NEW WINE, OLD WINESKIN? UNDERSTANDING CYBER INSURANCE COVERAGE. Dennis M. Wade, Esq. Robert Cosgrove, Esq. Wade Clark Mulcahy

Size: px

Start display at page:

Download "NEW WINE, OLD WINESKIN? UNDERSTANDING CYBER INSURANCE COVERAGE. Dennis M. Wade, Esq. Robert Cosgrove, Esq. Wade Clark Mulcahy"

Randell Ball
6 years ago
Views:

1 NEW WINE, OLD WINESKIN? UNDERSTANDING CYBER INSURANCE COVERAGE by Dennis M. Wade, Esq. Robert Cosgrove, Esq. Wade Clark Mulcahy 117

2 118

New Wine, Old Wineskin? Understanding Cyber Insurance Coverage By: Dennis M. Wade and Robert Cosgrove New York 111 Broadway New York, NY 10006 212.267.1900 www.wcmlaw.

3 New Wine, Old Wineskin? Understanding Cyber Insurance Coverage By: Dennis M. Wade and Robert Cosgrove New York 111 Broadway New York, NY New Jersey 955 S. Springfield Avenue, Suite 100 Springfield, NJ Pennsylvania 1515 Market Street, Suite 2050 Philadelphia, PA

4 New Wine, Old Wineskin? Understanding Cyber Insurance Coverage By: Dennis Wade and Robert Cosgrove 1 Neither do people pour new wine into old wineskins. If they do, the skins will burst; the wine will run out and the wineskins will be ruined. No, they pour new wine into new wineskins, and both are preserved. - Matthew 9:17 When Matthew scribed his parables nearly two thousand years ago, he could not have foreseen that his allegory of the wineskins would be so appropriate to the development of cyber insurance coverage jurisprudence in the twenty-first century. But when it comes to understanding how, if at all, traditional insurance policies afford coverage for cyber security and data privacy, courts throughout the United States struggle to pour new ideas into old and preexisting coverage paradigms. The question is will the old wineskins hold, or will they burst? In this essay, we address that question by examining the ways in which courts throughout the United States are addressing cyber claims in both the first and third party context. First-Party v. Third-Party Cyber Insurance Claims To understand cyber insurance, you first have to get clear in your mind the difference between first-party and third-party losses that are likely to give rise to a claim. Historically, first-party coverage inures to the benefit of the insured for a loss sustained to owner s property while thirdparty coverage is intended to indemnify the insured for any liability owed to third parties as a result of alleged acts or omissions. 2 In the context of cyber security and data privacy, a breach of the insured s network security or privacy may result in a first-party claims pertaining to resecuring the system and any resulting loss of personally identifiable information ( PII ) (including dealing with regulators). 3 But the very same breach can also contribute to a negligence or breach of contract third-party claim arising out of the publication or dissemination of customer or client PII. 1 Dennis Wade is a founding partner of Wade Clark Mulcahy. Robert Cosgrove is a WCM Partner and Certified Information Privacy Manager and Certified Information Privacy Professional, US. 2 See e.g., Port Authority v. Affiliated FM Ins. Co., 245 F.Supp.2d 563, 577, aff d, 311 F.2d 226 (3d Cir. 2002) (holding that third-party liability insurance, which indemnifies one from liability to third persons, is distinct from first-party coverage, which protects against losses sustained by the insured itself. ). 3 Personally identifiable information is the key concept in data privacy law and refers to any information (e.g. name, date of birth, social security number) that allows an individual to be identified as a particular person and not as a member of a group. 120 Page 1 of 8

5 Common First-Party Cyber Security Losses Although often overlooked, the majority of claims related to cyber security and data privacy revolve around first-party losses incurred by an insured because a network or database has been infiltrated or otherwise compromised. Specifically, as a result of unauthorized access into a given network or database, insureds are often expected, if not outright legally required, to respond by: conducting a forensic investigation of the breach; notifying customers, clients and regulators of the network compromise; paying civil fines and penalties; implementing administrative safeguards and training to stem the breach; securing expert legal advice regarding obligations and scope of exposure; hiring crisis management and/or public relations specialists to mitigate brand damage; retaining credit and identity theft monitoring on behalf of exposed customers and clients; and restoring and re-securing lost or compromised data. Indeed, the total cost of these fundamental Response Expenses routinely outweighs the actual exposure, if any, posed by the third-party consequences of a data breach when taking into account the very real correlation between security failures and the loss of business income. Further, if implemented properly, Response Expenses can ultimately reduce such exposure by limiting the opportunities available to hackers and thieves to use compromised PII to cause actual financial damage. Common Third-Party Cyber Security Losses While slight in comparison to the total cost of first-party Response Expenses, the potential thirdparty implications of a network or database breach are generally more recognizable because they tend to result in the public spectacle of litigation. In fact, given the nature of litigation, there is little doubt that a security failure or data breach results in significant costs, including: legal defense fees; consulting and testifying expert witness services; and liability for settlements, damages and judgments. To be sure, third-party exposure does not simply end with the insured s customers or clients, but may foreseeably extend to Response Expenses incurred by the customer, its agents or customer s customers who are forced to implement their own data security measures in the aftermath of the breach so as to mitigate their own direct damages. 121 Page 2 of 8

