CBI for the Cloud

   By Lon Berk, Partner, Hunton & Williams

In his article, "CBI for the Cloud," appearing in the Nov./Dec. 2011 issue of Coverage, Lon Berk of Hunton & Williams observes that the frequency of business cloud computing is expected to increase. The article describes cloud computing and its many advantages to businesses as well as its potential disadvantages. A significant risk is business interruption in the cloud. Examples of such business interruptions are described demonstrating the importance that companies understand whether the risk of such interruptions is covered under their insurance programs. The article then identifies the most promising coverage for losses caused by business interruption in the cloud-contingent business interruption ("CBI") insurance coverage. The article describes the nature and scope of CBI coverage, including the range of "dependent locations" to an insured company. CBI coverage is only triggered when a dependent location sustains "physical loss or damage."

The article discusses some courts' findings that damage to software or data does not constitute "direct physical loss." Accordingly, insurers have maintained that CBI coverage does not extend to interruptions in cloud computing. The basis for this contention is that data or software is not tangible or physical and thus cannot cause direct physical loss. The article argues that this contention is incorrect. To establish this, the article first provides a general description of what a computer is and does and points out that corrections made to restore computer data or functionality constitute physical repairs. Court decisions that do not distinguish between physical loss and data loss are analyzed.

The article notes that perhaps in response to the force of such arguments, insurers have both added policy exclusions purporting to restrict the coverage available for data loss and have offered separate policies to cover losses due to data and software corruption. The article contends that the exclusion should not apply to the vast majority of incidents that might result in interruption of computational services provided by cloud vendors. The article concludes that insured's facing such losses should look to their legacy CBI policies as well as any new specialized policies they may have for coverage.

Access the full article, CBI for the Cloud, on Lexis.com.

Purchase Coverage in the LexisNexis Store.

Read Abstracts of Coverage Articles.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Siemens and Beck on Obtaining Optimal Cyber Insurance

   By Rene Siemens and David Beck, Attorneys, Pillsbury Winthrop Shaw Pittman LLP

This commentary observes that the rising threat of cyber attacks and data breaches as well as the proliferation of data security and privacy laws have made it more important than ever for organizations that handle sensitive information to insure against data security and privacy losses.  The article further points out the most common cause of a data security breach remains the failure of employees, business partners or third-party outsourcing data processors to protect data. The article notes that there is a plethora of data security compliance laws in effect at both the state and federal level and discusses several of these statutes.

The article demonstrates that in recent years, a large and rapidly growing market has evolved for insurance that covers these so-called "cyber" risks.  These policies vary widely. This article analyzes potentially available coverages under both the newer cyber insurance policies and more traditional lines of coverage. With respect to third-party coverage they include various crisis management expenses, claim expenses, and regulatory response costs. First-party coverages in cyber insurance forms typically include costs associated with the loss of data collected by the insured, and lost revenue caused by interruption of an organization's data systems due to a cyber attack or denial of service attack. These coverages are delineated. The article identifies issues that arise under cyber insurance coverage and exclusions. It features recommendations for negotiating optimal cyber insurance policy terms, and identifies some of the pitfalls to avoid when purchasing cyber insurance.

Mr. Siemens is a nationally recognized insurance coverage practitioner who represents policyholders in negotiations and disputes with their insurers. He also handles complex litigation matters including product liability, mass tort, environmental, and consumer cases. Mr. Siemens has helped clients recover over $2 billion from their insurers. Chambers USA has described him as "an encyclopedia of insurance law," the PLC Cross-Border Insurance and Reinsurance Handbook ranks him in the top tier of policyholder attorneys, and Legal 500 has described him as "the smartest guy in the room." His practice encompasses almost every kind of insurance issue, ranging from major disaster, environmental, asbestos, nuclear, and product claims to large property and business interruption losses; disputes under D&O, E&O, and fiduciary liability policies; and cyber-liability, advertising, aviation, bond, clinical trial, credit, employment, insolvency, IP, life, media, mold, and warranty coverage issues.

Mr. Beck is an associate in the litigation department of Pillsbury Winthrop Shaw Pittman LLP. Mr. Beck advises on the resolution of complex business and contract disputes, with particular emphasis in the areas of construction and engineering.  In the area of insurance, Mr. Beck has handled numerous claims involving builders risk, commercial general liability, employment practices liability, pollution, professional and other policies.  Most recently, he has handled insurance claims involving engineering and construction defects, environmental contamination, directors and officers liability, employment liability and other issues.

Sign in with your Lexis.com ID to access the full text of this commentary, Siemens and Beck on Obtaining Optimal Cyber Insurance. Additional fees may be incurred. (approx. 42 pages)

If you do not have a lexis.com ID, you can purchase the full text of this commentary on the LexisNexis Store or you can access this commentary and additional Insurance Law Emerging Issues Commentaries on the Store.

Sign in with your Lexis.com ID to access the complete set of Emerging Issues Analysis for Insurance Law.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Videocast: Scott Godes and Richard Bortnick Face Off On: Cyber Insurance for Data Breaches and Advertising Injury, and Defining Publication

Two highly experienced insurance coverage attorneys - Scott Godes of Dickstein Shapiro and Richard Bortnick of Cozen O'Connor - faced off during the "NetDiligence Cyber Risk & Privacy Liability Forum" held in Philadelphia on June 7 and 8, 2010. Hear what they had to say about coverage for data breaches, advertising injury, and the definition of "publication," a critical term in the context of the release of private data. For information about attending or obtaining the recordings and materials from this and other educational programs produced by HB Litigation Conferences, visit www.LitigationConferences.com. 

  Listen to Mr. Godes’ podcast, LexisNexis® Insurance Law Community Podcast featuring Scott Godes of Dickstein Shapiro LLP on Cyber Liability Insurance Coverage.

Read Mr. Godes’ article, "Insurance Coverage for Intellectual Property and Cybersecurity Risks."

Read Mr. Godes’ article, “Insurance Coverage for Cyberattacks.”

