Bibeka Shrethsa quotes me in her article, “6th Circ. DSW Ruling Reveals New Data Breach Coverage Path”



In her article, 6th Circ. DSW Ruling Reveals New Data Breach Coverage Path, author Bibeka Shrestha writes about a recent ruling from the United States Court of Appeals for the Sixth Circuit.  The decision, Retail Ventures, Inc. v. National Union Fire Insurance Co. of Pennsylvania, — F.3d —, No. 10-4576/4608, slip op. (6th Cir. Aug. 23, 2012), affirmed the trial court ruling[1] that there was coverage relating to a data breach under a crime policy.  Specifically, the court found coverage under the Computer Fraud and Funds Transfer endorsement in the National Union insurance policy.

The article opens:

The Sixth Circuit’s Thursday ruling that a computer fraud rider in DSW Inc.’s crime insurance policy covers losses from hackers’ theft of customer credit card data shows that policyholders without cyber policies can turn to yet another common policy to score data breach coverage, experts say.

The article then explains that the appellate court affirmed the trial court’s ruling “The appeals court upheld a ruling that AIG Inc. subsidiary National Union Fire Insurance Co. of Pittsburgh, Pa., owed $6.8 million to cover a slew of losses the popular shoe retailer suffered after hackers lifted the credit card and checking” information related to customers and multiple stores.  Ms. Shrestha quotes me in the article, in which I opined that this should be a very helpful decision for getting coverage for data breaches.  You can see the quote and the rest of the article, after the jump, and the full content is available if you or your firm subscribe to the Insurance Law360 site and its content.

Want to read the other opinions and thoughts offered on the subject?  Then click on over to 6th Circ. DSW Ruling Reveals New Data Breach Coverage Path to read the entire article.

1 I’ve referenced the excellent trial court decision in multiple pieces that I’ve written about insurance coverage for data breaches, with this article specifically discussing the trial court ruling.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Video clip about potential insurance coverage for statutory based damages relating to data breaches and blast fax claims.

My good friends at HB Litigation Conferences posted a video from their 2012 East Coast NetDiligence Cyber Risk and Privacy Liability Forum that took place in Philadelphia on June 4-5, 2012.  In this video clip, I respond to moderator Ted Kobus‘ question about whether statutory damages, imposed after a data breach, are covered under liability insurance policies.

If you’re interested in cyber risks, data breaches, insurance coverage for cyber risks, insurance coverage for data breaches, and underwriting, brokering, buying, or selling cyberinsurance or privacy insurance, be sure to check out HB’s upcoming West Coast NetDiligence® Cyber Risk and Privacy Liability Forum, on October 11-12, 2012, in Marina del Rey, Calif.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Note:  as a speaker at the conference, I was not charged a fee related to the conference.

Please join me on August 15, 2012 for a webinar: You’ve had a privacy breach…now what?

Please join me on August 15, 2012 for a webinar:  You’ve had a privacy breach…now what?

LexisNexis® Emerging Issues Series | Social Media and Employment Policy Considerations

Here are the details from Lexis and HB:

LexisNexis® Presents a Complimentary CLE Accredited* Webinar:
The 2012 Top Privacy Concerns for Companies and Best Practices for Cyber Breach Preparedness

Government reports estimate that cyber breaches cost the U.S. economy over $1 trillion annually. The need to protect your company against breaches, data loss and theft are increasing in today’s ever-changing technological landscape. Our expert panelists will provide insights plus a risk manager’s perspective on privacy security, best practices for breach preparedness and explain the necessary coverage needs. Learn how to protect yourself in this 90-minute complimentary Webinar designed for in-house counsel.

On August 15, from 2 – 3:30 P.M. ET, join our panel of experts as they bring you the crucial steps needed to prepare for and address cyber privacy issues.

  • Understanding cyber privacy concerns today: Identifying your vulnerabilities & protecting against breaches, data loss or theft.
  • The state and federal statutory frameworks requiring the most observation and compliance.
  • Risk manager’s perspective on privacy security, breach preparedness and coverage needs.
  • Privacy breach—Now what? Understanding the case theories involved, the relevant developments in insurance coverage and the vendors you’ll need in place.
  • Unique concerns raised by the use and storage of health-related information.

Register now

Wednesday, August 15, 2012
2 – 3:30 
P.M. ET

FREE CLE-Eligible Webinar!
Earn 1.5 credit hours

Panelists include:

Scott Godes [formerly] of Dickstein Shapiro LLP

Mario Paez of Wells Fargo Insurance Services

Jimmy Kirtland of ING Americas

Lynn Sessions of Baker & Hostetler LLP

Professor David Bender of the University of Houston Law Center

*CLE is approved or in the process of approval for the mandatory CLE states listed below for 1.5 hours of CLE Credit. Of these, 0 qualify as hours of general, participatory, or skills credit, 0 qualify for hours of law office management, and 0 qualify for hours of ethics/professionalism.

Alabama, Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York†, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin and Wyoming.

†Only experienced NY attorneys may take Webinar training for CLE. New York regulation requires that all CLE sessions must be conducted by an attorney in good standing or a JD. The presenter for this event meets this New York regulation. Contact the LexisNexis® CLE group directly atCLE.Sales@lexisnexis.com with questions about eligibility requirements and for further details on CLE paperwork.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Please join me for a webinar “You’ve Had a Data Breach. Now What?” on Tuesday, August 14.

Please join me for a webinar presentation Dickstein Shapiro is hosting with Fleishman-Hillard titled “You’ve Had a Data Breach. Now What?” on Tuesday, August 14 from 2:003:00 PM ET.

Corporate counsel and communications teams will receive a practical, hands-on examination of what to do and not to do—in the wake of a data breach. With live commentary and Q&A session, this program will cover reality-tested strategies and tactics for a variety of circumstancesI will present this program with Brian Finch, leader of the Dickstein Shapiro Homeland Security Practice, Terry Banks and Gerard Carney at Fleishman-Hillard, and the presentation will be moderated by Michael Semko, Senior Counsel at the National Apartment Association.

