Tag Archives: DDoS

“Protecting Your Company Against Loss or Liability Arising from Cyberattacks”

My former colleague, Ken Trotter, and I recently wrote an article titled, “Protecting Your Company Against Loss or Liability Arising from Cyberattacks.”  It has been published in Hospitality Lawyer‘s September 2011 In-House Counsel Newsletter.  In the article, we discuss insurance coverage for data breaches, cyber risks, cyberattacks, and cyber events.  We discuss coverages under new cyberinsurance policies, and overlapping coverage with other insurance policies for data breaches, cyber risks, cyberattacks, and cyber events.

We provide an overview of potential coverage under:

  • First party property policies;
  • Business interruption coverage and policies;
  • Commercial General Liability (CGL) policies;
  • Directors and Officers Liability (D&O) policies;
  • Errors and Omissions policies; and
  • Crime and Fidelity policies.

We also give practical considerations when making claims for coverage.

Here is the opening paragraph to the article:

Does your company have insurance policies that will cover data breaches and cyber attacks?  The hospitality industry is particularly vulnerable to data breaches and other cyberattacks.  According to Willis Group Holdings, a British insurance firm, insurance claims for data theft worldwide jumped 56% last year, with a large number of those attacks targeting the hospitality industry.  The report said the largest share of cyber attacks—38%—were aimed at hotels, resorts and tour companies.  As just one example of these attacks, computer hackers broke into the computer system of a national hotel chain and stole the guests’ credit card information.  This summer, the Secret Service informed the owner of a family-run Italian restaurant that a thief hacked into the communication system between the cash register and the credit card processing company, stole credit card numbers, and then used them to fraudulently make purchases across the United States.  Businesses in the hospitality industry will continue to be attractive targets for hackers and data thieves, particularly since they obtain and maintain confidential data from consumers including countless credit card records.  There are risks for companies well beyond the possibility of hackers stealing consumer data.  Vital corporate data, whether it’s shared on the company’s servers or by third parties, may become inaccessible or even destroyed in a hacker attack.  Managing such risk is critical to successful business operations. Read more

Want to read moreThen click on over to the newsletter.

Learn about cyber risk, data breaches, and cyber insurance by joining me for the NetDiligence® West Coast Cyber Risk & Privacy Liability Forum!

It’s been said that 2011 is the year of the data breach and cyber attack.  If you’re looking to learn more about data breaches, privacy claims and privacy breaches, health care sector risks, cyber risk insurance coverage, and about state and federal regulations and laws covering data breaches and cyber risks, then you should join me for the NetDiligence® West Coast Cyber Risk & Privacy Liability Forum, organized and hosted by my good friends at HB Litigation Conferences.  You can get continuing legal education (CLE) credit, too.

Here are the details:

NetDiligence® West Coast Cyber Risk & Privacy Liability Forum

Date: October 4-5, 2011
Location:
The Ritz-Carlton, Marina del Rey, CA
Chairs: Brad Gow
, Endurance Specialty Holdings Ltd.;
Anne De Vries
, Managing Director, Digital Risk Managers, A division of Wells Fargo Special Risks, Inc.; Christopher Novak, Managing Principal, Verizon Business – Investigative Response;  and Ben Beeson, Partner, Global Technology and Privacy Risks Practice, Lockton Companies LLP

Agenda and Speakers

Register Now!

Delegate Rates:
Attorneys: $1,195**
Insurers & Brokers: $895**
Risk Managers and CFOs: $795**
Sitting Judges or Special Masters: FREE

Individual & Group Discounts Available

Please contact Brownie Bokelman at 484-324-2755 x212 or Brownie.Bokelman@litigationconferences.com to discuss these options.

Conference Venue and Hotel Information

The Ritz-Carlton, Marina del Rey is located at 4375 Admiralty Way, Marina del Rey, CA. Attendees should make reservations directly with the hotel by calling 1-800-241-3333 or click here to book online and enter code HBLHBLG. A block of rooms has been reserved for $239/night – mention the HB Litigation Cyber Risk Conference. The cut-off for this rate is September 12, 2011. If you have any questions or need assistance, please contact Cyndy Noonan directly at 484-324-2755 x201 or cyndy.noonan@litigationconferences.com.

Can’t Attend?

You can still benefit from our programs! Audio, video recordings and handbooks are available for our conferences! Individually priced and packaged, each captures the information and insights delivered by our faculty. Hear from experts, gain new perspectives, and learn proven techniques. For more information, click here, call 484-324-2755, or email allison.emery@litigationconferences.com to reserve your copy today!

My session will be:

State of the Cyber Nation Address

  • Notable recent cases and their impact on this budding litigation area
  • What plaintiffs’ counsel look for when evaluating new data breach class actions
  • Current theories of liability and claims alleged
  • How to present damages in this era?
  • Considerations to minimize the chance of litigation after a breach and settlement opportunities
  • More sophisticated defenses
  • Identity Theft Restoration Act-suing hackers?
  • How federal courts may change the game

Meredith Schnur, Wells Fargo Insurance Services USA, Inc.(Moderator)

Jon Lambiras, Berger & Montague, PC

John Mullen, Sr., Esq., Nelson Levine de Luca & Horst, LLC

Scott Godes, Esq., [formerly] Dickstein Shapiro

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note: as a speaker at the conference, I will not be charged a fee to attend the remainder of the conference.

myspace profile views counter

Podcast on D&O insurance, cybersecurity, cyber liabilities, privacy class actions, and insurance: “Executive Summary Webinar Series: What You Need to Know Before You Walk Into the Boardroom (July 2011)”

I recently joined Priya Cherian Huskins and Lauri Floresca of Woodruff Sawyer & Co. to discuss D&O insurance, cyberinsurance, and insurance coverage for privacy issues, data breaches, cyberattacks, denial-of-service attacks and more.   Lauri and Priya gave an overview of the D&O insurance marketplace, including changes in pricing, availability of limits, and new insurance policies and insurance products.  Then we shifted gears and talked about cybersecurity, cyber liability, and insurance coverage for cybersecurity risks.  We touched on the latest data breaches, privacy claims and class actions, and other cyber incidents to have hit the news and discussed the related insurance coverage issues.  The audio and supporting materials (that Woodruff Sawyer prepared) have been put online as a podcast and supporting PDF, so that you listen, in case you missed the live presentation.

To listen to this podcast, click here.

To view a pdf of the presentation, click here.

Date and Time


 

Tuesday, July 19, 2011


Webinar

11:00 AM – 11:30 AM PST


This webinar is offered free of charge.


Visit Us At:

LinkedIn   Facebook   Twitter


Woodruff-Sawyer & Co.

