Insurance coverage for cyberliability

Posted by Gene Killian on January 11, 2013

At the end of this month (January 26, to be exact), assuming that the Mayans remain incorrect, I’ll be doing a presentation to the New Jersey Institute for Continuing Legal Education on the topic of insurance coverage for cyberthreats.  Of course, I probably should be disqualified from making any comments whatsoever about trends in computer-related coverage, since I was a charter subscriber to the Mealey’s Y2K Litigation Reporter, the litigation world’s version of the Ford Edsel.

In any event, Willie Sutton is supposed to have remarked that he robbed banks because “that’s where the money is.”  (He denied making such a comment, but I’m not going to let the facts get in the way of a good story.)  Nowadays, the money is accessible without dynamite, drills or guns, to a new breed of criminal – so much so that the SEC now recommends that companies disclose the extent of their cybersecurity risks, including the availability of “relevant insurance coverage.”  (You can read the SEC guidance here.)  Liability associated with network security breaches is extreme.  According to one study of 137 events that took place between 2009 and 2011, the average total cost per incident was $3.7 million (including remedial costs and legal fees).     

I’ve previously blogged about Retail Ventures, Inc. v. National Union, 691 F.3d 821 (6th Cir. 2012), in which a chain of shoe stores had its wireless network hacked, and the Court found coverage under a computer fraud rider to a blanket (first-party) crime policy.  You can read that post here.

I’d now like to review briefly an interesting cyberliability case involving third-party coverage, Eyeblaster, Inc. v. Federal Ins. Co., 613 F.3d 797 (8th Cir. 2010).  (You can read the full Eyeblaster decision here.)  Facts: Eyeblaster is a marketing company that helps run advertising campaigns on the internet.  A computer user (Sefton) sued Eyeblaster, alleging that Eyeblaster injured his computer, software, and data after he visited an Eyeblaster website, through, among other things, the unauthorized installation of cookies on Sefton’s computer. Sefton contended that, after Eyeblaster did its thing, his computer slowed to a crawl and he had difficulty remediating the problem.

With respect to Eyeblaster’s general liability coverage, the issue was whether there had been damage to “tangible property,” so as to trigger property damage coverage.  The Court said yes,  writing as follows:  “Federal did not include a definition of ‘tangible property’ in its General Liability policy, except to exclude ‘software, data or other information that is in electronic form.’ The plain meaning of tangible property includes computers, and the Sefton complaint alleges repeatedly the ‘loss of use’ of his computer. We conclude that the allegations are within the scope of the General Liability policy.”

What we see here is that, at least under general liability policies, hardware tends to be viewed as more “tangible” than software, so that if there are allegations of any harm to hardware, there’s more likely to be coverage.

Along these lines, for those of you who may be dealing with cyberliability issues under standard liability policies, keep in mind that there are ISO exclusions that may apply.  The 2001 version of the exclusion reads: “For purposes of this insurance, electronic data is not tangible property.”  The 2004 version of the exclusion excludes ”[d]amages arising out of the loss of, loss of use of, damage to, corruption of, inability to access or inability to manipulate electronic data.”  Even if the 2004 exclusion had been in play in Eyeblaster, however, the Court likely would have found coverage.  The Eyeblaster Court focused on the idea that the hardware itself did not work, as opposed to electronic data (which may be an intangible concept) being corrupted.

As to the E&O coverage, Federal argued that there was no coverage for intentional acts, even if they result in unintentional damage.   The Court disagreed with that argument as well, writing:  “Sefton alleges that Eyeblaster installed tracking cookies, Flash technology, and JavaScript on his computer, all of which are intentional acts. However, Federal can point to no evidence that doing so is intentionally wrongful. As Eyeblaster points out in an affidavit filed with the district court, Federal's parent company utilizes JavaScript, Flash technology, and cookies on its own website. Federal cannot label such conduct as intentionally wrongful merely because it is included in the Sefton complaint; Federal has a duty to show that the use of such technology is outside its policy's coverage.”  (I always admire good lawyering; going to Chubb’s website and finding similar applications there was a nice touch.)

There are, of course, new insurance products coming onto the market specifically to deal with cyberliability issues, such as Marsh’s “Cloud Protect,” which is designed to protect small and midsized businesses against losses stemming from a cloud service provider’s failure.  When reviewing any of the new policies, pay specific attention to the definition of the terms “computer system” or “computer network,” to make sure that what you want to have covered, is in fact covered.

