to have an insurance-
    providing program if you do not have the people purchasing the
    policies.
        I think as well, any aspects that you can have of overall
    private reinsurance capacity, the amount of private insurance
    that it offered outside of TRIA is a really important marker of
    how well the private market is responding and developing
    capacity to deal with terrorism.
        Chairman Crapo. All right. Thank you.
        I am going to move to you--is it ``Nageer'' or ``Nagger''?
        Mr. Nageer. Nageer.
        Chairman Crapo. OK. Nageer.
        In terms of the objective of assuring that we achieve the
    best possible protection of hitting a taxpayer bailout or a
    taxpayer cost here, we need to understand how changes that we
    make to the program can have an impact on both small and large
    participants, some insurers themselves.
        So I guess the question I am asking is, Can you provide an
    indication of how smaller and larger insurers may be affected
    by changes in the coinsurance rate and the program trigger,
    respectively, based on our historical evidence?
        Mr. Nageer. Thank you for the question, Chairman Crapo.
        As you know that in your original opening statement, there
    have been a few levers that have been adjusted during the
    course of the lifecycle of TRIPRA currently, and the insurers
    with adequate notice have been able to adjust to these
    incremental changes, either to the increased trigger levels or
    the increased coinsurance between a loss being shared between
    the Government as well as the private marketplace.
        So in terms of having the ability and the capacity in the
    marketplace to be able to respond and take up increases in
    these different levers, the capacity does exist because there
    is adequate capital within the insurance and reinsurance market
    base for these types of incremental changes, but I stress the
    word ``incremental,'' and I stress the word also with some good
    notice as well. So you have got to give them some time to sort
    of prep for these changes and make it incremental so they can
    adjust their buying of reinsurance for example, or being able
    to plan ahead and structure their--the book of business that
    they underwrite properly.
        In terms of policyholders and insurers, who could be
    impacted by this, the very large insurers, one of the triggers
    under TRIPRA is the 20 percent insurer deductible, and how that
    works is 20 percent of the insurer's prior year's direct TRIPRA
    premium is retained by them for any one loss, before the
    Government co-shares the risk, the loss with them.
        So for the very larger insurers, 20 percent is a big
    number, but my colleagues at Guy Carpenter have measured the
    policyholder surplus of insurers with less than $500 million of
    policyholder surplus, which is basically reserves. And there
    are about 662 insurers who fall within that category.
        And a subset of that 662 is about 240 insurers who fall
    between the $100 million and $500 million of policyholder
    surplus, and those are the insurers who could be more directly
    impacted negatively with abrupt increases in the trigger
    levels. And the trigger in 2020 is going to be $200 million. So
    if you increased that gradually over time, yes, they could
    adjust for that, but that bucket of insurers within that $1 to
    $500 million policyholder surplus range are the ones who will
    be more impacted.
        Chairman Crapo. All right. Thank you.
        Dr. Kunreuther, you in your testimony, I think, endorsed a
    notion of incentivizing mitigation, something which you
    indicated is not currently in TRIA; is that correct?
        Mr. Kunreuther. That is correct.
        Chairman Crapo. Could you describe that in a little more
    detail what you are talking about there?
        Mr. Kunreuther. I would be happy to.
        I think the reason that I think mitigation is not included,
    number one, is it is always a challenge to get measures, but I
    think there is work that has been done.
        I will highlight just at least the fact that Pool Re in the
    United Kingdom have actually had a number of ideas in terms and
    thoughts that they are working closely with the U.K. government
    to incentivize firms to actually invest in mitigation.
        The basic idea in terms of what we are proposing here is
    that if you can spread the cost of the mitigation measure over
    time, you will have a much better chance of getting a
    successful investment in these measures because of the fact
    that people will not say--firms will not say or consumers will
    not say, which is the case certainly in the flood area, that
    ``This is too costly for us. It is going to affect our bottom
    line tomorrow.''
        And when you have the opportunity of actually spreading
    this with loans that could be made--and that has been done by
    FEMA, Federal Emergency Management Agency, for flood--it could
    be done by banks and financial institutions, but it could be
    also done by Treasury or by a Government agency to encourage
    those investments. You then have the opportunity of actually
    making this attractive in the short run because insurers
    hopefully would then--actually reduce their premiums because
    the claims that they are going to have to face would be lower
    than they would be before, and the actual premium reduction
    would be greater than the cost of the loan each year. So it
    would be viewed attractive financially for firms to want to do
    that, and this has been shown with consumers in investing in
    mitigation measures against natural hazards that they will want
    to do that.
        And that is the reason why we are suggesting it, to
    overcome a myopia bias.
        Chairman Crapo. All right. Well, thank you. That is very
    interesting. I appreciate that.
        Senator Brown.
        Senator Brown. Thank you, Mr. Chairman.
        Mr. Webel, I would like to start with you. Since the last
    reauthorization, there have been a number of tragic white
    supremacist attacks on synagogues and other places of worship
    in California, Florida, Minnesota, New York, Pennsylvania,
    South Carolina, and Texas. No amount, of course, of insurance
    money can make up for the lives lost and families torn apart.
        Recently, the Jewish Federation of Cleveland has raised an
    issue about protecting thousands of people whom they serve each
    week. As religiously affiliated nonprofit organizations try to
    take action to protect their communities, they often find that
    insurance for these kinds of threats is hard to come by and
    very, very expensive. TRIA was implemented to make sure this
    kind of insurance was available.
        My question is this: Do you think this situation, safety at
    houses of worship and other religious institutions, which we
    have been the target of threats and attacks, that that is the
    kind of problem TRIA was designed to address?
        Mr. Webel. TRIA is designed to address terrorism, and it is
    a broad swath. It does not specify.
        In one of the previous reauthorizations, they removed the
    requirement for it to be a foreign act of terrorism. So it does
    not make any distinction between the different types of
    terrorism. It just is terrorism as certified by the Secretary
    of the Treasury.
        Senator Brown. If insurance is available but priced so high
    that it is unaffordable, does that meet the spirit of Congress'
    intent?
        Mr. Webel. The law is basically silent on that. It has a
    ``make available'' provision, but it does not include
    specifications on what that premium is supposed to cost.
        Senator Brown. Is not it sort of intuitive that if you
    cannot afford it, you really do not have access to it?
        Mr. Webel. This is certainly an issue, and basically,
    implicitly what the law provides is there are specifications in
    State insurance law that premiums are not supposed to be
    excessive and so essentially above the cost of the risk.
        So the TRIA essentially defaults to the State regulation of
    insurance. It does not do it directly from the Federal level.
        Senator Brown. So if congressional intent is all terrorism,
    as you suggest, and it is not affordable because State
    regulators have not given the priority to make it accessible
    and affordable, then perhaps it is our obligation on this
    Committee and in the House and Senate to pressure our State
    regulators to make it affordable?
        Mr. Webel. That would be the lever that TRIA provides, yes,
    essentially.
        Senator Brown. Treasury used its discretion under the law
    to issue guidance clarifying TRIA's applicability to cyber-
    related risk. Do you think Treasury has the authority to make
    sure religious-affiliated institutions have real access to the
    Terrorism Risk Insurance Program?
        Mr. Webel. I do not see under the statute, as currently
    designed, where Treasury would have a direct lever to do that.
        Senator Brown. Should it?
        Mr. Webel. That is up to Congress.
        Senator Brown. Mr. Nageer, let me go through. Do you want
    to respond to that?
        Mr. Nageer. If I could, if you do not mind. So, just to
    add, the terrorism marketplace as we see it is quite
    competitive. There are lots of insurers, both on the property
    side, casualty side, and the terrorism side who have capacity
    to offer terrorism insurance for all ranges of motives, be it
    what you were just describing or what is conventionally known
    as acts of terrorism. So there is enough capacity within the
    marketplace, and I think to be able to--and TRIA served--in its
    initial creation of TRIA served to help create that vibrant
    marketplace.
        Senator Brown. Well, there is competition in the healthcare
    marketplace too, but to argue that it is always accessible----
        Mr. Nageer. Right.
        Senator Brown.----is another question. OK. Thank you for
    that.
        Let me ask the three of you and start with you, Mr. Nageer.
    I have a couple questions. As we look to move on a
    reauthorization bill, should we make the extension for a longer
    period, and how long should it actually be, Mr. Nageer?
        If each of you would give me a brief answer on that.
        Mr. Nageer. The last reauthorization was for 5 years.
    Before that, it was for 7 years. The 7 years worked quite well.
    So I think anywhere between 7 to 10 years would be a good
    outcome. It would allow the marketplace to adapt and grow,
    build capital, and be able to take on more of a trigger or a
    coinsurance mechanism, however you want to----
        Senator Brown. I like the way you negotiate. You say the
    last was 5, the one before was 7.
        Mr. Nageer. Correct.
        Senator Brown. So we should make it 7 to 10. I like that.
        Yes, go ahead. Your answer too. Do you want to answer too?
        Mr. Kunreuther. I would be happy to.
        I think a longer period is always desirable, but I think
    there are tradeoffs in doing that because when you have a
    longer period, the question is, are there going to be changes
    or things that would require one to review this and whatnot? So
    to the extent that there are opportunities at least to have
    studies done that would enable one to somehow say on the basis
    of possible changes, one would want to deal with this in a
    different way, I think cyber is a very good example of that, by
    the way, because there are some real challenges as to how one
    is going to deal with cyber. And that would not have been
    necessarily true 5 or 10 years ago.
        So I think I would favor, in general, a longer period of
    time. How long, I think is something that Congress and the
    stakeholders would have to discuss, because it gives people and
    gives firms the opportunity to plan more extensively than
    knowing that somehow things might be changed. And so I would
    move in that direction.
        There is a saying--and I think TRIA exhibits it in a very
    good way--that nothing is more permanent than the temporary,
    and so, in some sense, what was viewed as a temporary has
    become more permanent for very good reason. So that is one of
    the reasons why we support the renewal very strongly.
        Senator Brown. Thank you, Mr. Kunreuther.
        Mr. Webel?
        Mr. Webel. We obviously do not have a position on the
    length.
        I do think purely from the private-sector perspective,
    insurers certainly would be able to deal better with things the
    longer that it is, but I do think there is a very legitimate
    public policy perspective that Dr. Kunreuther said of taking a
    look at things more often to make sure that it is working.
        Senator Brown. Thank you.
        Chairman Crapo. Senator Tillis.
        Senator Tillis. Thank you, Mr. Chairman.
        Gentlemen, thank you for being here.
        Mr. Webel, I will not ask you this question because I know
    the answer. It has to do with supporting the reauthorization.
    Both of you all feel like we should reauthorize it, although,
    Professor Kunreuther, you have made some comments that I wanted
    to drill down on, and it really has to do--and I think, Mr.
    Nageer, you commented that the losses have been relatively low.
        So how instructive are the current incidences to any sort
    of downward trend on risk premiums right now? I mean, are we
    seeing a downward trend based on the losses, or how do they
    project out actuarially and determine how much they actually
    have to collect to provide insurance at a reasonable price?
        Mr. Nageer. In terms of the marketplace, yes, it is a bit
    of a downward trend for this because the insurers, like I said,
    have all capitalized, and they have not had to pay major claims
    recently, right?
        Senator Tillis. Yeah.
        Dr. Kunreuther, if we were going to look at--first, I do
    not believe we should have a permanent reauthorization because
    I do believe the world changes. The nature of the threats
    change, and it is Congress' role to update and reauthorize
    these programs.
        I do think that we should have a discussion about what a
    reasonable planning horizon is so that we can optimize the
    products that the private sector can offer.
        But if you take a look at the recoupment, the current
    recoupment policies, really the pyramid of how this program
    comes together, do you have any insights into specific areas
    that we should look at for any sort of modernization or
    reforms?
        Mr. Kunreuther. Thank you for the question, Senator Tillis.
        I think that one of the challenges with respect to
    terrorism and events that are very, very hard to estimate the
    risk is that when you have a recoupment, you are not pushing
    for a premium to be set on these very catastrophic losses that
    the Government would cover. And I think there are some real
    advantages to that in the sense that you are then saying you
    will have to pay it back with 140 percent in this particular
    case. So I would favor that aspect of it.
        I think a real interesting question that needs to be put on
    the table as a part of the discussion is, What kind of risk
    transfer mechanisms are available in the form of reinsurance
    and catastrophe bonds, which are being used in other cases?
        Senator Tillis. That was going to be my next question.
        Mr. Kunreuther. Oh, OK.
        Senator Tillis. No, that is a good one. Keep going.
        Mr. Kunreuther. And how can that play an important role in
    providing the kind of protection that firms would actually want
    to have, that insurers would want to have in terms of knowing
    that they can cover it, and the Government might want to have?
        I think Pool Re, as I mentioned earlier, in the United
    Kingdom has marketed a cat bond in order to be able to support
    very unusual losses that they might suffer in the United
    Kingdom, and that could be possibly considered by the Federal
    Government as well. And I think on that level, you could have a
    combination of the recoupment as well as these other forms of
    risk transfer, including private reinsurance.
        Senator Tillis. One of the questions, you brought up the
    point of mitigation, which has really been a thorn in my side
    on flood insurance program because we always talk about it, and
    we never do anything about it----
        Mr. Kunreuther. Challenge.
        Senator Tillis.----in terms of investing and for a lot of
    reasons, cost being one of them.
        But when you take a look at the nature of the threat,
    really the nature of the threat as it exists today versus 10
    years ago, it would seem like there is only so much that we
    could do with respect to mitigation. Can you enlighten me on
    some of the concepts that are being discussed now?
        Mr. Kunreuther. I think that is an excellent point in terms
    of saying that this is a real challenge with terrorism and on a
    couple of levels. That might not be the case with flood, where
    you can mitigate. You can elevate a structure.
        Senator Tillis. You know when the water is going to rise,
    and you can model that.
        Mr. Kunreuther. Right.
        Senator Tillis. But you cannot necessarily model the next
    attempt to take down a building.
        Mr. Kunreuther. I am not an expert at the moment but want
    to be more of an expert in the future. And I can comment that
    in the context of the United Kingdom, there are some
    suggestions for mitigation that they are now pursuing with the
    government, concrete structures, other ways to actually make
    these structures safer against terrorist attacks. And they are
    going to be working with insurers as well as with the
    government to try to deal with it.
        I think one of the reasons that this is so important is
    because we all want to reduce these losses, and to the extent
    that you can do that, I think it might help.
        Senator Tillis. Well, I think that the more we become
    hardened, the fewer targets a terrorist would have. So I think
    it has a public safety benefit as well. It maybe takes out an
    entire tranche of either domestic or foreign terrorist. So, to
    me, it is a very interesting discussion to have as we move
    forward through the reauthorization to see if there is
    something as a matter of public policy that we should incent
    State, local, and private-sector entities to invest in, because