View the original article here

Insurance Coverage for Denial-of-Service Attacks

   By Scott Godes, Counsel, Dickstein Shapiro LLP

It seems that 2011 has been the year of cyberattacks - denial of service attacks, data breaches, and more.  Would your insurance policies cover those events?  Beyond the denial of service attacks that made news headlines, a shocking "80 percent of respondents" in a survey of "200 IT security execs" "have faced large scale denial of service attacks," according to a ZDNet story.[1]  These attacks and threats do not appear to be on a downward trend.  They continue to be in the news after cyberattacks allegedly took place against "U.S. government Web sites - including those of the White House and the State Department -" over the July 4, 2009 holiday weekend.[2]  The alleged attacks were not only against government sites; they allegedly included, "according to a cyber-security specialist who has been tracking the incidents, . . . those run by the New York Stock Exchange, Nasdaq, The Washington Post, Amazon.com and MarketWatch."[3]  The more recent ZDNet survey shows that a quarter of respondents faced denial of service attacks on a weekly or even daily basis, with cyberextortion threats being made as well.[4]

Denial of Service Attacks

The cyberattacks that have stolen recent headlines were denial of service incidents.  Personnel from "CERT® Program," which "is part of the federally funded Software Engineering Institute (SEI), a federally funded research and development center at Carnegie Mellon University in Pittsburgh, Pennsylvania," have explained:

Denial of service attacks come in a variety of forms and aim at a variety of services. There are three basic types of attack:

•  consumption of scarce, limited, or non-renewable resources

•  destruction or alteration of configuration information

•  physical destruction or alteration of network components.[5]

Some attacks are comparable to "tak[ing] an ax to a piece of hardware" and are known as "so-called permanent denial-of-service (PDOS) attack[s]."[6]  If a system suffers such an attack, which also has been called "pure hardware sabotage," it "requires replacement or reinstallation of hardware."[7]

What Insurance Coverage Might Apply?

The first place to look for insurance coverage for a denial of service attack is a cybersecurity policy.  The market for cybersecurity policies has been called the Wild West of insurance marketplaces.  Cyber security and data breach policies, certain forms of which may be known as Network Risk, Cyber-Liability, Privacy and Security, or Media Liability insurance, are relatively new to the marketplace and are ever-changing.  The Insurance Services Office, Inc., which designs and seeks regulatory approval for many insurance policy forms and language, has a standard insurance form called the "Internet Liability and Network Protection Policy," and insurance companies may base their coverages on this basic insuring agreement, or they may provide their own company-worded policy form.  Because of the variety of coverages being offered, a careful review of the policy form before a claim hits is critical to understand whether the cyberpolicy will provide coverage, and, if it will, how much coverage is available for the event.  If your company does make a claim under a cyberpolicy, engaging experienced coverage counsel who is familiar with coverage for cybersecurity claims will help get the claim covered properly and fight an insurance company's attempt to deny the claim or otherwise improperly try to limit coverage that is due under the policy.

If your company faces a denial of service cyberattack and suffers losses as a result, but your company has not purchased a specialized suite of policies marketed as cyber security policies, coverage nonetheless may be available under other insurance policies.  In addition, other insurance policies may provide coverage that overlaps with a cyberinsurance policy.  Consider whether first party all risk or property coverage may apply.  First party all risk policies typically provide coverage for the policyholder's losses due to property damage.  If the denial of service cyberattack caused physical damage to your company's servers or hard drives, your company's first party all risk insurer should not have a credible argument that there was no property damage.  Even if the damage is limited to data and software, however, it may be argued that the loss is covered under your company's first party all risk policy, as some courts have found that damage to data and software consists of property damage.[8]

First party policies may also provide coverage for extra expense, business interruption, and contingent business interruption losses due to a cyberattack.  (Contingent business interruption losses may include losses that the policyholder faces arising out of a cyber security-based business interruption of another party, such as a cloud provider, network host, or others.)[9]

Look also to other first party coverages, such as crime and fidelity policies, to determine whether there may be coverage for losses due to a cyberattack.  In particular, crime policies may have endorsements, such as computer fraud endorsements, that may cover losses from a denial of service cyberattack.[10]

If, after a cyberattack, third parties seek to hold your company responsible for their alleged losses, consider whether your company's liability policies would provide coverage.  More importantly, consider your company's commercial general liability (CGL) insurance policy, if your company does not have a specialized cyber liability policy.  If your company did buy a cyberinsurance policy, there is coverage under a CGL policy (and others) that may overlap the coverage in a cyberinsurance policy, providing your company with additional limits of insurance coverage available for the claim.

The first coverage provided in a standard-form CGL insurance policy covers liability for property damage.  Similar to the analysis above for first party all risk policies, if there was damage to servers or hard drives, insurers should not be heard to argue that there was no property damage.  Courts are divided as to whether damage to data or software alone consists of property damage under insurance policies, with some courts recognizing that "the computer data in question 'was physical, had an actual physical location, occupied space and was capable of being physically damaged and destroyed'" and that such lost data was covered under a CGL policy.[11]  Be aware, however, that the insurance industry has revised many CGL policies to include definitions giving insurers stronger arguments that damage to data and software will not be considered property damage.  But also note that your company's CGL policy may have endorsements that provide coverage specifically for damage to data and software.[12]  Consider further whether a claim would fall within the property damage coverage for loss of use of tangible property-loss of use of servers and hard drives because of the cyberattack; loss of use of computers arising out of alleged software and data-based causes has been held sufficient to trigger a CGL policy's property damage coverage.[13]

Keep in mind that if there is a claim for property damage under a CGL policy, there may be coverage for obligations that your company has under indemnity agreements.  Standard form CGL policies provide coverage for indemnity agreements.[14]

Depending on the types of claims asserted, other liability policies may be triggered as well.  For example, directors and officers liability policies may provide coverage for investigation costs,[15] and errors and omissions policies also may cover, if the cybersecurity claims may be considered to be within the definition of "wrongful act."[16]  The takeaway for companies suffering from a cyberattack is that a careful review of all policies held by the insured is warranted to make certain that the most comprehensive coverage may be pursued.

Scott Godes is counsel with Dickstein Shapiro's Insurance Coverage Practice in the firm's Washington, D.C. office.  Mr. Godes is the co-head of the firm's Cyber Security Insurance Coverage Initiative and co-chair of the American Bar Association Computer Technology Subcommittee of the Insurance Coverage Committee of the Section of Litigation.  He frequently represents corporate policyholders in insurance coverage disputes.

--------------------------------------------------------------------------------

[1] Larry Dignan, Cyberattacks on Critical Infrastructure Intensify, ZDNet (Apr. 19, 2011).

[2] U.S. Government Sites Among Those Hit by Cyberattack, CNN (July 8, 2009).

[3] Siobhan Gorman & Evan Ramstad, Cyber Blitz Hits U.S., Korea, Wall St. J. (July 9, 2009).

[4] Larry Dignan, Cyberattacks on Critical Infrastructure Intensify, ZDNet (Apr. 19, 2011).

