Insurance coverage for cyberliability

Posted by Gene Killian on January 11, 2013

At the end of this month (January 26, to be exact), assuming that the Mayans remain incorrect, I’ll be doing a presentation to the New Jersey Institute for Continuing Legal Education on the topic of insurance coverage for cyberthreats.  Of course, I probably should be disqualified from making any comments whatsoever about trends in computer-related coverage, since I was a charter subscriber to the Mealey’s Y2K Litigation Reporter, the litigation world’s version of the Ford Edsel.

In any event, Willie Sutton is supposed to have remarked that he robbed banks because “that’s where the money is.”  (He denied making such a comment, but I’m not going to let the facts get in the way of a good story.)  Nowadays, the money is accessible without dynamite, drills or guns, to a new breed of criminal – so much so that the SEC now recommends that companies disclose the extent of their cybersecurity risks, including the availability of “relevant insurance coverage.”  (You can read the SEC guidance here.)  Liability associated with network security breaches is extreme.  According to one study of 137 events that took place between 2009 and 2011, the average total cost per incident was $3.7 million (including remedial costs and legal fees).     

I’ve previously blogged about Retail Ventures, Inc. v. National Union, 691 F.3d 821 (6th Cir. 2012), in which a chain of shoe stores had its wireless network hacked, and the Court found coverage under a computer fraud rider to a blanket (first-party) crime policy.  You can read that post here.

I’d now like to review briefly an interesting cyberliability case involving third-party coverage, Eyeblaster, Inc. v. Federal Ins. Co., 613 F.3d 797 (8th Cir. 2010).  (You can read the full Eyeblaster decision here.)  Facts: Eyeblaster is a marketing company that helps run advertising campaigns on the internet.  A computer user (Sefton) sued Eyeblaster, alleging that Eyeblaster injured his computer, software, and data after he visited an Eyeblaster website, through, among other things, the unauthorized installation of cookies on Sefton’s computer. Sefton contended that, after Eyeblaster did its thing, his computer slowed to a crawl and he had difficulty remediating the problem.

With respect to Eyeblaster’s general liability coverage, the issue was whether there had been damage to “tangible property,” so as to trigger property damage coverage.  The Court said yes,  writing as follows:  “Federal did not include a definition of ‘tangible property’ in its General Liability policy, except to exclude ‘software, data or other information that is in electronic form.’ The plain meaning of tangible property includes computers, and the Sefton complaint alleges repeatedly the ‘loss of use’ of his computer. We conclude that the allegations are within the scope of the General Liability policy.”

What we see here is that, at least under general liability policies, hardware tends to be viewed as more “tangible” than software, so that if there are allegations of any harm to hardware, there’s more likely to be coverage.

Along these lines, for those of you who may be dealing with cyberliability issues under standard liability policies, keep in mind that there are ISO exclusions that may apply.  The 2001 version of the exclusion reads: “For purposes of this insurance, electronic data is not tangible property.”  The 2004 version of the exclusion excludes ”[d]amages arising out of the loss of, loss of use of, damage to, corruption of, inability to access or inability to manipulate electronic data.”  Even if the 2004 exclusion had been in play in Eyeblaster, however, the Court likely would have found coverage.  The Eyeblaster Court focused on the idea that the hardware itself did not work, as opposed to electronic data (which may be an intangible concept) being corrupted.

As to the E&O coverage, Federal argued that there was no coverage for intentional acts, even if they result in unintentional damage.   The Court disagreed with that argument as well, writing:  “Sefton alleges that Eyeblaster installed tracking cookies, Flash technology, and JavaScript on his computer, all of which are intentional acts. However, Federal can point to no evidence that doing so is intentionally wrongful. As Eyeblaster points out in an affidavit filed with the district court, Federal's parent company utilizes JavaScript, Flash technology, and cookies on its own website. Federal cannot label such conduct as intentionally wrongful merely because it is included in the Sefton complaint; Federal has a duty to show that the use of such technology is outside its policy's coverage.”  (I always admire good lawyering; going to Chubb’s website and finding similar applications there was a nice touch.)