    at the end of the day, I think it could also reduce the Federal
    Government's downside risk.
        Mr. Kunreuther. If I can make just one very quick point, it
    does also address the affordability issue.
        Senator Tillis. Yeah.
        Mr. Kunreuther. If you then can have mitigation in place,
    premiums could come down, and some of the comments that were
    raised earlier could----
        Senator Tillis. And ultimately the cost of the mitigation
    itself----
        Mr. Kunreuther. Yeah.
        Senator Tillis.----when you have a higher demand for it.
        Thank you, Mr. Chair, and I look forward to us moving
    forward and getting the plan maybe modernized, but certainly
    reauthorized.
        Mr. Nageer. Senator, if I could add something else to
    Howard.
        So, as we move from these hardened target, you get more
    better protected against those targets. Softer targets appear,
    and what we have been seeing is the act of terrorism impacts
    not only major cities, but it is also spread across the rest of
    the country, smaller cities, more softer targets, where a
    perpetrator can actually get in and do some serious damage
    because they cannot get into these hardened targets.
        The interest of terrorism, we see it as being a nationwide
    hard, soft, small-city, big-city issue well across the country.
        Senator Tillis. Thank you.
        Chairman Crapo. Thank you.
        Senator Menendez.
        Senator Menendez. Thank you, Mr. Chairman.
        As a general matter, insurance markets in our country are
    private, and it is unusual to have any kind of Federal
    backstop, unless we have a public interest or a breakdown in
    the private market where a Government role is needed to restore
    functionality.
        In the case of Terrorism Risk Insurance, in my view, we
    have both. If terrorists attack our Country, the United States
    has a national interest in minimizing the economic harm they
    inflict, and in terms of market functionality, private actors
    are inherently limited in the things they can do to evaluate
    and reduce their risk in this regard.
        Insurance companies, for example, should not start their
    own intelligence agencies to improve their predictive models,
    and commercial real estate owners should not conduct
    counterterrorism operations to lower their premiums.
        So I would like to ask our witnesses, if you can, to
    elaborate on what makes terrorism different from other risks
    and why a Federal backstop is, in fact, needed.
        Mr. Kunreuther. I will be happy to start, and my colleagues
    will chime in.
        I think one of the real challenges with terrorism is that
    it is so very difficult to estimate what the likelihood of a
    terrorist attack will be in the future. We have been very
    fortunate not to have had anything since 9/11, but the fact of
    the matter is that prior to 9/11, the insurers were not worried
    about this, and after 9/11, they became very worried, as we all
    know. And that is one of the reasons why TRIA got passed, and I
    think it was very important that it did get passed for the
    reasons you were mentioning, Representative Menendez. So I
    appreciate your question.
        I think the fact that catastrophic losses and the potential
    for catastrophic losses will discover any private insurer from
    actually offering coverage, and TRIA does precisely that. It
    has the backstop of actually providing the protection, with a
    recoupment that I think is appropriate afterwards, for dealing
    with these large losses.
        And then the insurers have now found, as Tarique has
    indicated with respect to his comments on the Marsh report,
    that there are really a number of firms that are now willing to
    buy coverage and all insurers are forced to offer it.
        So I think this kind of partnership is the appropriate way.
    There are changes that we can discuss.
        Senator Menendez. The one thing about terrorism, as someone
    who offered all of the 9/11 Commission's recommendations into
    law when I was in the House of Representatives, is that we do
    not know what the next form of terrorism is going to be or its
    magnitude.
        We never thought that an airplane, something used for
    civilian travel, would become a weapon of mass destruction.
        We never thought that maybe cargo coming into a port could
    ultimately have a dirty bomb.
        We never thought that an envelope laced with anthrax could
    be a deadly weapon.
        So the iterations of what this is is always beyond even as
    we think ahead and try to prevent. It is a challenge. So I
    think it is a very unique one.
        I mean, in order to obtain a real estate or commercial
    loan, banks often generally require clients to obtain terrorism
    coverage. Without terrorism risk insurance, businesses lose out
    on essential financing options, and I think allowing TRIA to
    lapse or injecting uncertainty in the process can have serious
    economic consequences.
        Mr. Nageer, what happened to the commercial lending in real
    estate markets in 2014 when Congress allowed TRIA to expire for
    12 days?
        Mr. Nageer. Thank you for the question, Senator Menendez.
        So before I answer that question, I just want to add one
    thing to the modeling, your question before that.
        TRIA--an act of terrorism is not like an act of nature,
    right? Someone actually has to decide, ``I am going to
    perpetrate this act of terrorism.'' So that is very difficult
    for insurers to model, that uncertainty, that human element of
    it, and that is one of the issues.
        Obviously, we have got a ton of data points on the
    reinsurance side for natural disasters. For catastrophic
    terrorism events, 9/11 is the key data point on the model, and
    it does not help. You cannot be predictable with that. You can
    determine the impact of these events, but you cannot predict
    them. So this is why it is very difficult for insurers to model
    it.
        In terms of what happened in 2014, the uncertainty, it was
    very hectic. I was in the insurance market at that time, and
    insurers on property policies as well as workers' compensation
    policies, when they were considering policies which were going
    to go past December 31, 2014, started putting sunset provisions
    on policies, and a sunset clause is essentially a clause which
    says we elect--we reserve the right to change policies in terms
    of the limits, the coverages, and the prices for what we are
    offering you for terrorism insurance.
        So once you got into the window of the TRIPRA potentially
    not renewing at the end of 2014, we saw a preponderance of
    these sunset classes on clients buying insurance, starting in
    January 1st of 2013.
        As you go into the next renewal of 2020, any policy which
    renews comes into force on January 1, 2020, will expire January
    1, 2021, and those policies have a high possibility of having
    these sunset clauses being put on it.
        Senator Menendez. Mr. Chairman, a final note.
        I assume that if you are having a financial instrument, a
    loan, a mortgage, whatever, that has multiple years and your
    insurance is sunsetting within the context of that time period,
    that is going to make the lending institution far less desirous
    of making that a reality.
        Mr. Nageer. Absolutely.
        And the lender requirements on construction deals, long-
    term construction deals, or clients with these lender
    requirements make it quote onerous because that client then has
    to go purchase insurance in an alternative market, which is
    going to be added cost to their construction project or
    whatever it may be. And that market is available, but maybe not
    to the extent to replace the limit the clients would have
    gotten on TRIA.
        Senator Menendez. Maybe so.
        Thank you, Mr. Chairman.
        Chairman Crapo. Thank you.
        Senator Reed.
        Senator Reed. Well, thank you very much, Mr. Chairman.
    Thank you, gentlemen.
        Mr. Webel, could you please briefly describe how nuclear,
    biological, chemical, radiological terrorism events are treated
    under TRIA?
        Mr. Webel. Sure. Thank you for the question.
        NBCR is treated essentially like any other mode of attack.
    That is to say, it all works through the private insurance
    policies.
        What is particular about NBCR is most private insurance
    policies would exclude this damage, regardless of whether it
    was an accidental event or whether it was a terrorist event,
    and if the private insurance policies exclude it, it is
    effectively excluded under TRIA.
        So, for example, Senator Menendez just mentioned a dirty
    bomb or an anthrax attack. In reality, if a catastrophic attack
    occurred along those lines, it is entirely possible, if not
    likely, that TRIA coverage would not actually kick in because
    the private insurance policies that essentially underlie the
    TRIA coverage would not cover it.
        Senator Reed. In that context, as we reauthorize TRIA, do
    you have any suggested changes with respect to these NBCR
    policies?
        Mr. Webel. It is difficult because the TRIA mechanism has
    worked really well through the private market and allowing the
    State regulators to do the things that they do, allowing the
    private insurance companies to do the things that they do.
        It would certainly be possible from a generic perspective
    to put aspects of TRIA directly affecting those. In the
    original TRIA, there were terrorism exclusions that were
    nullified. So it is certainly within Congress' authority to do
    something like that with regard to NBCR.
        It would also be possible to put more incentives,
    essentially, into it. There have been proposals in the past to
    lower the deductibles, lower the trigger, lower the co-shares
    for an NBCR event, essentially incentivizing insurers to make
    the coverage or perhaps a mixture of the two approaches.
        Mr. Kunreuther. Could I just make one comment following up
    on Mr. Webel's point?
        I think that TRIA always had the intent that if the private
    insurers were not covering NBCR, then there would be some
    coverage by the Federal Government, if there was an NBCR loss,
    but it was sort of ambiguous in the sense that it was not
    really explicitly stated.
        But after the passage of TRIPRA in 2015, there was a
    comment by Treasury that they would be doing that.
        I think if one explicitly had that in the legislation that
    the Federal Government would cover that, it would avoid any of
    the uncertainty as to what might happen if there was an NBCR
    attack.
        Senator Reed. Thank you.
        Mr. Webel. But I think the question is what the mechanism
    would be because the mechanism for covering losses all works
    through the private insurance policies. It is a reimbursement
    to private insurance companies that have sustained losses. If
    they are not effectively sustaining losses because of the
    exclusion, how that mechanism would work is very unclear.
        Mr. Kunreuther. And the only suggestion that I would make
    on that is that there would be a recoupment----
        Mr. Webel. Yes.
        Mr. Kunreuther.----afterwards with respect to that, and
    that would be explicitly stated.
        Senator Reed. The environment has obviously changed since
    we first passed the TRIA Act, Mr. Webel. What things should we
    do for this changing environment?
        I know, again, my colleague, Senator Menendez, was talking
    about who would have thought of an envelope with anthrax, et
    cetera. Certainly, in the realm of cyber, who would have
    thought that and name the possible catastrophes? Is there any
    advice about changes?
        Mr. Webel. I think that cyber is the thing that people are
    looking at as the new threat, and Treasury specifically came
    out in 2016 and said the newly created cyber liability line of
    insurance would be covered under TRIA.
        So to the extent the private policies are covering cyber,
    again, it would do so, but I think that there is certainly the
    possibility of using the TRIA model or incentivizing or
    encouraging the market for cyber by explicitly including it in
    TRIA in some way because I think it is also a little unclear in
    terms of the damages that are being incurred in a cyber attack
    and whether that would meet triggers, whether that would meet
    deductibles and the like. And that is, I think, a real issue.
        Senator Reed. Well, thank you all, gentlemen, for your
    testimony. I appreciate it very much.
        Thank you, Mr. Chairman.
        Chairman Crapo. Thank you, Senator Reed.
        And that concludes the questioning for today's hearing.
        For Senators who wish to submit questions for the record,
    those questions are due by Tuesday, June 25th.
        To our witnesses, I suspect you may get a fair number of
    those because, as you can see, there were a number of other
    hearings and other interruptions today that caused us to not
    even be able to get a quorum for our Executive Session. So I
    think a lot of the Senators are probably going to submit some
    questions to you. We ask that as you receive those questions
    that you respond as promptly as you can.
        Again, we want to thank you for your expertise and for
    sharing your wisdom as well as your research with us today, and
    this hearing is adjourned.
        [Whereupon, at 11:33 a.m., the hearing was adjourned.]
        [Prepared statements, responses to written questions, and
    additional material supplied for the record follow:]
                   PREPARED STATEMENT OF CHAIRMAN MIKE CRAPO
        Today, we are joined by three witnesses who have evaluated and
    written extensively on the Terrorism Risk Insurance Program, including
    Mr. Tarique Nageer, Terrorism Placement and Advisory Leader with Marsh;
    Dr. Howard Kunreuther, Co-Director of the Wharton Risk Management and
    Decision Processes Center; and Mr. Baird Webel, Specialist in Financial
    Economics with the Congressional Research Service.
        The terrorist attacks on September 11, 2001, devastated U.S.
    citizens, households and businesses.
        In the wake of those attacks, Congress passed and the President
    signed into law the Terrorism Risk Insurance Act of 2002 to establish
    the Terrorism Risk Insurance Program, or TRIP, and to stabilize the
    market for terrorism risk insurance.
        Since then, Congress has reauthorized the Program three different
    times in 2005, 2007, and 2015.
        My goal in each reauthorization was to build on existing data to
    find ways for the private insurance industry to absorb and cover the
    losses for all but the largest acts of terror, ones in which the
    Federal Government would likely be forced to step in were the program
    not there.
        Congress made several improvements to the Program during the 2015
    reauthorization. It increased the program trigger from $100 million to
    $200 million in increments of $20 million each year; increased the
    level below which insurers are subject to mandatory recoupment $2
    billion each year to what is now a floating amount based on insurers'
    deductibles; and decreased the coinsurance rate from 85 percent to 80
    percent in 1 percent increments each year.
        That bill garnered overwhelming bipartisan support in the Senate
    with a vote of 93 to 4.
        The Program is once again set to expire on December 31, 2020.
        Well ahead of that expiration date, the Banking Committee has
    already started meeting with key stakeholders and is exploring whether
    there are additional balanced reforms to improve the Program and reduce
    taxpayer exposure without having a material negative effect on the cost
    and take-up rates for terrorism coverage.
        In 2018, the Treasury Department issued a report on the Program's
    effectiveness, which also discussed key developments in the marketplace
    for terrorism risk insurance.
        In addition to Treasury concluding in the report that ``The Program
    has accomplished its principle goals identified in TRIA,'' Treasury
    also observed that ``Private reinsurance of terrorism risk has
    significantly increased under the Program, and there is now increased
    private reinsurance capacity for the exposures that remain wholly with
    the private market under TRIP.''
        Each of today's witnesses has written extensively on the Program's
    effectiveness, structure and market developments.
        In 2018, Dr. Kunreuther co-authored a report on the Program, which
    found that ``Overall, TRIA has worked well. It has stabilized a very
    disrupted market in the aftermath of 2001, making terrorism insurance
    widely available and affordable. Take-up rates among enterprises small
    and large are rather high and premiums a few percentage points of what
    firms pay for their property insurance, even though cost and take-up
    rates vary widely by size, industry, geography, and line of business.''
        In its 2019 Terrorism Risk Insurance Report, Marsh discussed take-
    up rates, as well as cost, geographic and corporate trends in terrorism
    risk insurance in the United States, as well as globally.
        Marsh emphasized in the report that `` . . . the Federal backstop
    created by TRIA and reauthorized as TRIPRA--along with similar public-
    private mechanisms that exist in other countries--remains crucial to
    the continued stability and health of the property terrorism insurance
    market.''
        Finally, the Congressional Research Service has published numerous
    reports, including one as recently as April 2019, providing a
    comprehensive overview of the Program, its history, statutory changes
    in past reauthorizations and key considerations for this Congress.
        During this hearing, I look forward to hearing more about: specific
    considerations in evaluating the Program's effectiveness; how the
    Program has evolved over time; how the marketplace has responded to
    changes to the Program made by Congress in previous reauthorizations;
    what additional room exists to further reduce taxpayer exposure; and
    how different market participants may react to changes in different
    Program levers.
        Thank you all for joining us today to share your perspectives and
    research.
                                     ______