There is no fee for this program. If you would like to attend, please click here to register. Please feel free to contact me if you have any questions.

        

Join us for a Webinar on Tuesday, August 14

Legal and Communications Strategies to Protect Your Organization in the Wake of a Data Breach – or Before One Happens…

Barely a week goes by without a new data breach hitting the headlines…

Although breaches happen in a variety of circumstances – i.e., via hackers, internal theft, lost equipment, or accidental exposure – they all have one thing in common: far-reaching legal and communications implications.

Dickstein Shapiro LLP and Fleishman-Hillard invite you to join them for “You’ve Had A Data Breach. Now What?” a free, one-hour Webinar – with live commentary and Q&A session.

Focusing on reality-tested strategies and tactics “You’ve Had A Data Breach. Now What?” will deliver a practical, hands-on examination of the legal and communications imperatives – i.e., what to do and what not to do – in the wake of a data breach.

Other key topics:
· Reputational considerations
· Current legislative developments related to cybersecurity
· Internal and external communications dynamics and strategies

Concise, compelling and fast-moving, the “You’ve Had A Data Breach. Now What?” Webinar will last about 35-40 minutes and will be followed by a Q&A session.

SPEAKERS
· Brian Finch, Practice Leader, Homeland Security, Dickstein Shapiro LLP
· Terry Banks, Senior Vice President and Partner, Media Strategy and Operations, Fleishman Hillard
· Gerard Carney, Senior Vice President and Senior Partner, Financial Communications, Fleishman Hillard
· Scott Godes, [formerly] Counsel and Co-Leader, Insurance Coverage Cybersecurity Initiative, Dickstein Shapiro LLP
· Michael Semko, Senior Counsel, National Apartment Association

Title:  You’ve Had A Data Breach. Now What?
Date:  Tuesday, August 14, 2012
Time:  2:00 PM – 3:00 PM EDT

After registering you will receive a confirmation email containing information about joining the Webinar.
Reserve your Webinar seat now at:

https://www1.gotomeeting.com/register/512301200

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

My Co-Authored Chapter, “Helping Clients Evaluate Their Cyber Risks” Just Published In “Understanding Developments in Cyberspace Law, 2012 ed.”!

I’m happy to announce that the chapter that I co-authored with Mike Tomasulo, who practices intellectual property law in our firm‘s Los Angeles office, was published in “Understanding Developments in Cyberspace Law, 2012 ed.: Leading Lawyers on Analyzing Recent Trends, Case Laws, and Legal Strategies Affecting the Internet Landscape (Inside the Minds) New Edition.”

Here is a brief overview of what’s in the book, Understanding Developments in Cyberspace Law, 2012 ed.: Leading Lawyers on Analyzing Recent Trends, Case Laws, and Legal Strategies Affecting the Internet Landscape (Inside the Minds) New Edition:
This Aspatore legal title provides an authoritative, insider’s perspective on recent cases and legislation that are influencing the Internet. Written by partners from some of the nation’s leading law firms, this book examines current issues such as privacy, intellectual property, and data security. From mobile commerce to social media, these experts analyze the ways in which cyberspace demands new legal perspectives. In addition, these top lawyers discuss e-discovery issues and the best methods for helping clients protect themselves in a rapidly growing electronic environment.
For more information on the entire book, please check out the Summary of Contents.
Here is an excerpt from the introduction to our chapter:

Due to the increasing implementation of connected computer systems, courts and legislators around the world are creating Internet law, also known as cyber law, on a daily basis. . . .  Among many issues in cyber law, property rights are one of the most conceptually challenging issues that attorneys must assist their clients with. . . .

The chapter  discusses multiple cyber-related topics, including:

I.  Trends in Cyberspace Law

II.  Legislation and Rulings Impacting Cyber Law Issues

III.  The Intersection of Insurance and Cyber Risks

IV.  Patent Issues and Litigation in Cyberspace 

V.  Contracting in Cyberspace Media 

VI.  Understanding Cyber Law in Other Jurisdictions 

We conclude the chapter with some key takeaways for companies facing these risks.
Here are more details about the book, click here.  Ordering information is below:
ISBN-13: 9780314285249
Last Updated: 6/29/2012
Availability: In Stock
List Price:
$90.00

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

myspace profile views counter

Susan Kelly quotes me in her article, “Cloudy Coverage? Cyber policies may fall short for cloud computing” in Treasury & Risk.


In her article, Cloudy Coverage? Cyber policies may fall short for cloud computing, author  writes about insurance coverage for cloud computing risks for Treasury & Risk.  She also discusses whether insurance and cyber insurance policies provide coverage for cloud computing risks.

The article opens:

The ability to outsource a company’s technology infrastructure to a third party via cloud computing may seem like a dream come true—until the cloud arrangement breaks down. In April 2011, many Web sites that used Amazon’s cloud services business for hosting went down when Amazon encountered technical difficulties.

The article then discusses insurance coverage for cloud computing risks.  Ms. Kelly quotes me in the article:

One tricky question is the extent to which companies’ insurance covers losses caused by cloud computing problems. Scott Godes, [formerly] counsel at the law firm of Dickstein Shapiro, calls cyber coverage “the Wild West of insurance.”

“It’s a new marketplace . . . .”  . . . Godes notes that it’s rare to see the term “cloud computing” in a cyber policy and advises that companies look carefully at the wording of their policies. “It’s important to pay attention to things like what is the scope of the term ‘network,’” he says. “If that term is written in a way where it could encompass the outsourcing of hosting or support, you have a strong argument that cloud services are covered.”

Want to read the other opinions and thoughts offered on the subject?  Then click on over to Cloudy Coverage? Cyber policies may fall short for cloud computing to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Bibeka Shrethsa quotes me in her article, “Michaels Has Edge In Data Theft Coverage Suit, Attys Say”


PIN pad terminalIn her article, Michaels Has Edge In Data Theft Coverage Suit, Attys Say, author Bibeka Shrestha writes about an insurance coverage dispute relating to cyber risks, including coverage for putative class actions allegedly relating to the theft of credit card and debit card information. The policyholder and the insurance company dispute whether there is insurance coverage for the claim under commercial general liability (CGL) insurance policies.

