Tag Archives: Privacy

Insurance for Cyber Risks: Coverage Under CGL and “Cyber” Policies

Recently, I gave a presentation, along with Rick BortnickJennifer SmithWilliam T. Um, and Hon. Carl West (Ret.), about cyber risks, privacy class action claims, and insurance coverage for cybersecurity claims, cyber risks, privacy claims and privacy class actions, and other emerging risks.  We discussed these claims and we gave our thoughts about insurance coverage for cyber risks under cyberinsurance policies, as well as under Commercial General Liability policies (CGL), commercial crime policies, first party property and all risks policies, directors and officers policies (D&O), errors and omissions policies (E&O), and more.

As part of the presentation, Jennifer and I submitted a paper, Insurance for Cyber Risks:  Coverage Under CGL and “Cyber” Policies.  A nicely formatted version may be found here, hosted by Lockton.

ABA Section of Litigation 2012 Insurance Coverage Litigation Committee CLE Seminar,

March 1-3, 2012:
Insurance coverage for data breaches, denial of service attacks, and cybersecurity events

Insurance for Cyber Risks:
Coverage Under CGL and “Cyber” Policies

Scott Godes, Esq.
[formerly] Dickstein Shapiro LLP

Washington, DC

Jennifer G. Smith, Esq.
Lockton Companies

Washington, DC

THE RISE IN CYBER RISKS

It may seem like a few years ago, every firm had a Y2K practice, and was prepared to provide advice and counseling about how to handle the anticipated end of the world.  Luckily for society at large, the worst case scenario was not realized.  Just a few years later, the focus on liability and risks as related to computers and network security has changed to another, but far more real, issue:  the risk of data breaches, hacks, network interruptions, and other cyber risks.  The number of data breaches and cyber attacks that companies and other entities have faced has been so widespread and expensive that 2011 was dubbed “the year of the cyber attack.”  A recent PricewaterhouseCoopers report characterized “Cybercrime . . . as one of the top four economic crimes.”

Two of the most well-known cyber risks are cyber attacks and data breaches.  One form of cyber attack is a denial of service incident.  Denial of service attacks may be designed to bring a website or service down, preventing customers from accessing the site or the company’s products or services.  One research and development center has explained that denial of service attacks come in a variety of forms.  The three basic types of denial of service attacks are:

  • consumption of scarce, limited, or non-renewable resources;
  • destruction or alteration of configuration information;
  • and physical destruction or alteration of network components.

Some attacks are comparable to “tak[ing] an ax to a piece of hardware” and may be called “permanent denial-of-service (PDOS) attack[s].”  If a system suffers such an attack, which also has been called “pure hardware sabotage,” it “requires replacement or reinstallation of hardware.”

Another cyber risk, perhaps more widely discussed in the news, is a data breach.  The term data breach is used broadly, usually to describe incidents in which hackers, rogue current or former employees, or others steal or otherwise gain access to personally identifiable information or personal health information.  For example, in Anderson v. Hannaford Brothers Co., the court described a data breach against “a national grocery chain whose electronic payment processing system was breached by hackers . . . [with] hackers [having] stole[n] up to 4.2 million credit and debit card numbers, expiration dates, and security codes . . . .”

In the context of personal health information, “[U.S. Department of Health and Human Services] HHS issued regulations requiring health care providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their health information is breached.”  HIPAA imposes liability immediately for breaches of certain information by certain parties; the requirements state that the entity “shall” provide notice, and do not make reference to a letter from the government or a lawsuit to enforce the law.  When a “violation is not corrected . . . a penalty” may be imposed that is $50,000 for each violation, up to $1,500,000 in a calendar year, rather than $10,000 and a cap of $250,000.

Setting the legal and enforcement issues aside, consider certain business issues that may motivate an organization to choose  insurance as a risk transfer solution:

  • Loss of assets, brand, and reputation.
  • Investor fallout from uncovered losses with large claim and class action potential.
  • Many functions are conducted by outside vendors and contractors who may lack insurance and assets to respond. What if the vendor makes a systemic mistake? What if they fail to purchase insurance or keep it? What if they are located in a country where this insurance cannot be obtained? What if the policy they purchased denies coverage or has inadequate limits?
  • PCI (credit card industry security standards) compliant companies have had their security compromised from processes lapse, human error, or criminal insider.
  • No system can be designed to eliminate the potential for loss, as people and processes failures cannot be eliminated. Insiders may be perpetrators.
  • Responsibility rests with the data owner from a legal, regulatory perspective, and credit card association operating regulations.
  • Insurance companies have become more aggressive in asserting (even if wrongfully so) that “traditional” insurance may not cover security liability or adequately cover privacy risks.

