Ironshore Blanket Cyber Policy--Part XI: Insuring Agreement I.J

Michael Sean Quinn, Ph.D, J.D., Etc.

1300 West Lynn #208

Austin, Texas 78703

(o) 512-296-2594

(c) 512-656-0503

mquinn@msqlaw.com

TechDefender

Tech E&O, Network Security, Internet Media and MPL Insurance Policy 

Insuring Agreement I.J. TECHNOLOGY AND INTERNET
LIABILITY COVERAGE

Remember: This Blog is organized around insuring agreements, definitions and exclusions. Conditions, etc., may be remarked upon briefly, but they often resemble not only so-called "Real World" policies and those found in other currently existing so-called  "Policies for the Virtual World." It also ignores policy limits, retention matters, notice requirements, time intervals for coverage, etc., important as all these are. As usual, the discussion of everything in this blog is

Be sure to read the "Concluding Remarks," Even if you don't read all--even much--of the rest of the blog.

*****************************************************************************

Insuring Agreement 

Once the temporal and procedural components are ignored, the substance of the insuring agreement looks pretty much like this:

The Insurer will pay on the Insureds behalf all Loss. . .that the Insured is legally obligated to pay as Damages as the direct result of any covered Claim alleging a Technological Wrongful Act
Wrongful Act, except to the extent the Claim "would be covered under Insuring Agreements B and C[.]"  [B is NETWORK SECURITY LIABILITY COVERAGE;  C is PRIVACY LIABILITY COVERAGE, and both have been discussed in earlier blogs regarding this policy.]

It is worth keeping in mind that actionable defects in the rendering of "professional services" are often called "errors and omissions" policies, although both an error and an omission are not required--one of them will do just fine.  They are also often called various types of "malpractice."  (A generation ago, or so, the phrase "errors and omissions" applied to errors of accountants. Those separate usages are gone.)

New Definitions

 

All, or virtually all, of the starting definitions to be found in the insuring agreements (and in the exclusions, for that matter) depend upon other definitions. A rests on B; B rests on C; and so forth. The key definition of a substantively significant matter is the particular type of wrongful act. Going over the definitions will take some time.

The starting definition with which this coverage analysis starts is a buried definition, namely, Technological Services.  Obviously, the nature of (or the character of) a "wrongful act" depends on that activity with respect to which there has been a wrongful act. This definition is complex; it takes up nearly half a page. 

One thing about the idea of Technological Services is that it includes many services that are regarded as "professional services" on some policies in the so-called "real world."  These are policies that are not ordinary policies, e.g., for life, home and similar buildings, individual vehicle (including boats and the like), etc.  They are not ordinary business policies that cover a slew of ordinary activities.  Instead they are policies that cover specialized and "high class" activities, usually by persons and their companies. Only their professional activities are covered, and in many cases the "wrongful act" is negligence. Here are some examples: physicians, lawyers, accountants, psychologists, brokers, some financiers, and so forth. The Technological Services definition covers some professional services, in this sense, but others as well.  (Then again, perhaps in cyber lingo and its system of concepts lots of activities are called professional the analogues of which in the so-called "real world" would not be counted as such.  This may be quite reasonable since it is a very complex "world.")

Here are some of them:
(1) analysis, design, [and much else] of Computer Systems
 (2) "data base design," (including the warehousing, storage, or recording or analysis of data, etc.)  [MSQ: surely including "cloud" activities],"
(3) other related services:
(a)  consulting, etc. of "technological information," plus manufacture, repair, etc., \
(b) licensing computer software,
(c) website design, and the provision of various sorts of services, etc.,
(d) design, etc., of chat rooms, etc.,
(e) "e-commerce transaction services," etc., &
(f) "electronic data destruction services."

The meaning of the phrase Technological Wrongful Act is much simpler;  it "means any or alleged actual act, unintentional error alleged act, omission neglect or breach of duty by an Insured or Service Provider to others for a fee, including the Insured's intentional breach of contract to render services to others, or the failure of the Insured's Technological Products to perform the function intended."

The idea behind Technological Products is easy to grasp.  So is the idea of Service Provider, except that it is a hireling of the Insured and does its work. (Of course both of these summaries of definitions are just that, rough summaries.)

A too limited (and somewhat speculative) summary is this: The kind of wrongful act covered has to do with fouling up work in connection with an insured's technological work (or those of its service provider) they directly harm some computer stuff belonging to someone else and found in the so-called "cyber world" damages to the company to which the cyber material. However, I.J.provide coverage to that portion of this policy "covered under insuring agreements I.B and I.C." [The emphasis is mine] 

The "and" in this exclusion\or limit built into the insuring agreement requires that an event and consequence of that event be covered under both I.B and I.C in order to be outside J-coverage.
The coverage provided in I.B is injuries and then losses inflicted upon the network security of another by means of a covered wrongful act. (See Part See III.)  Being covered by I.B but not I.C doesn't entail no coverage under I.J.  Insuring agreement I.C covers injuries and losses caused to the privacy (or privacies) of others.  (See Part IV)  .C alone does not take an injury and its losses out of I.J.  It must be conjoined to I.B.