[5] Denial of Service Attacks, CERT (last visited July 9, 2009); About CERT, CERT (last visited July 10, 2009).

[6] Kelly Jackson Higgins, Permanent Denial-of-Service Attack Sabotages Hardware, Security Dark Reading, (May 19, 2008).

[7] Id.

[8] See, e.g., Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16 (Tex. App. 2003) (first party property coverage for data damaged because of hacker attack or computer virus); Am. Guar. & Liab. Ins. Co. v. Ingram Micro, Inc., No. 99-185 TUC ACM, 2000 U.S. Dist. LEXIS 7299, at *6 (D. Ariz. Apr. 18, 2000) (construing "physical damage" beyond "harm of computer circuitry" to encompass "loss of access, loss of use, and loss of functionality").

[9] Se. Mental Health Ctr., Inc. v. Pac. Ins. Co., 439 F. Supp. 2d 831, 837-39 (W.D. Tenn. 2006) (finding coverage under business interruption policy for computer corruption); see also Scott N. Godes, Ensuring Contingent Business Interruption Coverage, Law360 (Apr. 8, 2009 (discussing coverage under first party policies resulting from third party interruptions).

[10] For example, in Retail Ventures, Inc. v. National Union Fire Insurance Co., No. 06-443, slip op. (S.D. Ohio Mar. 30, 2009), the court held that a crime policy provided coverage for a data breach and hacking attack.

[11] See, e.g., Computer Corner, Inc. v. Fireman's Fund Ins. Co., 46 P.3d 1264, 1266 (N.M. Ct. App. 2002).

[12] See, e.g., Claire Wilkinson, Is Your Company Prepared for a Data Breach?, Ins. Info. Inst., at 20 (Mar. 2006) (discussing the Insurance Services Office, Inc.'s endorsement for "electronic data liability").

[13] See Eyeblaster, Inc. v. Fed. Ins. Co., 613 F.3d 797 (8th Cir. 2010).

[14] See, e.g., Harsco Corp. v. Scottsdale Ins. Co., No. 49D12-1001-PL-002227, slip op. (Ind. Super. Ct. Apr. 26, 2011).

[15] See MBIA, Inc. v. Fed. Ins. Co., No. 08 Civ. 4313, 2009 U.S. Dist. LEXIS 124335 (S.D.N.Y. Dec. 30, 2009).

[16] See Eyeblaster, 613 F.3d at 804.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author's law firm and/or the author's past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Scott Godes is the author of the chapter, Insurance Coverage for Intellectual Property and Cybersecurity Risks, in the second edition of New Appleman Law of Liability Insurance. See Scott's blog at Corporate Insurance Blog.

The Corporate Insurance Blog is a LexisNexis Insurance Law Community Top 50 Insurance Blog.

Access Chapter 18, "Insurance Coverage for Intellectual Property and Cybersecurity Risks", New Appleman Law of Liability Insurance, on lexis.com.

Learn more about New Appleman Law of Liability Insurance at The Store.

Other resources by Scott Godes on the LexisNexis Insurance Law Community:

Listen to Scott's podcast, LexisNexis Insurance Law Community Podcast featuring Scott Godes of Dickstein Shapiro LLP on Cyber Liability Insurance Coverage.

Watch Scott in this Videocast: Scott Godes and Richard Bortnick Face Off On: Cyber Insurance for Data Breaches and Advertising Injury, and Defining Publication.

Read Scott's article, Insurance Coverage for Intellectual Property and Cybersecurity Risks.

Read Scott's article, Dusting Off an Old Law" - Insurance Coverage for Trespass to Chattels Claims.

Read Scott's article, Insurance Coverage for Cyberattacks.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Insurance Coverage Implications of Social Media: Download This Complimentary White Paper

With social media pervading most aspects of society and business, are you up to date on the changes that it brings to the insurance industry? Download a complimentary white paper covering insurance implications of social media.

Social media presents a whole new set of exposures and liabilities that can cause significant damage to a company.

The majority of potential liabilities that companies face from social media fall into three categories: Privacy and Network Security; Intellectual Property; and Employment Practices.

This white paper will endeavor to explore these three areas of liability and provide insight and guidance to insurance professionals as well as companies on strategies and best practices to best address evolving social media coverage implications.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Insurance Coverage for Data Security Breaches

Data security breaches are a real threat in today’s computer-dependent work environment. Security breaches via hacking, unauthorized internal access, and the inadvertent disclosure of personal information, are all circumstances that can create cost and legal exposure. Chances are, a company’s existing insurance policies may provide some coverage in the event of a data security breach, but there are additional coverages that may be worth exploring and evaluating.There are three basic types of insurance policies that may provide some coverage for data security breaches:First party coverage: Includes loss or damage to own property. Lost or damaged data may be covered, but there are a number of exclusions to consider.Third party coverage: Coverage provided to a company when it is sued. Commercial General Liability (CGL) insurance is an example of third-party coverage that virtually all businesses have. There are provisions in CGL policies that do provide coverage for data security breaches. Errors and Omissions (E&O) coverage: Possible coverage for data security breaches may be available in an E&O policy.One newer policy type to consider is network risk insurance. It blends first and third party coverages and can provide broader insurance than a typical policy would otherwise cover. For example, under a CGL policy, a company may have advertising injury coverage that could extend into data breaches. But in a network risk policy, a company could also secure first party coverage (e.g. theft or damage to data), business interruption coverage and perhaps cyberextortion, crisis management costs, public relations response and identity theft coverages. Policies can also include third party coverages such as professional services, content or media liability, network and security cost insurance. Coverage for basic privacy liabilities such as inadvertent or unintended disclosures of confidential information may also be available.Companies should have their existing insurance coverage reviewed to better understand what may or may not be covered. This is not a costly exercise, and would provide a sense as to whether your company has sufficient coverage.In the case of an actual data security breach, or other unintended disclosure of private information, it is critical to provide prompt notice of loss to the insurance company. Also, don’t assume that there is a lack of coverage without a professional evaluation of your policy. This is a largely new area of insurance law, and you should not assume that a company’s in-house risk management department or your insurance broker will know the answer of whether coverage exists. Chances are there is little or no case law analyzing coverage in this newly developing area. As such, it is important to have the coverage evaluated in the event of a data security breach.Pillsbury's insurance recovery practice is one of the first in the United States, dating back to the Great San Francisco Earthquake of 1906, when we helped California businesses work with their insurers in order to rebuild. From the enormous business interruption losses arising from the terrorist attacks in September 2001, to some of the largest environmental cleanup cases in the country, Pillsbury’s insurance recovery and advisory attorneys are at the forefront of efforts to secure insurance coverage for its clients.