                  PREPARED STATEMENT OF SENATOR SHERROD BROWN
        Thank you Senator Crapo for holding the Committee's first hearing
    on the reauthorization of the Terrorism Risk Insurance Program. While
    the Program expires at the end of next year, after the lapse at the end
    of 2014 we all understand that we need to start early to make sure that
    does not happen again.
        The Terrorism Risk Insurance Program is critical to keeping our
    economy healthy. TRIA isn't just a program that helps in the event of a
    terrorist attack. Many businesses rely on this insurance in order to
    get access to credit, even in healthy economic times. Without
    Government assistance, the insurance market would be unable to provide
    affordable insurance to these businesses, including small businesses,
    across the country.
        While TRIA was initially designed to be temporary after 9-11,
    Republicans and Democrats have agreed several times since then that
    there is value in keeping it. People may hear the word ``terrorism''
    and think this doesn't apply to their community, that only businesses
    in places like New York and Washington or big national landmarks would
    need to worry about insuring against terrorism.
        But unfortunately, terrorism isn't confined to big cities and the
    groups perpetrating it don't only come from abroad. Ohio communities
    that have faced threats from white supremacists groups know all too
    well that this is a risk we all have to contend with.
        That's why I'm glad we've been able to work on it in a bipartisan
    way. We all agree there are some issues that the free market just can't
    solve on its own. This is one of them, and it's an example of the kind
    of successful Government intervention that is only possible when we
    come together as a country.
        There are some in Congress who would prefer the United States not
    make these kinds of guarantees--whether it's for workers' pensions and
    Social Security, for mortgages and affordable housing, for healthcare
    and food for low-income families, or for protections against economic
    destruction after terrorist attacks. Some politicians just aren't
    interested in coming together on behalf of Americans that live in
    Mansfield or Cleveland or Chillicothe in Ohio, or in Boise or Idaho
    Falls from the Chairman's State.
        I disagree, and I think the Terrorism Risk Insurance Program is
    emblematic of our ability to use Government to make the economy work
    better for everybody, especially during the most difficult of times. As
    we look at other issues on this Committee, I hope we will remember the
    success of this program, and our capacity to use Government to solve
    tough problems when we work together.
        In the last bipartisan authorization of the Program, we worked to
    strike a balance, which seems to work well. By increasing the program
    trigger to $200 million and gradually reducing the Government's share
    in the losses, we've made the program efficient without decreasing
    access to coverage. We have an opportunity to make the program even
    stronger by creating certainty in the marketplace through a long-term
    extension of the program. I hope we can work together to do that.
        I look forward to hearing the witnesses' testimony today.
        Thank you, Mr. Chairman.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    RESPONSES TO WRITTEN QUESTIONS OF SENATOR MENENDEZ FROM TARIQUE
                                 NAGEER

