Kidnap and Ransom Insurance: A Strategically Useful, Often Undiscussed, Marketplace Tool for International Operations

With kidnaping rates rising, the disruptive forces of kidnaping threaten the stability and success of corporate investment projects and put stress on appropriate corporate governance response methodologies. While kidnaping targets vary considerably among countries where it frequently occurs, most often the goal of kidnapers is money from ransom payments. Financial consequences of a kidnap ransom payment can be severe for companies, and psychological damage can be lasting to employees and their families. Given the increasingly global nature of business and increasing expansion into less politically and legally stable emerging markets, kidnap, ransom, and extortion pose a problem for management of corporations wishing to take advantage of emerging market opportunities. Kidnap and Ransom (K&amp;R) Insurance is a risk control technique used by about 75% of Fortune 500 companies, nongovernmental organizations, and an increasing percentage of small to medium sized companies. It is a bundled package policy that includes the purchase of an insurance policy to indemnify the company for the costs of kidnap, ransom, and extortion. Such policies can also provide protective consulting beforehand, provide crisis response and negotiation assistance, as well as psychological support services after the fact. In this paper, we describe the K&amp;R policy, its history, other nonfinancial corporate benefits provided by K&amp;R policies, and discuss its use by corporate managers for the benefit of corporate, financial, and personnel stability. It can also be used in course on managing international risk.

Growth into unstable environments can tax the resources of companies, many of which are neither equipped nor experienced to adequately deal with risks, such as kidnap risks, of their employees (or their families). Many, even larger companies, are not prepared to handle a kidnaping should it occur. Increased globalization has incentivized firms to expand supply and distribution chains into riskier locations because they may give competitive advantage to firms by minimizing the costs of materials and labor, so as to help maximize profits. Nonetheless, if risks, such as kidnap for ransom, are not properly managed, then this economic advantage can be largely undermined. A badly managed kidnaping can affect corporate culture, reputation, morale, and employee willingness to explore future opportunities in risky areas of the world (and possibly affect the continued survival of the company itself).
For example, while a successful oil drilling project in an uncertain political environment can generate significant cash flow for an oil company, such oil production depends on locating drilling apparatus and personnel in specific geographical environments where the oil is found, even if these areas spawn increased potential for kidnap, hijacking, detention, extortion, or ransom risk. There are many offshore oil platforms near Nigeria and in Columbia, and production, as well as transportation, in such regions can be hazardous. Sometimes sending personnel into these higher risk areas is an economic imperative for the firm's expansion; however, living in, working in, or traveling to these dangerous locations poses a serious problem for the firm, and those involved in firm governance are taking notice of the risk and addressing it. 2 There are other insurance products and risk management services that exist which relate to certain risks that arise in traveling to foreign unstable environments. Nevertheless, with ever-changing kidnaping trends, and changing underlying risk environments, K&R insurers are the best equipped to handle the totality of such threats. Consequently, we primarily focus on K&R insurance only. 3 As corporate Boards of Directors adjust to this newly expanded supply chain market world, more companies and nongovernmental organizations (NGOs) will be inclined to purchase K&R insurance to cover their exposed commercial ambassadors or employees (and their families). It is imperative for these organizations to enhance security to retain key personnel, since kidnaping is an occupational hazard faced by employees needing to live or operate in risky environments. An estimated 75% or more of the Fortune 500 companies have purchased K&R policies according to Kravitz and O'Molloy (2014), Spross (2019), and Simon (2019). Globally, K&R insurance is now also being purchased by midsized companies, manufacturing and service firms, and financial institutions to protect their employees (Bowers, 2001;Moorcraft, 2019). Once solely a product for top executives, K&R insurance is now also regularly used to cover field engineers and traveling service or maintenance personnel whose job demands lead them into remote places where being taken hostage is more likely. It can be a stand-alone product, or can be included as part of a more comprehensive insurance program. Currently, total annual K&R insurance premiums collected are between $250 and $300 million (Spross, 2019).
K&R insurance provides an important security tool that allows firms to more efficiently operate in dangerous areas. K&R insurance allows for the proper management of the debilitating kidnap risk at all levels. Most coverage forms extend their reach to additionally provide preventative measures that reduce the risk of kidnap, while still providing crisis responders and negotiation teams to mitigate the consequences if the risk should be realized. Additionally, K&R insurance alleviates fiscal impacts by providing reimbursement for ransoms and other consequential costs of kidnaping incidents. Firms exposed to such kidnap risk and who obtain K&R coverage can therefore better focus on managing the rest of their operations, leaving the control and management of the debilitating risk of kidnap to those more adept at managing it. This article is an attempt to shed light on a growing and dynamic insurance market.
According to Simon (2019) the insurance side of the K&R market is dominated by two insurers (AIG in the United States and Hiscox Special Risks in the UK). More than half of the corporate world's specialized protection insurance is underwritten by Hiscox (Gauldie, 2019). There are, however, a large number of brokers that market these policies, and many security and negotiation firms that specialize in kidnap response. The Lloyds of London market is still a very major market for K&R insurance that has about 20 syndicates that arrange K&R insurance (Spross, 2019).