There are, of course, new insurance products coming onto the market specifically to deal with cyberliability issues, such as Marsh’s “Cloud Protect,” which is designed to protect small and midsized businesses against losses stemming from a cloud service provider’s failure.  When reviewing any of the new policies, pay specific attention to the definition of the terms “computer system” or “computer network,” to make sure that what you want to have covered, is in fact covered.

Insurance brokers and malpractice

Posted by Gene Killian on December 06, 2012

New York’s highest court issued an interesting decision last week on the professional duties of insurance brokers.  This is a topic of renewed interest following Sandy, as I’m sure that more than a few policyholders will claim that their brokers provided them with insufficient coverage to weather the storm (pun intended).  I know, for example, that carriers are denying claims out on the Barrier Islands without even bothering to send out adjusters, so there are going to be a lot of unhappy policyholders around.

The policyholder in the New York case, American Building Supply, sells building materials to general contractors, and is the sole tenant in a subleased building which is used only by ABS employees and not open to the general public.  ABS claimed that, in discussions with its broker, it specifically requested general liability coverage for its employees in the event of injury.  Unfortunately, the policy involved in the case contained a cross-liability exclusion clause that provided in part:  “This insurance does not apply to any actual or alleged ‘bodily injury’…to…a present, former, future, or prospective partner, officer, director, stockholder, or employee of any insured.”  Neither the broker nor ABS actually read the policy when it was sold.  And you can guess what happened next:  an injured employee and a denial of liability coverage.

The broker (Petrocelli) attempted to defend the resulting malpractice suit by arguing that ABS was itself negligent, by failing to read and understand the policy it purchased.   The Court disagreed with that position, writing:  “The failure to read the policy, at most, may give rise to a defense of comparative negligence but should not bar, altogether, an action against a broker.” The Court also wrote:  “To set forth a case for negligence or breach of contract against a broker, a plaintiff must establish that a specific request was made to the broker for the coverage that was not provided.”  Here, issues of fact existed as to whether ABS had specifically requested coverage for its employees in the case of accidental injury, so the appeals court sent the case back to the trial court for resolution of that issue. 

In rendering its decision, the Court noted that Petrocelli’s position was illogical:  “Since no one but employees ever entered the premises, the coverage [Petrocelli] obtained, which excluded coverage for injuries to employees, hardly made sense.” 

You can read the full ABS case by clicking here.

The rule in New Jersey is slightly different.  The key New Jersey case is Aden v. Fortsh, 169 N.J. 64 (2001).   In Aden, the husband-and-wife policyholders bought a $48,000 condo and contended that they asked Fortsh, an insurance broker, to cover both the condo and $16,000 in contents.  Fortsh contended that he advised the Adens to consult the condo association policy to make sure that anything not covered by the policy he sold would be covered by the association’s policy.  As an aside, the first policy that Fortsh offered had a $120 annual premium, which the Adens rejected as too expensive.  Fortsh then got the Adens a policy with a $98 annual premium.  (Note to professionals:  when clients nickel-and-dime, there’s trouble just over the horizon.)  Fortsh completed the application for the policy and signed it with the Adens’ permission (a mistake in retrospect, since had the Adens signed it, the subsequent malpractice case would have been harder to sustain). Unfortunately, the policy had only $1000 in total coverage.

The Adens never read the policy.  A fire happened, and they had to pay $20,000 for repairs out of their own pocket.  Result:  malpractice suit.

The Court said that the Adens’ failure to read the policy didn’t matter:  “To hold that an insured must read the policy, and therefore is not entitled to rely on the broker’s expertise… would make the insured responsible for ‘self-inflicted harm,’ despite the broker’s express obligation to protect the insured from that harm…A broker is not an ‘order taker’ who is responsible only for completing forms and accepting commissions.”

The Court noted that its ruling would not preclude brokers from arguing that the policyholder’s failure to read the policy was the true cause of the harm.  But, the Court said, the broker’s lawyer had tried to do just that at trial, and the jury had rejected his efforts.  The Court wrote:  “Even had he read the policy, [Aden] would have been entitled to assume that the $1000 in dwelling coverage was sufficient coverage in light of Fortsh’s professional obligation to ensure that the condominium association’s policy and the policy he was procuring for Aden, in the aggregate, provided adequate coverage.”