    Q.1. TRIA reauthorization is particularly important to my home
    State of New Jersey, where there is a high population density,
    important cultural centers and landmarks, and major
    infrastructure, including ports, rail, and highways.
        What are the consequences of letting TRIA expire for high
    target States like New Jersey?

    A.1. If TRIA is allowed to expire or is substantially changed,
    and the mandatory make-available provision is removed, insurers
    would not be obliged to offer terrorism coverage. Additionally,
    the TRIA premium charged by insurers without the backstop in
    place is likely to be considerably higher. The United States is
    the world's largest buyer of terrorism insurance, and U.S.-
    based organizations continue to purchase coverage at a high
    rate. In 2018, the take-up rate for TRIPRA coverage embedded in
    U.S. property policies was 62 percent (see Figure 4). Take-up
    rates have remained close to 60 percent over the last several
    years.
        Potentially, property reinsurance capacity and competition
    could positively influence the supply of terrorism capacity;
    however, available coverage and limits would not be as readily
    available in certain cities. In particular, this may impact
    companies that have substantial property exposures in central
    business districts and where reinsurance capacity would be
    diminished and insufficient to meet insurers' demands.
        Additionally, some industries are susceptible to certain
    insurance requirements, such as mortgage lender requirements
    with real estate companies. Within TRIA's current structure,
    the limits available for terrorism insurance are typically
    sufficient for real estate companies to meet their risk
    transfer and lender requirement needs. A change in the Act's
    structure could potentially cause a gap in demand and
    availability. This susceptibility is not limited to ``central
    business districts'' or major cities.
        The main alternative for a property terrorism risk transfer
    mechanism if TRIA is not reauthorized would be the standalone
    terrorism insurance market. As standalone capacity is finite,
    the cost of this capacity likely would be considerably higher
    in areas or cities where demand is high, such as major
    metropolitan areas, central business districts, iconic
    buildings, ports/airports and even ``soft targets'' such as
    shopping malls.
        This market dynamic varies considerably by location. In
    certain high-risk cities--such as New York, San Francisco,
    Chicago, Houston, Atlanta or Washington, D.C.--the cost of
    standalone terrorism insurance capacity can be multiples of the
    current pricing for TRIA embedded as part of property programs.
        Organizations that employ captives also are likely to be
    affected in the event TRIA is allowed to expire or is
    significantly changed. Captives are widely used to supplement
    what is available in the commercial market, and, in some cases
    captive insurers are the only available option for certain
    layers and/or perils. This is most common in areas of higher
    perceived risk, such as for property or employee-related
    coverages in major cities. Generally speaking, since captives
    are best suited to primary operating layers, or as a mechanism
    for accessing risk transfer solutions, it is very likely that,
    absent TRIA, captive utilization for terrorism coverage would
    change significantly.
        In addition to property insurance, other coverage lines
    likely will be impacted if TRIA expires or is significantly
    changed, particularly workers' compensation insurance, as
    workers' compensation insurers are not permitted to exclude
    terrorism from their policies. Insurers are concerned about
    potential aggregation of risk, which may impact the
    availability of workers' compensation insurance should TRIA
    materially change or expire. Where these insurers are also
    offering other lines of insurance, such as property, the
    combined aggregate exposure likely will further limit their
    ability or willingness to offer substantial property limits.
        Likely impacts that the absence of or a serious
    modification of TRIA could have on the workers' compensation
    market are in the areas of pricing and capacity. It is expected
    that the reinsurance market would likely increase pricing
    because of the increased potential exposure. This would, in
    turn, have a trickle-down effect on the primary workers'
    compensation marketplace. Further, the ability of insurers to
    use reinsurance capacity to manage their maximum tolerable
    losses could prove more difficult, especially for the terrorism
    perils of NBCR events. This could significantly alter carriers'
    risk appetites and their willingness to offer coverage to
    employers with large employee accumulations.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    Q.2. What are consequences of letting TRIA expire for
    communities around the country that are home to critical
    infrastructure such as rail lines, power plants, highways,
    airports, or pipelines? If these investments become more
    costly, doesn't that have a nationally adverse impact?

    A.2. There is insufficient standalone terrorism capacity to
    cost effectively replace TRIA. This will result in increased
    terrorism insurance costs and insurance market dislocation for
    risks in the commercial real estate sector. This could result
    in negative economic impact for industries affected by this
    dislocation.
        The main alternative for a property terrorism risk transfer
    mechanism if TRIA is not reauthorized would be the standalone
    terrorism insurance market. Since standalone capacity is
    finite, the cost of this capacity likely would be considerably
    higher in areas or cities where demand is high, such as major
    metropolitan areas, central business districts, iconic
    buildings, ports/airports for example.
        The percentage of companies that purchased terrorism
    insurance--and the amount they spent on terrorism insurance as
    a portion of their overall premiums--varied significantly by
    industry in 2018. Education institutions, media organizations,
    financial institutions, and real estate companies were the most
    frequent buyers while transportation and hospitality and gaming
    companies spent the most on terrorism as a percentage of their
    total premium spend due to their perceived vulnerability (see
    Figure 5).

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Global dedicated reinsurance capital is estimated to be
    $440 billion; dedicated reinsurance capital in North America is
    estimated to be between $120 billion and $140 billion.
    Reinsurance capacity for terrorism, however, is dependent on a
    reinsurer's preference, appetite, expertise and aggregate
    constraints.
        It is not unforeseeable that changes to the backstop could
    result in a withdrawal of smaller carriers away from the
    terrorism segment, while larger carriers may or may not
    continue to write--and absorb more--risk throughout the cycle
    of market dislocation. This would have an impact on the
    marketplace with fewer options available for small businesses,
    potentially higher insurance expenses and less available for
    growth and investments.
                                    ------

     RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARREN FROM TARIQUE
                                 NAGEER

    Q.1. Certain mass shootings, such as those that occurred in Las
    Vegas, NV, Sutherland Springs, TX, and Newtown, CT, have not
    been certified by the Treasury Secretary as acts of terrorism.
    Therefore, these incidents have not been regarded as qualifying
    events for terrorism risk insurance, in part, because those
    attacks did not meet current law's requirement of being ``part
    of an effort to coerce the civilian population of the United
    States or to influence the policy or affect the conduct of the
    United States Government by coercion.'' Given the high
    frequency of mass shootings in the United States, is there a
    public policy interest in certifying certain mass shootings
    committed by individuals as qualifying events for terrorism
    risk insurance purposes, even if they are not demonstrably
    intended to coerce Americans or influence U.S. Government
    policy? Please explain why or why not.

    A.1. Unfortunately, mass shootings are an important topic and,
    as such, there are policy initiatives underway to address them.
    The private insurance market has developed forms of coverage to
    respond to active assailant threats--helping organizations and
    individuals victimized by such attacks to recover and mitigate
    their future risk. This insurance, active assailant coverage,
    complements the general liability and property coverage that
    most businesses already purchase, offering another layer of
    protection against the threat of assailants. Various active
    assailant insurance products available via commercial insurers
    typically offer affirmative coverage that is triggered by
    premediated malicious physical attacks by active assailants who
    are physically present and armed. These policies can typically
    offer:

      A.  Property damage, business interruption, and extra expense
            coverage;

      B.  Legal liability coverage;

      C.  Nonphysical damage coverage;

      D.  Loss of revenue and denial of access coverage;

      E.  Reimbursement for costs for public relations consulting,
            crisis management, medical services, counseling and/or
            psychiatric care, hiring of additional staff and added
            security.

    Beyond purchasing insurance coverage, it's vital that
    businesses carefully consider their potential risk and actively
    engage in
    prevention and response preparedness activities to help reduce
    the
    potential loss of life, injuries, and damage to their and
    others'
    property. The Department of Homeland Security offers various
    active shooter preparation guidance on its website: https://
    www.dhs.gov/cisa/active-shooter-preparedness.
        Please see Addendum 1 for additional information on
    dedicated coverage for active assailant events.

    Q.2. According to Congressional Research Service (CRS)
    specialist Baird Webel's written testimony, the current
    terrorism risk insurance program ``protect[s] consumers--by
    requiring insurers that offer [Terrorism Risk Insurance Act]-
    covered lines of insurance to make terrorism insurance
    available prospectively to their commercial policyholders.''
    Are there other actions that Congress or Federal agencies could
    take that would enhance protections for consumers in the
    terrorism risk insurance market?

    A.2. Terrorism insurance pools should continue to evolve their
    scope and scale to provide the requisite response and stability
    for companies to operate securely.
        Certain market segments are required to provide coverage
    (e.g., workers' compensation, unlimited, and for all terror
    perils) versus having greater flexibility (e.g., property
    terrorism, particularly nuclear, biological, chemical and
    radiological terrorism coverage, where it can be excluded if
    the insured does not elect to purchase the coverage).
        It would be beneficial to investigate requiring elements of
    nuclear, biological, chemical and radiological terrorism
    coverage that would allow the Federal Government to reduce its
    exposure to uninsured losses resulting from a NBCR loss
    scenario and further develop the private market appetite.
        Any actions should be reviewed with due consideration to
    avoid insurers pulling out of specific coverage lines, which
    would thus have a negative effect on policyholders due to
    reduced availability.

    Q.3. According to CRS specialist Baird Webel's written
    testimony, ``Federal law does not limit what insurers can
    charge for terrorism risk insurance, although State regulators
    typically have the authority under State law to modify
    excessive, inadequate, or unfairly discriminatory rates.''
    While one of the original goals of the Terrorism Risk Insurance
    Program is to preserve State regulation of insurance, is there
    a public policy interest in developing a Federal limit on what
    insurers can charge for terrorism risk insurance, or is the
    current State-centric framework sufficient to prevent abusive
    practices in the market?

    A.3. In the current marketplace, terrorism price competition
    among insurers is driven in part by modeling the exposure and
    reviewing correlated risks across multiple terrorism exposed
    lines of business (e.g., those insuring both property and
    workers' compensation for the same risk(s)).
        Insurers measure their accumulations of risk and price
    their business based on the physical address level of data and
    differentiates those insured(s) with different risk profiles
    within each covered line of business.
        The action to minimize the negative market impact arising
    from the uncertainty around TRIA's future and serve the
    marketplace well would be to provide clear guidance on how a
    reauthorization might look, as soon as possible. Subject
    policies with effective dates on (and after) January 1, 2020,
    that are issued with annual terms, are creating a potential
    (and unknown) increased net exposure to insurers post the
    scheduled December 31, 2020, expiration of TRIA.
        The uncertainty with TRIA will cause insurance carriers to
    consider issuing unilateral policy endorsement provisions that
    will allow them to increase the price for terrorism coverage
    mid-term once it is known how TRIA will look going forward
    (either materially changed or nonrenewed) post its expiration.
    This effectively pushes the uncertainty in the market to the
    commercial insurance buyers and employers of all sizes.
    Further, it leaves open for interpretation the definition of
    ``materially changed'' and eliminates the ability for the
    insurance buyer to maintain coverage and cost certainty.

    Q.4. On December 27, 2016, the Treasury Department issued
    ``guidance regarding how insurance recently classified as
    `Cyber Liability' for purposes of reporting premiums and losses
    to State insurance regulators will be treated under TRIA and
    Treasury's regulations for the Program (Program regulations).''
    That guidance ``confirms that stand-alone cyber insurance
    policies reported under the `Cyber Liability' line are included
    in the definition of `property and casualty insurance' under
    TRIA and are thus subject to the disclosure requirements and
    other requirements in TRIA and the Program regulations[.]
    Furthermore, that guidance noted, ``Cyber risk insurance
    remains an evolving insurance market, both in terms of product
    development and regulatory oversight.'' Similarly, cyberspace
    remains a consistently evolving threat environment. At this
    time, would you recommend any updates to the Treasury
    Department's guidance on cyber insurance policies? Please
    explain why or why not.