The article opens:

Arch Insurance Co. told an Illinois federal court Friday that it doesn’t have to defend Michaels Stores Inc. against a slew of putative data breach class actions because no private information was published, but policyholder attorneys say courts have in the past broadly interpreted what counts as “publication.”

The article then explains the basis of the dispute: “The coverage dispute involves seven putative class actions claiming that Michaels failed to prevent criminals from tampering with PIN pad terminals at its stores and stealing customers’ credit and debit card information.”

Ms. Shrestha quotes me in the article. She also notes my views that there is favorable, “policyholder-friendly” rulings regarding personal and advertising injury coverage for privacy, cybersecurity, and data breach claims under CGL insurance policies. The quotes and references all are after the jump, and the full content is available if you or your firm subscribe to the Insurance Law360 site and its content.

Want to read the other opinions and thoughts offered on the subject? Then click on over to Michaels Has Edge In Data Theft Coverage Suit, Attys Say to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Bibeka Shrethsa quotes me in her article, “Crate & Barrel Hammers Out Deal Ending ZIP Code Suits”


In her article, Crate & Barrel Hammers Out Deal Ending ZIP Code Suits, author Bibeka Shrestha writes about a settlement of privacy class actions and a related insurance coverage dispute regarding the potential insurance coverage for those privacy claims.  The putative privacy class actions were filed in California and related to alleged requests for and alleged recording of ZIP codes.

The article opens:

Crate & Barrel has tentatively resolved seven proposed class actions over its collection of customers’ ZIP codes and a related coverage dispute with Hartford Fire Insurance Co. in Illinois federal court.

According to a notice posted May 16, a settlement has been reached that would end the underlying actions in California state and federal courts accusing Euromarket Designs Inc., better known as Crate & Barrel, of requesting and recording customers’ ZIP codes during credit card transactions.

The article then gives details about the lawsuits and the insurance coverage action, including efforts to persuade Hartford to honor its duty to defend the privacy claims.  I have written about and presented on this topic before.

Ms. Shresthsa quotes me in her article, with my comments regarding the import of the settlement.  To read the entire article, including my quotes, click on over to Crate & Barrel Hammers Out Deal Ending ZIP Code Suits.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

“Litigating coverage dispute requires cost-benefit analysis,” an article about insurance coverage litigation by Judy Greenwald.

Business Insurance author Judy Greenwald recently wrote an article titled Litigating coverage dispute requires cost-benefit analysis.  In it, she writes about the issue of policyholders litigating questions of insurance coverage and insurance claims with their insurance companies.

The article opens:

When policyholders decide their only option is to pursue litigation against their insurers in coverage disputes, they should first conduct a cost-benefit analysis to see if it would be worth their while, say policyholder attorneys.

Speed may be critical, say attorneys, who note there can be a “race to the courthouse” as policyholders and insurers rush to file lawsuits in the jurisdictions viewed as most sympathetic to their cause.

The article provides viewpoints from multiple attorneys who represent corporate policyholders and corporate insureds.  I was honored to be included among the policyholder counsel whom she quoted.  Ms. Greenwald also quoted me in the article, writing:

Litigation sometimes may be necessary, say observers. “If you’re in a spot where simply the insurance company draws the line in the sand and refuses to discuss any further, and the parties are at loggerheads,” policyholders may be forced to file suit, said Scott N. Godes, [formerly] of counsel at Dickstein Shapiro L.L.P. in Washington.

Want to read the other opinions and thoughts offered on the subject?  Then click on over to Litigating coverage dispute requires cost-benefit analysis to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Harsco Litigation Counsel Joins the Faculty for the Additional Insured and Indemnification Issues Conference – May 11, 2012 in New York City.

I am happy to announce that we have added some terrific panelists and speakers to the Additional Insured and Indemnification Issues Conference on May 11, 2012 in New York City, hosted by my good friends at HB Litigation Conferences.  Here’s the update from HB:

Samuel Romaninsky, Senior Litigation Counsel for Harsco Corporation – a multinational industrial company based in Camp Hill, PA – will speak on HB’s Additional Insured and Indemnification Issues Conference on May 11, 2012, in New York. Mr. Romaninsky joins a panel discussing “Practical and Strategic Differences Between Contractual Indemnification and Additional Insured Coverage,” along with attorneys Carrie Raver of Barnes & Thornburg LLP, Yale Glazer of Lazare Potter & Giacovas LLP, and Christopher Murray, Claims Counsel in the Construction Risk Management Group at Chartis.

Harsco provides products and services to a variety of industries, including the construction, steel, and rail industries. Harsco’s diverse business lines give rise to a wide array of legal issues related to coverage as an additional insured and under wrap up policies and defense and indemnity obligations. Before joining Harsco, Mr. Romaninsky worked in private practice in Washington, DC.

HB’s Additional Insured and Indemnification Issues Conference will be held May 11, 2012 at Thomson Hall, 195 Broadway, New York, NY 10007, and will also be available via live webcast. The seminar is chaired byTimothy E. Delahunt, a partner at Kenney Shelton Liptak Nowak LLP and Scott Godes, [formerly] counsel at Dickstein Shapiro LLP.

For registration or additional information, contact Brownie Bokelman at 484-324-2755 x212.

Follow conference updates on LinkedIn Events.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Note:  as a speaker at the conference, I will not be charged a fee related to the conference.

myspace profile views counter

Business Insurance quotes me in “Risk managers’ expertise valuable in cyber risk efforts”

In the article, Risk managers’ expertise valuable in cyber risk effortsBusiness Insurance writes about managing cyber risks and insurance for those risks.

The article opens:

Most risk managers might not be information technology experts, but they can effectively manage cyber risks by applying their expertise in such areas as contract risks, assessing the value of exposures and communicating the potential impact of exposures across their organizations.