COVERAGE UNDER CGL POLICIES

Policyholders and insureds facing cyber risks and liabilities would be well served to analyze their entire slate of insurance policies to determine what coverages might apply to such risks.  Indeed, the Division of Corporation Finance of the U.S. Securities and Exchange Commission recently released “CF Disclosure Guidance:  Topic No. 2 – Cybersecurity.”  That guidance, in the context of cyber risks, notes insurance coverage for such risks, stating:  “Depending on the registrant’s particular facts and circumstances, and to the extent material, appropriate disclosures may include: . . . [a d]escription of relevant insurance coverage.”

Is there coverage for cyber risks under a “standard form” commercial general liability (“CGL”) insurance policy, one with insuring agreements drafted by the Insurance Services Office (“ISO”)?  That question is at issue at the time of this writing between Zurich (among other insurance companies) and various Sony entities in litigation.  In 2011, Sony allegedly suffered various cyber attacks and data breaches, with the events allegedly costing Sony nine figures, and leading to multiple putative class action lawsuits against various Sony entities.  Seeking to avoid defending or indemnifying Sony, Zurich filed an action against Sony, seeking declarations that there is no coverage under various CGL policies, among other requests for rulings.

Zurich itself had recognized, in at least one article, that “[t]hird-party liability policies such as Commercial General Liability (CGL) policies provide coverage to a company . . . for data security breaches.”

Standard form CGL policies often provide coverage for personal and advertising injury, bodily injury, and property damage.  “Personal and advertising injury” has several definitions; but for purposes of data breaches and cyber risks, one relevant definition is “[o]ral or written publication, in any manner, of material that violates a person’s right of privacy.”  The term “bodily injury” often is defined as including “bodily injury, sickness or disease . . . including death resulting . . . at any time.”  When analyzing the scope of bodily injury coverage in the context of cyber risks, however, consider whether the definition of “bodily injury” has been expanded to include mental anguish, mental injury, shock, fright, or similar terms.  “Property damage” in standard form CGL policies often includes “[p]hysical injury to tangible property, including all resulting loss of use of that property” and “[l]oss of use of tangible property that is not physically injured,” but often states that “electronic data is not tangible property.”

The leading case addressing these issues held that personal and advertising injury coverage was available for computer- and internet-based class action claims.  In Netscape Communications Corp. v. Federal Insurance Co., the U.S. Court of Appeals for the Ninth Circuit’s brief (and unpublished) opinion, along with the earlier trial court opinion that the Ninth Circuit reversed, illustrates that Netscape Communications Corporation (“Netscape”) was sued in putative class action lawsuits regarding a software program that provided Netscape with information about users’ internet activities and which Netscape used for targeted advertising.  The claimants alleged that Netscape’s program violated the Electronic Communications Privacy Act (“ECPA”) and the Computer Fraud and Abuse Act (“CFAA”).  The court held that “[a]lthough the underlying claims against AOL were not traditional breach of privacy claims, given that coverage provisions are broadly construed, the underlying complaints sufficiently alleged that AOL had intercepted and internally disseminated private online communications.”

With a dearth of cases interpreting publication in the cybersecurity context, it is helpful to consider analogous cases.  In Zurich American Insurance Co. v. Fieldstone Mortgage Co., a leading case on the issue, the insurance company argued “that in order to constitute a publication, the information that violates the right to privacy must be divulged to a third party.”  The court correctly rejected that argument, explaining that “the majority [of circuits] have found that the publication need not be to a third party.”  Other courts have followed the well-reasoned Fieldstone decision, finding that unauthorized access of credit reports meets the publication requirement under the relevant personal and advertising injury provisions.

Those holdings are critical in the context of data breaches.  Data breaches, as noted above, consist of situations in which private information has been publicized to third parties.  Therefore, the basic insuring agreement relating to personal and advertising injury should be considered broad enough to encompass a data breach.