You can read the full Aden decision by clicking here.

Here’s my take on all this.  Insurance policies are often a bewildering forest of arcane and discordant trees and weeds.  (From my perspective as a coverage lawyer, thank heaven for that!) Expecting policyholders to understand them when judges can’t agree on what they mean is usually downright nutty.  The best practice is for a broker to take the time at least to review the declarations page carefully, go over it with the client, and make sure everyone's on the same page. 

Bad Faith and the Duty to Defend

Posted by Gene Killian on October 15, 2012

I’m reading a wonderful book right now called “Young Men and Fire,” by Norman Maclean.  The book is about a horrific forest fire that took place in Montana in 1949.  Amazing how small sparks can result in a conflagration beyond all belief.   Those of us involved in the litigation game are familiar with that problem.  How about an $11 million claim by a client against a law firm resulting from a discovery violation, spawning several lawsuits and a major insurance battle? That was the situation recently faced by the Third Circuit in Post v. St. Paul Travelers, which has been approved for publication.  The case has some interesting things to say about how far the duty to defend extends, and about the essential elements of a bad faith claim.   

The facts:  Post and another attorney at the firm of Post & Schell, P.C. got themselves into hot water for improperly redacting information from documents produced by their client Mercy Hospital in a medical malpractice suit.  Unfortunately for Post, the misconduct came up during testimony at trial.  Mercy immediately fired Post, but became extremely concerned that the jury believed there had been a “cover-up,” which could lead to uninsured punitive exposure.  So, Mercy settled with the plaintiffs for $11 million – its full liability limit.

Mercy then retained counsel to bring a malpractice suit against Post.  The malpractice lawyer asked Post to advise his carrier (Travelers) of the claim, but did not immediately file suit. 

The plaintiffs in the underlying case commenced a sanctions proceeding against Post and his firm for the redactions.  Here’s where this gets interesting, from an insurance perspective.  Post filed a claim for coverage for the sanctions proceeding under his E&O policy on the ground that, although styled as a sanctions proceeding, the complaint was basically a claim for legal malpractice, and facts developed in the sanctions proceeding could be used against him in a malpractice suit.  (Note:  The underlying plaintiff, not Post’s client, filed the sanctions petition.) 

Travelers denied coverage based upon an exclusion for “civil or criminal fines, forfeitures, penalties or sanctions.”  Travelers also denied coverage on the ground that a covered “claim” is defined in the policy as a “demand that seeks damages,” and sanctions are not “damages.” 

Then, the plot thickened.  Mercy (or perhaps its carrier, perhaps sensing a potentially quick way to recover some insurance money) intervened in the sanctions proceeding, arguing that it had an “important interest” in the proceeding because the misconduct of its former counsel was at issue.   Mercy requested whatever relief was “just and equitable” from Post, including “costs, attorneys’ fees and expenses.”  Mercy’s Chief Executive Officer confirmed at deposition that Mercy sought money damages in the sanctions proceeding, including the amount of the settlement and compensation for negative publicity.

At this point, Travelers “saw the light” and offered to contribute to Post’s defense costs in the sanctions proceeding, subject to various qualifications.  Post agreed to Travelers’ terms, and submitted legal invoices for over $400,000, which included $250,000 in fees incurred in the sanctions proceeding before Mercy had intervened.  Travelers, bless its heart, generously offered to pay $36,000 of the $400,000.  Post was not happy.  Later, Mercy offered to mediate its malpractice claim with Post, and Travelers again generously agreed to contribute $3000 toward the mediation.  Post was even unhappier.

Meanwhile, Post sued the underlying plaintiffs’ lawyer (Quinn) for defamation and tortious interference, thinking that, faced with such a suit, Quinn might withdraw the sanctions petition, preventing Mercy from getting “free discovery” to be used in the yet-to-filed malpractice suit.  The “best-defense-is-a-good-offense” tactic worked, and the underlying plaintiffs withdrew their claim.  Mercy then sued Post for malpractice, and Post filed a separate suit against Mercy (not a counterclaim), presumably for fees.  Ultimately, Mercy and Post dismissed their claims against each other, with no money exchanging hands.