The article provides viewpoints from multiple people who deal with risk management, cyber risk, and insurance issues.  Business Insurance quotes a risk manager, underwriter, and a broker.  Business Insurance also quoted me in the article, writing:

Using last year’s California Supreme Court ruling in Pineda vs. Williams Sonoma Stores Inc. that held that ZIP codes can be considered personally identifiable information in certain cases as an example, “It’s really quite a changing time in terms of what’s out there in terms of risks and what companies’ potential risks and liabilities might be,” said Scott N. Godes, [formerly] of counsel in the insurance coverage practice at Dickstein Shapiro L.L.P. in Washington.

“We now have 46 states with data breach notification statutes. There’s pending legislation in Congress,” Mr. Godes said. In addition, the U.S. Securities and Exchange Commission has produced cyber security disclosure guidance requiring publicly traded companies to disclose their cyber risks to investors and makes those companies’ boards responsible for assessing their exposures and taking appropriate steps to address them, he said.

“Because of the ongoing changes, it’s certainly something companies need to be paying attention to,” he said.

Want to read the other opinions and thoughts offered on the subject?  Then click on over to Risk managers’ expertise valuable in cyber risk efforts to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Bibeka Shrethsa quotes me in her article, “Companies Eye Data Breach Policies As CGL Exclusions Multiply”


In her article, Cos. Eye Data Breach Policies As CGL Exclusions Multiply, author Bibeka Shrestha writes about insurance coverage for cyber risks, such as hacks and data breaches, and what insurance coverage might be available under commercial general liability (CGL) and other insurance policies, in addition to cyberinsurance policies.

The article opens:

More and more companies, including law firms, are seeking out cyber policies that specifically cover hack attacks, as insurers grow bolder about repudiating coverage for data breaches under commercial general liability policies.

Insurance brokers and underwriters have admitted to providing coverage for cyber losses under general liability policies in the past, according to Scott Godes, [former] co-leader of Dickstein Shapiro LLP’s cyber security insurance coverage initiative.

The article then explains, “But the insurance industry is starting to push back on covering data breaches under these broad policies . . . .”  Ms. Shrestha uses another two quotes from me.  They all are after the jump, and the full content is available if you or your firm subscribe to the Insurance Law360 site and its content.

Want to read the other opinions and thoughts offered on the subject?  Then click on over to Cos. Eye Data Breach Policies As CGL Exclusions Multiply to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Samantha Drake quotes me in her article, “Indemnification Agreements: Who Benefits From Your Coverage?”


In her article, Indemnification Agreements: Who Benefits From Your Coverage?, author Samantha Drake writes about insurance coverage, indemnity agreements, and additional insureds.

The article opens:

Shifting financial liability through contractual apportionment of risk is nothing new. But issues such as the scope of indemnity, choice of law and naming additional insureds adds so many potential wrinkles to an already complex area in which attorneys must be sure to do their homework.

The article discusses the points raised in a “recent panel entitled ‘Additional Insured Issues and Indemnification Agreements'” in which I spoke, “along with Timothy E. Delahunt, of Kenney Shelton Liptak Nowak LLP and Adam M. Shienvold, of Eckert Seamans Cherin & Mellott LLP. HB Litigation Conferences produced the panel.”  Ms. Drake quoted me in the article, writing:

Indemnification agreements are “something with which people have a lot of familiarity, at least in concept, but in terms of practice the law has a lot of variations,” said Scott Godes [formerly] of Dickstein Shapiro LLP.

Ms. Drake also noted my discussions of exceptions to exclusions within insurance policies for contractual liability, including exceptions for insured contracts.  She also provided an overview of the supplementary payments clause found in commercial general liability insurance policies (CGL policies).

Want to read the other opinions and thoughts offered on the subject?  Then click on over to Indemnification Agreements: Who Benefits From Your Coverage? to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Insurance for Cyber Risks: Coverage Under CGL and “Cyber” Policies

Recently, I gave a presentation, along with Rick BortnickJennifer SmithWilliam T. Um, and Hon. Carl West (Ret.), about cyber risks, privacy class action claims, and insurance coverage for cybersecurity claims, cyber risks, privacy claims and privacy class actions, and other emerging risks.  We discussed these claims and we gave our thoughts about insurance coverage for cyber risks under cyberinsurance policies, as well as under Commercial General Liability policies (CGL), commercial crime policies, first party property and all risks policies, directors and officers policies (D&O), errors and omissions policies (E&O), and more.

As part of the presentation, Jennifer and I submitted a paper, Insurance for Cyber Risks:  Coverage Under CGL and “Cyber” Policies.  A nicely formatted version may be found here, hosted by Lockton.

ABA Section of Litigation 2012 Insurance Coverage Litigation Committee CLE Seminar,

March 1-3, 2012:
Insurance coverage for data breaches, denial of service attacks, and cybersecurity events

Insurance for Cyber Risks:
Coverage Under CGL and “Cyber” Policies

Scott Godes, Esq.
[formerly] Dickstein Shapiro LLP

Washington, DC

Jennifer G. Smith, Esq.
Lockton Companies

Washington, DC

THE RISE IN CYBER RISKS

It may seem like a few years ago, every firm had a Y2K practice, and was prepared to provide advice and counseling about how to handle the anticipated end of the world.  Luckily for society at large, the worst case scenario was not realized.  Just a few years later, the focus on liability and risks as related to computers and network security has changed to another, but far more real, issue:  the risk of data breaches, hacks, network interruptions, and other cyber risks.  The number of data breaches and cyber attacks that companies and other entities have faced has been so widespread and expensive that 2011 was dubbed “the year of the cyber attack.”  A recent PricewaterhouseCoopers report characterized “Cybercrime . . . as one of the top four economic crimes.”

Two of the most well-known cyber risks are cyber attacks and data breaches.  One form of cyber attack is a denial of service incident.  Denial of service attacks may be designed to bring a website or service down, preventing customers from accessing the site or the company’s products or services.  One research and development center has explained that denial of service attacks come in a variety of forms.  The three basic types of denial of service attacks are:

  • consumption of scarce, limited, or non-renewable resources;
  • destruction or alteration of configuration information;
  • and physical destruction or alteration of network components.