To the extent that CGL policies have broadened definitions of bodily injury, there may be an argument that bodily injury coverage applies to, or (at a minimum) provides a defense for, data breach claims.  For example, one of the class action complaints filed against Sony alleges that “plaintiff and the Class have suffered damages, including, but not limited to, . . . fear and apprehension of fraud . . . .”  Such an allegation could be read as falling within an expanded definition of “bodily injury,” depending on how broadly the definition is written and whether it is construed as being tied to a physical bodily injury from the rest of the definition of the term.

The potential application of property damage coverage may be a more fact specific inquiry in the context of cyber risks.  For those policies excluding “electronic data” from the definition of “property damage,” convincing an insurer that a data breach alone caused covered property damage, or gives rise to a duty to defend under property damage coverage, will be challenging for policyholders and insureds.  Nonetheless, certain cyber attacks may result in property damage in the form of physical damage to tangible property.  For example, certain denial-of-service attacks cause physical destruction or alteration of network components.  If an insured can demonstrate that there were allegations of such damage, or actual evidence of such damage, property damage coverage should apply, as the claim does not implicate software and data alone.

The definition of property damage, in a standard form CGL policy, typically includes “[l]oss of use of tangible property that is not physically injured.”  This phrase presents an opportunity to seek coverage for loss of use of tangible property, such as the loss of use of computers or networks rendered inaccessible or inoperable as a result of a cyber attack.

A real world example is found in the Johns v. Sony complaint.  The putative class alleges that “Plaintiffs seek damages to compensate themselves and the Class for their loss (both temporary and permanent) of use of their PlayStation consoles . . . .”  Those loss of hardware use allegations should be considered loss of use of tangible property for purposes of pursuing and maximizing any insurance recovery.

In Eyeblaster, Inc. v. Federal Insurance Co., the U.S. Court of Appeals for the Eighth Circuit considered a similar set of allegations.  That dispute involved a complaint in which the claimant “alleg[ed] that Eyeblaster injured his computer, software, and data after he visited an Eyeblaster website.”  The court analyzed the scope of property damage coverage.  After determining that one prong of the property damage definition was not met, because the claimant alleged software and operating system damage, without allegations of damage to hardware, the court then considered whether the loss of use of tangible property prong of property damage was met.  The court held that alleged computer freezes, pop-up ads, hijacked browsers, random error messages, slowed performance and crashes, and ads based on past Internet surfing habits constituted property damage in the form of loss of use of tangible property sufficient for coverage under a CGL policy.  Likewise, in State Auto Property & Casualty Insurance Co. v. Midwest Computers & More, an Oklahoma federal district court held that loss of use of a computer system allegations fell within the loss of use of tangible property terms of the policy.

A final note specific to data breaches is the question of coverage for credit monitoring under CGL policies.  Policyholders and insureds should anticipate that insurance companies will assert that credit monitoring costs are not covered under CGL policies.  One such anticipated argument is that credit monitoring does not consist of “damages” “because of” personal and advertising injury, bodily injury, or property damage.  Policyholders and insureds should note that courts have rejected similar insurance company arguments in analogous contexts.  For example, class action plaintiffs have alleged that certain products (such as asbestos or lead paint) cause bodily injury at the cellular level, and, as such, they are entitled to the cost of medical monitoring that would allow said plaintiffs to know whether they will develop a cognizable injury or disease.  For those decisions recognizing the underlying claim alleges a covered claim, those decisions have recognized that medical monitoring costs are “damages” “because of” bodily injury.  That authority should be considered a persuasive basis in response to anticipated insurance company arguments that credit monitoring costs are excluded from coverage.

COVERAGE UNDER “CYBER” POLICIES

No doubt countless side-by-side coverage comparisons have been lost in the land of good intentions trying to delineate the distinctions between CGL, property, and cyber insurance solutions.  There are solid arguments that there is coverage for cyber risks under the insuring agreements within a standard ISO form CGL policy.  Likewise, policyholders have had some success in arguing that coverage may be afforded under the Computer Funds Transfer, Theft or Employee Theft/Dishonesty insuring agreements within a Fidelity and/or Commercial Crime program.  There also are solid arguments that coverage for private companies may provide coverage (specifically entity coverage) for cyber-related losses under a private company Directors & Officers Liability insurance program.  Notwithstanding those solid arguments and favorable case decisions, policyholders found themselves facing denials or in insurance coverage litigation to determine whether a CGL or other insurance policy will cover a data breach or other cyber event.