    A.4. TRIA serves an essential role to the insurance market by
    injecting stability into several terrorism-related lines of
    insurance. With regard to cybersecurity, terrorism remains a
    present and growing threat vector. That risk is typically
    covered under cyber insurance policies, but may also impact
    other lines of coverage, including property or workers'
    compensation.
        One hurdle for using TRIA to address acts of cyberterrorism
    could be the challenge of attribution. ``Attribution of attacks
    can be difficult. This is usually dependent on technical means
    of attribution. In malicious cyber actions, spoofing or
    obfuscation of an identity most often occurs. It is not easy to
    know who conducts malicious cyber activity.''\1\
    ---------------------------------------------------------------------------
        \1\ ``Strategies for Resolving the Cyber Attribution Challenge,''
    U.S. Air Force Research Institute (accessed at https://
    media.defense.gov/2017/May/11/2001745613/-1/-1/0/CPP_0001_yanna
    kogeorgos_cyber_ttribution_challenge.pdf).
    ---------------------------------------------------------------------------
        Congress should consider whether the Secretary of the
    Treasury can declare a certified act of terrorism without
    certain attribution. Potentially, the Secretary could have the
    flexibility to certify an act of terrorism based on factors
    such as the objective of the attack and the impact of the
    attack.
        Guidance on the Secretary's flexibility could potential be
    addressed in the report language that accompanies the passage
    of a reauthorization of TRIPRA.

                                   Addendum 1

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                    ------

     RESPONSES TO WRITTEN QUESTIONS OF SENATOR JONES FROM TARIQUE
                                 NAGEER

    Q.1. Cyber attacks are gaining traction as a preferred method
    to terrorize individuals and organizations. In 2016, the
    Treasury Department issued guidance that clarified
    cyberterrorism is included in TRIA.

        Some believe that Russia interference in the 2016
            Presidential election by manipulating voters with fake
            social media accounts is considered cyberterrorism.
            This type of cyber-
            terrorism has immeasurable consequences and affects
            Americans that would not even participate in TRIA.

        Additionally, the Port of Mobile keeps track of
            containers that are to be shipped across the country.
            The Port of Mobile is an important part of Alabama's
            economy. If an organization decided to pressure Alabama
            into particular policy positions by attacking their
            computer system it would have dramatic effects on
            business owners dependent on the Port to ship their
            merchandise.

        What cyberterrorism looks like and the effects on
            people is very different from physical terrorist
            attacks. How should TRIA adapt to the growing
            prevalence of cyber attacks that gives private
            insurance a backstop but also provides policy holders
            with protection?

    A.1. In 2016, the U.S. Department of the Treasury responded to
    the growing risk of cyberterrorism by clarifying that losses
    incurred under cyber insurance policies would be eligible under
    TRIA.
    Accordingly, TRIA may already serve as a backstop for cyber
    insurance carriers in the event of a certified act of
    cyberterrorism. Moreover, acts of terrorism, including acts of
    cyberterrorism, may not qualify for TRIA because the impacts of
    those attacks fail to meet the statutory loss thresholds.
        At this time, there is no basis to believe that TRIA should
    be altered to provide further support to the cyber insurance
    industry, or to support other covered lines of insurance for
    cyber perils. However, Congress may consider how systemic risks
    may arise from cyber attacks that do not qualify as acts of
    cyberterrorism, and how well the Nation is prepared to respond
    to such systemic attacks.

    Q.2. Often TRIA is discussed with large cities in mind, but
    many smaller communities can be targets of terrorist
    activities. This is shown with the Charleston, South Carolina,
    church shooting when a white supremacist murdered nine people.
    Small communities like this are likely to receive insurance
    from local agents.

        Also, Alabama is home to two extremely popular
            football teams, University of Alabama and Auburn
            University. The Iron Bowl is an annual game between
            Alabama and Auburn and draws large crowds from each
            school. This could easily be a target for terrorist
            organizations.

        How would reforms to TRIA affect smaller
            communities, particularly their premiums and the extent
            of their coverage?

    A.2. A change in the $200m industry loss may have an outsized
    impact on small carriers if:

      A.  A loss occurs in a region/facility with few other insured
            structures or employees in close proximity;

      B.  The carrier in question is liable for the majority
            insured loss, i.e., this is not a subscription risk and
            is placed almost entirely with one market;

      C.  In a year with a ``swarm'' of small attacks, the insurer
            in question takes a loss from one or two small-to-
            moderate size losses, but the total damage to the U.S.
            property/casualty industry is not significant and fails
            to qualify for certification.

    Small carriers could surmount this challenge by managing
    deployed limits and diversifying their footprints away from
    regions/locations of peak exposures. This could come at the
    cost of competitiveness or availability of capacity for
    policyholders and have a negative short-term impact on the
    carrier.
        One way to mitigate the impact of these changes would be to
    phase in the aggregate increase over a defined period of time,
    e.g., $25m increase per year for a decade. This would allow for
    more manageable budgeting and business planning, and mitigate
    market disruption.
        Changing the company deductible, however, would likely have
    an even more pronounced impact, especially on the small
    insurers. For example, if the company deductible were to
    increase by 10 points to 30 percent, a majority of small-to-
    medium sized carriers who rely more on TRIA's existence, and
    whose program deductible represents the largest percentage of
    policyholder surplus, will have to re-strategize regarding the
    company's:

      A.  Defined per occurrence risk tolerance;

      B.  Reinsurance buying strategy;

      C.  Aggregate amount of limit deployed in the marketplace;

      D.  Pricing for terrorism risk;

      E.  Ratings agency scrutiny.

        Ratings agency scrutiny is particularly important for small
    and mutual carriers. Carriers must submit annual assessments of
    their net-of-TRIPRA and reinsurance accumulations. An increase
    in the deductible mid-term could potentially lead to a gap in
    terrorism reinsurance coverage, and consequently, could lead to
    a failed stress test. If this were to occur, it may damage the
    firm's financial strength rating, and impede its ability to
    secure new business.
        In 2017, nearly 800 U.S.-based carriers wrote $215 billion
    in TRIPRA-eligible premium, with a combined policyholder
    surplus (PHS) of $733 billion.
        Considering the current 20 percent deductible requirement
    and PHS as a filter, Guy Carpenter's analysis concludes that
    small- to mid-size insurers could be substantially more
    vulnerable to the annual increases in the TRIPRA industry
    trigger and their overall net retentions as a percentage of PHS
    (see Table 1).

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Insurers with $1 billion in surplus and relatively larger
    TRIPRA deductibles (over $200 million) tend to manage their
    conventional terrorism exposures and accumulations rather than
    be dependent on TRIPRA recoveries.
        Insurers with less than $500 million in surplus and
    relatively more exposure to terrorism losses are more likely to
    fall under the widening ``TRIPRA coverage gap'' that exposes
    them to a loss scenario where TRIPRA may not be industry
    triggered, leaving private reinsurance as their only source of
    surplus protection.
        It is not unforeseeable that changes to the backstop could
    result in a withdrawal of smaller carriers away from the
    terrorism segment, while larger carriers may or may not
    continue to write--and absorb more--risk throughout the cycle
    of market dislocation. This would have an impact on the
    marketplace with fewer options available for small businesses,
    potentially higher insurance expenses and less capital
    available for growth and investments.
        If changes are considered, we would recommend gradually
    phasing in any increases in the deductible over a planned time
    horizon. This would mitigate short-term market disruptions and
    allow smaller companies time to adequately capitalize
    themselves to take on an increased share within the private
    market.
                                    ------

     RESPONSES TO WRITTEN QUESTIONS OF SENATOR SINEMA FROM TARIQUE
                                 NAGEER

    Q.1. What types of uncertainty will the insurance market and
    insured entities experience if Congress waits too long to
    consider reauthorization of the Terrorism Risk Insurance Act
    (TRIA)? How will that timing affect entities seeking coverage
    or renewal of coverage?

    A.1. The uncertainty around the future of the Terrorism Risk
    Insurance Program Reauthorization Act (TRIPRA)--scheduled to
    expire on December 31, 2020--can significantly affect the
    property/casualty insurance industry.
        If TRIPRA is not renewed by Congress, the property
    insurance industry will be left with no Federal backstop for
    losses from certified acts of terrorism. As policies with
    effective dates after December 31, 2019, may extend beyond the
    expiration date of the legislation, insurers must determine in
    advance how to deal with their terrorism exposures as of that
    date.
        Property insurers may either accept the terrorism liability
    on all in-force policies on a fully net basis or place sunset
    clauses on policies written after December 31, 2020. Such a
    clause would cancel the terrorism coverage effective December
    31, 2020, if legislation extending TRIPRA is not passed by
    Congress and signed by the President.
        In addition to property insurance, other coverage lines
    likely will be impacted if TRIA expires or is significantly
    changed, particularly workers' compensation insurance, as
    workers' compensation insurers are not permitted to exclude
    terrorism from their policies. Insurers are concerned about
    potential aggregation of risk, which may impact the
    availability of workers' compensation insurance should TRIA
    materially change or expire. Where these insurers are also
    offering other lines of insurance, such as property, the
    combined aggregate exposure likely will further limit their
    ability or willingness to offer substantial property limits.
        Likely impacts that the absence of or a serious
    modification of TRIA could have on the workers' compensation
    market are in the areas of pricing and capacity. It is expected
    that the reinsurance market would likely increase pricing
    because of the increased potential exposure. This would, in
    turn, have a trickle-down effect on the primary workers'
    compensation marketplace. Further, the ability of insurers to
    use reinsurance capacity to manage their maximum tolerable
    losses could prove more difficult, especially for the terrorism
    perils of NBCR events. This could significantly alter carriers'
    risk appetites and their willingness to offer coverage to
    employers with large employee accumulations.

    Q.2. Should a lapse in terrorism coverage provided by TRIA
    occur, what effects do you foresee on the availability and
    pricing of said coverage?