| DEFINING " KIDNAPING"
There is no internationally recognized definition for "Kidnap" or even "Kidnap for Ransom." A general understanding of the terms exists, but there are different categories of kidnaping, with overlapping motivations and corporate consequences. On the other hand, as far as K&R policies are concerned, recognizing a kidnap for ransom incident is pretty straightforward. Vannini et al. provide an appropriate definition: Ransom kidnapping refers to a situation in which the overriding purpose for the act is a payment (usually a sum of money) for the release of the hostage and the enrichment of the perpetrators (Vannini, Dettoto, & McCannon, 2015, p.1).
Syndicates of underwriters from Lloyd's of London largely back the K&R market (Shortland, 2016). Due to this fact, we also include a legally recognized definition of "kidnaping" from England: Endorsed by Lord Brandon of England in R v. D ([1984] AC 778), is the definition that "kidnapping is committed by the taking or carrying away of persons without their consent, by force or fraud, and without lawful excuse" (Mohamad, 2014, p. 85).
As mentioned previously, there are multiple categories of kidnaping. The three main types are criminal kidnaping, political kidnaping, and emotional or pathological kidnaping (Zannoni, 2009). The motive behind each kidnaping of most direct relevance to corporate management is usually economic; that is, the primary purpose of the kidnaping is to obtain payment of a ransom from a family member or a business of the victim (although, politically motivated kidnaping can also be relevant to a firm whose executive or worker is taken). Kidnapers can also take hostages to provide a physical shield in an attempt to escape from the scene of a crime or to use the kidnaped person as an extortion tool in conjunction with a demand for keys or secret codes to access areas where cash or valuables are stored. The main motive of political kidnaping is to demand money that can be used to fund terrorist groups or guerrilla liberation movements or to effect political or journalistic outcomes (e.g., the terrorist kidnaping of Daniel Pearl, a Wall Street Journal reporter). Emotional and pathological kidnaping can be committed by mentally disturbed people or could, for example, involve a child kidnaped by an estranged or noncustodial parent. In this paper, we focus on the first two types because of their direct relevance to corporation business decision making in hazardous business environments.
Familial kidnaping is excluded from discussion here since its corporate fiscal impact is small (although the impact on families is great). In the United States, a 2002 report from the Department of Justice (Hammer, Finkelhor, & Sedlak, 2002) estimated that there were 203,900 family member abductions of children in 1999 alone. Inclusion of these numbers would not reflect corporate risk, and comparable statistics for family member abduction is not available across countries (and indeed not all countries consider taking of a child by a biological parent as kidnaping) making cross country kidnap risk profiles for travelers and businesses uninformative and potentially misleading (e.g., the United States would look to be very high kidnap risk relative to other countries were these familial kidnapings included, yet the kidnap for ransom risk is relatively low in the United States). It would not have an effect on corporate K&R insurance. In addition to familial kidnaping, we also exclude the so called "express kidnapings" from discussion here since these have a less pronounced impact on corporate governance, corporate finances, or corporate behavior. An express kidnaping is one where the victim is captured shortly before midnight and forced to go to an ATM and withdraw their maximum daily amount, is kept until after midnight and forced to withdraw the maximum amount from the ATM again, and is then released. The whole ordeal can last <0.5 hr. It is often not a significant amount of money and is more likely to not be reported that larger scale K&R scenarios. It also has little corporate fiscal impact and is not discussed further since our focus here is corporate alternatives for managing more impactful K&R risk. Also, "virtual kidnapings" are excluded. A "virtual kidnaping" is one where a parent is called, and, using personal information about the victim obtained through unsecured social media (like Facebook, Instagram, Twitter, etc.), is convinced that the caller has the child and will harm them unless a ransom is paid. In fact, the child has not been physically kidnaped, but the extortion is sometimes successful. These kidnapings are less likely to be reported to authorities. Again, the business impact is not great here, so they are excluded from our analysis and statistics.
It must be noted that there are data challenges faced when attempting to measure the impact of kidnap for ransom risk. There are several incentives to not report kidnapings, ranging from fear of persecution, fear of governmental consequences (it is usually illegal to make payments to terrorist organizations, a frequent perpetrator of kidnaping for ransom) to fear of premium hikes, and fear of having the reputation of paying kidnapers (increasing future kidnap risk). As a result, the numbers we found related to kidnapings are necessarily acknowledged to be incomplete. To account for underreporting requires in-depth statistical analysis that is not in the purview of our paper. For those interested in modeling such discrepancies, we recommend following the statistical estimations of groups such as Wood et al. (2016), which use Bayesian statistical modeling to account for underreporting of car crashes. Nonreporting for car crashes follow similar incentives as K&R reporting, at least in so far as the desire to protect insurance premiums.
The data we did find, however, does provide an informative outline of what benefits K&R insurance provide. Underreporting means that the true number of kidnapings for ransom is higher than what is actually reported. What this implies is higher actual risk and an even stronger significance of (and need for) K&R coverage.
Data on K&R coverage is also difficult to find due to the nature of the topic. Insurers have an obvious incentive to keep exact coverage secret, since revealing policy details and payments made would result in moral hazards, and even worse, increased K&R risk. Nevertheless, we provide estimates that paint an illustrative picture of the scope of K&R coverage.

