Terrorism Risk Insurance Act: Considerations for Reauthorization

What GAO Found

The Terrorism Risk Insurance Act (TRIA) requires the Department of the Treasury to administer a program in which the federal government would share some of the losses from a certified act of terrorism with private insurers. After an event is certified (determined to have met certain criteria), Treasury reimburses insurers for the federal share of losses, after insurers pay mandated deductibles.

The terrorism insurance market has been stable under the Terrorism Risk Insurance Program. Treasury reported in 2024 that the insurance is generally available and affordable.

In 2021, Treasury clarified that the Terrorism Risk Insurance Program can cover terrorism losses on eligible cyber policies. But certifying cyberattacks under TRIA can be challenging for three reasons:

1. Cyberattacks may not meet TRIA's requirement that an attack be violent or dangerous to human life, property, or infrastructure.
2. Cyberattacks may not readily meet the TRIA requirement that attacks be part of an effort to coerce the U.S. population or government, or influence policy.
3. Cyberattacks may not meet the TRIA requirements that damage occur in the U.S. or in specific areas outside the U.S.

Additionally, the Cybersecurity and Infrastructure Security Agency and the Federal Insurance Office have not completed an assessment on whether cybersecurity risks warrant a specific federal insurance response. GAO's recommendations to both agencies to conduct such an assessment remain open. If Congress were to consider legislation for a federal cyber insurance response, GAO's framework for providing federal assistance to private market participants could help inform its design, such as taking steps to mitigate moral hazard.

Past changes to TRIA reduced federal fiscal exposure, but some future changes may affect affordability and availability. Each reauthorization of TRIA through 2015 reduced the magnitude of the government's explicit fiscal exposure, such as by increasing the insurer deductible from 7 percent of premiums in 2003 to 20 percent in 2020. GAO found changes to the industry aggregate retention would have a higher impact on federal fiscal exposure than changing the deductible or coshare parameters. Insurers told GAO they considered the potential effect of program changes in each reauthorization and modified risk-mitigation strategies, as needed. However, some program changes, such as those to the deductible and copayment share, and program triggers could affect the availability and affordability of terrorism insurance.

There could be significant disruptions to the insurance market if no federal terrorism risk insurance program existed. Our analysis of insurance data and information from Treasury and industry found TRIA's federal backstop has played a role in stabilizing the terrorism insurance market. In the absence of a loss-sharing program, insurers likely would limit coverage or exit certain markets.

Why GAO Did This Study

In November 2002 Congress enacted TRIA to protect businesses, ensure widespread availability and affordability of insurance for terrorism risk, and respond to concerns about how absence of such coverage would affect the U.S. economy.

This statement for the record provides information on (1) the stability of the terrorism insurance market, (2) TRIA's ability to cover cyber losses, (3) the impact of past TRIA changes on federal fiscal exposure and the potential impact of further changes, and (4) how the absence of TRIA could affect the terrorism insurance market.

This statement is based on GAO's prior reports from May 2014 to June 2022. Detailed information on GAO's objectives, scopes, and methodologies can be found in the published reports.