Some attacks are comparable to “tak[ing] an ax to a piece of hardware” and may be called “permanent denial-of-service (PDOS) attack[s].”  If a system suffers such an attack, which also has been called “pure hardware sabotage,” it “requires replacement or reinstallation of hardware.”

Another cyber risk, perhaps more widely discussed in the news, is a data breach.  The term data breach is used broadly, usually to describe incidents in which hackers, rogue current or former employees, or others steal or otherwise gain access to personally identifiable information or personal health information.  For example, in Anderson v. Hannaford Brothers Co., the court described a data breach against “a national grocery chain whose electronic payment processing system was breached by hackers . . . [with] hackers [having] stole[n] up to 4.2 million credit and debit card numbers, expiration dates, and security codes . . . .”

In the context of personal health information, “[U.S. Department of Health and Human Services] HHS issued regulations requiring health care providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their health information is breached.”  HIPAA imposes liability immediately for breaches of certain information by certain parties; the requirements state that the entity “shall” provide notice, and do not make reference to a letter from the government or a lawsuit to enforce the law.  When a “violation is not corrected . . . a penalty” may be imposed that is $50,000 for each violation, up to $1,500,000 in a calendar year, rather than $10,000 and a cap of $250,000.

Setting the legal and enforcement issues aside, consider certain business issues that may motivate an organization to choose  insurance as a risk transfer solution:

  • Loss of assets, brand, and reputation.
  • Investor fallout from uncovered losses with large claim and class action potential.
  • Many functions are conducted by outside vendors and contractors who may lack insurance and assets to respond. What if the vendor makes a systemic mistake? What if they fail to purchase insurance or keep it? What if they are located in a country where this insurance cannot be obtained? What if the policy they purchased denies coverage or has inadequate limits?
  • PCI (credit card industry security standards) compliant companies have had their security compromised from processes lapse, human error, or criminal insider.
  • No system can be designed to eliminate the potential for loss, as people and processes failures cannot be eliminated. Insiders may be perpetrators.
  • Responsibility rests with the data owner from a legal, regulatory perspective, and credit card association operating regulations.
  • Insurance companies have become more aggressive in asserting (even if wrongfully so) that “traditional” insurance may not cover security liability or adequately cover privacy risks.

COVERAGE UNDER CGL POLICIES

Policyholders and insureds facing cyber risks and liabilities would be well served to analyze their entire slate of insurance policies to determine what coverages might apply to such risks.  Indeed, the Division of Corporation Finance of the U.S. Securities and Exchange Commission recently released “CF Disclosure Guidance:  Topic No. 2 – Cybersecurity.”  That guidance, in the context of cyber risks, notes insurance coverage for such risks, stating:  “Depending on the registrant’s particular facts and circumstances, and to the extent material, appropriate disclosures may include: . . . [a d]escription of relevant insurance coverage.”

Is there coverage for cyber risks under a “standard form” commercial general liability (“CGL”) insurance policy, one with insuring agreements drafted by the Insurance Services Office (“ISO”)?  That question is at issue at the time of this writing between Zurich (among other insurance companies) and various Sony entities in litigation.  In 2011, Sony allegedly suffered various cyber attacks and data breaches, with the events allegedly costing Sony nine figures, and leading to multiple putative class action lawsuits against various Sony entities.  Seeking to avoid defending or indemnifying Sony, Zurich filed an action against Sony, seeking declarations that there is no coverage under various CGL policies, among other requests for rulings.

Zurich itself had recognized, in at least one article, that “[t]hird-party liability policies such as Commercial General Liability (CGL) policies provide coverage to a company . . . for data security breaches.”

Standard form CGL policies often provide coverage for personal and advertising injury, bodily injury, and property damage.  “Personal and advertising injury” has several definitions; but for purposes of data breaches and cyber risks, one relevant definition is “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”  The term “bodily injury” often is defined as including “bodily injury, sickness or disease . . . including death resulting . . . at any time.”  When analyzing the scope of bodily injury coverage in the context of cyber risks, however, consider whether the definition of “bodily injury” has been expanded to include mental anguish, mental injury, shock, fright, or similar terms.  “Property damage” in standard form CGL policies often includes “[p]hysical injury to tangible property, including all resulting loss of use of that property” and “[l]oss of use of tangible property that is not physically injured,” but often states that “electronic data is not tangible property.”

The leading case addressing these issues held that personal and advertising injury coverage was available for computer- and internet-based class action claims.  In Netscape Communications Corp. v. Federal Insurance Co., the U.S. Court of Appeals for the Ninth Circuit’s brief (and unpublished) opinion, along with the earlier trial court opinion that the Ninth Circuit reversed, illustrates that Netscape Communications Corporation (“Netscape”) was sued in putative class action lawsuits regarding a software program that provided Netscape with information about users’ internet activities and which Netscape used for targeted advertising.  The claimants alleged that Netscape’s program violated the Electronic Communications Privacy Act (“ECPA”) and the Computer Fraud and Abuse Act (“CFAA”).  The court held that “[a]lthough the underlying claims against AOL were not traditional breach of privacy claims, given that coverage provisions are broadly construed, the underlying complaints sufficiently alleged that AOL had intercepted and internally disseminated private online communications.”

With a dearth of cases interpreting publication in the cybersecurity context, it is helpful to consider analogous cases.  In Zurich American Insurance Co. v. Fieldstone Mortgage Co., a leading case on the issue, the insurance company argued “that in order to constitute a publication, the information that violates the right to privacy must be divulged to a third party.”  The court correctly rejected that argument, explaining that “the majority [of circuits] have found that the publication need not be to a third party.”  Other courts have followed the well-reasoned Fieldstone decision, finding that unauthorized access of credit reports meets the publication requirement under the relevant personal and advertising injury provisions.

Those holdings are critical in the context of data breaches.  Data breaches, as noted above, consist of situations in which private information has been publicized to third parties.  Therefore, the basic insuring agreement relating to personal and advertising injury should be considered broad enough to encompass a data breach.