The "Eight Corners" Rule and the Duty to Defend

Posted by Gene Killian on July 13, 2012

One of the issues that frequently comes up in complicated third-party cases is:  How far outside the underlying complaint does the carrier have to go to determine whether coverage exists?  New Jersey is not an “eight corners” state (in which all the court considers is the four corners of the policy and the four corners of the complaint). The New Jersey Supreme Court has specifically held: “Insureds expect their coverage and defense benefits to be determined by the nature of the claim  against them, not by the fortuity of how the plaintiff, a third party, chooses to phrase the complaint against the insured. To allow the insurance company ‘to construct a formal fortress of the third party's pleadings and to retreat behind its walls, thereby successfully ignoring true but unpleaded facts within its knowledge that require it, under the insurance policy, to conduct the putative insured's defense’ would not be fair.’” SL Industries, Inc. v. American Motorists Insurance Co., 128 N.J. 188, 197 (1992) (citations omitted).  

Along these lines, some time ago, I wrote about the New Jersey Appellate Division’s decision in Adams-Stiefel Funeral Home v. Zurich American, which involved issues of coverage for companies that were essentially “innocent bystanders” in an illegal plot to harvest body parts from corpses.  In a companion case, the New Jersey Supremes have now affirmed the Appellate Division’s ruling of no coverage.  The case facts are a little unique (and ghoulish), but the decision raises some important questions about the scope of the duty to defend.  The Supreme Court decision is here.  

Memorial Properties and Mt. Hebron are the owner and manager (respectively) of a cemetery known as Liberty Grove Memorial Gardens.  They were implicated in a scheme in which a New Jersey dentist and a New Jersey “master embalmer” worked in conjunction with funeral homes and crematories to obtain access to human remains, and to sell body parts.  Memorial and Mount Hebron denied any involvement in the plot, and consistently maintained that, when they received bodies from funeral directors for cremation, the remains were already in sealed containers that were not opened by Memorial and Mt. Hebron prior to cremation. They also argued that the documentation accompanying the remains appeared proper.    

The families of the decedents alleged that, following the deaths of their relatives on various dates in 2003, 2004 and 2005, two persons not connected with Memorial Properties or Mt. Hebron extracted tissue, bones and organs from the remains without authorization, sometimes replacing harvested bone with polyvinyl chloride (PVC) piping so that the bodies would appear intact. The families contended that these persons falsified decedents' medical and funeral records to conceal the illegal tampering with the remains.  The families allege that they were unaware of the “harvesting” until law enforcement authorities told them about it in 2006.  They claimed, among other things (and understandably), damages relating to emotional distress.

Two insurance companies – Assurance and Maryland Casualty - denied coverage for the families’ claims. The policies involved are specially tailored to the funeral home industry, but they basically contain “occurrence”-based coverage.

The Assurance policy provided coverage for the year 2003 for claims arising from damage to human remains and bodily injury, including mental anguish.  Assurance took a “no pay” position, on the ground that the occurrences were outside of the policy period, since the families only learned of the harvesting scheme in 2006. 

In upholding the Assurance denial, the Supreme Court wrote in part:         “The decedent's surviving spouse seeks damages for ‘severe pain and suffering, severe emotional distress and harm, [and] financial or economic loss,’ including lost wages. Her alleged damages derive from her distress upon learning of the unauthorized harvesting of her husband's tissue, bones and organs, and not from a purported cause of action based on property damage to her decedent's remains. Accordingly, in the New Jersey case in which the harvesting took place in 2003, the ‘occurrence’ was the plaintiff-spouse's alleged emotional distress upon discovery of the harvesting scheme in a 2006 conversation with law enforcement, and her claim falls outside of the policy period set forth in the Assurance policy.”

In other words, the Supremes divorced damage to the body (the “property”) from the emotional damage suffered by the plaintiffs.  Since the plaintiffs’ emotional damage only took place after 2003 (hence outside the policy period), no coverage.  Burt how does this square with the principles of SL Industries?  Since the cause of action was in fact based upon damage to the decedent’s body (without that, there would have been no “emotional distress”), wouldn’t a reasonable policyholder expect coverage for this claim?

The other carrier, Maryland Casualty, denied coverage based upon an exclusion removing coverage for claims based upon such activities conducted "by any insured or anyone for whom the insured is legally responsible" including "disarticulation" of body parts from a deceased body, "distribution, sale, loaning, donating or giving away" parts of a deceased body, and “any criminal act.”  Based upon this exclusion, the Supremes wrote in part that the underlying plaintiffs had alleged “an active role by Memorial and Mt. Hebron in the harvesting scheme” which fell “squarely within the parameters of the exclusionary clause.”  

The problem with the ruling in favor of Maryland Casualty is that the policyholders presented evidence that they had not participated in the scheme, and that the bodies had been delivered to them in sealed containers with appropriate certifications.  The Supremes simply resolved that issue against the policyholder without apparently conducting the outside-the-eight-corners analysis required by SL Industries…which is disappointing, to say the least. 

What is an "occurrence"?