View the original article here

LexisNexis Presents a Complimentary CLE-Accredited Webinar: The Intersection of Social Media, Privacy Laws and the Insurance Industry

LexisNexis® Presents a Complimentary CLE-Accredited* Webinar
The 2013 Traffic Jam: The Intersection of Social Media, Privacy Laws and the Insurance Industry

The world’s most popular social media site, Facebook®, reported recently that it now has over one billion users worldwide. With social media pervading most aspects of society and business, are you up to date on the changes that it brings to the insurance industry? During this free Webinar, a panel of experts will help get you up to date on social media’s influence on policy exposure, regulatory changes and internal privacy policies for insurance carriers and more.

Topics include:

•   Carrier use of social media for policy sales, customer service issues and risk management guidance, and whether it is a good thing or a landmine of liability

•   Ways in which public information on social media sites influences pricing and underwriting

•   Current state and federal laws governing carrier use of private information found on social media sites

•   Technological influences impacting coverage and proof of coverage, such as mobile devices

With the rapid pace of change in this arena, insurance underwriters, attorneys and general counsel alike should not miss out on this important Webinar!

*CLE is approved or in the process of approval for the mandatory CLE states listed below for 1.5 hours of CLE Credit. Of these, 1.5 qualify as hours of general, participatory, or skills credit, 0 qualify for hours of law office management, and 0 qualify for hours of ethics/professionalism.

Alabama, Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York†, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin and Wyoming.

†Only experienced NY attorneys may take Webinar training for CLE. New York regulation requires that all CLE sessions must be conducted by an attorney in good standing or a JD. The presenter for this event meets this New York regulation. Contact the LexisNexis CLE group directly at CLE.sales@lexisnexis.com with questions about eligibility requirements and for further details on CLE paperwork.

Register now
Thursday, November 15, 2012
2 – 3:35 P.M. ET

FREE CLE-Eligible Webinar!
Earn 1.5 credit hours

Panelists include:

•   Ronald Raether, Esq., of Faruki, Ireland & Cox, P.L.L.

•   Peter Foster of Willis North America

•   John Mullen, Esq., of Nelson Levine de Luca & Hamilton

The faculty will also take your questions on this important topic.

Legal & Professional
Online Research Content

LexisNexis and the Knowledge Burst logo are registered trademarks of Reed Elsevier Properties Inc., used under license. Other products or services may be trademarks or registered trademarks of their respective companies.

LexisNexis Privacy and Security Statement | Copyright © 2012 LexisNexis. All rights reserved.

9443 Springboro Pike, Miamisburg, OH 45342

View the original article here

Smaller Companies Should Consider Cyber-Liability Insurance

   By Kevin M. LaCroix, Esq., Executive Vice President, OakBridge Insurance Services

Smaller companies increasingly are the subject of data breaches and those smaller companies "are the number-one target of cyber-espionage attackers," according to a recent study detailed in a April 24, 2013 CFO.com article entitled "Should You Consider Cyber Insurance?" (here). Smaller companies increasingly are the subject of cyber attacks due to "inadequate security infrastructure for protecting financial information, customer data and intellectual property."

As the cyber threats "become more pervasive," smaller businesses are "taking out insurance policies designed to bolster their protection form the potentially crippling costs that can accompany data breaches and other cyber attacks." Take up for this product is, according to the article, particularly strong for companies in the high-technology, financial services and health-care industries. As the article explains, these policies may be particularly valuable for smaller companies that lack the resources to undertake as robust of a preventive program as a larger company might.

As the article explains, the policies provide both first-party coverage (such as notification costs) and also protect against third party liability claims (such as lawsuits for damages). In a serious incident, this insurance protection, according to one commentator quoted in the article "can sometimes be a life-or-death issue for smaller companies." The policies also cover forensic IT examinations to determine how a breach occurred and some policies even provide for public relations services to mitigate negative publicity. Again, these services could be particularly valuable for a smaller company that may not have sufficient crisis management resources available.

This type of insurance is of course no substitute for proactive cybersecurity risk management, "such as sound data-protection protocols and employee education." In any event, as part of the application process, the insurance company will want reassurance that these kinds of efforts and protocols are in place. The insurance provides company owners and managers reassurance that the company will be able to weather the storm if problems do emerge.

According to the article, as news about cyber breaches become increasingly common, more and more companies will conclude that the cost-benefit analysis weighs in favor or purchasing this type of insurance.

Read more at The D & O Diary.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Farella Braun: Coverage for Theft of Customer Credit Card Information

   By Tyler Gerking, Partner, Farella Braun + Martel LLP

In August, the U.S. Court of Appeals for the Sixth Circuit ruled that there was coverage for first-party and third-party losses arising from the theft of customer credit card information by hackers under a crime policy's computer fraud endorsement.  See DSW Inc. v. National Union Fire Ins. Co. of Pittsburgh, Pa., Case No. 10-4576/5608 (Aug. 23, 2012).  The Sixth Circuit found that the National Union crime policy at issue covered third-party liability losses even though the insuring agreement limited coverage to loss "resulting directly from" the "theft of any Insured property by Computer Fraud."  The Sixth Circuit also rejected National Union's argument that an exclusion barring coverage for "any loss of proprietary information, Trade Secrets, Confidential Processing Methods or other confidential information of any kind" applied.  The court reasoned that, while credit card information might be considered confidential in some circumstances, it could not have been the type of confidential information envisioned by the exclusion.  Otherwise, the exclusion would vitiate the coverage that the policy promised to provide.

This is yet another example showing that insureds should read all of their insurance policies carefully for possible coverage when they suffer a loss or are involved in litigation.  Insureds are more commonly buying technology errors and omissions coverage or more specific cyber policies that could cover this type of loss, but the endorsement on the National Union crime policy is not uncommon.

I was quoted in this Law360 article (http://www.law360.com/insurance/articles/372903, sign-in required) about the Sixth Circuit's ruling that policies often have slight differences in policy language that can make a big difference to insureds.  That is especially true of policies that cover privacy and cyber risks.

Read additional articles on legal developments that affect policyholders at the Policyholder Perspective blog.

The Policyholder Perspective blog has been selected as a LexisNexis Insurance Law Community Top Insurance Blog.

For more information about LexisNexis products and solutions, connect with us through our corporate site.