INSURANCE MARKETPLACE
The development of the dynamic K&R insurance market can be traced back to the notorious kidnaping of the U.S. aviator Charles Lindbergh's infant son from his nursery in 1932 (Economist, 2006). In spite of a large-scale investigation by the Federal Bureau of Investigation (FBI), and a ransom being paid, the baby was murdered. In addition to leaving a lasting emotional scar on the United States as a society (and the subsequent passage of very strict federal penalties in the United States for kidnaping), the Lindbergh kidnaping affected the global insurance industry, as other "at risk" individuals sought out insurance to help deal with any possible kidnap risk or ransom demands. Following the Lindberg kidnaping, Lloyd's of London insurance syndicates began selling K&R insurance to certain clients. Lloyds is still a major supplier of such insurance today.
The K&R policy, however, did not gain much attention at the corporate governance level until the 1960s when a series of bank executives' wives were kidnaped. After those kidnap cases, the market of K&R insurance grew rapidly, and it became one of Lloyd's of London's most important sources of income from the mid-1970s to mid-1980s (Economist, 2006. The market is still growing, especially after publicized events such as Somali pirates taking hostages, or terrorist kidnapings widely reported in the media. Although there are no official industry-wide statistics, according to Hiscox Insurance, sales of K&R insurance were up 30% from 2009 to 2010 (Hiscox, 2010). Corporate boards of directors are becoming more aware that due diligence requires that they examine this risk and consider how to handle it.
The London-based Foreign Policy Centre estimated that "economic kidnaping is one of the fastest growing criminal industries" and that kidnapers globally generate profits in excess of $1.5 billion on an annual basis (Lobo-Guerrero, 2007;McAvoy & Randall, 2010). As mentioned earlier, it is also estimated that at least 12,000 K&R situations occur globally each year (Bell, 2019;McAvoy & Randall, 2010). According to a study by Control Risks reported in Mohamed (2008), in the decade between 1998 and 2008, kidnapings increased over 275%. Large increases in kidnaping are not restricted to this period. Nayak et al. (2017) report that the most recent publicly available data saw kidnapings of foreign nationals increase nearly 100 between 2011 and 2012, with a $2 million average ransom demand in 2012. 4 The annual growth rate in the K&R insurance market is about 12.25% and had a market value of roughly $4.37 billion in 2010 (Venkatesan, Choudhary, & Kuntal, 2015) The crisis response and risk management company NYA24, who are contracted by many insurers to handle K&R issues, 4 In Africa alone from 2013 to 2014 there was a reported 30% increase in the number of kidnapings (Gusovsky 2015).
reports over 19,000 kidnap for ransom cases worldwide from 2014 to 2017 (NYA24, 2018). Private security services provider Kroll also postulated that there are probably more than 15,000 cases each year (Kroll, 2006).
Exact statistics on the frequency of corporate kidnaping, however, are difficult to obtain because of the fact that most kidnap cases are often not reported. Bell (2019) estimates that no more than 20% are reported, and in some countries the reporting rate may be much lower. 5 In Mexico, for example, in 2008 it was estimated that only about 10% of kidnapings are reported each year (Kenney, 2008, p. 572). McAvoy and Randall (2010) estimated that more than 7,000 people were held in 2008 in Mexico alone, so if Kenney's estimates are accurate, then in 2008 only 7,000 of an approximate 70,000 kidnapings in Mexico were reported. More recent data (2012) released in 2013 by Mexico's statistics bureau (INEGI) estimated there were 105,682 kidnapings in Mexico in 2012 with only 1,317 reported to federal or local authorities (a low 1.2% reporting rate). Because of perceived corruption (suspected and sometime proven) involvement of police and other authorities, many felt it was a waste of time to report as they suspected that nothing would be done, or worse, that more harm would come to their family members or employees (Ferdman 2013). More credence can be given to the countries of vulnerability (and relative risk) estimates and trend estimates of such K&R companies (like Control Risk, 2018, 2019) since, as noted in Shortland (2019), not only are most kidnaping for ransom that are insured arise out of Lloyds of London syndicates, but also the various Lloyd syndicates share information such as where kidnaping occur, what ransom was paid in particular location, and presumably also whether or not the kidnaping was made public (as the insurers also have incentives not to announce K&R claims as noted in the paper). Thus, there is a higher level of confidence in the statistics of Control Risk and other K&R firms (e.g., AIG, Hiscox, etc.). Kidnapings are more likely to be reported in countries where there is more faith in the authorities being noncorrupt and willing (and able) to help the victim (e.g., the United States, UK, and EU). Countries with drug cartel related kidnapings or gang related kidnaping are less likely have reliable kidnap reporting for these reasons, and because of fear of reprisal.