Posted by Gene Killian on June 08, 2012

When I started in this business at Anderson Kill back in the 1980s (when the firm was still Anderson Russell Kill & Olick, P.C.), junior lawyers (including me) would do anything, and I mean anything, to keep from sliding into the abyss known as the Insurance Coverage Group.  Who wanted to while away his or her limited days on this mortal coil wrestling with the arcane nuances of insurance policies?  Ugh. We all wanted to try the next great RICO case.  But when the late Gene Anderson came into my (shared) office and told me that I was going to be doing coverage work, there was no right of appeal. 

Thank goodness for that.  Over the years, my insurance coverage practice has exposed me to situations that most lawyers will never see, from sinking flowline bundles in the North Sea to crusty old manufacturing plants in the Upper Peninsula of Michigan.  The point is that insurance coverage practice can take you to a lot of strange and interesting places, and raise a lot of strange and interesting questions. 

Like, for example, the village of Kivalina, Alaska, and one of the weirder coverage cases to come down the pike lately.  (I guess I should have expected it, since I’ve read that some BigLaw firms are starting “global warming” practice groups.)   

Kivalina is located on the tip of a small barrier reef on the northwest coast of Alaska, approximately 70 miles north of the Arctic Circle. In 2008, Kivalina sued AES, a Virginia-based company involved in generating and distributing electricity.  Kivalina claimed that AES had engaged in energy-generating activities using fossil fuels that emit carbon dioxide and other greenhouse gases, and that the emissions contributed to global warming, causing ice on the village’s shoreline to melt.  This allegedly exposed the shoreline to storm surges, resulting in erosion of the shoreline and making the village uninhabitable.

Steadfast (a Zurich Financial Services company) had sold CGL insurance to AES, and AES tendered the suit.  Steadfast disclaimed coverage and refused to defend.

The main question in this case was:  Do allegations of the causation of global warming equate to allegations of “property damage” caused by an “occurrence,” triggering coverage under the policies?

Before I give you the Virginia Supreme Court’s answer to that question, a word here about the history of the comprehensive general liability policy (prudently renamed by the industry the “commercial” general liability policy).  Many years ago, if a company wanted to buy liability insurance, it had to go to the carrier and specify its exposures.  If the exposures weren’t listed, there was no coverage.

Then, in the early part of the 20th century, the insurance industry marketers got a bright idea:  “Let’s provide comprehensive coverage, so that everything’s covered unless excluded.  That’ll be a lot easier to sell.”  Hence the birth of the CGL policy. 

Many courts don’t really grasp how this works.  So, if an offbeat claim comes along, they figure there’s no coverage, and they try to back into a reason why.  That’s the exact opposite of how the policy is supposed to operate.

You can see where I’m headed with this.  In the AES case, the Court held that there was no covered “occurrence,” writing:  “Kivalina plainly alleges that AES intentionally released carbon dioxide into the atmosphere as a regular part of its energy-producing activities.  Kivalina also alleges that there is a clear scientific consensus that the natural and probable consequence of such emissions is global warming and damages such as Kivalina suffered.  Whether or not AES’s intentional act constitutes negligence, the natural and probable consequence of that intentional act is not an accident.”  (Emphasis added.)

Let’s break down the Court’s logic on that one, and you can see the fallacy:

Major premise:  If the policyholder meant to cause the damage that resulted from its intentional acts, there is no coverage.

Minor premise:  Scientists say that releases of carbon dioxide cause damage.

Conclusion:  Therefore, the policyholder intended to cause the damage that resulted.

I regret to say that this reasoning is intellectually dishonest.  The major and minor premises do not lead to the conclusion that AES intended to cause damage, because what unnamed “scientists” think is not relevant to determining the policyholder’s subjective intent, and the typical policy form speaks in terms of what is intended “from the standpoint of the insured.”  Since the possibility exists that AES itself did not intend to cause the specific damage alleged here, a duty to defend should exist.

Lest the reader think that there had been an editing error in the opinion, the Court confirmed its misunderstanding of insurance by writing:  “If an insured knew or should have known that certain results were the natural or probable consequences of intentional acts or omissions, there is no ‘occurrence’ within the meaning of a CGL policy.”  (Emphasis added.)  In support of this rather astonishing proposition, the Court cited a treatise written by two lawyers who have spent their professional careers defending insurance companies in coverage litigation.

Folks, “should have known” is a negligence standard.  If negligence isn’t covered by liability insurance, we’re all in a lot of trouble.

You can read the full decision here.

The timing of an "occurrence" and the duty to defend

Posted by Gene Killian on February 22, 2012

Every once in awhile, we come across a case that calls to mind the formal legal term:  “Eeeeww.”  Here’s one that’s now before the New Jersey Supremes, and that (if you can get past the ghoulishness) involves two important questions:  

(1)  When does an “occurrence” take place under a liability policy? 

