A bomb threat shut down several blocks of downtown Halifax in August, evacuating hotels, government offices and the towers at Purdy's Wharf while police contained a suspicious vehicle. The threat turned out to be a false alarm. But it did what these incidents always do in Canada: it reopened the question of what happens to the businesses in that evacuation zone if a threat like that isn't a false alarm.
The uncomfortable answer, twenty-five years after 9/11, is that Canada still doesn't have one. The US, UK, France and Germany all built a government-backed reinsurance mechanism for exactly this kind of loss in the two years after the attacks. Canada looked at the same problem, started the same conversation and then simply didn't finish it.
The mechanics of why 9/11 forced this conversation everywhere are well known in the industry by now: a single, deliberate attack produced roughly US$60 billion in insured losses across property, aviation, life and liability lines simultaneously, and reinsurers worldwide responded by pulling terrorism cover from commercial policies rather than trying to price something with no relevant loss history. What's less discussed is how differently governments responded to that same reinsurance vacuum.
In Canada, the Insurance Bureau of Canada spent the last months of 2001 in talks with the federal Finance Ministry, pushing for a temporary government reinsurance facility before year-end treaty renewals on December 31, the same deadline the US industry was racing against. The Canadian government's own read on the situation, according to contemporaneous reporting, was that it "did not want to move in advance of, or in a sufficiently different manner than, the U.S." Ottawa decided to wait and see what Washington would do.
Washington took another year. Canada's deadline didn't wait. When reinsurance treaties renewed on January 1, 2002 with no government mechanism in place, Canadian insurers did the only thing they could: they began writing terrorism exclusions into commercial property and liability policies, eventually covering an estimated 70% of the market. Parliament, for its part, moved fast on the security side. The Anti-terrorism Act received royal assent on December 18, 2001 but no equivalent urgency applied to the insurance question.
It would be easy to assume Canada simply hadn't gotten around to it yet. By 2007, a Guy Carpenter report made clear that wasn't the case: Canada had, by then, deliberately declined to join "the global trend" of government-backed terrorism pools taken up by the US (TRIA), the UK (Pool Re, expanded after 9/11), France (GAREAT) and Germany (Extremus). The report's explanation was that Ottawa "felt insurers had not shown a willingness to commit a sufficient percentage of their assets to any proposed program." In other words, the two sides never agreed on the price of admission, and once the immediate post-9/11 urgency passed, neither side had much incentive to reopen the file.
The report also flagged a very Canadian wrinkle: large parts of the country's insurance law were, at the time, more than 80 years old and never built with a peril like this in mind, creating particular confusion over whether fire damage following a terrorist act should be treated the same as fire following an earthquake.
With no public backstop, the market did what markets do: it improvised. Terrorism coverage in Canada today is typically sold as a standalone product, layered on top of a standard commercial policy rather than bundled in automatically, with capacity coming from private insurers and the broader Lloyd's and global reinsurance market rather than any domestic pool.
It works, in the sense that coverage is generally available to businesses that go looking for it. It is also, by design, thinner than the US or UK equivalent, and a recurring industry concern is that a lot of Canadian terrorism wordings were originally adapted from American definitions and don't always map cleanly onto the kinds of incidents more likely to occur here.
That gap has resurfaced periodically ever since, usually the same way it did in August: a threat, a headline, a round of "should Canada finally build one of these" commentary, and then quiet again once the immediate danger passes. It happened after the 2015 Paris attacks, when brokers openly floated the idea of a Canadian scheme in the trade press. It happened again this year in Halifax.
Each time, the underlying arithmetic hasn't changed: the market has muddled through without a major, market-breaking terrorism loss on Canadian soil, so the political cost of building a backstop nobody has needed yet keeps outweighing the cost of not having one.
That arithmetic is exactly why 9/11 remains relevant to lines of business that have nothing to do with terrorism. Cyber risk poses the identical test the industry failed to fully answer in 2001: can a loss be modelled with confidence, does it stay independent of other losses rather than cascading through thousands of unrelated policyholders at once, and is there enough capacity to hold it without a public backstop.
Canada's cyber market is growing quickly with industry estimates putting it past US$590 million in 2025, heading toward US$1.14 billion by 2030. The reality is that capacity per risk still lags the UK and US markets, and carriers have been closing that gap only recently.
Twenty-five years on, the number worth remembering isn't the size of the 9/11 loss. It's the number of major economies that responded to that loss by building a public-private backstop, and where Canada landed on that list: alongside the US, UK, France, Germany and a growing number of others who decided a systemic, hard-to-model risk needed a government partner Canada is still, deliberately or by inertia, not one of them.