Not reporting by firms (and individuals) may have another rational basis. Companies are reluctant to disclose that they paid a ransom, since disclosing this information could make their other employees more vulnerable (announcing that they paid), or might even subject the company to legal problems if it were determined that such ransom payments violated certain countries' law against giving financial support to guerrilla or terrorist groups. For example, the United Nations Security Council passed a resolution (#2133) in 2014 prohibiting states from "making funds, financial assets or economic resources available for the benefit of those involved in terrorist acts" (UN Security Council Resolution 2133). The United States addressed the ransom issue in U.S. Code Title 18, Crimes and Criminal Procedure, specifically in Part I, CRIMES, Chapter 55, Kidnaping, and Section 1202, Ransom money. Here such ransom payments are deemed criminal and delivering such a ransom or reward "shall be fined under this title or imprisonment not more than ten years, or both." It should be noted however, in 2015 President Obama signed an Executive Order that basically allowed private ransom payments by families to recover relatives kidnaped overseas. While the U.S. government itself will continue its over 200 year old policy of refusing to pay 5 According to the U.S. State Department Bureau of Consular Affairs 30-40% of U.S. citizens' overseas kidnaping are reported (Gusovsky 2015). The higherreporting rate for U.S. citizens could be due to a more free and investigative press and less incentive for U.S. citizens to not report (less fear of retribution), and more faith in fidelity of governmental authorities. ransom payment, President Obama's administration pledged not to prosecute families who privately pay ransom (Jackson & Johnson, 2015). Thus, assuming no changes in subsequent administrations, a K&R policy that reimburses a family for private ransom payments would be acceptable under this standard. According to Greg Bangs (product manager for the kidnap/ ransom and extortion unit at the Chubb Group of Insurance Companies, quoted in MacDonald 2012) "all K&R insurance is set up as reimbursement policies, because in many countries around the world, it's illegal to insure against a ransom but not to pay a ransom," and "It's 100 percent legal for a company itself to pay the ransom, and then normally the K&R insurance reimburses them for that back in their home country." Kidnapings for ransom inside the United States itself are very infrequent, and when U.S. kidnapings do occur, 95% of the kidnapers are caught and punished (Macko, 1997). The proportion of global kidnap for ransom in the United States has also been trending downwards, the main reason being that the FBI is involved in all kidnap cases and respective punishment laws are strictly enforced. The worldwide percentage of kidnap-for-ransom incidents in 2012 for United States, Canada and the Caribbean combined was only 1% (Statista.com, 2019 (2019) says Asia-Pacific is the largest business travel market in the world, due in part to densely populated countries, strong economic growth and high penetration of internet and technology. It is also high risk for kidnaping. Control Risks (2019), a risk analyst group expert in handling kidnapings, offers the following breakdown of kidnaping trends by region for 2018. The Americas, mostly south of the United States, accounted for 37% of global kidnaping, down from 48% the previous year. Sub-Saharan Africa accounted for 26% of global kidnaping, up from 19% of the previous year. The Asia-Pacific region accounted for 29%, up from 22% of the previous year. On the other hand, the firm NYA24 estimates that the Asia region accounted for about 43% of their recorded kidnapings, noting that the high number of kidnaping incidents in India contributed to this percentage (NYA24, 2018).
There are multiple risk analyst groups with expertise in global kidnap for ransom trends. Like the K&R market, kidnaping trends are also dynamic, and business firms should stay up to date with kidnaping trends when planning business expansion or employee travel to hazardous areas, and they should use this knowledge when seeking K&R coverage to mitigate kidnap risks. Tracking kidnap trends also provides insight into whether or not premiums will be on the high end (premiums depend on where one is traveling). Key to this analysis is paying close attention to what type of kidnaping is going on in a particular region.
In Mexico, drug cartels may kidnap journalists in order to silence their reporting of smuggling. In Columbia, armed kidnaping forces may target workers from oil companies. Nigerian and Somali kidnapers may pirate cargo to demand ransom. Kidnaping wealthy businesspersons from Taiwan or Hong Kong is common in China. Another form of corporate kidnap reported to occur in China involves "unwarranted detention," a euphemistic phrase used by insurers to describe the situation wherein local firm, during business negotiations, tries to exert undue influence on foreign executives by using co-operative accomplices in the local government or the local police to have the foreign businessperson placed under house arrest (Economist, 2006).
The kidnaping/ransom/extortion attempts (and successes) involving pirating cargos with people onboard has also been drawing recent media attention. For example, according to the International Maritime Bureau (ICC Commercial Crime Services, 2017), in 2017 there were 136 vessels boarded, six hijacked, 16 of which were fired upon by pirates, and 22 more attempted hijackings. Of these, 75 were kidnaped for ransom. Somali piracy accounts for many of the 2017 figures, with continuing opportunistic attacks in 2018. The pirates illegally intercept vessels and hijack the vessel, crew, and cargos in order to force the ship-owners to negotiate with them, usually through an intermediary, for the secure release of the vessel, its cargo, and crew. The ransom sometimes represents an economic proportion of the value of the property at risk.
Near the Gulf of Aden (connecting the Red Sea with the Indian Ocean, with Yemen to the north, and Somalia to the south), piracy has continued to escalate at such a rate that K&R insurance premiums have increased by 10 times (Sakellaridou 2009, p. 8). Analysts disagree on the cost of piracy per year, some arguing it totaling to $1 billion a year, while others range it as high as $16 billion (Sakellaridou, 2009, p. 11). The reason for these conflicting numbers is that, as with other kidnapings, much of the piracy goes unreported, in part because ship owners fear a significant increase in their premiums or a reputation with the pirates for paying.
Kidnaping resolutions vary of course, but most accounts follow a similar distribution. According to Gigerenzer (2002), the ultimate resolution of kidnaping events breaks down as follows: Resolution of kidnaping events Resolution %
These statistics are roughly similar today with Simon (2019) reporting that only a small percentage of kidnap victims escape, very few are rescued, and <1% of kidnapings end in the death of the victim. K&R insurance is key for positive resolutions in kidnaping events. Cognizant (an insurance consulting group) estimates that deaths resulting from kidnaping events are reduced by 88.89% when the victims are safeguarded by a K&R insurance policy (Venkatesan et al., 2015). This claim is supported by K&R expert Dr. Anja Shortland's findings that "97.5% of insured hostages come back" (Peterson, 2019) and Simon (2019) who also reports over 97% of cases with K&R insurance involved result in successful release.