50 California St., 12th Fl.

San Francisco, CA 94111

Before you walk into your next board meeting, what do you need to know when it comes to current D&O liability issues? The “Executive Summary” is Woodruff-Sawyer’s webinar series for CFOs, GCs, Controllers and others who work with boards of directors.  The upcoming session will feature a conversation with Woodruff-Sawyer’s Priya Cherian Huskins and Lauri Floresca, both nationally-recognized insurance experts, and Scott Godes [formerly] of Dickstein Shapiro.Scott [was] the co-leader of Dickstein Shapiro’s Cyber Security Coverage Initiative. Areas of Discussion

  • D&O Market Update
  • D&O Litigation Update

– Newest numbers on D&O suits
– Latest on Supreme Court rulings

  • Lessons from Sony & Citi: What boards should be asking about cyber liability

– Updates on the recent high-profile data security breaches
– Understanding the impact of California’s recent Supreme Court zip code decision
– What should boards do to mitigate cyber risks?

Click here to register for this webinar.

For questions, please email seminar@wsandco.com


Woodruff-Sawyer is one of the largest independent insurance brokerage firms in the nation, and is an active partner of International Benefits Network and Assurex Global. For over 90 years, Woodruff-Sawyer has been partnering with clients to implement and manage cost-effective and innovative insurance, employee benefits and risk management solutions, both nationally and abroad. Headquartered in San Francisco, Woodruff-Sawyer has offices throughout California and in Portland, Oregon. For more information, call 415.391.2141 or visit www.wsandco.com.


Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

myspace profile views counter

Join me for a free webinar about D&O and cyberinsurance: “Executive Summary”: What You Need to Know Before You Walk into the Boardroom

Please join me on July 19, 2011, at 2:00 pm Eastern, for a free webinar hosted by Woodruff Sawyer & Co. Priya Cherian Huskins, Lauri Floresca, and I will discuss D&O insurance, cyberinsurance, and insurance coverage for privacy issues, data breaches, cyberattacks, denial-of-service attacks and more. Here are the details from Woodruff Sawyer‘s announcement:

 

Date and Time


 

Tuesday, July 19, 2011


Webinar

11:00 AM – 11:30 AM PST


This webinar is offered free of charge.


Visit Us At:

LinkedIn   Facebook   Twitter


Woodruff-Sawyer & Co.

50 California St., 12th Fl.

San Francisco, CA 94111

Before you walk into your next board meeting, what do you need to know when it comes to current D&O liability issues? The “Executive Summary” is Woodruff-Sawyer’s webinar series for CFOs, GCs, Controllers and others who work with boards of directors.  The upcoming session will feature a conversation with Woodruff-Sawyer’s Priya Cherian Huskins and Lauri Floresca, both nationally-recognized insurance experts, and Scott Godes [formerly] of Dickstein Shapiro.Scott [was] the co-leader of Dickstein Shapiro’s Cyber Security Coverage Initiative. Areas of Discussion

  • D&O Market Update
  • D&O Litigation Update

– Newest numbers on D&O suits
– Latest on Supreme Court rulings

  • Lessons from Sony & Citi: What boards should be asking about cyber liability

– Updates on the recent high-profile data security breaches
– Understanding the impact of California’s recent Supreme Court zip code decision
– What should boards do to mitigate cyber risks?

Click here to register for this webinar.

For questions, please email seminar@wsandco.com


Woodruff-Sawyer is one of the largest independent insurance brokerage firms in the nation, and is an active partner of International Benefits Network and Assurex Global. For over 90 years, Woodruff-Sawyer has been partnering with clients to implement and manage cost-effective and innovative insurance, employee benefits and risk management solutions, both nationally and abroad. Headquartered in San Francisco, Woodruff-Sawyer has offices throughout California and in Portland, Oregon. For more information, call 415.391.2141 or visit www.wsandco.com.

 

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

myspace profile views counter

Join me for ACI’s 5th National Advanced Forum on Cyber & Data Risk Insurance

Are you looking for a conference discussing insurance coverage for cyber and data risk issues, where you will have “the unique opportunity to network, benchmark your products against the competition and gain valuable information about the right insurance coverage for your company”? Then you should join me for the American Conference Institute 5th Annual Cyber & Data Risk Insurance conference.

Here are the introductory details:

Cyber & Data Risk Insurance

Monday, September 26 to Tuesday, September 27, 2011
Affinia Manhattan Hotel, New York, NY

International legislative changes and compliance…External threats from the explosion of social media…Cloud computing…PCI, HIPAA & HITECH standards… social engineering, malware downloads, phishing, click-jacking, spoofing, whistleblowing, massive leaks… THE LIST GOES ON

The expanded scope of Cyber & Data Risk Insurance is here. Attend the annual September conference that the industry has known and trusted for years!

* * *

Dates:
Mon, Sep 26, 2011
Tue, Sep 27, 2011
Location:
Affinia Manhattan Hotel
New York, NY

Accreditation:

Accreditation will be sought in those jurisdictions requested by the registrants which have continuing education requirements. This course is identified as nontransitional for the purposes of CLE accreditation.

ACI certifies that the activity has been approved for CLE credit by the New York State Continuing Legal Education Board in the amount of 15.0 hours. An additional 2.0 hours will apply to workshop A and 3.0 hours to workshop B.

ACI certifies that this activity has been approved for CLE credit by the State Bar of California in the amount of 12.75 hours. An additional 2.0 hours will apply to workshop A and 2.5 hours to workshop B.You are required to bring your state bar number to complete the appropriate state forms during the conference. CLE credits are processed in 4-8 weeks after a conference is held.

ACI has a dedicated team which processes requests for state approval. Please note that event accreditation varies by state and ACI will make every effort to process your request.Questions about CLE credits for your state? Visit our online CLE Help Center at http://www.americanconference.com/CLE

My panel will be:

10:05     State of the Market: New Exposures, Coverage Options and Trends that Are Changing the Scope of Cyber Liability

Edward McGuire, Senior    Vice    President,    Sales    &    Marketing S.H. Smith & Co.
Steven H. Haase, CPCU ARM, INSUREtrust
Malcolm Randles, Underwriter,    Enterprise    Risks    510, R    J    Kiln    &    Co    Limited
Jenny B. Bradford, J.D., Vice    President    Financial    Products,    Risk    Management    Liability, Regions Insurance
Scott N. Godes, Counsel, [formerly] Dickstein    Shapiro    LLP