To the extent that CGL policies have broadened definitions of bodily injury, there may be an argument that bodily injury coverage applies to, or (at a minimum) provides a defense for, data breach claims.  For example, one of the class action complaints filed against Sony alleges that “plaintiff and the Class have suffered damages, including, but not limited to, . . . fear and apprehension of fraud . . . .”  Such an allegation could be read as falling within an expanded definition of “bodily injury,” depending on how broadly the definition is written and whether it is construed as being tied to a physical bodily injury from the rest of the definition of the term.

The potential application of property damage coverage may be a more fact specific inquiry in the context of cyber risks.  For those policies excluding “electronic data” from the definition of “property damage,” convincing an insurer that a data breach alone caused covered property damage, or gives rise to a duty to defend under property damage coverage, will be challenging for policyholders and insureds.  Nonetheless, certain cyber attacks may result in property damage in the form of physical damage to tangible property.  For example, certain denial-of-service attacks cause physical destruction or alteration of network components.  If an insured can demonstrate that there were allegations of such damage, or actual evidence of such damage, property damage coverage should apply, as the claim does not implicate software and data alone.

The definition of property damage, in a standard form CGL policy, typically includes “[l]oss of use of tangible property that is not physically injured.”  This phrase presents an opportunity to seek coverage for loss of use of tangible property, such as the loss of use of computers or networks rendered inaccessible or inoperable as a result of a cyber attack.

A real world example is found in the Johns v. Sony complaint.  The putative class alleges that “Plaintiffs seek damages to compensate themselves and the Class for their loss (both temporary and permanent) of use of their PlayStation consoles . . . .”  Those loss of hardware use allegations should be considered loss of use of tangible property for purposes of pursuing and maximizing any insurance recovery.

In Eyeblaster, Inc. v. Federal Insurance Co., the U.S. Court of Appeals for the Eighth Circuit considered a similar set of allegations.  That dispute involved a complaint in which the claimant “alleg[ed] that Eyeblaster injured his computer, software, and data after he visited an Eyeblaster website.”  The court analyzed the scope of property damage coverage.  After determining that one prong of the property damage definition was not met, because the claimant alleged software and operating system damage, without allegations of damage to hardware, the court then considered whether the loss of use of tangible property prong of property damage was met.  The court held that alleged computer freezes, pop-up ads, hijacked browsers, random error messages, slowed performance and crashes, and ads based on past Internet surfing habits constituted property damage in the form of loss of use of tangible property sufficient for coverage under a CGL policy.  Likewise, in State Auto Property & Casualty Insurance Co. v. Midwest Computers & More, an Oklahoma federal district court held that loss of use of a computer system allegations fell within the loss of use of tangible property terms of the policy.

A final note specific to data breaches is the question of coverage for credit monitoring under CGL policies.  Policyholders and insureds should anticipate that insurance companies will assert that credit monitoring costs are not covered under CGL policies.  One such anticipated argument is that credit monitoring does not consist of “damages” “because of” personal and advertising injury, bodily injury, or property damage.  Policyholders and insureds should note that courts have rejected similar insurance company arguments in analogous contexts.  For example, class action plaintiffs have alleged that certain products (such as asbestos or lead paint) cause bodily injury at the cellular level, and, as such, they are entitled to the cost of medical monitoring that would allow said plaintiffs to know whether they will develop a cognizable injury or disease.  For those decisions recognizing the underlying claim alleges a covered claim, those decisions have recognized that medical monitoring costs are “damages” “because of” bodily injury.  That authority should be considered a persuasive basis in response to anticipated insurance company arguments that credit monitoring costs are excluded from coverage.

COVERAGE UNDER “CYBER” POLICIES

No doubt countless side-by-side coverage comparisons have been lost in the land of good intentions trying to delineate the distinctions between CGL, property, and cyber insurance solutions.  There are solid arguments that there is coverage for cyber risks under the insuring agreements within a standard ISO form CGL policy.  Likewise, policyholders have had some success in arguing that coverage may be afforded under the Computer Funds Transfer, Theft or Employee Theft/Dishonesty insuring agreements within a Fidelity and/or Commercial Crime program.  There also are solid arguments that coverage for private companies may provide coverage (specifically entity coverage) for cyber-related losses under a private company Directors & Officers Liability insurance program.  Notwithstanding those solid arguments and favorable case decisions, policyholders found themselves facing denials or in insurance coverage litigation to determine whether a CGL or other insurance policy will cover a data breach or other cyber event.

What is the solution then, for those organizations that are concerned with insurance companies taking aggressive positions as to coverage under CGL or other policies for cyber risks in the wake of a data breach or other cyber event?  Insurance companies now are marketing stand-alone, dedicated insurance policies as being designed to address information risk.  Those insurance policies should provide the solution.

Many refer to this solution as “cyber insurance.”  Cyber insurance is a coat of many colors, with as many product names as there are colors of the rainbow.  Other variations include:  Information Security Insurance, Network Security Insurance, Privacy Insurance, Data Breach Insurance, Network Breach Insurance, Technology Solutions, Cyber-this, Cyber-that (e.g., “plus”, “enhancement”, “solution”), Information Insurance, or, when all else fails, some iteration of Professional Liability or E&O – seemingly irrespective of the buyer’s actual services.  For the purposes of this article and to avoid calling attention to any one particular insurer, we will continue to refer to this solution as “cyber insurance.”

Although the expression “no two forms are alike” may be a stretch under other circumstances, it is painfully, tediously true in the cyber insurance context.  These forms vary vastly from the fundamental structure and scope of the policy to the retention and use of outside experts.  Certain policies are duty to defend policies; others are indemnity policies.  Certain policies have specifically delineated intentional torts drafted into the definition of “personal injury” or “wrongful act”; other policies – perhaps in an effort to avoid changing forms amid rapidly evolving regulations – leave such definitions or insuring agreements rather broadly defined.  Some might even argue “vague and ambiguous.”  Each of these issues, and the many others not listed herein, serves as a reminder to potential buyers to rely on their experts in the search for the best cyber insurance solution for that particular organization.