In the inevitable coverage litigation between Post and Travelers over defense costs incurred in the various litigations, here were the main issues and how they were resolved:

1. Did Travelers have to pay defense costs associated with the sanctions proceeding (in addition to the malpractice suit)?  Answer:  Yes, but only after Mercy (Post’s client) joined the proceeding and sought damages from Post.  The Court wrote:  “No amount of participation by Mercy in the sanctions proceedings would be sufficient prior to the filing of a ‘suit’ – which means under the Policy ‘a civil proceeding that seeks damages’ – a prerequisite to Travelers’ liability…that prerequisite was satisfied [when] Mercy filed its answer to the sanctions petition and sought damages against Post.”  Once that condition was met, however, the sanctions proceeding and the malpractice claim were inextricably intertwined, so the defense of one necessitated the defense of the other.   

2.  Did Travelers have to pay the costs of Post’s separate suit against Mercy, which was interposed as part of his overall defense strategy?  Answer:  No, although had Post asserted a counterclaim instead of a separate suit, Travelers would have been compelled to cover the costs of prosecuting the counterclaim, because “the pursuit of the counterclaims [would have been] inextricably intertwined with the defense.”  The Court wrote:  “However, Post did not simply assert counterclaims in the same proceeding; rather, he filed a separate civil action in a different venue…to hold that Post’s separate action was covered by the Policy simply because it related to Mercy’s suit would condone, and perhaps even encourage, the multiplicity of litigation.”

3.  Did Travelers commit bad faith by denying coverage based upon the “sanctions exclusion” when it knew that actual damages were sought? Answer:  No, because according to the Court, there was no “dishonest purpose.”  Specifically, the Court wrote:  “Travelers did not frivolously decline to provide a defense to Post; rather, after an investigation and retention of outside counsel, Travelers reasonably concluded that the sanctions exclusion in the Policy applied to Post’s claim and denied coverage.  Even if Travelers’ claims-handling was not ideal, there is no evidence in the record…to indicate that Travelers’ purported handling of Post’s claim was motivated by dishonest purpose or ill will.”  (Emphasis added.)

One observation on the bad faith issue. “Dishonest purpose or ill will” is a pretty murky standard.  Exactly how would a policyholder go about proving that?  Not every case involves a statement from a claims person saying:  “Even though we should, we’re not paying, and, by the way, I hate you.”  Maybe judges should avoid formulating standards that are difficult if not impossible to apply in the real world.  If the insurance company takes a coverage position that is not legitimately debatable and is not reasonably supported by documents in the claim file, that’s bad faith…which most people in the insurance industry understand.

You can read the full decision by clicking here.   

Are Punitive Damages Insurable?

Posted by Gene Killian on September 21, 2012

The answer is maybe, under some circumstances.  Unfortunately for the major accounting firm BDO Seidman, however, such circumstances didn’t exist in a recent New York coverage decision.  You can read the full opinion by clicking here.

BDO’s coverage dispute stemmed from a $92 million Florida jury verdict against BDO (ouch), which included $55 million in punitive damages.  The jury found that BDO had prepared fraudulent audits of a failing retirement home that went bankrupt.  The estate of philanthropist George Batchelor sued BDO and Deloitte Touche, saying it relied on the fraudulent audits when investing in a company that acquired, financed and managed assisted living residences.

The carriers disclaimed coverage for the punitive damages award under BDO’s professional indemnity insurance, which contained an exclusion for punitive damages reading as follows:

“This policy excludes…to the extent it is uninsurable by law…any claim for claims for fines, penalties, punitive or exemplary damages imposed by a judgement [sic] or any other final adjudication.”  (Note that, under this exclusion, coverage for punitive damages is precluded only if such coverage is prohibited by law.  Be sure to review exclusions carefully before concluding that there’s no coverage.)

When BDO refused to acknowledge that punitive damages were not covered under the policy, the carriers brought a declaratory judgment action in New York, and then sought summary judgment.

BDO opposed the summary judgment motion by arguing that the coverage case should be put off until an appeal in the underlying case was decided.  The Court refused to delay a ruling, writing:  “[BDO] has presented no reason for this court to question the regularity of the Florida proceedings or the legitimacy of the Florida judgment awarding punitive damages.”