  • Market overview and legal developments
    • Updates on new exposures, coverage decisions and new products to ensure coverage
    • Addressing the lack of uniformity among policies
    • Cyber risk insurance overlap with other insurance policies
    • How big is the market and how much has it grown over the past few years?
    • New clients and non-technology companies purchasing coverage:   who they are and what they are looking for
  • A    closer    look    at    security    &    privacy    challenges    facing    small    businesses
    • What considerations have been given to products that may attract small to mid-market    companies?
    • How carriers are capitalizing on this
  • State of the reinsurance market for cyber-risk insurance
    • Clarification of comprehensive contracts and identifying key provisions

Interested in attending?  You can get a discounted rate through me, taking $600 off of the registration price, if you register by June 30.   If you’re interested in getting the discounted rate, please e-mail me.  Or, if it’s after June 30, you can click here:
Register Now

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note:  as a speaker at the conference, I will not be charged a fee to attend the remainder of the conference.

myspace profile views counter

Insurance Coverage for Denial-of-Service Attacks

DDoS

It seems that 2011 has been the year of cyberattacks – denial of service attacks, data breaches, and more.  Would your insurance policies cover those events?  Beyond the denial of service attacks that made news headlines, a shocking “80 percent of respondents” in a survey of “200 IT security execs” “have faced large scale denial of service attacks,” according to a ZDNet story.[1]  These attacks and threats do not appear to be on a downward trend.  They continue to be in the news after cyberattacks allegedly took place against “U.S. government Web sites – including those of the White House and the State Department –” over the July 4, 2009 holiday weekend.[2]  The alleged attacks were not only against government sites; they allegedly included, “according to a cyber-security specialist who has been tracking the incidents, . . . those run by the New York Stock Exchange, Nasdaq, The Washington Post, Amazon.com and MarketWatch.”[3]  The more recent ZDNet survey shows that a quarter of respondents faced denial of service attacks on a weekly or even daily basis, with cyberextortion threats being made as well.[4]

Denial of Service Attacks

The cyberattacks that have stolen recent headlines were denial of service incidents.  Personnel from “CERT® Program,” which “is part of the federally funded Software Engineering Institute (SEI), a federally funded research and development center at Carnegie Mellon University in Pittsburgh, Pennsylvania,” have explained:

Denial of service attacks come in a variety of forms and aim at a variety of services. There are three basic types of attack:

  • consumption of scarce, limited, or non-renewable resources
  • destruction or alteration of configuration information
  • physical destruction or alteration of network components.[5]

Some attacks are comparable to “tak[ing] an ax to a piece of hardware” and are known as “so-called permanent denial-of-service (PDOS) attack[s].”[6]  If a system suffers such an attack, which also has been called “pure hardware sabotage,” it “requires replacement or reinstallation of hardware.”[7]

What Insurance Coverage Might Apply?

The first place to look for insurance coverage for a denial of service attack is a cybersecurity policy.  The market for cybersecurity policies has been called the Wild West of insurance marketplaces.  Cyber security and data breach policies, certain forms of which may be known as Network Risk, Cyber-Liability, Privacy and Security, or Media Liability insurance, are relatively new to the marketplace and are ever-changing.  The Insurance Services Office, Inc., which designs and seeks regulatory approval for many insurance policy forms and language, has a standard insurance form called the “Internet Liability and Network Protection Policy,” and insurance companies may base their coverages on this basic insuring agreement, or they may provide their own company-worded policy form.  Because of the variety of coverages being offered, a careful review of the policy form before a claim hits is critical to understand whether the cyberpolicy will provide coverage, and, if it will, how much coverage is available for the event.  If your company does make a claim under a cyberpolicy, engaging experienced coverage counsel who is familiar with coverage for cybersecurity claims will help get the claim covered properly and fight an insurance company’s attempt to deny the claim or otherwise improperly try to limit coverage that is due under the policy.

If your company faces a denial of service cyberattack and suffers losses as a result, but your company has not purchased a specialized suite of policies marketed as cyber security policies, coverage nonetheless may be available under other insurance policies.  In addition, other insurance policies may provide coverage that overlaps with a cyberinsurance policy.  Consider whether first party all risk or property coverage may apply.  First party all risk policies typically provide coverage for the policyholder’s losses due to property damage.  If the denial of service cyberattack caused physical damage to your company’s servers or hard drives, your company’s first party all risk insurer should not have a credible argument that there was no property damage.  Even if the damage is limited to data and software, however, it may be argued that the loss is covered under your company’s first party all risk policy, as some courts have found that damage to data and software consists of property damage.[8]

First party policies may also provide coverage for extra expense, business interruption, and contingent business interruption losses due to a cyberattack.  (Contingent business interruption losses may include losses that the policyholder faces arising out of a cyber security-based business interruption of another party, such as a cloud provider, network host, or others.)[9]

Look also to other first party coverages, such as crime and fidelity policies, to determine whether there may be coverage for losses due to a cyberattack.  In particular, crime policies may have endorsements, such as computer fraud endorsements, that may cover losses from a denial of service cyberattack.[10]

If, after a cyberattack, third parties seek to hold your company responsible for their alleged losses, consider whether your company’s liability policies would provide coverage.  More importantly, consider your company’s commercial general liability (CGL) insurance policy, if your company does not have a specialized cyber liability policy.  If your company did buy a cyberinsurance policy, there is coverage under a CGL policy (and others) that may overlap the coverage in a cyberinsurance policy, providing your company with additional limits of insurance coverage available for the claim.

The first coverage provided in a standard-form CGL insurance policy covers liability for property damage.  Similar to the analysis above for first party all risk policies, if there was damage to servers or hard drives, insurers should not be heard to argue that there was no property damage.  Courts are divided as to whether damage to data or software alone consists of property damage under insurance policies, with some courts recognizing that “the computer data in question ‘was physical, had an actual physical location, occupied space and was capable of being physically damaged and destroyed’” and that such lost data was covered under a CGL policy.[11]  Be aware, however, that the insurance industry has revised many CGL policies to include definitions giving insurers stronger arguments that damage to data and software will not be considered property damage.  But also note that your company’s CGL policy may have endorsements that provide coverage specifically for damage to data and software.[12]  Consider further whether a claim would fall within the property damage coverage for loss of use of tangible property—loss of use of servers and hard drives because of the cyberattack; loss of use of computers arising out of alleged software and data-based causes has been held sufficient to trigger a CGL policy’s property damage coverage.[13]

Keep in mind that if there is a claim for property damage under a CGL policy, there may be coverage for obligations that your company has under indemnity agreements.  Standard form CGL policies provide coverage for indemnity agreements.[14]

Depending on the types of claims asserted, other liability policies may be triggered as well.  For example, directors and officers liability policies may provide coverage for investigation costs,[15] and errors and omissions policies also may cover, if the cybersecurity claims may be considered to be within the definition of “wrongful act.”[16]  The takeaway for companies suffering from a cyberattack is that a careful review of all policies held by the insured is warranted to make certain that the most comprehensive coverage may be pursued.