View the original article here

Insurance Coverage for Cyberattacks

If your business suffered the same sort of cyberattacks alleged to have taken place against "U.S. government Web sites - including those of the White House and the State Department -" over the July 4, 2009 holiday weekend, would your insurance cover losses that your company faced?[1] Not worried, because the alleged attacks were only against government sites? Unfortunately, the cyberattacks were more widespread, and allegedly included, "according to a cyber-security specialist who has been tracking the incidents, . . . those run by the New York Stock Exchange, Nasdaq, The Washington Post, Amazon.com and MarketWatch."[2]

Denial of Service Attacks

The cyberattacks described were denial-of-service incidents. Personnel from "CERT® Program," which "is part of the federally funded Software Engineering Institute (SEI), a federally funded research and development center at Carnegie Mellon University in Pittsburgh, Pennsylvania," have explained: Denial-of-service attacks come in a variety of forms and aim at a variety of services. There are three basic types of attack:

consumption of scarce, limited, or non-renewable resources

destruction or alteration of configuration information

physical destruction or alteration of network components.[3]

Some attacks are comparable to "tak[ing] an ax to a piece of hardware," and are known as "so-called permanent denial-of-service (PDOS) attack[s]."[4] If a system suffers such an attack, which also has been called "pure hardware sabotage," it "requires replacement or reinstallation of hardware."[5]

What Insurance Coverage Might Apply?

If your company faces a denial-of-service cyberattack and suffers losses as a result, but your company has not purchased a specialized suite of policies marketed as cyber security policies, coverage nonetheless may be available under other insurance policies. Consider whether first party all risk or property coverage may apply. First party all risk policies tend to provide coverage for the policyholder's losses due to property damage. If the denial-of-service cyberattack caused physical damage to your company's servers or hard drives, your company's first party all risk insurer should not have a credible argument that there was no property damage. Even if the damage is limited to data and software, however, it may be argued that the loss is covered under your company's first party all risk policy, as some courts have found that damage to data and software consists of property damage.[6]

First party policies may also provide coverage for extra expense, business interruption, and contingent business interruption losses due to a cyberattack. (Contingent business interruption losses may include those arising out of a third party's cyber security-based business interruption.)[7]

Look also to other first party coverages, such as crime and fidelity policies, to determine whether there may be coverage for losses due to a cyberattack. In particular, crime policies may have endorsements, such as computer fraud endorsements, that may cover losses from a denial of service cyberattack.

If, after a cyberattack, third parties seek to hold your company responsible for their alleged losses, consider whether your company's liability policies would provide coverage. More importantly, consider your company's commercial general liability (CGL) insurance policy (if your company does not have a specialized cyber liability policy).

The first coverage provided in a standard-form CGL insurance policy covers liability for property damage. Similar to the analysis above for first party all risk policies, if there was damage to servers or hard drives, insurers should not be heard to argue that there was no property damage. Courts are divided as to whether damage to data or software alone consists of property damage under insurance policies, with some courts recognizing that "the computer data in question 'was physical, had an actual physical location, occupied space and was capable of being physically damaged and destroyed'" and that such lost data was covered under a CGL policy.[8] Be aware, however, that the insurance industry has revised many CGL policies to include definitions giving insurers stronger arguments that damage to data and software will not be considered property damage. But also note that your company's CGL policy may have endorsements that provide coverage specifically for damage to data and software.[9] Consider further whether a claim would fall within the property damage coverage for loss of use of tangible property-loss of use of servers and hard drives because of the cyberattack.

Consider Cyber Security Specialty Policies

Looking beyond the coverages and endorsements discussed above, your company should consider the recent cyberattacks as an opportunity to reevaluate the need for specialized coverages for cyber security losses. Insurance companies continue to introduce new specialized products for cyber security risks, marketing the new policies as including data compromise, cyber liability, network risk, and/or computer data coverage. The Insurance Services Office, Inc., which designs and seeks regulatory approval for many insurance policy forms and language, has a standard insurance form called the "Internet Liability and Network Protection Policy," and insurance companies may base their coverages on this basic insuring agreement, or they may provide their own company-worded policy form. Cyber security and data breach policies, certain forms of which may be known as Network Risk, Cyber-Liability, Privacy and Security, or Media Liability insurance, are relatively new to the marketplace and are ever-changing. An experienced broker may be able to advise what coverages are available, and an attorney with experience in advising policyholders about insurance coverage issues may be able to advise as to the potential strengths and weaknesses of the various policy terms offered.

Scott Godes is counsel with Dickstein Shapiro's Insurance Coverage Practice in the firm's Washington, D.C. office. Mr. Godes is the co-head of the firm's Cyber Security Insurance Coverage Initiative and co-chair of the American Bar Association Computer Technology Subcommittee of the Insurance Coverage Committee of the Section of Litigation. He frequently represents corporate policyholders in insurance coverage disputes.

Listen to Mr. Godes’ podcast, LexisNexis® Insurance Law Community Podcast featuring Scott Godes of Dickstein Shapiro LLP on Cyber Liability Insurance Coverage

[1] U.S. Government Sites Among Those Hit by Cyberattack, CNN, http://www.cnn.com/2009/TECH/07/08/government.hacking/index.html (July 8, 2009).

[2] Siobhan Gorman & Evan Ramstad, Cyber Blitz Hits U.S., Korea, Wall St. J., http://online.wsj.com/article/SB124701806176209691.html (July 9, 2009).

[3] Denial of Service Attacks, CERT, http://www.cert.org/tech_tips/denial_of_service.html (last visited July 9, 2009); About CERT, CERT, http://www.cert.org/meet_cert/ (last visited July 10, 2009).

[4] Kelly Jackson Higgins, Permanent Denial-of-Service Attack Sabotages Hardware, Security Dark Reading, http://www.darkreading.com/security/management/showArticle.jhtml?articleID=211201088 (May 19, 2008).

[5] Id.

[6] See, e.g., Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16 (Tex. App. 2003) (first party property coverage for data damaged because of hacker attack or computer virus); Am. Guar. & Liab. Ins. Co. v. Ingram Micro, Inc., No. 99-185 TUC ACM, 2000 U.S. Dist. LEXIS 7299, at *6 (D. Ariz. Apr. 18, 2000) (construing "physical damage" beyond "harm of computer circuitry" to encompass "loss of access, loss of use, and loss of functionality").

[7] Se. Mental Health Ctr., Inc. v. Pac. Ins. Co., 439 F. Supp. 2d 831, 837 (W.D. Tenn. 2006) (finding coverage under business interruption policy for computer corruption); see also Scott N. Godes, Ensuring Contingent Business Interruption Coverage, Law360, (Apr. 8, 2009) http://insurance.law360.com/articles/94765 (discussing coverage under first party policies resulting from third party interruptions).