6 The Emerging Coverage Analysis for First-Party Cyber Insurance Claims Data Breaches as First-Party Property Losses There is little doubt that in the early 2000 s, data privacy and cyber security were far from the forefront of the average person s consciousness, much less that of the judiciary tasked with analyzing first-party property coverage. It comes as no surprise, then, that many courts considering the applicability of first-party benefits in the context of cyber security were confused by, if not outright hostile to, the notion that an insured could be entitled to reimbursement of costs it incurred as the result of data losses. In fact, for many courts the omnipresence of technology in everyday life was subordinate to the notion that traditional first-party property insurance policies need not address intangible losses of information and data. For example, in the 2003 California Court of Appeals case of Ward General Ins. Services v. Employers Fire Ins. Co., the appellate division was charged with determining whether a firstparty insurance policy issued by Employer Fire Insurance Company to Ward General Insurance Services covered the loss of stored computer data not accompanied by the loss or destruction of the storage medium. 4 Specifically, Ward s claim arose out of the loss of electronically stored data used to service its clients insurance policies that occurred during the course of updating its computer databases. 5 As a result of its data loss, Ward was forced to retain outside experts to restore the system, and also suffered a loss of business income because its operations were suspended during the restoration process. 6 Although Ward timely presented these restoration and business interruption claims to Employers under its first-party policy, the latter eventually denied coverage arguing that the data loss was not caused by a direct physical loss as required by the insurance contract. 7 In the ensuing litigation, Employers disclaimer of coverage, Ward opted for an appeal to public policy rather than a textual challenge, arguing that the importance and omnipresence of computers and electronic databases in the economy compelled a finding that the loss of intangible data must constitute a physical loss that is covered. 8 Notwithstanding the emotional appeal, the California Court of Appeals flatly rejected Ward s contention, and noted that public policy regarding the importance of data security should not be employed to redefine the scope of coverage where the answer to the coverage dispute could be ascertained solely from the language of the policy, itself. 9 In the absence of any tangible or physical disruption to the data, the Court of Appeals therefore affirmed Employers disclaimer and denied coverage of the restoration and business interruption losses caused by Ward s inadvertent data deletion Ward General Ins. Services v. Employers Fire Ins. Co., 7 Cal.Rptr.3d 844, 845 (2003). 5 Ward General Ins. Services, 7 Cal.Rptr.3d at Id. 7 Id. 8 Id. at Id. 10 Id. at Page 3 of 8

7 Still, while courts like Ward General Ins. Services were reluctant to entertain the unknown of data loss in respect of first-party insurance coverage, a divergent trend began to appear in the federal courts where jurists appeared more inclined to find cyber security claims within the embrace of property coverage. Indeed, in the case of NMS Services Inc. v. Hartford, the United States Court of Appeals for the Fourth Circuit was charged with determining whether a firstparty commercial insurance policy afforded NMS Services Inc. coverage for business interruption and response costs associated with a former employee s cyber-attack that resulted in the erasure of computer files and databases necessary for the operation of the company s manufacturing, sales and administrative systems. 11 Although the policy at issue in NMS Services Inc. did provide coverage for business interruption and extra expenses incurred during the restoration of its operations, Hartford denied coverage for the network breach citing familiar policy language requiring that the suspension of business be caused by direct physical loss or damage to property. 12 Rejecting the approach in Ward, however, the Fourth Circuit reasoned that even though data was not physically tangible, it was undoubtedly property that was damaged by the erasure such that NMS Services Inc. was entitled to reimbursement for its business interruption losses and response costs. 13 The disconnect between Ward and NMS Services Inc. fostered uncertainty in the cyber arena. But more recent cases have favored the latter approach as our reliance on technology and the accompanying risk of cyber-attacks has grown exponentially. One such case comes from the United States District Court for the Middle District of Louisiana where in Landmark American Ins. Co. v. Gulf Coast Analytical Laboratories, Inc. the court was asked to determine whether the loss of data unaccompanied by physical destruction or damage to the host medium was sufficient to warrant reimbursement of business interruption losses and rehabilitation expenses. 14 More specifically, in Gulf Coast Analytical, the insured was a research laboratory that suffered a data loss preventing it from conducting business during its restoration period. 15 As a result of the data loss, the insured incurred roughly $100,000 in response costs, and an additional $1 million in loss of business income. 16 Following its presentation of the claim to Landmark American Insurance Company, coverage was denied on the basis that data loss could only be covered if the system in which it was stored or processed was also physically destroyed or damaged. 17 The District Court disagreed with this application of the policy s language (even though the language did call for direct physical loss before coverage could attach), explaining instead that tangibility is not a defining quality of physicality and [data] is still physical because it can be observed and altered through human action. 18 Consequently, the Middle District of Louisiana 11 NMS Services Inc. v. Hartford, 62 Fed.Appx. 511, 512 (4th Cir. 2003). 12 NMS Services Inc., 62 Fed.Appx at Id. 14 Landmark American Ins. Co. v. Gulf Coast Analytical Laboratories, Inc., 2012 WL , 1 (M.D. La. 2012). 15 Id. at Id. 17 Id. 18 Id. at Page 4 of 8