(2)  Can a court look past the pleadings to determine whether the duty to defend exists?

Robert and Stephanie Samanns  sued Adams-Stiefel Funeral Home, Inc., contending that the body of Robert's deceased father had been subjected to an illegal scheme of human tissue harvesting that came to light through an investigation in New York State in 2006.  The Samannses alleged that the funeral home had "negligently and carelessly cared for, disposed of, and/or prepared the corpse... for cremation."  According to the Samannses, the funeral home had entrusted the corpse to a cut-rate cremation service, which had allowed unsavory types to dismember the corpse.  The Samannses contended that they had suffered emotional injury as a result of the harm done to the body.

The funeral home’s general liability policies provided the standard coverage for “bodily injury” or “property damage,” but also contained an exclusion for “improper handling”, defined to encompass such acts as “[d]isarticulation of any part or parts of a ‘deceased human body’ by any insured or anyone for whom the insured is legally responsible.”

The funeral home tried to get around the “improper handling” exclusion by arguing that the allegations in the Samanns complaint really pertained to conduct by the cremation service, for which the funeral home was not "legally responsible."  The insurance companies responded that "whether [the funeral home was] responsible for the actions of [the cremation service] " did not matter because there were "allegations that [the funeral home]... is legally responsible.... The ultimate facts and the truth of whether they're responsible doesn't matter. It's the allegations that count here and that's why there's no duty to defend."  The trial court agreed with the carrier, granting summary judgment.

Under New Jersey law, the carriers’ statement of the law relating to the duty-to-defend point (and the trial court’s adoption of it) was breathtakingly wrong.  The New Jersey Supreme Court has pointedly held:  “Insureds expect their coverage and defense benefits to be determined by the nature of the claim against them, not by the fortuity of how the plaintiff, a third party, chooses to phrase the complaint against the insured.  To allow the insurance company ‘to construct a formal fortress of the third party’s pleadings and to retreat behind its walls, thereby successfully ignoring true but unpleaded facts within its knowledge that require it, under the insurance policy, to conduct the putative insured’s defense’ would not be fair.”  SL Industries v. American Motorists, 128 N.J. 188, 198-99 (1992) (citations omitted).  Therefore, if the policyholder could point to actual facts outside the pleadings that potentially brought the claim within coverage, the duty to defend existed.

The Appellate Division ignored the question of whether unpleaded  facts could trigger the duty-to-defend, instead writing:  “The allegations of…negligence vis-a-vis [the cremation service] fall squarely within the exclusion of coverage for bodily injury... arising out of the [f]ailure to... properly dispose of a deceased human body. When the negligence allegations against [the funeral home] are compared to the policy, the proper conclusion is that those claims originated from, grew out of, or have a substantial nexus to the failure to... properly dispose of decedent's body. This exclusion is specific, plain, clear and prominent.”

The Appellate Division’s ruling disregarded the exception to the exclusion, which stated that the exclusion could only be applied when “the insured or anyone for whom the insured is legally responsible” committed the wrongdoing.  Why would the funeral home be “legally responsible” for criminal acts committed by the cremation service?

The next question was when the “occurrence” under the policy took place.   The Samannses’ claim was primarily for emotional distress.    The timing issue was important, because one of the carriers argued that any “damage” took place outside of its policy period, and therefore was not covered. 

The appeals court wrote:  “It is well-established that ‘the time of the 'occurrence' of an accident within the meaning of an indemnity policy is not the time the wrongful act was committed but the time when the complaining party was actually damaged…the important time factor, in determining insurance coverage where the basis of the claim is negligence, is the time when the damage has been suffered. Here, the ‘damage’ occurred in October 2006, when Samanns first learned of the illegal tissue harvesting from decedent's body. The Assurance policy was in effect from December 2004 to December 2005.”

The main question for the Supremes is when the “occurrences” took place – at the time the body parts were allegedly taken, or when the families learned about the theft a few years later.  The policyholder’s attorney (George Dougherty of Katz & Dougherty in Lawrenceville) argued to the Court that the situation was analogous to that of a homeowner whose homeowner’s policy is almost ready to expire, and is asked by a neighbor going on vacation to watch over some childhood memorabilia with little or no intrinsic value but a great deal of sentimental value.  A fire in the kitchen destroys the memorabilia right before the property expires, but the neighbor does not return from vacation and discover the loss until after the policy has expired.  “The fire in the kitchen took place during the policy period,” argued Dougherty.

The problem is that the claim here isn’t really for damage to the body; it’s for the resulting emotional distress.  (Justice Albin seemed to be focused on this issue when he asked Mr. Dougherty whether a dead body has any intrinsic value.)  Can it be said that, for insurance purposes, the claim for emotional distress accrued when the body was dismembered, even though the Samannses did not know of the dismemberment until later? Stay tuned.