| THE K&R INSURANCE POLICY GOALS AND PROVISIONS
A key characteristic goal of K&R insurance is to provide support to the insured client and the victim so as to secure a release of the kidnaped person with minimal physical harm or trauma. Additionally, the insurer, in the interests of the client, attends to the correct handling of any extortion or ransom demands and attempts to safeguard the continued business operations while acting within the law (Victor O. Schinnerer & Company, 2010a, 2010b. From a corporate governance perspective, this is important as the unanticipated rapid gathering of large quantities of money to pay a ransom may force the company into untimely disintermediation of assets or require putting other positive net present value projects on hold (or even discontinuing projects). Loans taken by the company (or family) are a usual mechanism for obtaining funds quickly.
K&R policies typically do not have deductibles. As a result, premiums mostly go toward covering the ransom payments, crisis response services, and the costs of getting in touch with criminal and regulatory authorities (Barlyn & Cohn, 2017). Generally, a K&R insurance policy provides coverage for the following (Kenney, 2008, p. 561): 1. Reimbursement for paid ransom (the insurer does not pay the ransom directly), 2. Reimbursement of expenses incurred in resolving an extortion attempt or in securing the kidnap victim's release, 3. Reimbursement of expenses incurred in securing the release of a detained or hijacked victim, 4. Reimbursement of money lost in the ransom delivery process, 5. Access to security consultants (on a nonreimbursement basis) for training related to preventive measures such as personal risk management security awareness, training, and danger alerts. The preventative training and advice are a side benefit of the underwriting process itself as exposures must be understood in order for premiums to be set. Crisis management advice is also given during the entire process.
Additionally, in the event of an abduction, the insurance firm behind the K&R policy can provide access to individuals experienced in hostage negotiation, and crisis risk management response (up to and sometimes including mounting an armed rescue attempt). In addition to covering direct indemnification costs related to ransom coverage, contracts can include coverage which provides reimbursement of reward money provided to informants, fees incurred in securing and employing an interpreter, incurred legal expenses, personal financial loss reimbursement, and even cosmetic surgery if needed subsequently. The coverage can be extended to the family of the employee overseas as well as the employee him or herself (Kenney, 2008).
In particularly risky environments, where suspending operations and evacuating personnel is not feasible within the corporate strategic business plan, K&R insurance providers can give security advice related to preventive measures. They can assist in making sure that potentially targeted employees movements are unpredictable (restrictions on nonessential travel, advising to take different routes to work each day, use different times and cars, changing hotel reservations upon arrival, etc.). In more extreme situations, security personnel can be arranged to provide potential targets with physical protection, such as armored vehicles or armed escorts.
Providing security and protection services not only protect the interests of the insured but also of the insurers who wish to reduce moral hazards. Moreover, there is a level of confidence that assumes individual policyholders will actively work against putting themselves through the trauma of being kidnaped, even if they are covered. Moreover, many K&R policies can stipulate to policyholders (company agent purchasing the insurance) that if employees are made aware of their coverage, their insurance contract is "automatically invalidated (Shortland, 2019). These mechanisms usually take the place of more common moral hazard reducing instruments, such as deductibles. 6

| PREMIUM CONSIDERATIONS
Premiums for K&R insurance vary greatly depending on the risk of the country where coverage is provided (and naturally also upon what "add-ons" or endorsements are included), the visibility of the person being covered, whether coverage is for a single trip, a year of coverage or a multiyear contract, and how many personnel are covered. For example, according to Macko (1997), in 1997 the annual premium for a $1 million policy for a family of five could range from $18,000 to $30,000 whereas for a $5 million policy, the premium would be about $70,000 (Macko, 1997). In countries with political turmoil or known historical kidnap risk, the premium is higher. More recent estimates for a top C-Suite executive, annual premiums are estimated to range anywhere from $250,000 to $500,000 a year (Jett, 2017). More accurate premium estimates are hard to obtain since any publications of real premiums and coverages is likely to affect the amount of ransom demanded by kidnapers. Moreover, premiums will be very firm exposure specific. Depending on expose, a year of not hazardous location travel could cost $2,000 for a $5 million policy that covers ransom and provides the risk and crisis management team described previously (Bell, 2019).
Gallagher (2019) provides one way in which premiums are advertised. On their website, they give two estimates: $400 per million limit for companies with limited foreign exposure (locations or travel), and $1,000-$3,000 per million of coverage limit for companies with higher exposures, including frequency of foreign travel and locations. The $400 per million limit premium means that every million dollars of coverage provided costs an additional $400 in premiums.
The capacity of the K&R market can be large. Great American Insurance Group (2019) offers K&R liability limits of up to $65 million with no deductible and no excluded countries and which can be customized to suit an individual or a corporation. Companies with higher exposure face premiums in the range of $65,000-$195,000 a year.
Additionally, the probability of needing to pay-out on Kidnap for Ransom is hard to estimate without more detailed information about the travel, risk, and so forth, to be quoted, which results in difficulties in obtaining general information concerning pricing of coverage on other than a specific application basis. This problem exists within Terrorism Insurance, too. Michel-Kerjan and Kunreuther (2018) found that insurers will set higher premiums for events with ambiguous probabilities and uncertain losses. A previous study by Kunreuther found that insurers charged about 1.43-1.77 times higher than for cases with ambiguous probabilities and uncertain losses (Kunreuther, Hogarth, & Meszaros, 1993).