Scott Godes [was] counsel with Dickstein Shapiro’s Insurance Coverage Practice in the firm’s Washington, D.C. office.  Mr. Godes is the co-head of the firm’s Cyber Security Insurance Coverage Initiative and co-chair of the American Bar Association Computer Technology Subcommittee of the Insurance Coverage Committee of the Section of Litigation.  He frequently represents corporate policyholders in insurance coverage disputes.

[1] Larry Dignan, Cyberattacks on Critical Infrastructure Intensify, ZDNet, http://m.zdnet.com/blog/btl/cyberattacks-on-critical-infrastructure-intensify/47455 (Apr. 19, 2011).

[2] U.S. Government Sites Among Those Hit by Cyberattack, CNN, http://www.cnn.com/2009/TECH/07/08/government.hacking/index.html (July 8, 2009).

[3] Siobhan Gorman & Evan Ramstad, Cyber Blitz Hits U.S., Korea, Wall St. J., http://online.wsj.com/article/SB124701806176209691.html (July 9, 2009).

[4] Larry Dignan, Cyberattacks on Critical Infrastructure Intensify, ZDNet, http://m.zdnet.com/blog/btl/cyberattacks-on-critical-infrastructure-intensify/47455 (Apr. 19, 2011).

[5] Denial of Service Attacks, CERT, http://www.cert.org/tech_tips/denial_of_service.html (last visited July 9, 2009); About CERT, CERT, http://www.cert.org/meet_cert/ (last visited July 10, 2009).

[6] Kelly Jackson Higgins, Permanent Denial-of-Service Attack Sabotages Hardware, Security Dark Reading, http://www.darkreading.com/security/management/showArticle.jhtml?articleID=211201088 (May 19, 2008).

[7] Id.

[8] See, e.g., Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16 (Tex. App. 2003) (first party property coverage for data damaged because of hacker attack or computer virus); Am. Guar. & Liab. Ins. Co. v. Ingram Micro, Inc., No. 99-185 TUC ACM, 2000 U.S. Dist. LEXIS 7299, at *6 (D. Ariz. Apr. 18, 2000) (construing “physical damage” beyond “harm of computer circuitry” to encompass “loss of access, loss of use, and loss of functionality”).

[9] Se. Mental Health Ctr., Inc. v. Pac. Ins. Co., 439 F. Supp. 2d 831, 837-39 (W.D. Tenn. 2006) (finding coverage under business interruption policy for computer corruption); see also Scott N. Godes, Ensuring Contingent Business Interruption Coverage, Law360 (Apr. 8, 2009), http://insurance.law360.com/articles/94765 (discussing coverage under first party policies resulting from third party interruptions).

[10] For example, in Retail Ventures, Inc. v. National Union Fire Insurance Co., No. 06-443, slip op. (S.D. Ohio Mar. 30, 2009), the court held that a crime policy provided coverage for a data breach and hacking attack.

[11] See, e.g., Computer Corner, Inc. v. Fireman’s Fund Ins. Co., 46 P.3d 1264, 1266 (N.M. Ct. App. 2002).

[12] See, e.g., Claire Wilkinson, Is Your Company Prepared for a Data Breach?, Ins. Info. Inst., at 20 (Mar. 2006), http://www.iii.org/assets/docs/pdf/informationsecurity.pdf (discussing the Insurance Services Office, Inc.’s endorsement for “electronic data liability”).

[13] See Eyeblaster, Inc. v. Fed. Ins. Co., 613 F.3d 797 (8th Cir. 2010).

[14] See, e.g., Harsco Corp. v. Scottsdale Ins. Co., No. 49D12-1001-PL-002227, slip op. (Ind. Super. Ct. Apr. 26, 2011).

[15] See MBIA, Inc. v. Fed. Ins. Co., No. 08 Civ. 4313, 2009 WL 6635307 (S.D.N.Y. Dec. 30, 2009).

[16] See Eyeblaster, 613 F.3d at 804.

Update:  This post also has been put online over at DoS-Attacks.com.  You can see the post by clicking here.

Second update:  This post also has been put online at the Lexis Insurance Law Community.  You can see the post by clicking here.

Third update:  This post also has been put online on the Blog Notions insurance blog.  You can see the post by clicking here.

Fourth update:  This post also has been put online on Core Compass.  You can see the post by clicking here (registration required).

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

“Is Your Company Prepared for Cyber Risk?”

Looking for a great article discussing cyber risk, the costs of cyber risk and data breaches, how companies and corporate boards are dealing with cyber risk, and a discussion about cyber insurance?  Then you should click here, to read a great article in Corporate Board Member Magazine, written by Chris Costanzo, “Is Your Company Prepared for Cyber Risk?

The article’s lede is:

If directors think about cybercrime at all, they are apt to consider cases like Heartland Payment Systems or TJX Cos., in which hackers exposed millions of customer records. Actually, they should be contemplating Google, which accused an electronic spy ring based in China of unleashing sophisticated cyber attacks against its computer systems early last year.

The Google case is emblematic of a new type of cybercrime that is stealthier and potentially more harmful than the massive data breaches that were front-page news a few years ago. When hackers steal customer data, they do it quickly and move on, leaving companies with the administrative hassle of notifying customers.

It goes on to quote several thought leaders on cyber risk, including people who consult on cyber risk, remediation for data breaches and cyber threats, and lawyers who work on the area of insurance coverage for cyber risks.  Mr. Costanzo was nice enough to quote me in the article:

That’s not to say companies shouldn’t explore other options. “If you haven’t bought a cyber policy, you should absolutely look to other policies to see what other coverage could be available there,” says Scott Godes, [formerly] counsel at Washington, D.C.-based Dickstein Shapiro. Existing case law backs up the use of general liability or errors and omissions policies to cover cyber breaches, Godes says. “But I would be loathe to say, ‘Don’t buy a cyber policy,’ particularly as insurance companies get more savvy,” he adds.

The entire article is a great read if you have an interest in cyber security and cyber risk.  Click here to read the entire article, “Is Your Company Prepared for Cyber Risk?

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

myspace profile views counter

Join me for the Second Annual NetDiligence® Cyber Risk & Privacy Liability Forum!

Want to learn about cybersecurity, cyberinsurance, privacy liability, cyberrisk, and other issues relating to privacy and network security, and insurance coverage for those risks?  Of course you do.

And you want to hear this from people who are recognized throughout the industry, including brokers selling cyberinsurance, underwriters writing and selling the coverage, and insurance attorneys who handle the claims and write coverage opinions about the risks, don’t you?  Of course!