The core elements of cyber insurance that are unique to this particular insurance solution may include coverage in varying degrees for the following:

  • Network Security Liability
    • Claim Expenses and Damages emanating from Network and non-Network security breaches.
  • Media Liability
    • Claim Expenses and Damages emanating from Personal Injury Torts and Intellectual Property Infringement (except Patent Infringement).
    • Claim Expenses and Damages emanating from Electronic Publishing (website) and some will provide coverage for all ways in which a company can utter and disseminate matter.
  • Privacy Liability
    • Claim Expenses and Damages emanating from violation of a Privacy Tort, Law or Regulation.
    • Claim Expenses and Damages emanating from a violation of a law or regulation arising out of a Security Breach.
  • Privacy Regulatory Proceeding and Fines
    • Claim Expenses in connection with a Privacy Regulatory inquiry, investigation or proceeding.
    • Damages/Fines related to a Consumer Redress Fund.
    • Privacy Regulations Fines.
    • PCI Fines.
  • Privacy Event Expense Reimbursement
    • Expense reimbursement for third party forensics costs.
    • Public Relations costs.
    • Legal.
    • Mandatory Notification Costs (Compliance with Security Breach Notification Laws) and Voluntary Notification Costs.
    • Credit Monitoring.
    • Call Center.
    • Second Security Audits required by Financial Institutions (varies by market).
  • Data/Electronic Information Loss
    • Covers the cost of recollecting or retrieving data destroyed, damaged or corrupted due to a computer attack.
  • Business Interruption or Network Failure Expenses
    • Covers cost of lost net revenue and extra expense arising from a computer attack and other human-related perils.  Especially valuable for computer networks with high availability needs.
  • Cyber-Extortion
    • Covers both the cost of investigation and the extortion demand amount related a threat to commit a computer attack, implant a virus, etc.

Also significant, and perhaps unique to the cyber insurance market, is the rapid rate at which the underwriters have modified and/or enhanced their forms. Issues like contractual liability/indemnification, mandatory versus voluntary notification, and even the defining triggers under the policy(ies) appear to change every 18 months – with new product introductions every six months.  Again, buyers are encouraged to carefully review the different program terms and conditions, so that they can prioritize and weigh their coverage needs against the solutions offered by the underwriters.

Although sorting through various cyber insurance solutions may be a daunting task to first-time buyers, it is worth repeating that insurance companies market this solution as being designed expressly to contemplate information risk, including data privacy and network security.  A properly designed insurance solution may very well pre-empt a difficult explanation to senior management after a cyber loss, a much more favorable position to be in than explaining why the policyholder’s insurance companies have sued the policyholder, simply because the policyholder put the insurance company on notice.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.


Join me at the 2012 NetDiligence® Cyber Risk & Privacy Liability Forum.

My good friends at HB Litigation Conferences present:

NetDiligence® Cyber Risk & Privacy Liability Forum
June 4-5, 2012| Hyatt at the Bellevue, Philadelphia, PA

I’ll be a speaker on a panel discussing the “State of the Cyber Nation – Cases, Theories, and Damages”:

State of the Cyber Nation – Cases, Theories, and Damages
•Is actual harm still needed?
•Statutory framework – CMIA litigation, Video Protection Privacy Act, and the Driver’s Privacy Protection Act
•Notable recent cases and their impact
•Current theories of liability and claims alleged
•How to present damages in this era
•How to minimize the chance of litigation after a breach and settlement opportunities
•More sophisticated defenses
•Identity Theft Restoration Act-suing hackers?  How federal courts may change the game
•Medical disclosure cases and how they fit into the mix
•Developments in insurance coverage for cyber and privacy risks

Theodore Kobus III, Esq., Baker & Hostetler LLP (Moderator)
John Mullen Sr., Esq., Nelson Levine de Luca & Horst, LLC
Scott Godes, Esq, [formerly] Dickstein Shapiro
Jamie Sheller, Esq.
, Sheller P.C.
Mark Camillo, Chartis Insurance
Ben Barnow, Esq., Barnow & Associates, P.C.

Take a look at the full agenda by clicking here.  And you can register online by clicking here.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note:  as a speaker at the conference, I was not charged a fee to attend the remainder of the conference.
myspace profile views counter

Join me for the IRMI Cyber & Privacy Risk Conference.

IRMI Cyber & Privacy Risk Conference.  Mark your calendar to join us in Baltimore, MD on May 16-17, 2012.

Noted cybersecurity, homeland and national security expert Richard A. Clarke will deliver the keynote address.

Discussing the last IRMI Cyber & Privacy Risk Conference, IRMI notes:

This past July in San Francisco, 100 risk managers, underwriters, agents and brokers attended the first IRMI Cyber & Privacy Risk Conference.

These industry thought leaders came away with a greatly improved understanding of how to identify, contractually transfer, and insure liability risks arising from the use of technology and the Internet in business. Many networking opportunities were provided to build relationships with leaders in cyber and privacy risk management and insurance.

My session will be:

Wednesday, May 16, 10:45 a.m. – 12:15 p.m.

The Cyber Risk Regulatory and Legal HorizonAs the web of laws and regulatory requirements increases, managing the risks of cyber security becomes even more challenging. On top of the multitude of state laws, the SEC recently released reporting requirements and Congress is set to take up a number of bills during 2012. This workshop will provide an overview the range of laws and regulations in place and explore the new legislative developments affecting cyber insurance and risks, as well as the reporting requirements issued recently by the SEC.

Panelists:

  • Scott N. Godes, Counsel in the Insurance Coverage Practice, [formerly] Dickstein Shapiro LLP
  • Jacob Olcott, Principal, Cybersecurity, Good Harbor Consulting, LLC
  • Tim Stapleton, Assistant Vice President and Professional Liability Product Manager, Zurich North America
  • Other Panelists To Be Announced

Interested in attending?  Then head on over to the RIMS 2012 website to register.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Note:  as a speaker at the conference, I will not be charged a fee related to the conference.

myspace profile views counter

Allen Smith quotes me in his article, “‘Wild West’ of Cyber Insurance Might Cover Spear Phishing, Other Cybercrime.”

In his article, ‘Wild West’ of Cyber Insurance Might Cover Spear Phishing, Other CybercrimeSociety for Human Resource Managementauthor Allen Smith, manager, workplace law content, for SHRM writes about cyber risks and cyber insurance.