    A.2. If Congress does not extend or renew TRIPRA, the market
    dynamics for terrorism insurance will be further disrupted and
    may result in increased pricing as capacity shrinks.
        In the absence of a federally mandated offer of TRIA
    terrorism coverage, there remains the strong likelihood that
    insurance and capital markets will choose not to offer
    terrorism coverage--using the premise that there is a higher
    certainty of returns elsewhere.
        TRIA's expiration or substantial modification at extension
    will
    almost certainly affect embedded TRIA coverage, standalone
    terrorism pricing/demand for capacity and TRIA captive
    programs. Terrorism insurance capacity may be difficult to
    acquire at reasonable cost for insureds with significant
    exposures in a central business district of a major (Tier 1)
    city, or if the properties are
    perceived as potential targets for terrorism attacks, and/or
    where there have been instances of foiled plots.
        The main alternative for a property terrorism risk transfer
    mechanism if TRIA is not reauthorized would be the standalone
    terrorism insurance market. As standalone capacity is finite,
    the cost of this capacity likely would be considerably higher
    in areas or cities where demand is high, such as major
    metropolitan areas,
    central business districts, iconic buildings, ports/airports,
    and even ``soft targets'' such as shopping malls.
        This market dynamic varies considerably by location. In
    certain high-risk cities--such as New York, San Francisco,
    Chicago, Houston, Atlanta or Washington, D.C.--the cost of
    standalone terrorism insurance capacity can be multiples of the
    current pricing for TRIA embedded as part of property programs.
        Organizations that employ captives also are likely to be
    affected in the event TRIA is allowed to expire or is
    significantly changed. Captives are widely used to supplement
    what is available in the commercial market, and, in some cases
    captive insurers are the only available option for certain
    layers and/or perils. This is most common in areas of higher
    perceived risk, such as for property or employee-related
    coverages in major cities. Generally speaking, since captives
    are best suited to primary operating layers, or as a mechanism
    for accessing risk transfer solutions, it is very likely that,
    absent TRIA, captive utilization for terrorism coverage would
    change significantly.

    Q.3. In December 2016, the Department of the Treasury issued
    guidance which clarified that losses from cyber-terrorist
    attacks were to be treated the same as commercial property and
    casualty losses. Do you think this guidance sufficiently covers
    all forms of cyber attacks?

    A.3. The December 2016 guidance from the U.S. Department of the
    Treasury addressed a unique issue related to TRIA's coverage of
    cyber perils.
        A core insuring agreement for cyber insurance is data asset
    restoration. When malware encrypts, corrupts or destroys data,
    a cyber insurance policy can reimburse the cost to restore or
    recreate that data. This coverage may also include
    reimbursement for the cost of replacing servers, devices or
    other components that have been corrupted beyond repair, often
    referred to as ``bricking.'' In addition to this coverage being
    available in the cyber insurance market, some property carriers
    may also offer this coverage. Other carriers, however, may
    exclude this coverage because the loss does not result from a
    physical event, such as fire or explosion.
        Prior to December 2016, Treasury was silent on whether
    cyber insurance should be included or excluded from TRIA. As a
    result, if a quickly replicating, data destroying malware
    created a widespread data corruption event and corresponding
    loss of revenue from business interruption, such as NotPetya,
    TRIA may have responded differently to losses under property
    insurance policies and cyber insurance policies, even though
    they responded to the same losses from the same peril.
        Accordingly, Treasury's guidance clarified that losses from
    cyber-terrorist attacks that were subject to the coverage of
    cyber insurance policies were to be treated the same as
    commercial property and casualty losses.

    Q.4. How do insurers effectively measure and quantify loss from
    cyber attacks?

    A.4. One of Marsh's services as a trusted cyber-risk adviser is
    to help quantify the potential impact of a cyber attack and to
    help clients establish controls for ongoing assessment of cyber
    risk. In some instances, such as data breaches, this can be
    based on modeling from prior claims activity. In other
    instances, such as losses from loss of revenues and extra
    expense from malware events, the lack of claims history may
    require alternative means of quantification that involves
    assessment of clients' cyber assets, review of the client's
    process and procedures for protecting assets and proposing
    scenarios that could lead to large loss. With collaborative
    engagements by Marsh brokers and consultants, Marsh offers
    clients the opportunity to dispel the uncertainty of their
    cyber exposures and devote adequate resources with optimal
    results.
                                    ------

    RESPONSES TO WRITTEN QUESTIONS OF SENATOR MENENDEZ FROM HOWARD
                               KUNREUTHER

    Q.1. TRIA reauthorization is particularly important to my home
    State of New Jersey, where there is a high population density,
    important cultural centers and landmarks, and major
    infrastructure, including ports, rail, and highways.
        What are the consequences of letting TRIA expire for high
    target States like New Jersey?

    A.1. The consequences of letting TRIA expire for high target
    States like New Jersey could be highly significant because many
    private insurers will likely refuse to offer coverage against
    terrorism losses to commercial firms because of a concern with
    the consequences of a catastrophic loss to their operations.
    Those insurers considering offering coverage will very likely
    charge much higher premiums than if they are protected by TRIA.
    The likelihood of a cyber-terrorist attack and its consequences
    are highly ambiguous so they will focus on worst case scenarios
    in specifying the price of terrorism coverage.

    Q.2. What are consequences of letting TRIA expire for
    communities around the country that are home to critical
    infrastructure such as rail lines, power plants, highways,
    airports, or pipelines? If these investments become more
    costly, doesn't that have a nationally adverse impact?

    A.2. If TRIA expires and critical infrastructure is uninsured
    and suffers a severe loss from a terrorist attack, this would
    have a
    nationally adverse impact. The President might issue a disaster
    declaration so that Federal assistance could be provided.
    Including infrastructure losses as part of TRIA could encourage
    investments now in mitigating future losses through long-term
    loans and premium reductions, as noted in my testimony.
                                    ------

     RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARREN FROM HOWARD
                               KUNREUTHER

    Q.1. Certain mass shootings, such as those that occurred in Las
    Vegas, NV, Sutherland Springs, TX, and Newtown, CT, have not
    been certified by the Treasury Secretary as acts of terrorism.
    Therefore, these incidents have not been regarded as qualifying
    events for terrorism risk insurance, in part, because those
    attacks did not meet current law's requirement of being ``part
    of an effort to coerce the civilian population of the United
    States or to influence the policy or affect the conduct of the
    United States Government by coercion.'' Given the high
    frequency of mass shootings in the United States, is there a
    public policy interest in certifying certain mass shootings
    committed by individuals as qualifying events for terrorism
    risk insurance purposes, even if they are not demonstrably
    intended to coerce Americans or influence U.S. Government
    policy? Please explain why or why not.

    A.1. To address this important issue, the Department of the
    Treasury needs to interact with private insurers to determine
    whether insurers now provide protection against mass shootings
    that may not be caused by terrorists. If there is sufficient
    private insurance coverage then it may not be necessary to
    include these events under TRIA. If there is limited coverage
    against mass shootings, then it will be important to determine
    who pays for the losses from these events and whether a case
    can be made to consider including these events under TRIA when
    it is considered for renewal in 2020.

    Q.2. According to Congressional Research Service (CRS)
    specialist Baird Webel's written testimony, the current
    terrorism risk insurance program ``protect[s] consumers--by
    requiring insurers that offer [Terrorism Risk Insurance Act]-
    covered lines of insurance to make terrorism insurance
    available prospectively to their commercial policyholders.''
    Are there other actions that Congress or Federal agencies could
    take that would enhance protections for consumers in the
    terrorism risk insurance market?

    A.2. No response provided.

    Q.3. According to CRS specialist Baird Webel's written
    testimony, ``Federal law does not limit what insurers can
    charge for terrorism risk insurance, although State regulators
    typically have the authority under State law to modify
    excessive, inadequate, or unfairly discriminatory rates.''
    While one of the original goals of the Terrorism Risk Insurance
    Program is to preserve State regulation of insurance, is there
    a public policy interest in developing a Federal limit on what
    insurers can charge for terrorism risk insurance, or is the
    current State-centric framework sufficient to prevent abusive
    practices in the market?

    A.3. I feel that insurers should be able to charge premiums
    that reflect their risks, so State regulators should not
    restrict the premiums insurers can charge. It will be important
    for State regulators to make sure that the premiums are high
    enough so that the insurers has a low chance of insolvency if
    it suffers a catastrophic loss. One of the important reasons
    for renewing TRIA is to provide a Federal backstop if insurers'
    total losses exceed a certain amount. In my testimony I
    indicated that the Wharton Risk Center's study revealed that
    total insured losses from a terrorist attack would have to
    exceed $60 billion before the Federal Government would be
    responsible for covering any insured losses.

    Q.4. On December 27, 2016, the Treasury Department issued
    ``guidance regarding how insurance recently classified as
    `Cyber Liability' for purposes of reporting premiums and losses
    to State insurance regulators will be treated under TRIA and
    Treasury's regulations for the Program (Program regulations).''
    That guidance ``confirms that stand-alone cyber insurance
    policies reported under the `Cyber Liability' line are included
    in the definition of `property and casualty insurance' under
    TRIA and are thus subject to the disclosure requirements and
    other requirements in TRIA and the Program regulations[.]
    Furthermore, that guidance noted, ``Cyber risk insurance
    remains an evolving insurance market, both in terms of product
    development and regulatory oversight.'' Similarly, cyberspace
    remains a consistently evolving threat environment. At this
    time, would you recommend any updates to the Treasury
    Department's guidance on cyber insurance policies? Please
    explain why or why not.

    A.4. In my testimony I noted that cyberterrorism is an
    interdependent risk where compromising one computer network can
    cause losses to many others in the interconnected system. The
    existence of such interdependencies provides challenges to
    insurers in determining whether to offer protection against
    this risk in their terrorism coverage and if so what premium to
    charge. For this reason I feel that it is important that the
    Department of the Treasury interact with private insurers to
    determine whether cyberterrorism should be included under the
    TRIA backstop. By including it in TRIA both private insurers
    and the Federal Government would form a private-public
    partnership to deal with a risk where the likelihood of a
    cyber-terrorist attack and its consequences are highly
    ambiguous. With a backstop from the Federal Government if the
    losses from a cyber terrorist were extremely large, insurers
    would feel more comfortable insuring this risk and would
    consider charging a lower premium than if they were fully
    responsible for a catastrophic loss.
                                    ------

      RESPONSES TO WRITTEN QUESTIONS OF SENATOR JONES FROM HOWARD
                               KUNREUTHER

    Q.1. Cyber attacks are gaining traction as a preferred method
    to terrorize individuals and organizations. In 2016, the
    Treasury Department issued guidance that clarified
    cyberterrorism is included in TRIA.
        Some believe that Russia interference in the 2016
    Presidential election by manipulating voters with fake social
    media accounts is considered cyberterrorism. This type of
    cyberterrorism has immeasurable consequences and effects
    Americans that would not even participate in TRIA.
        Additionally, the Port of Mobile keeps track of containers
    that are to be shipped across the country. The Port of Mobile
    is an important part of Alabama's economy. If an organization
    decided to pressure Alabama into particular policy positions by
    attacking their computer system it would have dramatic effects
    on business owners dependent on the Port to ship their
    merchandise.
        What cyberterrorism looks like and the effects on people is
    very different from physical terrorist attacks. How should TRIA
    adapt to the growing prevalence of cyber attacks that gives
    private insurance a backstop but also provides policy holders
    with protection?

    A.1. In my testimony I noted that cyberterrorism is an
    interdependent risk, where compromising one computer network
    can cause losses to many others in the interconnected system.
    The existence of such interdependencies provides challenges to
    insurers in determining whether to offer protection against
    this risk in their terrorism coverage and, if so, what premium
    to charge. For this reason I feel that it is important that the
    Department of the
    Treasury interact with private insurers to determine whether
    cyberterrorism should be included under the TRIA backstop. By
    including it in TRIA, both private insurers and the Federal
    Government would form a private-public partnership to deal with
    a risk where the likelihood of a cyber-terrorist attack and its
    consequences are highly ambiguous. With a backstop from the
    Federal Government, if the losses from a cyber terrorist were
    extremely large, insurers would feel more comfortable insuring
    this risk and would consider charging a lower premium than if
    they were fully responsible for a catastrophic loss.