[8] See, e.g., Computer Corner, Inc. v. Fireman's Fund Ins. Co., 46 P.3d 1264, 1266 (N.M. Ct. App. 2002).

[9] See, e.g., Claire Wilkinson, Is Your Company Prepared for a Data Breach?, Ins. Info. Inst., at 20 (Mar. 2006) http://www.iii.org/assets/docs/pdf/informationsecurity.pdf (discussing the Insurance Services Office, Inc.'s endorsement for "electronic data liability").

View the original article here

Farella Braun + Martel LLP: Protect Your Business With Cyber Liability Coverage

   By Amanda Hairston, Senior Associate, Farella Braun + Martel LLP

Many insurers are now offering "cyber liability" or "cyber risk" policies designed to protect policyholders against electronic injuries that policyholders may either suffer themselves or cause to others. Most of these policies focus on protecting policyholders in the event of a data breach. According to a recent report, the finance and insurance industries experienced the largest percentage of data breaches followed closely by information technology, retail trade, manufacturing, public administration, transportation and warehousing as well as education, government, and healthcare. Virtually no company is immune from this type of risk.

It is worth looking at purchasing cyber liability coverage because insurers have argued that "traditional policies" do not protect against this type of harm. For example, insurers have argued that there is no advertising injury coverage where there is no "publication" of the data. Today, many policies also have language excluding from the definition of "property damage" loss of or damage to electronic information and/or data. Finally, policyholders should keep in mind that CGL policies do not cover the insured's own first-party losses, while a cyber liability policy typically does provide this type of coverage.

Policyholders may also face problems seeking coverage under E&O policies depending on what services they typically perform. However, where the cyber risk arises directly from the company's business, it may actually have coverage under such a policy. For example, in Eyeblaster, Inc. v. Fed Ins. Co., 613 F.3d 797 (8th Cir. 2010), the insured, an online marketing campaign management company, was sued by an individual who alleged that the insured's online advertising caused his computer to be infected with a spyware program that severely impaired the function of his computer, resulting in data loss, numerous pop-up ads, a hijacked browser, and frequent error messages. The Eighth Circuit found that the allegations triggered a duty to defend under the E&O policy. In that case, Eyeblaster had disclosed to the insurer that its core business activity was the technology used for interactive advertising content delivery and management, and thus any allegation that Eyeblaster intentionally served an ad would have been in the ordinary course of its business. The court found that Eyeblaster's activity of causing software (such as Flash and JavaScript) to be installed on the computer, while intentional, was not excluded under the policy as an intentional wrongful act and thus the claims were covered under the policy.

Although more insurers are offering this type of coverage, there is no standard policy language. Accordingly, policyholders should look closely at their existing coverage to determine what types of events may be covered. Cyber liability policies can cover everything from liability for permitting access to identifying information of customers to transmitting a computer virus or malware to a third party customer to failing to notify a third party of their rights under the relevant regulations in the event of a security breach. As a result, all companies should be looking closely at what type of coverage they currently have for these types of risks and examining what types of coverage are available in the marketplace.

Read additional articles on legal developments that affect policyholders at the Policyholder Perspective blog.

For more information about LexisNexis products and solutions, connect with us through our corporate site.

View the original article here

Bricks and Mortar Coverage for a Digital World: Recent Trends and the Insurance Coverage Implications of Internet, Technology, and Social Media

The insurance world is, as many practitioners already know, shaped and molded by the development of both new business practices and new technologies.   The growth of emerging industries often comes accompanied by new risks and liabilities, which in turn give rise to new insurance products and eventually, insurance coverage litigation.   The loop becomes complete when new insurance products and coverage cause businesses to change their practices.

Over the last decade or so, the Internet has caused a complete transformation in business practices – transcending the boundaries of time, space, and location and hurling businesses out of their bricks and mortar offices into cyberspace at light speed. In the last two to three years, there has been a further explosion in the digital world through the development and viral growth of social networking and social media technologies, even further altering how companies do business, both in business-to-consumer and business-to-business capacities.  This growth was predictably accompanied by countless accusations of liability.  In 2009 and 2010, hundreds if not thousands of demand letters, investigations, lawsuits, and other legal proceedings were brought in connection with online and Internet activities of disgruntled customers, faithless or departing employees, anonymous bloggers, crafty competitors, and even ex-spouses.

The growth of social media and social networking has similarly impacted the insurance industry.  Not only have new practice industries for legal and insurance professionals emerged, but more interestingly, they have appeared on an unchartered landscape.

This article explores and reports on the insurance coverage implications of Internet technology and social media, and assesses their ramifications, both retrospectively to address issues and disputes already known to exist and prospectively to address the salient topics that may prove problematic.   First, an extensive primer on the evolution of social media technologies will be provided.  From there, specific trends that have arisen in the landscape of social networking and media law in the last year are identified, accompanied by a discussion of the applicable insurance coverage implications. Ultimately, this article aims to assess whether traditional insurance coverage providing protection to "bricks and mortar" businesses can ever capture and address the new risks posed by the digital age, which has not only changed how new business risks are covered by insurance, but more fundamentally, how businesses do business.

Download the entire article, Bricks and Mortar Coverage for a Digital World: Recent Trends and the Insurance Coverage Implications of Internet, Technology, and Social Media, by Rabeh Soofi.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Public Companies Must Disclose Cyber-Liability Risks

By Rene Siemens and David Beck, Attorneys, Pillsbury Winthrop Shaw Pittman LLP

If you thought you did not need cyber insurance before, Uncle Sam may cause you to think otherwise.  On October 13, 2011, the Securities and Exchange Commission ("SEC") Division of Corporation Finance issued guidance on disclosure obligations relating to cyber security risks and incidents.  The guidance, which is based on existing disclosure requirements and is effective immediately, emphasizes the need for SEC registrants to provide "timely, comprehensive, and accurate information about [cyber] risks and events that a reasonable investor would consider important to an investment decision."

The required disclosures highlighted by the SEC include:

1)    Risk factors relating to a potential cyber incident, including known or threatened attacks;

2)    Costs or other consequences associated with known cyber incidents or the risk of potential incidents, where such costs represent a material event, through disclosure in the Management Discussion and Analysis section of the registrant's annual report;

3)    Cyber incidents that materially affect a registrant's products, services, or relationships with customers and suppliers;

4)    Material legal proceedings involving cyber incidents; and

5)    Any material impact of cyber security, both pre- and post-incident, on the registrant's financial statements.