Nonetheless, premiums can vary across the board. According to American International Companies, EglobalHealth Insurers and Agency, and Hiscox insurance syndicate in Lloyds of 6 Unlike deductibles in automobile and health insurance, deductibles in K&R insurance would generally not be expected to a useful technique to decrease the moral hazard associated with the employee having knowledge of their K&R coverage. The moral hazard usually associated with "taking less care because there is insurance present" is mitigated by the fact that the kidnap victim faces physical hardships including lack of food, physical discomfort, psychological and physical torture, and possibly death. Accordingly, for this reason it still behooves them to take care even if no deductible is present. In addition, the moral hazard associated with a person "faking" or conspiring in their own kidnaping for a share of a large ransom will not be deterred by a third party (their employer-policyholder) having to pay a deductible. Finally, the use of deductibles would only further constrain the individual company's (or individual's) ability to raise the money needed proceed with following the kidnaper's ransom demands.
London (see also Chandler Solutions, 2019), premium considerations for a K&R insurance policy will generally depend on the answers to the following types of questions (and their follow up questions) useful for assessing risk: • Has the company experienced or been threatened with any attempted kidnaping, extortion, or detention before? • Are there any current threats regarding kidnaping, extortion, or detention?
• What are the details of the coverage you are seeking?
• Which country you are living in/traveling to?
• What industry are you in?
• What kinds of operations does your company undertake?
• What is the financial management/revenue of your company? • How many employees (size of the company) are there in your company? What is your corporate responsibility? • What are the travel patterns of your employees?
Companies that know their answers to these questions can optimize their responses and practices to minimize their expected premium costs. This reduces the problems associated with adverse selection as well as allowing insurance companies to better manage moral hazards.
Being able to answer these questions in a satisfactory manner is important for policyholders to maximize their net gain.
Additionally, those interested in purchasing a K&R insurance policy should do proper research into potential insurers. This includes gaining familiarity with the differences in advertised K&R packages and finding one that best fits their company's needs. For example, if a company wants to venture out into a specific region, such as Southeast Asia, then it is best to look for policies that include crisis responders with a particular expertise in such areas. Staying up to date with kidnap for ransom trends is critical to maximize coverage in K&R policy negotiation.

| PUBLIC POLICY CONSIDERATIONS
As mentioned previously, the United Nations and some other countries, have stated public policy prohibitions against giving support to terrorists or guerrilla organizations. Ransoms collected by these groups go to fund their activities, and as such, the payment of ransom can conflict with public policy or laws in some countries. Accordingly, such payments may not be reported to authorities and the existence of K&R insurance may be kept confidential (even from the insured) for this reason as well. While currently enforcement of the legal prohibition against paying ransom in United States only applies to the government itself (and not to businesses or individuals after Obama's Executive Order of 2015), it is still illegal (the law has not changed, only the Justice Department's administrative enforcement of the law as it applies to families has).
It has been argued (Clendenin, 2006) that the payment of such ransoms by businesses and individuals should be outlawed (and enforced) as being contrary to public policy and leading to increasing risk in the long run. This perspective has been challenged by Kenney (2008) as being counterproductive and potentially endangering to the victims and their families (and the firms involved).
In our opinion, prohibition against payment is not good public policy. First, such a prohibition in a single country would prove to be ineffective as insurance companies in other countries could still sell K&R policies to international corporations, wealthy individuals, and business people and still indemnify ransom payments. Second, there appears to be no empirical relationship between the country's stated policy on legality/illegality of ransom payments and the number of the country's citizens that are kidnaped for ransom (Mellon, Bergen, & Sterman, 2017). For example, the United States has a prohibition against paying ransom, yet compared with other countries that are known to pay ransom, a disproportionate number of United States citizens are kidnaped for ransom (perhaps for political reasons, or due to the perception of relative wealth of American business travelers and their firms). Finally, a "no payment" policy will put businesspeople at greater risk because many of their families may lack the means necessary to secure their release. Even though in the long run it might be argued that nonpayment helps close a funding source for terrorist and guerrilla organizations (if kidnap for ransom loses its profitability, the frequency will decrease), implementing a nonpayment policy is not a useful alternative for corporations. For the corporation, nonpayment increases the risk that the valuable employee will be killed or the hijacked cargo destroyed (a costlier alternative for the firm). The disruptive business consequences are greater with nonpayment, especially since, as noted previously, over 97% of victims are released when there is K&R insurance (which can reimburse for ransom paid). Allowing the payment removes illegality and takes the payment out of the shadows and making the problem more transparent. As learned from the many syndicates in Lloyd of London who specialize in K&R insurance and who cooperatively share their data, more successful negation techniques, and control on sizes of ransom paid, and other positive results can ensue when such information is distributed, which it might generally not be if illegal (Shortland, 2019). Being afraid to reveal such payments because of illegality can inhibit this progress.