    Q.2. Often TRIA is discussed with large cities in mind, but
    many smaller communities can be targets of terrorist
    activities. This is shown with the Charleston, South Carolina,
    church shooting when a white supremacist murdered nine people.
    Small communities like this are likely to receive insurance
    from local agents.
        Also, Alabama is home to two extremely popular football
    teams, University of Alabama and Auburn University. The Iron
    Bowl is an annual game between Alabama and Auburn and draws
    large crowds from each school. This could easily be a target
    for terrorist organizations.
        How would reforms to TRIA affect smaller communities,
    particularly their premiums and the extent of their coverage?

    A.2. In setting premiums for terrorist coverage, insurers are
    concerned with the size of the program trigger for TRIA. In
    2020 if a terrorist attack creates insured losses less than
    $200 million, then TRIA will not be triggered. In this case
    there will be no Federal backstop. If insurers are concerned
    with having to be responsible for the total losses from mass
    shootings or a terrorist attack in a small community, they are
    likely to charge higher premiums and reduce their coverage.
    Some insurers may decide not to provide protection against mass
    shootings or to firms in smaller communities from losses from a
    terrorist attack. In considering the
    renewal of TRIA, consideration should be given to the size of
    the program trigger and whether losses from mass shootings from
    terrorists should be covered by TRIA even if the total insured
    losses were lower than the TRIA program trigger. If losses from
    mass shootings would be covered by TRIA, insurers are likely to
    charge lower premiums and provide more coverage against these
    terrorist-related disasters.
                                    ------

      RESPONSE TO WRITTEN QUESTION OF SENATOR SINEMA FROM HOWARD
                               KUNREUTHER

    Q.1. In December 2016, the Department of the Treasury issued
    guidance which clarified that losses from cyber-terrorist
    attacks were to be treated the same as commercial property and
    casualty losses. Do you think this guidance sufficiently covers
    all forms of cyber attacks? How do insurers effectively measure
    and quantify loss from cyber attacks?

    A.1. In my testimony I noted that cyberterrorism is an
    interdependent risk where compromising one computer network can
    cause losses to many others in the interconnected system. The
    existence of such interdependencies provides challenges to
    insurers in determining whether to offer protection against
    this risk in their terrorism coverage and if so what premium to
    charge. For this
    reason I feel that it is important that the Department of the
    Treasury interact with private insurers to determine whether
    cyberterrorism should be included under the TRIA backstop. By
    including it in TRIA both private insurers and the Federal
    Government would form a private-public partnership to deal with
    a risk where the likelihood of a cyber-terrorist attack and its
    consequences are highly ambiguous. With a backstop from the
    Federal Government if the losses from a cyber terrorist were
    extremely large, insurers would feel more comfortable insuring
    this risk and would consider charging a lower premium than if
    they were fully responsible for a catastrophic loss.
                                    ------

      RESPONSE TO WRITTEN QUESTION OF SENATOR MENENDEZ FROM BAIRD
                                 WEBEL

    Q.1. TRIA reauthorization is particularly important to my home
    State of New Jersey, where there is a high population density,
    important cultural centers and landmarks, and major
    infrastructure, including ports, rail, and highways.
        What are the consequences of letting TRIA expire for high
    target States like New Jersey?
        What are consequences of letting TRIA expire for
    communities around the country that are home to critical
    infrastructure such as rail lines, power plants, highways,
    airports, or pipelines? If these investments become more
    costly, doesn't that have a nationally adverse impact?

    A.1. TRIA acts to lower the cost of terrorism insurance in two
    primary ways. (1) It directly subsidizes terrorism insurance by
    providing reinsurance coverage for no upfront premiums; and (2)
    it expands the supply of terrorism insurance through the
    requirement that companies offer terrorism insurance to
    commercial policyholders. TRIA expiration would remove both the
    direct subsidy and the extra supply from the market and thus
    would likely raise the cost of terrorism insurance. The impact
    of this would be felt to the greatest extent in high target
    States as insurers would likely seek to reduce their overall
    exposure to such States. In addition, it would be in such
    States that lenders would be most likely to require terrorism
    coverage before providing loans for large commercial real
    estate projects. A similar dynamic would also come into play
    with critical infrastructure, thus raising costs for such
    projects and potentially having a nationally adverse impact as
    critical infrastructure is necessary for the economy
    nationwide. If TRIA were to expire, however, Congress might
    also consider redirecting the resources that are devoted to
    TRIA to some other use that could support critical
    infrastructure.
                                    ------

      RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARREN FROM BAIRD
                                 WEBEL

    Q.1. Certain mass shootings, such as those that occurred in Las
    Vegas, NV, Sutherland Springs, TX, and Newtown, CT, have not
    been certified by the Treasury Secretary as acts of terrorism.
    Therefore, these incidents have not been regarded as qualifying
    events for terrorism risk insurance, in part, because those
    attacks did not meet current law's requirement of being ``part
    of an effort to coerce the civilian population of the United
    States or to influence the policy or affect the conduct of the
    U.S. Government by coercion.'' Given the high frequency of mass
    shootings in the United States, is there a public policy
    interest in certifying certain mass shootings committed by
    individuals as qualifying events for terrorism risk insurance
    purposes, even if they are not demonstrably intended to coerce
    Americans or influence U.S. Government policy? Please explain
    why or why not.

    A.1. TRIA requires the following for certification of a
    terrorist attack under the statute. An act must:

      (i)   to be an act of terrorism;

      (ii)  to be a violent act or an act that is dangerous to----

          (I)    human life;

          (II)   property; or

          (III)   infrastructure;

      (iii)  to have resulted in damage within the United States,
            or outside of the United States in the case of----

          (I)   an air carrier or vessel described in paragraph
            (5)(B); or

          (II)   the premises of a United States mission; and

      (iv)  to have been committed by an individual or individuals,
            as part of an effort to coerce the civilian population
            of the United States or to influence the policy or
            affect the conduct of the U.S. Government by coercion.

    In addition, the statute requires that the act of terrorism
    cause more than $5 million in aggregate property casualty
    insurance losses in order to be certified. Losses incurred for
    in health or life insurance are not covered under TRIA.
        The certification of an event as an act of terrorism under
    TRIA serves a relatively narrow statutory purpose. It solely
    relates to potential sharing of insured losses by the Federal
    Government and is not referenced in other national security or
    judicial statutes. In past experience, particularly following
    the 2013 Boston Marathon bombing, the President in a statement
    identified an attack as an act of terror, but the relatively
    low level of insured property casualty losses meant that, under
    the TRIA criteria, it could not be certified regardless of the
    motives involved. Due to the precise nature of terrorism
    exclusions in insurance policies covering some of the Boston
    businesses who suffered losses due to the bombing, TRIA
    certification in that case would likely have resulted in
    coverage gaps and less payments to insureds.\1\
    ---------------------------------------------------------------------------
        \1\ See, for example, ``Mass. Regulator on Boston Bombing Claims,
    TRIA Reauthorization Effort,'' Insurance Journal, April 23, 2014, at
    https://www.insurancejournal.com/news/east/2014/04/23/327033.htm; and
    ``Insurance Payout May Depend on Whether Boston Bombing Was `Terrorist
    Act,' '' ABC News, at https://abcnews.go.com/Business/boston-firms-
    wait-terrorism-certification-insurance-payout/story?id=19043385.
    ---------------------------------------------------------------------------
        Many mass shooting events may fall into a similar category
    as the Marathon bombing. While they may inflict a tragic toll
    on the life and health of those involved, mass shootings may
    not cause losses in commercial property casualty insurance
    sufficient to meet the TRIA criteria for certification. In such
    cases, only addressing the TRIA criteria with regard to motives
    may have relatively little effect on potential certification of
    mass shootings as terrorist events under TRIA. In addition,
    certification is only the first threshold that must be crossed
    before the Government would share losses under TRIA. The
    combination of the program trigger and the insurer deductible
    make it unlikely that the certification of most mass shootings
    as eligible for coverage under TRIA would result in any actual
    loss sharing.\2\
    ---------------------------------------------------------------------------
        \2\ For example, recent press reports suggest approximately $750
    million in insured damages for the Las Vegas shooting (``MGM Sees $800
    Million Las Vegas Shooting Settlement; $751 Million Covered by
    Insurance,'' Insurance Journal, May 20, 2019). The primary insurer
    reported was Zurich American Insurance (``MGM Resorts Sues Zurich
    American Insurance for Las Vegas Shooting Defense Costs,'' Insurance
    Journal, June 24, 2019). According to data supplied to CRS by the
    Treasury Department, Zurich's TRIA insurer deductible would be
    approximately $1.4 billion. Thus, if the press reports are accurate,
    even if the Las Vegas shooting were certified, no Federal loss sharing
    would occur.

    Q.2. According to Congressional Research Service (CRS)
    specialist Baird Webel's written testimony, the current
    terrorism risk insurance program ``protect[s] consumers--by
    requiring insurers that offer [Terrorism Risk Insurance Act]-
    covered lines of insurance to make terrorism insurance
    available prospectively to their commercial policyholders.''
    Are there other actions that Congress or Federal agencies could
    take that would enhance protections for consumers in the
    ---------------------------------------------------------------------------
    terrorism risk insurance market?

    A.2. Beyond the ``make available'' provisions TRIA effectively
    leaves terrorism insurance consumer protection issues (such as
    affordability of terrorism insurance or the precise details of
    terrorism insurance policies) to the State insurance regulators
    as is the case in commercial insurance generally. This primacy
    of State insurance regulation is codified in the 1945 McCarran-
    Ferguson Act.\3\ It is possible for Congress to revisit this
    aspect of McCarran-Ferguson with regard to terrorism insurance,
    as was done to a degree in the original 2002 TRIA, which also
    nullified terrorism exclusions that previously had been
    approved by State insurance regulators at the time. Such
    increased Federal oversight of terrorism insurance, however,
    would require specific statutory change as the Federal agencies
    who might provide such oversight, including the Department of
    the Treasury, the Consumer Financial Protection Bureau, and the
    Federal Trade Commission, currently have little or no authority
    to oversee insurance.
    ---------------------------------------------------------------------------
        \3\ Codified at 15 U.S.C. Sec. Sec.  1011-1015.

    Q.3. According to CRS specialist Baird Webel's written
    testimony, ``Federal law does not limit what insurers can
    charge for terrorism risk insurance, although State regulators
    typically have the authority under State law to modify
    excessive, inadequate, or unfairly discriminatory rates.''
    While one of the original goals of the Terrorism Risk Insurance
    Program is to preserve State regulation of insurance, is there
    a public policy interest in developing a Federal limit on what
    insurers can charge for terrorism risk insurance, or is the
    current State-centric framework sufficient to prevent abusive
    ---------------------------------------------------------------------------
    practices in the market?