Failure to make the above disclosures could subject registrants to various consequences, including SEC enforcement actions or lawsuits brought by shareholders.

The new SEC guidance provides yet another reason for companies that handle sensitive information to insure themselves against data security and privacy claims.  Indeed, the SEC expressly notes insurance coverage as one of the relevant factors to be considered in assessing a company's potential cyber liability risk.  In recent years, a large market has evolved for insurance that is specifically designed to cover these risks - marketed under names like "privacy breach insurance," "network security insurance," and "cyber-liability insurance."  This insurance provides both first and third-party coverage for loss associated with a cyber security incident, and includes coverage for costs such as restoring damaged data, responding to regulatory investigations, defense and indemnification against lawsuits arising out of cyber incidents, and loss of revenue for business interruption caused by a data security breach.  While traditional insurance may cover some of these risks too, this new coverage should be seriously considered by any company-whether a registrant with the SEC or not-handling sensitive information.

In procuring cyber insurance, it is important to note that one size does not fit all.  Every insurance company has its own unique policy forms, terms, and exclusions.  Therefore, it is important to consult with an attorney or other professional familiar with the coverages available and the needs of your business so as to ensure that you do not purchase coverages that you do not need or are inadequate.

Pillsbury offers an cyber insurance policy review program-Data Security Plus-to provide our clients with the critical assistance they need to obtain "state-of-the-art" coverage for data security and privacy breaches.  Our team brings market knowledge, up-to-date understanding of evolving insurance case law, and effective advocacy to bear during the placement process to alert you to critical deficiencies in the policy forms you are offered and to negotiate improvements to coverage, including drafting and negotiating manuscripted policy wordings and modifying policies to address recent legal developments.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

How to Negotiate Cyber Insurance

   By Rene Siemens and David Beck, Attorneys, Pillsbury Winthrop Shaw Pittman LLP

This article previously appeared in Risk Management magazine.

Exposure to network and data security breaches has grown exponentially in recent years and the market for insurance tailored to cover this risk has grown just as fast.  These insurance policies are sold under names like "cyber insurance," "privacy breach insurance" and "network security insurance."  The market for this coverage often seems like the Wild West, with premiums and terms varying dramatically from one insurer to the next and being highly negotiable.  Before buying or renewing a cyber insurance policy, it is crucial to understand what you are really being offered and know how to bargain for what you need.

Cyber insurance policies cover third-party claims and first-party losses.  Most policies cover costs of defending against claims that result from network and data security breaches, regulatory investigations, judgments and settlements.  Policies may also cover a hodge-podge of other items including costs of notifying individuals whose data has been breached, providing credit monitoring, retaining public relations and forensic investigation consultants, restoring lost or stolen data, and pursuing indemnity rights when someone else has caused the breach.  Some policies cover lost revenue due to interruption of business operations as a result of a breach, costs of responding to "E-extortion" and "E-ransom" demands, and even media liability claims.  Few policies contain all of these coverages and every policy's coverage is different.

Negotiating Coverage - What To Look For In A Cyber Insurance Policy

Given the sometimes bewildering variety and lack of standardization in cyber insurance policies, buying an "off-the-shelf" policy is rarely the best approach and can result in disaster.  It is best to have experienced professionals help you place and negotiate this kind of insurance.  Ask your broker whether he or she has specific cyber insurance expertise, and if not, ask for a referral to a broker who does.  It is a good idea to have an attorney who has cyber insurance experience (and doesn't work for the insurance companies!) help you negotiate the fine print, since the legal meaning of insurance policy wordings can be critical.  Nevertheless, there are a few things you should always bear in mind when buying or renewing a cyber insurance policy.

Buy What You Need

With all the bells and whistles now offered by some insurers, it is important to stick to basics.  Consider whether you really need the coverages being offered and just say "no" if you don't.  For example, business interruption coverage is usually subject to a lengthy waiting period before it attaches.  Some companies conclude that this coverage is not worth the extra premium because they expect network disruptions to be quickly fixed.

Conversely, if an insurer is unwilling to remove an objectionable exclusion or limitation from its policy, then ask your broker to get bids from other insurers.  The cyber insurance market is highly competitive, with many insurers focused on building market share right now, and one insurer might very well be willing give you what another won't.

Limits Of Liability

One of the most important issues in negotiating cyber insurance is determining the appropriate limits of liability.  The costs of responding to a data breach can be substantial.  Estimates vary, but one study found that in 2011 the average organizational cost of a data breach involving the loss or theft of personal data was $5.5 million, or $194 per electronic record.  To put that number in context, a data breach involving just 25,000 records (which is below average) would nearly exhaust a $5 million policy.  And if a plaintiff class actually obtained a judgment under a state statute that imposes $1,000 in damages for each claimant, the judgment alone could consume $25 million of insurance policy limits.  Because cyber insurance is not particularly expensive, you should choose limits of liability in light of your total potential liability exposure in the event of a breach.

Most cyber insurance policies impose sub-limits on some coverages, such as for crisis management expenses, notification costs, or regulatory investigations.  These sub-limits are not always obvious and they are often inadequate.  They should be scrutinized carefully and set realistically.

Get Retroactive Coverage

Most cyber insurance policies limit coverage to breaches that occur after a specified "retroactive date."  In some policies the retroactive date is the same as the inception date of the policy.  This means there may be no coverage for claims first made during the policy period that result from breaches that occurred before the policy period, even if the insured did not know about the breach when it bought the policy.  Because breaches may go undiscovered for some time before claims are made, insureds should always ask for a "retroactive date" that is earlier than the policy's inception.  This will ensure that coverage extends to unknown breaches that occurred before the policy incepted but first give rise to a claim during the policy period.  Insurers do not always offer retroactive coverage unless asked, but it is commonly available for periods of 1, 2, 5 or 10 years and is sometimes unlimited.

Beware Of Broadly-Worded Exclusions

It is not uncommon to find cyber insurance provisions that contradict the insured's basic purpose in buying the coverage.  Sometimes these provisions have been cut from other insurance policy forms and unthinkingly pasted into cyber insurance forms where they do not belong.  For example, some policies broadly exclude coverage for any liability arising from a breach of contract.  The problem is that many insureds collect and store confidential information from customers, patients or business partners pursuant to contracts that require them to maintain the confidentiality of the information.  They buy cyber insurance precisely to protect them in case a privacy breach gives rise to damages claims under such confidentiality agreements.  Many insurers, if asked, are willing to modify their exclusions to make it clear that they will not bar coverage for these claims.  This is just one of many examples of broadly-worded exclusions that need to be reviewed carefully and narrowed to make sure that they will not defeat the reasonable expectations of the insured in buying cyber insurance.