As mentioned previously, the purchase of K&R insurance is usually kept confidential (Hiscox, 2010;Wojcik, 2012), and even those covered are usually unaware that they have the coverage. In fact, under many K&R contracts, revealing such coverage runs the risk of invalidating K&R contracts (Shortland, 2019). This is not solely to align with public policy considerations, but also to avoid moral hazard (e.g., potential fraudulent kidnaping conspiracies) and to avoid the increased risk created by employees having this knowledge If the kidnap victim knows, under the duress of a kidnaping they might tell the kidnapers "Don't kill me-my firm has $10 million in K&R Insurance on me." Then the ability to negotiate for reduced payments is severely constrained and negotiation becomes much more difficult. In addition, the kidnapers may choose to simply kill the victim and kidnap someone else who is viewed as being easier to deal with and who does not have the potential of having a K&R insurer and their team mount an armed rescue attempt. At the least, the kidnapers are likely to move the victim to a more remote and secure defendable location making rescue and negotiations more difficult and hazardous (and perhaps more expensive). Also, if K&R insurance is known to the kidnapers to be (or have been) available as a source of ransom payments, it can put future employees at increased risk, For this reason, some insurers may retain the right to cancel the K&R insurance if its existence becomes widely known and consequently compromises the abilities of the insurer and crisis management team to respond adequately. Generally, K&R insurance policy existence and provisions is held in strict confidence by the firm buying the coverage, with only a selected few within the firm cognizant of its existence until the need for the coverage arises.
A recommendation to purchasers is to select a K&R policy form that only requires a reasonable effort, as much as possible, to make sure that there is restricted awareness of the K&R coverage. This allows the policyholder room for reasonable discretion in deciding where and when to disclose coverage. Additionally, it is advisable to select a policy that does not require immediate notification of the insurer (or authorities) as this might go against kidnaper instructions and might endanger the abducted person's life. Such a clause, however, still requires you to alert the insurer and law enforcement when it is safe and practicable to do so. The Hiscox K&R policy form, for example, incudes these clauses (Hiscox, 2009). They say under Notice of Claim (Hiscox,p. 7) C. Notice of Claim-It is a condition precedent to the Company's obligation to pay when an Insured Event has occurred, or is believed to have occurred, the Named Insured shall: (1) notify the Company and Control Risks (or an alternative Security Consultant that the Company has approved) and provide whatever information is required as soon as is practicable; (2) inform or allow Control Risks (or an alternative Security Consultant that the Company has approved) to inform the appropriate authorities responsible for law enforcement in the country where the Insured Event has occurred, or is believed to have occurred, of the Kidnap, Extortion, Products Extortion, Detention or Hijack, including any Ransom demand, as soon as is practicable, but taking into consideration the personal safety of the victim.

| FURTHER CONSIDERATIONS ABOUT K&R INSURANCE
After a kidnaping and ransom payment, the corporation has to determine how to expense these costs of doing business on their taxes. For example, if the child of an oilfield worker is kidnaped and $50,000 is paid to secure her release, then a question arises due to the expense not being that for an employee nor occurring on the job as part of business operations. If K&R insurance had not been purchased, then the deduction of the expense is not a straightforward issue. On the other hand, the purchase of K&R insurance can be deducted as an ordinary business expense, and the coverage extended to the family of exposed workers by endorsement. Without insurance, the situation is less clear when the kidnap victim, such as a wife, is not an employee (however the ransom paid for an employee can be deducted as a nonbusiness casualty or theft loss). Other expenses associated with the kidnaping may pose deductibility problems (e.g., the expenses associated with finding a lost child may not be eligible for deduction). Purchasing the K&R insurance appears to alleviate these problems, as the policy is a bundled package of benefits under a single price. This aforementioned bundle of benefits is a main incentive for companies and NGOs (and individuals) to purchase a K&R insurance policy rather than self-insuring (retaining) the risk. Even if the individual or firm does have the means to pay the ransom payment, there are important comparative advantages in employing the bundle of services that a K&R policy provides. Insurers already have contracts with crisis responders, negotiation teams, and so forth, and are better equipped to provide a rapid response to a kidnap for ransom incident. This is even truer when taking into consideration the role of Lloyd's of London, whose syndicates underwrite most of these K&R insurance policies (Shortland, 2016). There are about 20 syndicates that underwrite kidnap for ransom risks, each comprised of one or more Lloyd's members that provide capital for the syndicate and accept the respective financial risks. These syndicates are run from the same floor and building on Lime Street in London (Shortland, 2016). They work closely together, and if one of their subcontracted crisis responders or negotiation teams are lacking, then all Lloyd's of London syndicates drop their contracts. This provides a huge incentive for these teams to provide exemplary results.
Additionally, this concentration of organizations allows for a de-facto governance of ransom demand spillover. These syndicates share ransom knowledge and accordingly know what to expect from kidnapers. Shortland also found that insured transnational kidnap cases generally settle for relatively smaller amounts compared with what most firms could settle for (Shortland, 2016, p. 286). Instead of firms self-insuring and paying large ransoms (and setting ransom amount precedence and expectations by the kidnapers), insurers work together to keep a lid on ransom inflation. The estimated K&R profits of $1.5 billion mentioned earlier would most surely be much higher if it were not for this coordination amongst insurers (Economist, 2018;Shortland, 2019).