What is the solution then, for those organizations that are concerned with insurance companies taking aggressive positions as to coverage under CGL or other policies for cyber risks in the wake of a data breach or other cyber event?  Insurance companies now are marketing stand-alone, dedicated insurance policies as being designed to address information risk.  Those insurance policies should provide the solution.

Many refer to this solution as “cyber insurance.”  Cyber insurance is a coat of many colors, with as many product names as there are colors of the rainbow.  Other variations include:  Information Security Insurance, Network Security Insurance, Privacy Insurance, Data Breach Insurance, Network Breach Insurance, Technology Solutions, Cyber-this, Cyber-that (e.g., “plus”, “enhancement”, “solution”), Information Insurance, or, when all else fails, some iteration of Professional Liability or E&O – seemingly irrespective of the buyer’s actual services.  For the purposes of this article and to avoid calling attention to any one particular insurer, we will continue to refer to this solution as “cyber insurance.”

Although the expression “no two forms are alike” may be a stretch under other circumstances, it is painfully, tediously true in the cyber insurance context.  These forms vary vastly from the fundamental structure and scope of the policy to the retention and use of outside experts.  Certain policies are duty to defend policies; others are indemnity policies.  Certain policies have specifically delineated intentional torts drafted into the definition of “personal injury” or “wrongful act”; other policies – perhaps in an effort to avoid changing forms amid rapidly evolving regulations – leave such definitions or insuring agreements rather broadly defined.  Some might even argue “vague and ambiguous.”  Each of these issues, and the many others not listed herein, serves as a reminder to potential buyers to rely on their experts in the search for the best cyber insurance solution for that particular organization.

The core elements of cyber insurance that are unique to this particular insurance solution may include coverage in varying degrees for the following:

  • Network Security Liability
    • Claim Expenses and Damages emanating from Network and non-Network security breaches.
  • Media Liability
    • Claim Expenses and Damages emanating from Personal Injury Torts and Intellectual Property Infringement (except Patent Infringement).
    • Claim Expenses and Damages emanating from Electronic Publishing (website) and some will provide coverage for all ways in which a company can utter and disseminate matter.
  • Privacy Liability
    • Claim Expenses and Damages emanating from violation of a Privacy Tort, Law or Regulation.
    • Claim Expenses and Damages emanating from a violation of a law or regulation arising out of a Security Breach.
  • Privacy Regulatory Proceeding and Fines
    • Claim Expenses in connection with a Privacy Regulatory inquiry, investigation or proceeding.
    • Damages/Fines related to a Consumer Redress Fund.
    • Privacy Regulations Fines.
    • PCI Fines.
  • Privacy Event Expense Reimbursement
    • Expense reimbursement for third party forensics costs.
    • Public Relations costs.
    • Legal.
    • Mandatory Notification Costs (Compliance with Security Breach Notification Laws) and Voluntary Notification Costs.
    • Credit Monitoring.
    • Call Center.
    • Second Security Audits required by Financial Institutions (varies by market).
  • Data/Electronic Information Loss
    • Covers the cost of recollecting or retrieving data destroyed, damaged or corrupted due to a computer attack.
  • Business Interruption or Network Failure Expenses
    • Covers cost of lost net revenue and extra expense arising from a computer attack and other human-related perils.  Especially valuable for computer networks with high availability needs.
  • Cyber-Extortion
    • Covers both the cost of investigation and the extortion demand amount related a threat to commit a computer attack, implant a virus, etc.

Also significant, and perhaps unique to the cyber insurance market, is the rapid rate at which the underwriters have modified and/or enhanced their forms. Issues like contractual liability/indemnification, mandatory versus voluntary notification, and even the defining triggers under the policy(ies) appear to change every 18 months – with new product introductions every six months.  Again, buyers are encouraged to carefully review the different program terms and conditions, so that they can prioritize and weigh their coverage needs against the solutions offered by the underwriters.

Although sorting through various cyber insurance solutions may be a daunting task to first-time buyers, it is worth repeating that insurance companies market this solution as being designed expressly to contemplate information risk, including data privacy and network security.  A properly designed insurance solution may very well pre-empt a difficult explanation to senior management after a cyber loss, a much more favorable position to be in than explaining why the policyholder’s insurance companies have sued the policyholder, simply because the policyholder put the insurance company on notice.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.


Advertisements

Join me at the 2012 NetDiligence® Cyber Risk & Privacy Liability Forum.