As to coverage for the punitive damages award, the Court wrote:  “The purpose of punitive damages is…to punish conduct having a high degree of moral culpability and to serve as a warning to others in the future… Insurance coverage for the punitive damages in the Batchelor Action would be contrary to public policy.”

In New Jersey, directly assessed punitive damages likewise are not insurable as a matter of public policy.  There’s a question, however, as to whether vicariously assessed punitive damages can be covered.  In Malanga v. Mfrs. Cas. Ins. Co., 146 A.2d 105, 28 N.J. 220 (1958), for example, a jury returned a verdict for compensatory and punitive damages against a partnership and an individual partner, Malanga.   The Court held that the partnership was covered for punitive damages as long as the acts were not authorized by the partnership.  (The case had a Sopranos flair to it.  The partnership was a contracting company engaged in an earth-moving project.  A neighbor refused to allow Malanga onto his property to perform work.  Malanga then did the only sensible thing, running the neighbor over with a bulldozer.)

Specifically, the Malanga Court wrote:  “Since it cannot be said that the assault and battery was committed by, or at the direction of, the insured partnership, there is no reason to deny it the indemnity which it has purchased.  If the defendant intended to exclude the partnership from coverage for liability resulting from an assault by one of its members, it should have made that intention known.”

Absent a clear and specific exclusion for punitive damages, then, don’t assume that a punitive damages award isn’t covered.  It’s important (as always) to examine the policy and the underlying facts very carefully.   

By the way, the Chicago-based law firm of McCullough, Campbell & Lane, LLP, which represents insurance companies, maintains an excellent 50-state survey of this issue on its website.  You can see the survey by clicking here.

Misrepresentations in policy application

Posted by Gene Killian on April 18, 2012

In Continental Casualty Co. v. Law Offices of Melbourne Mills, Jr., PLLC, the Sixth Circuit has just ruled that a lawyer’s failure to disclose an ongoing state bar association investigation against him constituted a material representation justifying the rescission of his malpractice insurance.

The defendant was one of three attorneys who represented a class of Kentucky plaintiffs in a product liability lawsuit over the diet drug fen phen. The case was settled for $200 million in 2001 and the defendant received $23 million as his fee. Class members later accused the lawyers of cheating them and a state judge ordered the lawyers to repay $62.1 million in settlement funds and interest.

The defendant sought coverage of legal malpractice claims arising from the fen phen matter under a policy sold by Continental. Continental sued to rescind the policy based on the defendant’s failure to disclose the state bar investigation in his policy application.

The Court wrote:  “This is ‘precisely the kind of information that Continental [sought and] would need to evaluate its potential for current and future risk.’ In this case, that risk was amplified by the enormity of the $200 million class action settlement. [The defendant] had a duty to disclose this information … and when he did not, he affected Continental’s opportunity to consider and weigh its options when issuing the policy.”

In the alternative, the court concluded that the Kentucky Supreme Court’s decision to disbar the defendant in 2010 served as a sufficient basis for precluding coverage under the policy’s dishonesty exclusion clause.

This case obviously involved some serious malfeasance, but the point needs to be made:  Check your application CAREFULLY before submitting it.  If you're faced with a serious claim of some sort, you don't want to fight the rescission battle. 

The timing of an "occurrence" and the duty to defend

Posted by Gene Killian on February 22, 2012

Every once in awhile, we come across a case that calls to mind the formal legal term:  “Eeeeww.”  Here’s one that’s now before the New Jersey Supremes, and that (if you can get past the ghoulishness) involves two important questions:  

(1)  When does an “occurrence” take place under a liability policy? 

(2)  Can a court look past the pleadings to determine whether the duty to defend exists?

Robert and Stephanie Samanns  sued Adams-Stiefel Funeral Home, Inc., contending that the body of Robert's deceased father had been subjected to an illegal scheme of human tissue harvesting that came to light through an investigation in New York State in 2006.  The Samannses alleged that the funeral home had "negligently and carelessly cared for, disposed of, and/or prepared the corpse... for cremation."  According to the Samannses, the funeral home had entrusted the corpse to a cut-rate cremation service, which had allowed unsavory types to dismember the corpse.  The Samannses contended that they had suffered emotional injury as a result of the harm done to the body.