The article opens:

The cyber insurance policy market is “a little like the Wild West of insurance,” but cyber insurance might help cover notification and legal costs incurred for data breaches or losses stemming from cybercrime, according to Scott Godes, an attorney [formerly] with Dickstein Shapiro in Washington, D.C., and author of the Corporate Insurance Blog.

In addition to quoting me on cyber insurance, the article also provides viewpoints from multiple people who deal with insurance and cyber risk issues, including Larry Ponemon, chairman of the Ponemon Institute in Traverse City, Michigan,  Ken Goldstein, vice president with Chubb Group Insurance Cos. in Simsbury, Connecticut, Peter Foster, senior vice president with Willis North America in New York, Don Fergus, an independent risk consultant in the Washington, D.C., metro area, and chairman of the ASIS IT Security Council, and Eric Sinrod, an attorney with Duane Morris in San Francisco.

Want to read the other opinions and thoughts offered on the subject?  Then click on over to ‘Wild West’ of Cyber Insurance Might Cover Spear Phishing, Other Cybercrime to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Join me for the Additional Insured and Indemnification Issues Conference – May 11, 2012 in New York City.

Is your company an additional insured under another company’s insurance policies? Does your company issue certificates of insurance? Do you deal with indemnity agreements? Do you know whether indemnity agreements are covered by insurance? Would you like to learn the answers to these questions? Of course you would.

You’d like to hear about this from a commercial litigator and insurance coverage attorneys, wouldn’t you?

Plus, you’d like CLE credit for listening, including CLE ethics credit, wouldn’t you?

Well, say no more!

If you’re looking for all of that and more, organized and hosted by my good friends at HB Litigation Conferences, please join me for the Additional Insured and Indemnification Issues Conference: Other People’s Money Conference, as detailed by HB:

HB Litigation Conferences is pleased to announce the Additional Insured and Indemnification Issues Conference: Other People’s Money will be held Friday, May 11, 2012, at Thomson Hall in New York. The seminar is chaired by Timothy E. Delahunt, a partner at Kenney Shelton Liptak Nowak LLP and Scott Godes, [formerly] counsel at Dickstein Shapiro LLP.

The recently released Additional Insured and Indemnification Issues Conference agenda features sessions on Triggering The Duty To Defend Under Additional Insured Coverage; Scope Of The Duty To Indemnify Under Additional Insured Endorsements; Priority Of Coverage Where Additional Insured Coverage Exists; Practical And Strategic Differences Between Contractual Indemnification And Additional Insured Coverage; Ethical Considerations Particular To Additional Insured Coverage: Conflicts, Privilege And Confidentiality.

The event is sponsored by Dickstein Shapiro LLP. For additional sponsorship opportunities, contact Jeanne Billings at 484-580-8241 or jeanne.billings@litigationconferences.com.

Early bird registration – $100 off – is available through February 24, 2012. HB offers complimentary registrations* to in-house counsel and 50% off registrations* for their teams of outside counsel. Space is limited so register ASAP.

For additional information or to register, contact Brownie Bokelman at 484-324-2755 x212 or brownie.bokelman@litigationconferences.com.

*Discounts valid on new registrations only and cannot be combined with any other offer. Space is limited for in-house counsel complimentary registrations and 50% off discounted registrations for outside counsel. One complimentary registration per company.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Note:  as a speaker at the conference, I will not be charged a fee related to the conference.

myspace profile views counter

“A Lawyer’s Advice for Evaluating Your Cyber Coverage”

I recently wrote an article titled, “A Lawyer’s Advice for Evaluating Your Cyber Coverage:  Policies vary significantly from carrier to carrier—and even within the various forms of one company.”  It has been published on the Property Casualty 360° website, republished from the February 6, 2012 issue of National Underwriter.

In the article, I discuss insurance coverage for data breaches, cyber risks, cyberattacks, and cyber events, including what factors to consider when buying cyberinsurance policies for cyber risks.  I also discuss how different cyber risks may be characterized, whether as within first party, or third party insurance coverages, and how to keep those risk factors in mind when brokering, broking, or buying a cyberinsurance policy.

Here is a brief excerpt from the article:

Policyholders and insureds exposed to cyber risks would be well served to analyze carefully their insurance policies to determine exactly which coverages apply to them—and to see if any critical coverages are missing.

Cyber Liability insurance should provide coverage for the vast majority of key cyber risks, and there may also be overlapping coverage under other policies for such exposures.

The first place that a company should look to determine whether it has, or may have, coverage for cyber risks is any specific Cyber Liability policies that the entity holds. A very close look at these policies is warranted, as the coverage under such policies often varies significantly from carrier to carrier—and even within the various forms that one particular insurance company offers.

Want to read moreThen click on over to the full article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Michael P. Voelker quotes me in his Property Casualty 360 article, “After ‘Year of the Data Breach,’ Carriers Increase Capacity, Competition for Cyber Risks.”

In his article, After ‘Year of the Data Breach,’ Carriers Increase Capacity, Competition for Cyber Risks, Property Casualty 360°author Michael P. Voelker writes about cyber risks and cyber insurance.

The article opens:

There’s a good reason why 2011 is known among security professionals as the Year of the Data Breach.

The antics began in April, with a bold, high-profile data raid on Sony’s Playstation Network database—and ended with hackers scamming credit-card details, passwords and home addresses from the systems of intelligence-analysis firm Stratfor in December.

The article provides viewpoints from multiple people who deal with insurance and cyber risk issues.  Mr. Voelker also quoted me in the article, writing:

“The Cyber Liability insurance market is the ‘Wild West’ of insurance,” observes Scott N. Godes, [formerly] counsel at Dickstein Shapiro LLP. “It’s worthwhile going through a policy with a fine-toothed comb with someone who truly understands Cyber Liability.”

Want to read the other opinions and thoughts offered on the subject?  Then click on over to After ‘Year of the Data Breach,’ Carriers Increase Capacity, Competition for Cyber Risks to read the entire article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

« Older Entries Recent Entries »