My good friends at HB Litigation Conferences present:

NetDiligence® Cyber Risk & Privacy Liability Forum
June 4-5, 2012| Hyatt at the Bellevue, Philadelphia, PA

I’ll be a speaker on a panel discussing the “State of the Cyber Nation – Cases, Theories, and Damages”:

State of the Cyber Nation – Cases, Theories, and Damages
•Is actual harm still needed?
•Statutory framework – CMIA litigation, Video Protection Privacy Act, and the Driver’s Privacy Protection Act
•Notable recent cases and their impact
•Current theories of liability and claims alleged
•How to present damages in this era
•How to minimize the chance of litigation after a breach and settlement opportunities
•More sophisticated defenses
•Identity Theft Restoration Act-suing hackers?  How federal courts may change the game
•Medical disclosure cases and how they fit into the mix
•Developments in insurance coverage for cyber and privacy risks

Theodore Kobus III, Esq., Baker & Hostetler LLP (Moderator)
John Mullen Sr., Esq., Nelson Levine de Luca & Horst, LLC
Scott Godes, Esq, [formerly] Dickstein Shapiro
Jamie Sheller, Esq.
, Sheller P.C.
Mark Camillo, Chartis Insurance
Ben Barnow, Esq., Barnow & Associates, P.C.

Take a look at the full agenda by clicking here.  And you can register online by clicking here.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note:  as a speaker at the conference, I was not charged a fee to attend the remainder of the conference.
myspace profile views counter

“2012 Data Privacy and Information Security Predictions”

My friend, Christine Marciano, who is President, Cyber Data Risk Managers, just released her 2012 Data Privacy and Information Security Predictions. The report is an interesting series of predictions on what 2012 will hold in the areas of privacy and cyber risks. Here is how Christine describes the report:

This is our first Data Privacy and Information Security Predictions report. We asked
leading Data Privacy and Information Security professionals what they thought the New
Year will hold in terms of the threats that are on the 2012 landscape. The predictions
that are included in this report offer a wide range of threats and concerns that need to
be considered by every business or organization that operates in cyberspace regardless
of its size.

Christine starts off the report with some of her own predictions regarding 2012 and what people might expect in terms of cyber risks and cyber threats:

As we start 2012, we can expect to see a continuance of data breaches and increasing cyber attacks. Taking a look back at 2011, we have learned that no system is ever 100% secure no matter the name or the size of an organization. It’s important for businesses and organizations to know what they need to be prepared for and to take steps to help minimize the threats that do not appear to be going away. Looking ahead, it appears that in 2012 we will see an increase of heightened and very sophisticated threats than what was seen in 2011. We can recall 2011 as the year the hackers and the hacktivists got started on the data breach and gained a great amount of attention. With all of the digital information and big data that is being stored, it should come as no surprise that data breaches are not going away in 2012 as they are only going to get bigger. I expect that we will also see more serious hacktivists attacks. It seems that the hacktivist is no longer hacking organizations just for the fun of it. They are attacking for specific causes and I believe that hacktivists are going to be a very serious threat in 2012 and organizations must be prepared.

Christine cites me for a prediction about data breaches and insurance coverage for data breaches and privacy risks. Here is her write up for me in the report:

DATA BREACHES WILL FORCE MANY TO REVIEW THEIR EXISTINGINSURANCE POLICIES TO SEE WHAT’S COVERED

Scott N. Godes, [formerly] Counsel, Dickstein Shapiro LLP, states…

In terms of a trend in the areas of privacy and information security, I have noticed a sea change in both areas, leading to more need for analysis of insurance policies to cover these risks. When considering privacy risks, there has been an expansion of risks and potential liability for privacy violations, with the Pineda v. Williams Sonoma decision serving as one example. This year also has been called the year of the data breach, and companies are taking a hard look at how their insurance might and does cover such claims. These risks are being considered much more closely by companies, along with a careful analysis of how their insurance policies might cover.