Beware Of Panel And Consent Provisions

Many cyber insurance policies require that any investigators, consultants or attorneys used by the insured to respond to a claim or potential claim be drawn from a list of professionals that have been pre-approved by the insurer.  If the insured has consultants or attorneys that it wants to involve in the event of a loss because they already know its business operations, it is a good idea to ask to add these professionals to the insurer's pre-approved list during underwriting.  It may be easier to add professionals to the pre-approved list before you pay the policy's premium than after the insurance company already has your money.

Cyber insurance policies also often contain consent provisions stating that the insured must obtain the insurer's consent before incurring any expenses to notify customers or patients of a data breach, conduct forensic investigations, or defend against third-party claims.  Such prior consent provisions are sometimes invoked by insurers to deny coverage when emergency costs have been incurred without the insurer's consent, even if the costs are completely reasonable and necessary.  If prior consent provisions are included in the policy and cannot simply be removed, you should at a minimum change them to provide that the insurer's consent "shall not be unreasonably withheld."  It is also a good idea to keep your insurer on "speed dial" when a breach happens, so that it can't assert that it has been kept in the dark about any emergency response costs you had to incur.

Allocation Of Defense Costs

Where both covered and non-covered claims are asserted in the same lawsuit against the insured, an issue often arises regarding the proper allocation of defense costs: i.e., what portion of the insured's defense costs must the insurer must pay?  There are a number of ways that insurance policies can respond in this situation, with some policy provisions being more advantageous to the insured than others.  For example, some policies provide that the insurer will pay 100% of defense costs if the lawsuit alleges any claim that is potentially covered, while other policies say that the insurer will only pay the portion of defense costs it unilaterally believes to be covered until a different allocation is negotiated, arbitrated or judicially determined.

These issues are less likely to arise in a "duty to defend" policy (where the insurer must take over the insured's defense of any third-party claims), which typically covers 100% of defense costs so long as any of the claims against the insured is potentially "covered."  However, under a "duty to pay" policy (where the insurer agrees to reimburse the insured for its defense costs or pay them on its behalf), allocation is more likely to be disputed.  It is important to understand the allocation method contained in the policy and try to negotiate one up front that is favorable to you.

Obtain Coverage For Acts And Omissions Of Vendors

Chances are that at least a portion of your organization's data processing and storage is outsourced to a third-party vendor.  Therefore, it is important that your cyber insurance policy cover claims against you that result from breaches caused by your data management vendors.  Most cyber insurance policies do provide coverage for such vicarious liability, but not all of them clearly do.  It is widely understood in the insurance industry that policyholders expect coverage for claims that arise out of the acts and omissions of their vendors, consultants and subcontractors.  If such coverage is not initially offered or is unclear, you should demand that it be clearly included in the policy.

Dovetail Cyber Insurance With Indemnity Agreements

You should also make sure that your cyber insurance and vendor indemnity agreements complement each other so that you can maximize your recovery from both sources.  For example, some cyber insurance policies state that the policy's deductible or self-insured retention "shall be borne by the Insured uninsured at its own risk."  Some insurers may interpret this language as requiring the insured to pay the retention out of its own pocket, and take the position that if the insured gets reimbursed for this amount from the vendor that caused the breach then it has failed to satisfy this precondition to coverage.  This kind of clause can therefore present the insured with a Hobson's Choice:  either pursue indemnity from your vendor and give up your insurance, or collect from your insurance company and let the responsible vendor off the hook.  This unfair outcome is not in the interest of either insurer or insured.  Insurers are often willing to modify these provisions to clarify that the insured can collect its self-insured retention from a third party without compromising its insurance coverage.

Harmonize Cyber Insurance With Other Insurance

Some cyber insurance policies provide that your data management vendors are also insured under your policy.  There may be business reasons for wanting vendors to be insured under your policy in a particular case, but it is often preferable for your policy to provide that it will only apply excess of a vendor's insurance, and require in your supplier contracts that your vendors must buy their own cyber insurance which is to act as primary insurance and name you as an insured.  This structure can reduce the odds that your insurance policy limits will be depleted by claims for which your vendors are primarily responsible.

Get a Partial Subrogation Waiver

If your insurer pays a loss, it may become "subrogated" to your claims against any third parties that were responsible for causing the breach.  This means that the insurer can try to recoup its payment by pursuing your claims against the responsible parties.  Many cyber insurance policies contain a provision stating that you cannot take any action to impair the insurer's subrogation rights.

One problem with such provisions in the cyber insurance context is that contracts with data management vendors commonly contain limitation of liability provisions.  These provisions can give rise to disputes about whether the insured has breached its contract with its insurer by impairing or limiting its recourse against the vendor.

A possible fix is to insist that a partial "waiver of subrogation" provision be added to your cyber insurance policy.  Such provisions, which are quite common in other lines of coverage, simply provide that the insurer will not assert that its subrogation rights have been impaired by any contract into which you entered before a loss occurs.  Some insurers are willing to agree to such provisions in the cyber context, but others may not be.  If your insurer is not willing to give a partial subrogation waiver, you should consider shopping elsewhere.

Clearly, cyber insurance policies can be a valuable tool for mitigating losses arising from a network or data security breach.  But the value can vary greatly from one policy to the next.  When buying or renewing cyber insurance caveat emptor is the rule:  it is essential that each policy provision be reviewed carefully and that enhancements to coverage are negotiated where appropriate.

Rene Siemens is a partner in the insurance recovery practice of Pillsbury Winthrop Shaw Pittman LLP.  He represents policyholders in disputes and negotiations with their cyber insurers and other insurers.

David Beck is an associate in the insurance recovery practice of Pillsbury Winthrop Shaw Pittman LLP.  He advises policyholders in the negotiation and resolution of complex insurance matters.

For more information about LexisNexis products and solutions connect with us through our corporate site.

View the original article here

Turkey: Insurance sector's gross written premiums up 25%

View the original article here

Irish banks admit customers hit by fraudulent credit card transactions after breach

View the original article here

Haiyan unlikely to dent major reinsurers: A.M. Best

View the original article here

Bahrain: Arab Insurance Group registers 41% rise in net profit

View the original article here

China: Dual insurance regulatory approach planned in Shanghai

View the original article here