The funeral home’s general liability policies provided the standard coverage for “bodily injury” or “property damage,” but also contained an exclusion for “improper handling”, defined to encompass such acts as “[d]isarticulation of any part or parts of a ‘deceased human body’ by any insured or anyone for whom the insured is legally responsible.”

The funeral home tried to get around the “improper handling” exclusion by arguing that the allegations in the Samanns complaint really pertained to conduct by the cremation service, for which the funeral home was not "legally responsible."  The insurance companies responded that "whether [the funeral home was] responsible for the actions of [the cremation service] " did not matter because there were "allegations that [the funeral home]... is legally responsible.... The ultimate facts and the truth of whether they're responsible doesn't matter. It's the allegations that count here and that's why there's no duty to defend."  The trial court agreed with the carrier, granting summary judgment.

Under New Jersey law, the carriers’ statement of the law relating to the duty-to-defend point (and the trial court’s adoption of it) was breathtakingly wrong.  The New Jersey Supreme Court has pointedly held:  “Insureds expect their coverage and defense benefits to be determined by the nature of the claim against them, not by the fortuity of how the plaintiff, a third party, chooses to phrase the complaint against the insured.  To allow the insurance company ‘to construct a formal fortress of the third party’s pleadings and to retreat behind its walls, thereby successfully ignoring true but unpleaded facts within its knowledge that require it, under the insurance policy, to conduct the putative insured’s defense’ would not be fair.”  SL Industries v. American Motorists, 128 N.J. 188, 198-99 (1992) (citations omitted).  Therefore, if the policyholder could point to actual facts outside the pleadings that potentially brought the claim within coverage, the duty to defend existed.

The Appellate Division ignored the question of whether unpleaded  facts could trigger the duty-to-defend, instead writing:  “The allegations of…negligence vis-a-vis [the cremation service] fall squarely within the exclusion of coverage for bodily injury... arising out of the [f]ailure to... properly dispose of a deceased human body. When the negligence allegations against [the funeral home] are compared to the policy, the proper conclusion is that those claims originated from, grew out of, or have a substantial nexus to the failure to... properly dispose of decedent's body. This exclusion is specific, plain, clear and prominent.”

The Appellate Division’s ruling disregarded the exception to the exclusion, which stated that the exclusion could only be applied when “the insured or anyone for whom the insured is legally responsible” committed the wrongdoing.  Why would the funeral home be “legally responsible” for criminal acts committed by the cremation service?

The next question was when the “occurrence” under the policy took place.   The Samannses’ claim was primarily for emotional distress.    The timing issue was important, because one of the carriers argued that any “damage” took place outside of its policy period, and therefore was not covered. 

The appeals court wrote:  “It is well-established that ‘the time of the 'occurrence' of an accident within the meaning of an indemnity policy is not the time the wrongful act was committed but the time when the complaining party was actually damaged…the important time factor, in determining insurance coverage where the basis of the claim is negligence, is the time when the damage has been suffered. Here, the ‘damage’ occurred in October 2006, when Samanns first learned of the illegal tissue harvesting from decedent's body. The Assurance policy was in effect from December 2004 to December 2005.”

The main question for the Supremes is when the “occurrences” took place – at the time the body parts were allegedly taken, or when the families learned about the theft a few years later.  The policyholder’s attorney (George Dougherty of Katz & Dougherty in Lawrenceville) argued to the Court that the situation was analogous to that of a homeowner whose homeowner’s policy is almost ready to expire, and is asked by a neighbor going on vacation to watch over some childhood memorabilia with little or no intrinsic value but a great deal of sentimental value.  A fire in the kitchen destroys the memorabilia right before the property expires, but the neighbor does not return from vacation and discover the loss until after the policy has expired.  “The fire in the kitchen took place during the policy period,” argued Dougherty.

The problem is that the claim here isn’t really for damage to the body; it’s for the resulting emotional distress.  (Justice Albin seemed to be focused on this issue when he asked Mr. Dougherty whether a dead body has any intrinsic value.)  Can it be said that, for insurance purposes, the claim for emotional distress accrued when the body was dismembered, even though the Samannses did not know of the dismemberment until later? Stay tuned.