Follow Scott Godes on Twitter:
@insurancecvg

She also quotes several people who write and speak a good deal about cyber risks, including:

  • Misha Glenny, Author of DarkMarket: Cyberthieves, Cybercops and You (Knopf, 2011), about smartphones and international cybercrime;
  • Jim Duster, Vice President of Sales, Debix; and Jake Kouns, Director of Cyber Security and Technology Risks, Underwriting, Markel Corporation, about the growth of cyberinsurance for 2012;
  • InfoLawGroup Senior Counsel, Richard Santales, about EU Data Protection regulation changes, HIPAA breach notification changes, upcoming FTC privacy report, and cloud computing;
  • InfoLawGroup Partner, David Navetta, about concerns over BYOD (“bring your own device”) and COIT (“consumerization of information technology);
  • Bruce Anderson, CEO, Cyber Investigation Services, about small and medium businesses becoming a target for data breaches in 2012, increased cyber attacks, growth in website attacks, mobile threats, and hacktivists targeting the cloud;
  • Anthony M. Freed, Managing Editor at Infosec Island, about cyber attacks on critical infrastructure;
  • Shaun Dakin, Managing Director, Webbmedia Group, about the FTC using existing power to regulate commercial enterprises; and
  • Robert Fletcher, founder and CEO of Intellectual Property Insurance Services Corporation, as to how Changes in America Invents Act will drive intellectual property owners to explore specialized intellectual property insurance policies to fund IP litigation.

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2012.

Join me for the “CyberCrime 2011 Symposium: Security in the Age of WikiLeaks – Cybercrime, Espionage & Hacktivism”!

Sage Data Security is going to host the “CyberCrime 2011 Symposium:  Security in the Age of WikiLeaks – Cybercrime, Espionage & Hacktivism.”  Sage gives this brief overview of the Symposium:

2011 has been an unprecedented year of data compromise, exposure and harm to organizations large and small. At the CyberCrime 2011 Symposium, you’ll learn what’s being done – and what you can do – to detect, deter, and defeat cybercriminals causing mayhem around the world.

Join us on November 3 and 4 and learn from the experts about the latest threats coming from today’s smart and subversive cybercriminals. You’ll gain essential knowledge to help your organization protect itself – and its customers – against sophisticated malware, spiteful hacktivists, and financially motivated cybercrime.

Now in its second year, the CyberCrime 2011 Symposium is THE must-attend conference for any financial, healthcare or governmental professional involved in operations, compliance, security or information services. Seats are limited – be sure to reserve yours now.

Here are the highlights, from the conference website:

Conference Highlights:

  • WikiLeaks – Is Any Secret Safe? Lunch session keynote address: Wired.com Senior Editor Kevin Poulsen, the man who broke the WikiLeaks story.
  • 50 Days of Mayhem: What We Can (and Should) Learn from LulzSec – How a small band of “hacktivists” caused (and are still causing) sleepless nights for security professionals around the world…and how we should have been able to stop them.
  • The Malware Behind the RSA Breach and other Advanced Persistent Threats – Joe Stewart of Dell SecureWorks reveals how the APT/cyber-espionage behind the breach of RSA last spring can be traced back to an attack originating in China.
  • Respond and Defeat – 2011 Secret Service Cyber Intelligence Update  Learn how the Cyber Intelligence Section (CIS) within the U.S. Secret Service’s Criminal Investigative Division is combatting cybercrime that targets the nation’s financial payment systems and critical infrastructures.
  • Krebs on Security: ZeuS, Thieves and Money Mules Award-winning blogger and columnist Brian Krebs returns to the Symposium with the dinner keynote detailing the latest exploits of organized cybercrime.
  • Learn from the Mistakes of Others: Be Better Prepared to Combat Security Risks to Your Organization – Trends, recommendations and insights from the 2011 Verizon Data Breach Investigations Report.
  • What You Need to Know Before It Happens to You – An expert panel of forensic, legal and industry experts discuss what it takes to minimize the impact of a malicious external attack, an insider threat, a vendor compromise or an accidental exposure.

I’m a “featured speaker” at the event.  My session will be:

Cyber Insurance: Will You Be Covered if Your Company Suffers a Cyber Event?
The price tag on corporate data breaches is soaring. Does Cyber Risk Insurance make sense for your organization? Cyber Insurance policies generally cover third-party liability – e.g. suits filed by customers whose accounts have been hacked; direct costs – e.g. notification letters sent to affected customers; and, increasingly, fines and penalties associated with data breaches. This session will focus on what policy holders should be looking for in Cyber and Data Security Coverage and how to avoid potential pitfalls.

So, please register and join me!

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note: as a speaker at the conference, my travel costs will be covered, and I will not be charged a fee to attend the remainder of the conference.

myspace profile views counter

Learn about cyber risk, data breaches, and cyber insurance by joining me for the NetDiligence® West Coast Cyber Risk & Privacy Liability Forum!