What’s that, you want all of that, and CLE credit, too?  Done.

If you’re looking for all of that and more, organized and hosted by my good friends at HB Litigation Conferences, please join me for the:

NetDiligence® Cyber Risk & Privacy Liability Forum

Date: June 9-10, 2011
Location: The Union League, 140 South Broad Street, Philadelphia, PA
Chairs: Richard Bortnick, Esq., Cozen O’Connor, West Conshohocken, PA
Oliver Brew, Senior Vice President of Technology – Media and Telecoms Underwriting, Hiscox USA, New York
Toby Merrill, VP & National Privacy, Technology & Media Liability Product Manager, ACE Professional Risk
Meredith Schnur, Professional Risk Group, Wells Fargo Insurance Services USA, Inc., New York

Delegate Rates

Attorneys: $1,195**; Insurers & Brokers: $895**; Risk Managers and CFOs: $795**

Agenda and Speakers

Register Now! Conference Venue and Hotel

The Union League is located at 140 South Broad Street, Philadelphia. A block of rooms has been secured for Wednesday, June 8th and Thursday, June 9th at a rate of $189 for a standard room and $239 for a suite. The rate includes complimentary breakfast for (2) guests per room, use of our fitness center and complimentary internet. For reservations, please call 215-587-5570 and refer to the HB LITIGATION CONFERENCE room block. If you have any questions or need assistance, please contact Cyndy Noonan at cyndy.noonan@litigationconferences.com or 484-324-2755×201.

Group Discounts

Group Discounts are available. Please contact Brownie Bokelman at 484-324-2755 x212 or Brownie.Bokelman@litigationconferences.com. Groups of 5+ and Passport Packages are available for additional savings for your firm’s practice group or legal department or for package pricing for a single conference or a series of conferences.

My panel will be:

GL vs. Network Security

  • GL underwriter panel topic, GL vs. AIPI claims
  • Other’s insurance & concurrent insurance
  • Forgotten insurance agreement-when does adv.
    injury under a GL stop and where does injury begin
    under media policy
  • Coverage and how the policies respond

Moderator: Thomas Srail, Senior Vice President-Willis Executive Risks, Willis North America
Shannon Giese, Financial Services Group–Professional Risk Solutions, A Division of Aon Risk Services Northeast, Inc.
Scott Godes, Esq., [formerly] Dickstein Shapiro LLP
Richard Reed, Vice President & Worldwide Commercial Errors and Omissions Product Manager, Chubb Specialty Insurance, Warren, NJ

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note:  as a speaker at the conference, I will not be charged a fee to attend the remainder of the conference.

myspace profile views counter

Video interviews for RiskCommunities, TechRisk Institute regarding cybersecurity, privacy, and cyberinsurance.

Julie Davis of Risk Communities recently asked me to speak with her about insurance coverage for cybersecurity claims, data breaches, and other cyberrisks. Julie did video interviews of me and uploaded them to the Risk Communities video channel.

Here’s how Risk Communities introduced me:

“Last year we introduced our broadcast channel, with the idea of highlighting business professionals, and topics, that are impacting business and risk management issues for the technology industry. Scott Godes as volunteered his time to help our followers understand insurance and risk management challenges and trends in Network, Privacy and Security risks.”

There are two video clips. We discuss litigation trends in the area of insurance coverage for cybersecurity, various types of insurance coverage for cybersecurity, risk transfer for cyberrisks, and data and network privacy issues.

Here’s my video interview: “Overview of Network, Security & Privacy Exposures and Risks”

Here’s my video interview: “Overview of Litigation and Trends in Network, Security & Privacy Risks”

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

myspace profile views counter

My Chapter on Insurance Coverage for Cybersecurity and Intellectual Property Claims Now Available in the New Appleman Law of Liability Insurance Treatise

Looking for a treatise on insurance coverage?  How about one that has an entire chapter on insurance coverage for cybersecurity and intellectual property claims and risks?

Remember when I wrote that I had written a chapter on insurance coverage for cybersecurity and intellectual property claims for the New Appleman Law of Liability Insurance Treatise?  Of course you do.  And you probably were wondering, “When will I be able to buy that treatise, so that I can have it on my bookshelf and refer to it regularly for all of my questions about insurance coverage for cybersecurity and intellectual property claims?!?”  Well, here’s your answer.  The treatise is available on the Lexis website.  That’s right!  Although you really will want to race right to Chapter 18 – Insurance Coverage for Intellectual Property and Cybersecurity Risks, so that you can read about insurance for data breaches, DDoS attacks, viruses, hackers, cybercrime, and IP losses, you’ll get the whole treatise, too.  It’s a five volume looseleaf set that gets updated with supplements. 

So what are you waiting for?  Click here to order your very own treatise.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

myspace profile views counter

AgentsOfAmerica.ORG features my post: “Insurance Coverage for Cyberattacks and Denial-of-Service Incidents”

If your business suffered losses from a cybersecurity incident, a denial-of-service attack, or some other computer-, network-, or internet-related event, would you know whether your insurance would cover the losses?  If your insurance company denied your claim, would you know whether the insurance company had done so properly?

Well, if you’d like some additional thoughts on these issues, check out my post at the AgentsOfAmerica.ORG website.  They posted my piece titled, “Insurance Coverage for Cyberattacks and Denial-of-Service Incidents” and also featured it in their newsletter.  In my post, I discuss insurance coverage for cyberattacks, cybersecurity events, denial-of-service (DDoS) attacks, and more.  I note a couple of recent cases finding in favor of insurance for these sorts of events under commercial general liability (CGL) insurance policies as well as new cyber insurance policies.

So head over to the AgentsOfAmerica.ORG site and check out my post to see more!

 

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

“LexisNexis® Insurance Law Community Podcast featuring Scott Godes . . . on Cyber Liability Insurance Coverage”

LexisNexis was kind enough to have me record a podcast regarding insurance coverage for cyber liabilities. As LexisNexis states on the Insurance Law Center:

On this edition, Scott Godes discusses the types of cyber liabilities facing companies today, what to do, in terms of insurance, if a cyber incident or data breach occurs and types of policies that provide coverage for a cyber event. Copyright© 2010 LexisNexis, a division of Reed Elsevier Inc. Visit http://www.lexisnexis.com/community/insurancelaw/.

If you’d like to hear the entire podcast, please click here.