    A.3. The State regulatory system generally treats commercial
    insurance lines, such as those covered under TRIA, to less
    direct oversight on consumer protection grounds than personal
    lines, such as homeowners insurance or automobile insurance.
    This is typically justified on the grounds that the businesses
    purchasing commercial lines are seen as sophisticated consumers
    who are better able to understand insurance contracts and seek
    out the best prices.\4\ Thus, for example, there is little
    direct rate regulation in commercial insurance compared to
    personal insurance where some States require prior approval of
    rate changes, or have after-the-fact approval processes.
    ---------------------------------------------------------------------------
        \4\ Similar theories are present in financial regulation under
    Federal law, such as the concept of an ``accredited investor'' used by
    the Securities and Exchange Commission. See CRS Report IF11278,
    ``Accredited Investor Definition and Private Securities Markets,'' by
    Eva Su.
    ---------------------------------------------------------------------------
        Recent Treasury and private data on terrorism insurance
    pricing has generally been interpreted as signaling no
    significant problems in the market; and CRS is unaware of any
    State departments of insurance taking public action against
    insurers for excessive rates on terrorism insurance. Overall
    average rates can, however, mask individual markets that may be
    facing difficulties. It is within Congress' purview to
    investigate complaints of excessive rates and enact changes
    addressing any issues found. Since Congress has found the
    availability of terrorism insurance important enough on public
    policy grounds to create and extend the TRIA program, this
    might also be sufficient grounds to justify additional Federal
    attention to the affordability of terrorism insurance.

    Q.4. On December 27, 2016, the Treasury Department issued
    ``guidance regarding how insurance recently classified as
    `Cyber Liability' for purposes of reporting premiums and losses
    to State insurance regulators will be treated under TRIA and
    Treasury's regulations for the Program (Program regulations).''
    That guidance ``confirms that stand-alone cyber insurance
    policies reported under the `Cyber Liability' line are included
    in the definition of `property and casualty insurance' under
    TRIA and are thus subject to the disclosure requirements and
    other requirements in TRIA and the Program regulations[.]
    Furthermore, that guidance noted, ``Cyber risk insurance
    remains an evolving insurance market, both in terms of product
    development and regulatory oversight.'' Similarly, cyberspace
    remains a consistently evolving threat environment. At this
    time, would you recommend any updates to the Treasury
    Department's guidance on cyber insurance policies? Please
    explain why or why not.

    A.4. The years since the Treasury guidance have not
    substantially altered the evolving and uncertain nature of
    cyber insurance. The combined public-private nature of TRIA,
    however, provides significant space for private insurers to
    innovate in the coverages offered for cyber risk while still
    remaining under the reinsurance backstop provided by TRIA.
    Treasury's guidance seems clear that policies in the new cyber
    liability line of insurance are eligible for TRIA coverage.
    This does not mean, however, that there might not be future
    issues relating to TRIA coverage in the case of a cyber-
    terrorist attack. For example, if the exact perpetrators are
    unknown, it may be difficult for Treasury to certify the attack
    under the criteria contained in the TRIA statute. It is also
    possible that a substantial attack might occur but be under the
    various thresholds in the law that limit Federal sharing of
    terrorism losses. Addressing such issues, however, would be
    beyond Treasury's authority to address in guidance and would
    instead require amendments by Congress to the underlying
    statute.
                                    ------

      RESPONSES TO WRITTEN QUESTIONS OF SENATOR JONES FROM BAIRD
                                 WEBEL

    Q.1. Cyber attacks are gaining traction as a preferred method
    to terrorize individuals and organizations. In 2016, the
    Treasury Department issued guidance that clarified
    cyberterrorism is included in TRIA.
        Some believe that Russia interference in the 2016
    Presidential election by manipulating voters with fake social
    media accounts is considered cyberterrorism. This type of
    cyberterrorism has immeasurable consequences and effects
    Americans that would not even participate in TRIA.
        Additionally, the Port of Mobile keeps track of containers
    that are to be shipped across the country. The Port of Mobile
    is an important part of Alabama's economy. If an organization
    decided to pressure Alabama into particular policy positions by
    attacking their computer system it would have dramatic effects
    on business owners dependent on the Port to ship their
    merchandise.
        What cyberterrorism looks like and the effects on people is
    very different from physical terrorist attacks. How should TRIA
    adapt to the growing prevalence of cyber attacks that gives
    private insurance a backstop but also provides policy holders
    with protection?

    A.1. While TRIA does not directly address cyberterrorism, the
    flexibility inherent in the combined public/private nature of
    the program has allowed cyberterrorism to be covered by TRIA
    without specific statutory changes. As long as private
    insurance policies are covering cyberterrorism, TRIA will as
    well even if the effects of a cyber-terrorist attack may be
    substantially different than other forms of terrorism. The
    purchase of cyber insurance by businesses is growing, however
    it may not be reaching coverage levels that would be considered
    optimal from a public policy perspective. For example, higher
    coverage levels could be desired since insurance often serves
    to mitigate damage through mechanisms like information sharing
    on best practices.
        There are some aspects of the TRIA design that may not be
    optimal if the desire is to promote the purchase of cyber
    insurance and ensure that TRIA provides coverage for a
    terrorist attack via cyberspace. For example, the program
    trigger, currently at $180 million and set to go to $200
    million, and the 20 percent insurer deductible are high enough
    that the insured loss levels from many cyber attacks may not
    cross the thresholds and result in TRIA loss sharing. In
    addition, the definition of an act of terrorism in the statute
    requires than an act be ``committed by an individual or
    individuals, as part of an effort to coerce the civilian
    population of the United States or to influence the policy or
    affect the conduct of the U.S. Government by coercion.'' In the
    case of a cyber attack, however, it may be difficult to even
    identify perpetrators, let alone define what their intent might
    be.

    Q.2. Often TRIA is discussed with large cities in mind, but
    many smaller communities can be targets of terrorist
    activities. This is shown with the Charleston, South Carolina,
    church shooting when a white supremacist murdered nine people.
    Small communities like this are likely to receive insurance
    from local agents.
        Also, Alabama is home to two extremely popular football
    teams, University of Alabama and Auburn University. The Iron
    Bowl is an annual game between Alabama and Auburn and draws
    large crowds from each school. This could easily be a target
    for terrorist organizations.
        How would reforms to TRIA affect smaller communities,
    particularly their premiums and the extent of their coverage?

    A.2. The TRIA program does not contain differential application
    processes or metrics for different-sized communities. However,
    the thresholds in the Act (i.e., the program trigger, the
    insurer deductible, and the $5 million loss threshold for
    certification) may have a differential effect simply due to the
    cost differences between larger and smaller cities. For
    example, an identical building is much more expensive to build
    in Manhattan than Mobile, thus, an otherwise identical
    terrorist attack will likely cause lower insured damages and be
    less likely to clear the thresholds for TRIA coverage. Thus, if
    the TRIA dollar thresholds are raised, this would have in
    relative terms, a larger effect on these less expensive
    communities as TRIA coverage would be less likely to be
    triggered. In practical terms, however, the impact on premiums
    will be somewhat reduced as the overall cost of insurance in
    such communities is lower and the risk of a terrorist attack,
    and thus the premiums for terrorism insurance, is seen as
    lower.
                                    ------

      RESPONSES TO WRITTEN QUESTIONS OF SENATOR SINEMA FROM BAIRD
                                 WEBEL

    Q.1. In December 2016, the Department of the Treasury issued
    guidance which clarified that losses from cyber-terrorist
    attacks were to be treated the same as commercial property and
    casualty losses. Do you think this guidance sufficiently covers
    all forms of cyber attacks?

    A.1. The Treasury guidance does not overrule the statutory
    language that is in place, particularly the exemption of
    specific lines of insurance from the TRIA program. In 2016, the
    State insurance regulators introduced a new cyber liability
    line of insurance for regulatory purposes. Prior to this,
    policies covering cyber risk were reported in different lines
    of insurance, including in some cases lines of insurance that
    were specifically exempted from TRIA. This new cyber liability
    line of insurance largely prompted the Treasury guidance. It is
    not clear whether some of the coverage for cyber risk is still
    being covered under an exempted line, but to the extent that
    damage from a cyber attack still is covered under these
    exempted lines, TRIA would not cover such an attack. This may
    very well have less of an impact over time as more future cyber
    coverage likely will be provided under the cyber-specific line
    of insurance that is being covered under TRIA.
        The guidance also does not affect all of the other
    statutory aspects of the program, such as the certification
    requirements and the various monetary thresholds. To the extent
    that a cyber-terrorist attack might interact differently with
    these statutory requirements compared to a noncyber attack,\1\
    Treasury would be limited in its ability to provide coverage
    under TRIA for such an attack as any guidance cannot contradict
    the statute upon which it is based.
    ---------------------------------------------------------------------------
        \1\ For example, it seems more likely that a cyber attack might be
    carried out without immediate attribution to the perpetrating party,
    thus making it difficult to discern the motive that is necessary for
    certification.

    Q.2. How do insurers effectively measure and quantify loss from
    ---------------------------------------------------------------------------
    cyber attacks?

    A.2. Measuring and quantifying loss from cyber attacks is
    difficult and the insurance coverage for such attacks is still
    immature compared to more established lines of insurance where
    the industry might have decades, or even centuries, of data to
    draw upon. The insurance rating agency AM Best describes the
    situation as follows:

            Cyber risk modeling is still in its infancy, as events
            and threat vectors are still evolving. To simulate the
            event sets and fit them into traditional statistical
            distribution forms is the first challenge. Cataloging
            the exposure in an insurer's portfolio to these events
            and how the losses vary depending on the severity of
            the attack and estimating the financial damage are all
            complicated problems that cyber modeling firms are
            tackling. These models are improving and may provide
            directional input into relative rankings of risk but
            need to be complimented with stress testing and
            analytical, experience-based judgment for pricing,
            capital consumption, and allocation.\2\
    ---------------------------------------------------------------------------
        \2\ AM Best, ``Cyber Insurers Are Profitable Today, but Wary of
    Tomorrow's Risks,'' June 17, 2019, p. 11.

    A frequent insurer response to the uncertainty reportedly has
    been to use certain policy provisions, such as exclusions and
    limits as well as reinsurance purchases to reduce exposure to
    large losses.\3\ Policy provisions such as exclusions and
    limits tend to reduce the utility of cyber insurance to
    consumers and may lead to consumer confusion.\4\
    ---------------------------------------------------------------------------
        \3\ See ``Data Deficit Remains Key Challenge for Cyber Insurance
    Underwriters,'' Insurance Journal, June 18, 2019, at https://
    www.insurancejournal.com/news/national/2019/06/18/529663.htm.
        \4\ See ``Businesses Believe Cyber Insurance Covers More Than It
    Does: Survey,'' Insurance Journal, July 31, 2019, at https://
    www.insurancejournal.com/news/national/2019/07/31/534394.htm.
    ---------------------------------------------------------------------------

                  Additional Material Supplied for the Record

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]