8 declined to endorse Landmark s denial of coverage and instead declared that the insured was entitled to reimbursement of its first-party losses as a result of the network failure. 19 The Emerging Coverage Analysis for Third-Party Cyber Insurance Claims As one can imagine, while the fight on the first-party side centered on the notion of data and PII as property, the same battle has often been at the forefront of the coverage analysis for thirdparty cyber insurance claims. Nevertheless, as the jurisprudence regarding data and PII as property has emerged in favor of the insured. This same trend has caused jurists to re-think what triggers the duty to defend or indemnify. Indeed, these challenges have grown in number as the trend in litigation over time has been to allow victims of data breaches and cyber-attacks to pursue their claims in court against data controllers and data processors even if their standing to do so is dubious in the absence of actual injury. 20 It is unsurprising; therefore, that this overall trend towards increasing recovery in the third-party context has been accompanied by extremely recent decisions appearing to indicate that coverage for cyber security litigation is readily available even under the most mundane of insurance policies. Data Breaches as Third-Party Property Losses In their nascence, challenges to the duty to defend and indemnify insureds in respect of cyber security claims were almost resoundingly resolved in favor of the insurer on the basis that thirdparty plaintiff claims for loss or dissemination of data did not constitute property damage under traditional commercial general liability insurance policies. As evidenced in the case of America Online, Inc. v. St. Paul Mercury Ins. Co., courts considering policies that required claims of physical damage to tangible property before the duty to defend attached were known to hold that data was nothing more than information and ideas that happen to be stored in electronic form. 21 Indeed, courts confronting this interpretative exercise relied heavily on the popular definition of the words physical and tangible to hold that the loss or publication of data could not constitute covered property damage because the data was itself not palpable or tactile. 22 Perhaps predictably, however, the courts collective resolve to hold data privacy and cyber security claims at bay in the third-party context during the early 2000 s eventually gave way as the Internet and data, more generally, became inextricably woven into the fabric of everyday life. In fact, the end of the first decade of the new millennium was for cyber security, at least marked by a rapid and stark departure from the traditional concept of data in the third-party insurance context when the United States Court of Appeals for the Eighth Circuit decided Eyeblaster, Inc. v. Federal Ins. Co Id. 20 See SOMEBODY S WATCHING ME: DEFENDING DATA BREACH CLAIMS, Counterpoint (April 2015), available at < 21 America Online, Inc. v. St. Paul Mercury Ins. Co., 347 F.3d 89, 93 (4th Cir. 2003). 22 America Online, Inc., 347 F.3d at Eyeblaster, Inc. v. Federal Ins. Co., 613 F.3d 797 (8th Cir. 2010). 124 Page 5 of 8