It’s been said that 2011 is the year of the data breach and cyber attack.  If you’re looking to learn more about data breaches, privacy claims and privacy breaches, health care sector risks, cyber risk insurance coverage, and about state and federal regulations and laws covering data breaches and cyber risks, then you should join me for the NetDiligence® West Coast Cyber Risk & Privacy Liability Forum, organized and hosted by my good friends at HB Litigation Conferences.  You can get continuing legal education (CLE) credit, too.

Here are the details:

NetDiligence® West Coast Cyber Risk & Privacy Liability Forum

Date: October 4-5, 2011
Location:
The Ritz-Carlton, Marina del Rey, CA
Chairs: Brad Gow
, Endurance Specialty Holdings Ltd.;
Anne De Vries
, Managing Director, Digital Risk Managers, A division of Wells Fargo Special Risks, Inc.; Christopher Novak, Managing Principal, Verizon Business – Investigative Response;  and Ben Beeson, Partner, Global Technology and Privacy Risks Practice, Lockton Companies LLP

Agenda and Speakers

Register Now!

Delegate Rates:
Attorneys: $1,195**
Insurers & Brokers: $895**
Risk Managers and CFOs: $795**
Sitting Judges or Special Masters: FREE

Individual & Group Discounts Available

Please contact Brownie Bokelman at 484-324-2755 x212 or Brownie.Bokelman@litigationconferences.com to discuss these options.

Conference Venue and Hotel Information

The Ritz-Carlton, Marina del Rey is located at 4375 Admiralty Way, Marina del Rey, CA. Attendees should make reservations directly with the hotel by calling 1-800-241-3333 or click here to book online and enter code HBLHBLG. A block of rooms has been reserved for $239/night – mention the HB Litigation Cyber Risk Conference. The cut-off for this rate is September 12, 2011. If you have any questions or need assistance, please contact Cyndy Noonan directly at 484-324-2755 x201 or cyndy.noonan@litigationconferences.com.

Can’t Attend?

You can still benefit from our programs! Audio, video recordings and handbooks are available for our conferences! Individually priced and packaged, each captures the information and insights delivered by our faculty. Hear from experts, gain new perspectives, and learn proven techniques. For more information, click here, call 484-324-2755, or email allison.emery@litigationconferences.com to reserve your copy today!

My session will be:

State of the Cyber Nation Address

  • Notable recent cases and their impact on this budding litigation area
  • What plaintiffs’ counsel look for when evaluating new data breach class actions
  • Current theories of liability and claims alleged
  • How to present damages in this era?
  • Considerations to minimize the chance of litigation after a breach and settlement opportunities
  • More sophisticated defenses
  • Identity Theft Restoration Act-suing hackers?
  • How federal courts may change the game

Meredith Schnur, Wells Fargo Insurance Services USA, Inc.(Moderator)

Jon Lambiras, Berger & Montague, PC

John Mullen, Sr., Esq., Nelson Levine de Luca & Horst, LLC

Scott Godes, Esq., [formerly] Dickstein Shapiro

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

Note: as a speaker at the conference, I will not be charged a fee to attend the remainder of the conference.

myspace profile views counter

Podcast on D&O insurance, cybersecurity, cyber liabilities, privacy class actions, and insurance: “Executive Summary Webinar Series: What You Need to Know Before You Walk Into the Boardroom (July 2011)”

I recently joined Priya Cherian Huskins and Lauri Floresca of Woodruff Sawyer & Co. to discuss D&O insurance, cyberinsurance, and insurance coverage for privacy issues, data breaches, cyberattacks, denial-of-service attacks and more.   Lauri and Priya gave an overview of the D&O insurance marketplace, including changes in pricing, availability of limits, and new insurance policies and insurance products.  Then we shifted gears and talked about cybersecurity, cyber liability, and insurance coverage for cybersecurity risks.  We touched on the latest data breaches, privacy claims and class actions, and other cyber incidents to have hit the news and discussed the related insurance coverage issues.  The audio and supporting materials (that Woodruff Sawyer prepared) have been put online as a podcast and supporting PDF, so that you listen, in case you missed the live presentation.

To listen to this podcast, click here.

To view a pdf of the presentation, click here.

Date and Time


 

Tuesday, July 19, 2011


Webinar

11:00 AM – 11:30 AM PST


This webinar is offered free of charge.