Disclaimer:
This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

Join me for ACI’s 4th Annual Advanced Forum on Cyber & Data Risk Insurance.

data breach, cybersecurity, insurance coverage

Interested in learning more about cybersinsurance and cybersecurity?  How about coverage for data breaches, cybersecurity events, and other computer risks?  Then please join me for American Conference Institute’s:

4th Annual Advanced Forum on

Cyber & Data Risk Insurance

Monday, September 27 to Tuesday, September 28, 2010
The Helmsley Park Lane Hotel, New York, NY, United States

Cyber and data risk insurance is becoming critical to businesses that operate online, as cyber-attacks are increasing exponentially in terms of frequency, scope, costs and overall impact. With even the best compliance practices in place, it is impossible to guarantee that the private information of consumers and employees will be protected. State Attorneys General and the Federal Trade Commission are becoming more active in investigating and penalizing companies who fail to adequately prevent or respond to a data breach. Additionally, there has been an increase in federal and state legislation and a rise in private actions in the form of mass class actions that are sure to significantly impact this industry.

Demand for cyber and data risk insurance is growing rapidly as businesses are focusing their efforts to address their information risk and data security needs.Broader cyber risk insurance policies have emerged, covering costs relating to responding to a data breach including: notification costs, credit monitoring costs, forensic investigations, call center support, public relations and defense of a claim brought by individuals or federal and state officials.

In light of these risks and exposures, it is critical that you are up to date with the trends in the fast evolving area of cyber and data risk insurance. That is why American Conference Institute developed our successful and well-attended Cyber & Data Risk Insurance Conference in September 2007 and the response in 2008 and 2009 was even better. To those who have attended, come to this 4th annual event — now in New York City — for a revised and updated agenda and to hear from the best and the brightest in the industry, including the FTC, the OTS, the FBI, 2 State Attorneys General and an Assistant Attorney General. For first-time attendees, this conference is your best opportunity to get the tools you need to learn about the new policies, including pricing and negotiating specific coverage, mitigating risks associated with e-business, and to learn strategies so that you can maximize your profitability while minimizing your potential liabilities.

The security and safeguarding of information is vital to protect an organization from financial and reputational loss. This conference is your best opportunity to network with industry insiders, compare products and strategies and to learn valuable information on potential risks and liabilities so that you can put the appropriate insurance protection and risk management practices in place.

Be sure to also register for the Post-Conference Workshop: Negotiating and Drafting Cyber Risk Provisions and Policies

September 28, 2010; 2:00 p.m. – 5:00 p.m.

Back by popular demand with updated content to reflect new developments and additional workshop leaders to walk you through the ins and outs of negotiating and drafting this highly specialized coverage.

Register now by calling 888-224-2480, faxing your registration form to 877-927-1563 or registering online.

Dates:

Mon, Sep 27, 10

Tue, Sep 28, 10

Location:

The Helmsley Park Lane Hotel

New York, NY, United States

My panel, What Policy Holders Are and Should Be Looking for in Cyber and Data Security Coverage, will be covering:

  • Coverage considerations: What liability and first-party coverages are desirable?
  • Reasons companies have or have not bought coverage
  • How standards are evolving in response to new technology threats
  • Consumer redress: when is it covered and when not?
  • Coverage for liabilities (including defense and other costs) and first party losses
    • intentional violations
    • coverage for electronic and non-electronic loss
  • Implementing privacy and data security compliance and policies

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

Note:  as a speaker at the conference, I was not charged a fee to attend the remainder of the conference.

“Insurance Coverage for Intellectual Property and Cybersecurity Risks.”

Can you think of many, or, in fact, any, companies that are risk free when it comes to the areas of intellectual property or cybersecurity?  If you represent companies with risks relating to intellectual property and cybersecurity, what insurance coverage would apply if those risks turned into claims and potential liabilities?  Are you familiar with the developing body of insurance coverage law in those areas?

I’m the author of a forthcoming treatise chapter that answers those exact questions.  It’s the “Insurance Coverage for Intellectual Property and Cybersecurity Risks” chapter of the New Appleman Law of Liability Insurance, Second Edition, to be released in June 2010.  Here’s the chapter’s introduction:

Two developing areas of insurance coverage law are the issues of insurance coverage for intellectual property-based claims and cybersecurity-based claims.  This chapter describes coverages available for such claims.  The chapter first analyzes and details the development of coverage for intellectual property claims through advertising injury found in general liability insurance policies, as well as other coverages.  The chapter then analyzes coverage for cybersecurity claims.  The area of coverage for cybersecurity claims is, relative to most insurance coverage topics, quite nascent, and the chapter considers decisions that should be seen as analogous to this developing topic.  The chapter discusses coverage for cybersecurity claims under general liability, first-party, and other policies, as well as new policies being marketed as specific to cybersecurity risks and claims.

The intellectual property section of the chapter provides a basic overview of various types of intellectual property risks and provides a detailed discussion of how insurance policies apply to those risks.  The chapter explains the legal principles at issue when seeking insurance coverage for such risks and potential liabilities.  The chapter discusses the majority and minority rules for various issues and provides an analysis of the various exclusions that insurance companies have cited when trying to deny coverage for intellectual property claims.

The cybersecurity section of the chapter provides an overview of the new and growing cybersecurity risks faced today and details what insurance policies apply to those risks.  The chapter details how courts have ruled on coverage questions for cybersecurity and computer-related risks and liabilities.  For those areas of the law that are not as well-developed, in light of the relatively new nature of cybersecurity risks, the chapter notes analogous caselaw and how those holdings should apply to cybersecurity claims.  The section also notes issues to consider for companies in the market for new and specialized cybersecurity insurance policies.

This post appeared originally at the Lexis Insurance Law Community.
Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

myspace profile views counter

Please join me for the NetDiligence® Cyber Risk & Privacy Liability Forum

hblc

Dickstein Shapiro LLP is pleased to announce that

Scott Godes, Esq. is speaking on the Are You Covered When Hackers Get Through?
session at this conference.

Dickstein

NetDiligence® Cyber Risk & Privacy

Liability Forum

Date: June 7-8, 2010

Price: Risk Managers, CFOs: $795*;

Insurers, Brokers, Policyholders: $895*; Attorneys: $1,195*

Location: The Union League, 140 South Broad Street, Philadelphia, PA

CLE Credit: 6-8 CLE credits (CPD and CPCU credits also available), depending on state requirements. View the CLE credit details.

Mention promo code COB10A when you register for the live event and save $100!**

Chairs

Nicholas Economidis, Specialty Lines, Beazley Group

John Mullen, Sr., Esq., Nelson Levine de Luca & Horst,

Chair of Complex Litigation Practice Group

Robert Parisi, Jr., SVP, National Practice Leader for

Tech/Telecom E&O, and Network Risk, Marsh FINPRO

What You Will Learn

(For a complete agenda and faculty listing, click here.)