Someone reading this article might wonder what relevance $1.5 billion has in a global economy worth trillions. Like other specialty insurance markets, however, K&R is much more than the ransom dollar amount. There is a huge social cost associated with K&R, ranging from the psychological damage done to the victim to the trauma carried by their family, friends, and colleagues, and the potential for reputational risk and even bankruptcy for the firm involved. A kidnaping results in the disruption of networks and value creation. For this reason, K&R insurance is a powerful corporate tool. Its bundles of benefits provide multinational organizations with proper security to allow them to continue to conduct business in otherwise very dangerous areas. Lobo-Guerrero (2007) describes this benefit as: The insurance policy, once a claim is made, enables the possibility for the victim to recover his or her capacity to be a parent, a friend, an employee, a citizen. The policy facilitates putting the victim back into circulation, a circulation of species-life that proceeds through the complex networks and technologies through which and in which the individual "exists." As such, K&R insurance is a security instrument that allows a company to continue to make profits, a family to continue to function, and an individual to continue to succeed by recapacitating them and continuing the circulation. Psychological posttraumatic counseling for the abducted and their families and coworkers can be of substantial value in facilitating the continued operation of the organizational system in which the kidnaping occurred.

| CYBER RISK AND RANSOMWARE COVERAGE?
Increasingly another common disruption of business activity requiring the payment of ransom to return the business operations to a pre-event status is the usage of ransomware, a form of computer malware that is malevolently embedded into a company's database or operational system and used to hold data and servers "hostage" until a ransom is paid to free them. The hacker who installs this malware demands a ransom payment return for retrieval of stolen passcodes and data access.
Ransomware attacks and other cyber weapons are targeting individuals, companies, and governments at an increasingly alarming rate. In September 2016, the National Cyber Security Centre for the UK reported that the amount of recorded cybersecurity incidents had doubled year-on-year, reaching 200 per month (Camillo, 2017). The U.S. Department of Justice now estimates that an average of 4,000 ransomware attacks occur daily since January, 2016. In 2015, this number was a mere 1,000. Cyber security firm Symantec Corp observed over 460,000 ransomware attempts in 2016, a 36% increase from the previous year (Barlyn & Cohn, 2017). According to Malwarebytes, there has been a 363% year-over-year increase in Ransomware attacks in the first half of 2019. Additionally, in a report by Trend Micro, the total number of ransomware detections between January and April of this year was 40,916,812.
Meanwhile, the average ransom demand increased by 266% (Barlyn & Cohn, 2017). Cybercrime is reportedly costing the global economy approximately $445 billion a year, with the potential to reach $1 trillion within the next decade (Camillo, 2017). These statistics are not the only concern as ransomware is becoming more advanced. For example, the use of fileless ransomware (e.g., a code that embeds itself in an existing resident software like Windows PowerShell, without being written to disk) and lateral payload distribution methods (e.g., bitcoin payments) changes the threat and payment delivery process. The recent ransomware attack on over 20 Texas cities (Fazzini, 2019) reinforces the pressing nature of this issue. Now, it is more important than ever to protect businesses as well as communities from malicious cyberransomware threats.
In fact, some K&R insurance policies do provide reimbursement for ransom paid as a result of ransomware. While the usual K&R coverage is provided only in connection with "kidnap," "detention," or "hijack" of an "insured person" (Skidmore, 2018), coverage can vary in wording under different policies, so those seeking ransomware coverage should be careful to examine the breadth of the wording in the particular policy to allow coverage for ransomware extortion involving other than human targets. Kidnap, Ransom and Extortion Insurance can cover cyberextortion. While standalone cyber insurance coverage can be purchased separately, depending on the wording of the K&R policy, there may be additional coverage either explicitly or implicitly for cyber extortion claims in the K&R policy too.

| CONCLUSIONS
The dynamic K&R insurance market offers a wide range of services associated with the mitigation of potential kidnapings and their consequences, beyond the simple indemnification of ransom dollars paid. K&R insurance coverage provides the insured with the necessary security to allow business expansion or continue operations in regions otherwise deemed too risky to operate in. Corporate directors must protect their employees and families if their business operations put them at risk. Companies of all sizes are increasing their business by expanding supply chains or distribution systems into emerging markets, which are intrinsically less stable politically, legally, and economically. The unavoidable increased potential threat of kidnaping is a marketplace risk whose handling must be confronted at a corporate strategic level.
Many firms and NGOs are not equipped to properly mitigate kidnap risks themselves, much less internalize the sudden demand for high ransom costs. The dynamic K&R market has evolved and possesses a comparative advantage in handling these risks. Due to their specialization and expertise in preventative measures, crisis response, negotiation teams, and ransom indemnification, K&R providers can address the totality of kidnap issues, financial as well as psychological. To obtain optimal coverage, a firm with this exposure should research K&R insurers and policy language (there is no "standard" form used by all insurers) that will best fit their needs, such as K&R policies that include extortion coverage and maybe even ransomware risk on top of human kidnap risk.
More and more firms are using K&R insurance as a means of hedging these risks and the disruptive financial (and personal and psychological) consequences of abductions, extortions or hijacks as they expand into emerging less stable counties. As mentioned previously, K&R is a risk control technique used by about 75% of Fortune 500 companies (Kravitz & O'Molloy, 2014;Simon, 2019;Spross 2019) because it provides indemnification of costs as well as pre-event security advice, crisis management and rescue response, professional negotiation teams to assist the firm, and psychological counseling of affected persons after the event. It also has important tax consequences whereas self-insuring (retaining) such risk has payment deductibility still uncertain. Consideration of kidnap risk, training for appropriate prevention behavior, and crisis management plans are important aspects of corporate governance in this evolving, more hazardous global business environment. K&R insurance, while little known and unpublicized, can play an increasingly vital strategic role for corporate Boards of Directors to mitigate such risks and their consequences.