Visit Us At:

LinkedIn   Facebook   Twitter


Woodruff-Sawyer & Co.

50 California St., 12th Fl.

San Francisco, CA 94111

Before you walk into your next board meeting, what do you need to know when it comes to current D&O liability issues? The “Executive Summary” is Woodruff-Sawyer’s webinar series for CFOs, GCs, Controllers and others who work with boards of directors.  The upcoming session will feature a conversation with Woodruff-Sawyer’s Priya Cherian Huskins and Lauri Floresca, both nationally-recognized insurance experts, and Scott Godes [formerly] of Dickstein Shapiro.Scott [was] the co-leader of Dickstein Shapiro’s Cyber Security Coverage Initiative. Areas of Discussion

  • D&O Market Update
  • D&O Litigation Update

– Newest numbers on D&O suits
– Latest on Supreme Court rulings

  • Lessons from Sony & Citi: What boards should be asking about cyber liability

– Updates on the recent high-profile data security breaches
– Understanding the impact of California’s recent Supreme Court zip code decision
– What should boards do to mitigate cyber risks?

Click here to register for this webinar.

For questions, please email seminar@wsandco.com


Woodruff-Sawyer is one of the largest independent insurance brokerage firms in the nation, and is an active partner of International Benefits Network and Assurex Global. For over 90 years, Woodruff-Sawyer has been partnering with clients to implement and manage cost-effective and innovative insurance, employee benefits and risk management solutions, both nationally and abroad. Headquartered in San Francisco, Woodruff-Sawyer has offices throughout California and in Portland, Oregon. For more information, call 415.391.2141 or visit www.wsandco.com.


Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

myspace profile views counter

Join me for a free webinar about D&O and cyberinsurance: “Executive Summary”: What You Need to Know Before You Walk into the Boardroom

Please join me on July 19, 2011, at 2:00 pm Eastern, for a free webinar hosted by Woodruff Sawyer & Co. Priya Cherian Huskins, Lauri Floresca, and I will discuss D&O insurance, cyberinsurance, and insurance coverage for privacy issues, data breaches, cyberattacks, denial-of-service attacks and more. Here are the details from Woodruff Sawyer‘s announcement:

 

Date and Time


 

Tuesday, July 19, 2011


Webinar

11:00 AM – 11:30 AM PST


This webinar is offered free of charge.


Visit Us At:

LinkedIn   Facebook   Twitter


Woodruff-Sawyer & Co.

50 California St., 12th Fl.

San Francisco, CA 94111

Before you walk into your next board meeting, what do you need to know when it comes to current D&O liability issues? The “Executive Summary” is Woodruff-Sawyer’s webinar series for CFOs, GCs, Controllers and others who work with boards of directors.  The upcoming session will feature a conversation with Woodruff-Sawyer’s Priya Cherian Huskins and Lauri Floresca, both nationally-recognized insurance experts, and Scott Godes [formerly] of Dickstein Shapiro.Scott [was] the co-leader of Dickstein Shapiro’s Cyber Security Coverage Initiative. Areas of Discussion

  • D&O Market Update
  • D&O Litigation Update

– Newest numbers on D&O suits
– Latest on Supreme Court rulings

  • Lessons from Sony & Citi: What boards should be asking about cyber liability

– Updates on the recent high-profile data security breaches
– Understanding the impact of California’s recent Supreme Court zip code decision
– What should boards do to mitigate cyber risks?

Click here to register for this webinar.

For questions, please email seminar@wsandco.com


Woodruff-Sawyer is one of the largest independent insurance brokerage firms in the nation, and is an active partner of International Benefits Network and Assurex Global. For over 90 years, Woodruff-Sawyer has been partnering with clients to implement and manage cost-effective and innovative insurance, employee benefits and risk management solutions, both nationally and abroad. Headquartered in San Francisco, Woodruff-Sawyer has offices throughout California and in Portland, Oregon. For more information, call 415.391.2141 or visit www.wsandco.com.

 

Disclaimer:

This blog is for informational purposes only. This may be considered attorney advertising in some states. The opinions on this blog do not necessarily reflect those of the author’s law firm and/or the author’s past and/or present clients. By reading it, no attorney-client relationship is formed. If you want legal advice, please retain an attorney licensed in your jurisdiction. The opinions expressed here belong only the individual contributor(s). © All rights reserved. 2011.

myspace profile views counter

Recent Entries »