  • Keynote Address by Keith Morales of The Federal Reserve Bank of Philadelphia
  • Data Breach Liability: An Unstable Legal Environment
  • Cyber Security and Privacy Liability Concerns: The Risk Managers Speak
  • Regulatory Trends Briefing
  • Loss Control-Assessing & Quantifying Network Risks
  • Responding to a Data Breach
  • Design and Implementation of an Incident Response Plan
  • Solving Special Computer Security Issues
  • Are You Covered When Hackers Get Through?
  • Looking Into the Crystal Ball: Future Insurance Needs

To learn more or register for this conference,

please call 484-324-2755 or click here.

*All cancellations must be received in writing. Full refunds will be issued if cancellation requests are received 4 weeks before the event begins. Credits, good for 6 months from date of issue, will be issued if cancellation requests are received 3 weeks before the event begins. HBLC reserves the right to cancel any of its programs. Speakers, sessions and times are subject to change.

**Limit one discount per registrant. Discount cannot be combined with any other offer. Offer valid at the live event only and on new registrations only.

UnionLeauge

CAN’T ATTEND?

You can still benefit from this program! Audio/video recordings are available now.  Individually priced and packaged, each recording captures the information and insights delivered by our faculty. Listen to experts, gain new perspectives, and learn proven techniques. For more information,

click here, call 484-324-2755, or email Allison.Emery@litigationconferences.com.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

Note:  as a speaker at the conference, I was not charged a fee to attend the remainder of the conference.

myspace profile views counter

Check out my article, “At Risk: Insurance Coverage for Cyber Security and Data Breaches” in Strategize Magazine.

The fine folks at Strategize Magazine have published an article that I wrote, along with my colleague, Ken Trotter.  The article is titled, “At Risk:  Insurance Coverage for Cyber Security and Data Breaches.”  It’s in the January/February 2010 edition of the magazine.

Strategize is a magazine that promises:

in each issue of Strategize, we’ll clear out the clutter to reveal what’s really relevant. Our aim is to be your one-stop information source that brings the reader to the boardroom, following the national trends that affect business today, and the innovations of our most provocative business leaders.

Our article gives a clear and easy to read overview of insurance coverage for cyber security and data breach claims.  We give real world examples of data breaches and cyber security incidents, and how they affect businesses today.  We also discuss coverage for those types of claims under commercial general liability insurance policies, first party insurance policies, crime policies, directors and officers policies, and more.  Interested?*  Then aim your mouse here to readAt Risk:  Insurance Coverage for Cyber Security and Data Breaches.”

* Even if you’re not that interested in the topic, it’s worth the click to see the cool online magazine format and graphic that they put with the article.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

myspace profile views counter

Join Me at the NetDiligence® Cyber Risk & Privacy Liability Forum!

My good friends at HB Litigation Conferences present:

The NetDiligence® Cyber Risk & Privacy Liability Forum
June 7-8, 2010 | The Union League, 140 South Broad Street, Philadelphia, PA

I’ll be a speaker on a panel discussing insurance coverage for cyber risk and privacy issues.  Here’s the topic for my panel:

Are You Covered When Hackers Get Through?

• Does a company have coverage for data breaches?

• Knowing your client and when to advise coverage

• Advising clients who have been hacked

• How to secure coverage for future incidents

• Finer legal points of coverage-handling fines, penalties, and notice costs

• Business interruption claims

Moderator: Nicholas Economidis, Specialty Lines, Beazley Group, Philadelphia

Scott Godes, Esq, [formerly] Dickstein Shapiro, Washington, DC

Oliver Brew, Vice President of Technology, Media and Telecoms Underwriting, Hiscox USA, Westchester, NY

Richard Bortnick, Esq., Cozen O’Connor, West Conshohocken, PA

Take a look at the full agenda by clicking here.  And you can register online by clicking here.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.

Note:  as a speaker at the conference, I was not charged a fee to attend the remainder of the conference.
myspace profile views counter

A blog post so nice, it had to be published twice.

The fine folks at the Lexis Insurance Law Center have republished my post, “Dusting Off an Old Law” – Insurance Coverage for Trespass to Chattels Claims.  Many thanks to my friend Karen Yotis for putting the article online.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2010.
myspace profile views counter

Join Me for Insurance Coverage for Cybersecurity CLE Hosted by the Pennsylvania Bar Institute.

On Wednesday, August 26, 2009, I’ll be presenting a CLE for the Pennsylvania Bar Institute on insurance coverage for cybersecurity liabilities.  Here’s a snapshot of the PBI’s page so that you can sign up.

Business Law | Insurance Practice
search:
advanced
Tele-Web Seminar

Tele-Web Seminar
Insurance Coverage for Cybersecurity

1.5 Total CLE credits (No Ethics)

Note: This tele-web seminar will begin on Wednesday, August 26, 2009 at 12:00 PM to 1:30 PM Eastern Time.
Product №: 6116T
Course Level: Intermediate
Duration: 90 minutes

Register Now
Item Description | Faculty | Pricing

Item DescriptionThe financial liability of failing to protect information properly can be extraordinarily high.  One way in which to protect your clients and yourself from liability is to obtain cybersecurity insurance.  This program examines this relatively new type of insurance, the pros and cons of obtaining it, and will help you to help your clients explore their options.

Our faculty will discuss:

  • An overview of cybersecurity and data breach risks and potential liabilities
  • How “traditional” insurance coverage might cover cybersecurity and data breach risks and liabilities
  • New insurance products in the marketplace for cybersecurity and data breach risks and liabilities
Register Now Back to top

Pricing Back to top
  • Members–PA or any co. bar assn.
$99.00
  • Nonmember
$119.00

Faculty Register Now Back to top
Scott Godes, Esq., [formerly] Dickstein Shapiro, LLP, Washington, DC
Timothy Delahunt, Esq., Kenney, Shelton, Liptak & Nowak, LLP, Buffalo, NY
Arturo PerezReyes, Client Executive, Saylor & Hill, Oakland, CA
Register Now Back to top
Register NOW so you can print the course materials when they are available.
icon_acrobat Instructions (1 Page, 14 KB)
Contact us at 1-800-932-4637
Email us at callincle@pbi.org
click for live chat Having trouble using this site?
Help us improve
Powered by Legalspan

myspace profile views counter

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2009.

Insurance Coverage for Cyberattacks and Denial-of-Service Incidents.