9 In Eyeblaster, the Court of Appeals entertained third-party coverage for a media advertising firm that would allow customers to create interactive ads to be placed on the Internet, as well as track and manage the performance of the same. 24 Eyeblaster, was sued when its platform was allegedly hijacked, allowing hackers direct access into at least one customer s computer causing a loss of data, damage to his operating system and resulting loss of income. 25 While Eyeblaster, timely tendered the defense of the lawsuit to Federal Insurance Company under both its commercial general liability and Information and Network Technology Errors and Omission policies, the latter declined to accept its defense, arguing that the alleged infiltration into the plaintiff s operating system did not constitute a physical loss for which coverage would attach. 26 However, in directly contradicting the rationale in America Online, supra, the Eyeblaster, court held that the underlying plaintiff s allegations that Eyeblaster, erred in allowing unknown hackers to access his system were sufficient to demonstrate that a property interest in the data had been damaged such that a duty to defend attached under both policies. 27 The Publication Requirement in Third-Party Property Losses Where Eyeblaster, and its progeny made short work of the heart of most insurers challenges to third-party coverage of data privacy and cyber security claims, more recent decisions confirm the current tendency toward finding of coverage. In fact, even the challenge du jour regarding publication of data or PII by third-party hackers has recently been found wanting at the federal level, signaling that even if insurers are initially successful in novel interpretations of their respective duties to defend and indemnify, they will ultimately have to rethink the way in which they approach cyber security altogether if they are to avoid exposure to certain data privacy risks. Indeed, in the wake of cases like Eyeblaster, rendering fundamental concepts of third-party coverage ineffective to the notion of cyber security insurance, insurers turned to alternative theories in an attempt to convince the courts that their insurance contracts were not intended to indemnify data liabilities. One such theory was the rooted in the language of most commercial general liability policies personal and advertising injury coverage parts which provide that the insurance afforded thereunder applies to oral or written publication in any manner of material that violates a person s right of privacy. As evidenced in the New York case of Zurich American Insurance Co. v. Sony Corp. of America, et al., insurers argued that in order to substantiate coverage, the plaintiff s claim in the underlying lawsuit must allege that the publication in any manner was committed by the insured, itself, not hackers or other thirdparties who were able to unlawfully access information controlled by the insured. 28 By in large, this interpretation was accepted by most courts as was the case in Sony Corp. of America, where the judge found that requiring insurers to indemnify their insured s for the alleged criminal acts 24 Eyeblaster, Inc., 613 F.3d at Id. at Id. 27 Id. at Zurich American Insurance Co. v. Sony Corp. of America, 2014 WL (N.Y. Sup. 2014). 125 Page 6 of 8

10 of unknown parties would too broadly expand the scope of publication implied by the insurance contract. 29 True to form, however, judicial resolve toward finding coverage for these types of third-party cyber security claims has ultimately proved true as demonstrated by the Court of Appeals for the Fourth Circuit s March 2016 decision in Travelers Indem. Co. of America v. Portal Healthcare, where the former sued its insured for a declaration of no coverage under a commercial general liability policy on the basis that coverage can only attach where the insured affirmatively publishes data or PII that gives unreasonable publicity to the data subject. 30 In particular, the declaratory judgment action in Portal Healthcare Solutions, LLC. incepted after a putative class of plaintiffs sued the company in New York state court alleging that it failed to safeguard confidential medical records by allowing them to become publicly accessible on the Internet via a network error. 31 According to Travelers, the plaintiffs allegations of network error and inadequate safeguards were insufficient to demonstrate that Portal Healthcare had affirmatively published the data or PII as required by its interpretation of the insurance policy. 32 This interpretation and, for that matter, the interpretation employed by the court in Sony Corp., supra was rejected by both the United States District Court for the Eastern District of Virginia and the Fourth Circuit Court of Appeals, which each independently held that publication under the subject policy does not hinge on the insured s intentions, but rather only whether the information put before the public through any of the insured s alleged acts or omissions. 33 Consequently, at both the trial and appellate level, the Fourth Circuit concluded that coverage should attach regardless of the involvement of third parties in publishing confidential data or PII, provided the insured is at least implicated in the dissemination by the manner in which it conducted itself. 34 Conclusion The history and emergence of cyber security jurisprudence in the first and third-party contexts suggest that courts, attorneys, and claims professionals should all remain mindful of our potentially disastrous tendency to accommodate novelties in the short-term at the expense of stability and predictability. As we have endeavored to demonstrate throughout this essay, what once began as an unyielding fealty to traditional principles in insurance law has morphed into a growing body of precedential and persuasive decisions that attempt to force feed cyber security into available, and often incompatible, coverage regimes. While we have our doubts that the trend can be reversed, there is little doubt that an accord that provides fair and viable cyber 29 Id. 30 Travelers Indem. Co. of America v. Portal Healthcare Solutions, LLC, 35 F.Supp.3d 765, 769, aff d at Docket No (March 24, 2016). 31 Travelers Indem. Co. of America, 35 F.Supp.3d at Id. at Id. 34 Id. 126 Page 7 of 8

11 security coverage must be struck at the market level to avoid further conflation of critical insurance concepts. As a result, it is for attorneys, claims professionals and insurers to collaborate consistent with the Matthew s unknowingly prescient advice not to pour wine into old coverage skins. 127 Page 8 of 8

THREE ADDITIONAL AND IMPORTANT TAKEAWAYS FROM SONY

March 7, 2014 THREE ADDITIONAL AND IMPORTANT TAKEAWAYS FROM SONY In Zurich Amer. Ins. Co. v. Sony Corp., Index No. 651982/2011 (N.Y. Supr. Ct. Feb. 21, 2014), the New York trial court held that Sony Corporation