If your business suffered the same sort of cyberattacks alleged to have taken place against “U.S. government Web sites – including those of the White House and the State Department –” over the July 4, 2009 holiday weekend, would your insurance cover losses that your company faced?[1] Not worried, because the alleged attacks were only against government sites?  Unfortunately, the cyberattacks were more widespread, and allegedly included, “according to a cyber-security specialist who has been tracking the incidents, . . . those run by the New York Stock Exchange, Nasdaq, The Washington Post, Amazon.com and MarketWatch.”[2]

Denial of Service Attacks

 

The cyberattacks described were denial-of-service incidents.  Personnel from “CERT® Program,” which “is part of the federally funded Software Engineering Institute (SEI), a federally funded research and development center at Carnegie Mellon University in Pittsburgh, Pennsylvania,” have explained:

Denial-of-service attacks come in a variety of forms and aim at a variety of services. There are three basic types of attack:

  • consumption of scarce, limited, or non-renewable resources
  • destruction or alteration of configuration information
  • physical destruction or alteration of network components.[3]

Some attacks are comparable to “tak[ing] an ax to a piece of hardware,” and are known as “so-called permanent denial-of-service (PDOS) attack[s].”[4] If a system suffers such an attack, which also has been called “pure hardware sabotage,” it “requires replacement or reinstallation of hardware.”[5]

What Insurance Coverage Might Apply?

If your company faces a denial-of-service cyberattack and suffers losses as a result, but your company has not purchased a specialized suite of policies marketed as cyber security policies, coverage nonetheless may be available under other insurance policies.  Consider whether first party all risk or property coverage may apply.  First party all risk policies tend to provide coverage for the policyholder’s losses due to property damage.  If the denial-of-service cyberattack caused physical damage to your company’s servers or hard drives, your company’s first party all risk insurer should not have a credible argument that there was no property damage.  Even if the damage is limited to data and software, however, it may be argued that the loss is covered under your company’s first party all risk policy, as some courts have found that damage to data and software consists of property damage.[6]

First party policies may also provide coverage for extra expense, business interruption, and contingent business interruption losses due to a cyberattack.  (Contingent business interruption losses may include those arising out of a third party’s cyber security-based business interruption.)[7]

Look also to other first party coverages, such as crime and fidelity policies, to determine whether there may be coverage for losses due to a cyberattack.  In particular, crime policies may have endorsements, such as computer fraud endorsements, that may cover losses from a denial of service cyberattack.

If, after a cyberattack, third parties seek to hold your company responsible for their alleged losses, consider whether your company’s liability policies would provide coverage.  More importantly, consider your company’s commercial general liability (CGL) insurance policy (if your company does not have a specialized cyber liability policy).

The first coverage provided in a standard-form CGL insurance policy covers liability for property damage.  Similar to the analysis above for first party all risk policies, if there was damage to servers or hard drives, insurers should not be heard to argue that there was no property damage.  Courts are divided as to whether damage to data or software alone consists of property damage under insurance policies, with some courts recognizing that “the computer data in question ‘was physical, had an actual physical location, occupied space and was capable of being physically damaged and destroyed’” and that such lost data was covered under a CGL policy.[8] Be aware, however, that the insurance industry has revised many CGL policies to include definitions giving insurers stronger arguments that damage to data and software will not be considered property damage.  But also note that your company’s CGL policy may have endorsements that provide coverage specifically for damage to data and software.[9] Consider further whether a claim would fall within the property damage coverage for loss of use of tangible property—loss of use of servers and hard drives because of the cyberattack.

Consider Cyber Security Specialty Policies

Looking beyond the coverages and endorsements discussed above, your company should consider the recent cyberattacks as an opportunity to reevaluate the need for specialized coverages for cyber security losses.  Insurance companies continue to introduce new specialized products for cyber security risks, marketing the new policies as including data compromise, cyber liability, network risk, and/or computer data coverage.  The Insurance Services Office, Inc., which designs and seeks regulatory approval for many insurance policy forms and language, has a standard insurance form called the “Internet Liability and Network Protection Policy,” and insurance companies may base their coverages on this basic insuring agreement, or they may provide their own company-worded policy form.  Cyber security and data breach policies, certain forms of which may be known as Network Risk, Cyber-Liability, Privacy and Security, or Media Liability insurance, are relatively new to the marketplace and are ever-changing.  An experienced broker may be able to advise what coverages are available, and an attorney with experience in advising policyholders about insurance coverage issues may be able to advise as to the potential strengths and weaknesses of the various policy terms offered.

[Note 1:  This post also appears on Lexis’ Insurance Law Center, with thanks to my friend Karen Yotis.]

[Note 2:  This post is featured in Blawg Review #221, thanks to  H. Scott Leviant of The Complex Litigator.]


[1] U.S. Government Sites Among Those Hit by Cyberattack, CNN, http://www.cnn.com/2009/TECH/07/08/government.hacking/index.html(July 8, 2009).

[2] Siobhan Gorman & Evan Ramstad, Cyber Blitz Hits U.S., Korea, Wall St. J., http://online.wsj.com/article/SB124701806176209691.html (July 9, 2009).

[3] Denial of Service Attacks, CERT, http://www.cert.org/tech_tips/denial_of_service.html (last visited July 9, 2009); About CERT, CERT, http://www.cert.org/meet_cert/ (last visited July 10, 2009).

[4] Kelly Jackson Higgins, Permanent Denial-of-Service Attack Sabotages Hardware, Security Dark Reading, http://www.darkreading.com/security/management/showArticle.jhtml?articleID=211201088 (May 19, 2008).

[5] Id.

[6] See, e.g., Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16 (Tex. App. 2003) (first party property coverage for data damaged because of hacker attack or computer virus); Am. Guar. & Liab. Ins. Co. v. Ingram Micro, Inc., No. 99-185 TUC ACM, 2000 U.S. Dist. LEXIS 7299, at *6 (D. Ariz. Apr. 18, 2000) (construing “physical damage” beyond “harm of computer circuitry” to encompass “loss of access, loss of use, and loss of functionality”).

[7] Se. Mental Health Ctr., Inc. v. Pac. Ins. Co., 439 F. Supp. 2d 831, 837 (W.D. Tenn. 2006) (finding coverage under business interruption policy for computer corruption); see also Scott N. Godes, Ensuring Contingent Business Interruption Coverage, Law360, (Apr. 8, 2009) http://insurance.law360.com/articles/94765 (discussing coverage under first party policies resulting from third party interruptions).

[8] See, e.g., Computer Corner, Inc. v. Fireman’s Fund Ins. Co., 46 P.3d 1264, 1266 (N.M. Ct. App. 2002).

[9] See, e.g., Claire Wilkinson, Is Your Company Prepared for a Data Breach?, Ins. Info. Inst., at 20 (Mar. 2006) http://www.iii.org/assets/docs/pdf/informationsecurity.pdf (discussing the Insurance Services Office, Inc.’s endorsement for “electronic data liability”).

myspace profile views counter

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2009.

Recent Entries »