My guess is that actionable invasions of privacy on the net can occur without the destruction of or injury to network security.  I.J is really about fouling up the rendition of cyber services.  Obviously,
inflicting damages upon a network is the same as a failure to renter satisfactory services.  Not will the latter likely to invade someone's privacy.  So why separate them off so sharply? Simplifying adjustment? Unlikely: the adjustment process with remain the same.  Premium allocation?  A little more likely, perhaps, since reinsurance would be priced differently without this "exclusion." Neither of these seem likely, however, so I am mystified.

An Ironshoe Cyber Insurance Policy--Part VIII: Insuring Agreement I.G

Michael Sean Quinn, Ph.D, J.D., Etc.

1300 West Lynn #208

Austin, Texas 78703 

(o) 512-296-2594

(c) 512-656-0503

mquinn@msqlaw.com

TechDefender

Tech E&O, Network Security, Internet Media and MPL Insurance Policy 

Insuring Agreement I.G: DIGITAL ASSET EXPENSES COVERAGE

Remember: This blog is organized around insuring agreements, definitions and exclusions. Conditions, etc., may be remarked upon briefly, but they often resemble not only each other but those found in currently existing policies. It also ignores policy limits, retention matters, notice requirements, time intervals for coverage, etc., important as these are. As usual, the discussion of everything in this blog is tentative, partial, and perhaps mistaken here and there.  It is a new and relatively uncharted ocean.

*  *  *  *  *  *

This insuring agreement is the first of three first-party coverages. It is important to quote the entirety of the agreement, and then give a quick explanation. As usual this agreement depends upon several definitions, two of which are new here; as usual they depend on others. There are more definitions than will be discussed here, since they have been discussed early in these blogs, so they will not be discussed in detail. 

Here is I.G:

"The Insurer will reimburse the Company for any Digital Asset Expenses the Company incurs as the direct result of the corruption, damage, impairment, destruction or deletion of Digital Assets directly caused by a Network Security Incident[.]"  [This is the end of what will be fully quoted in this blog.]

There are several important points to note in this definition. First, the Insurer has an obligation to reimburse.  Technically, under the wording of the contract, this means the Insured has to spend the money before it collects from the insurer. The Insured's right to reimbursement only for covered spending.  Thus, the Insurer probably has a right to "observe,"  "monitor," and maybe even to some degree "regulate"expenditures.  [The words in quotes are mine, not those of the policy.] Of course, any such regulation must be reasonable and necessary.

 The rights of the insurer and the insured parties to the contract may conflict on this and--of course--other matters. One area disputes in this area might develop is over the need for forensic investigation; carriers may sometimes assert that one is enough; while the insured may assert that it has a right to pick its own investigator.

Second, it is the Company and not the Insured that is covered in I.G. Of course, the Company is part of the Insured, but it is not the only one; the others are individuals and they are named as Insureds here.  Probably that is because it is the Company that will be incurring the expenses that are covered.

Third, the term "direct" is in I.G twice. Hence, there must be two direct, as opposed to indirect, causation's.  First, the covered expenses must directly result from a covered incident to which the covered Digital Assets were subjected. Second, the expenses must directly result from the corruption [etc.] of the Digital Assets.  

(The reader might use the following images to get an idea of required directness. Suppose Obama sends a diplomatic message to Putin. He might hand it to him. That's obviously direct. The U.S. Secretary of State might tell him or hand him a note. Is that direct? If Obama "wires" it; and the document is decoded; the Russian Foreign Secretary picks it up, reads it, and hands it along; maybe with a memo; Is this "direct"? Are there degrees of directness?  If so, how does this handle back-and-forth arguments about claims?) See Retail Ventures Inc. v. National Union Fire Insurance of Pittsburgh, PA., 691 F.3d (6th Cir. 2012)

Of course, as already said, there are many other definitions, some of which are complex right on their surfaces and some of them involve other "sub-definitions," and they may be quite complex. Many other cyber policies are like this. The reader has been warned.

Some Key Definitions

The place to begin to sketch the other key portions of this agreement I.G is with the idea of--the definition of--a Digital Asset:

"Digital Assets means Electronic Data, Software, audio files, and image files stored on the Company's Computer System." (And then is a list of what is not within the definition, e.g., some pieces of paper, "unless they have been converted to Electronic Data, and then only in that form.")  The main themes of the definitions within this definition are predictable, although there may be sub-surface subtleties; all such components will be subject to endless dispute.

The other key definition is Digital Asset Expenses:

The phrase Digital Asset Expenses, as one might expect, to what it costs to replace or restore Digital Assets that has been injured in specified ways "corruption or deletion as the direct result of a Network Security Incident. Of course the expenses must be "reasonable and necessary."  These Expenses include "disaster recovery and or computer forensic investigation efforts[.]"  In addition, the replacement or restoration must be done in specified ways, e.g., solid records or other (to some extent) matching Electric Data.

Exclusions

There are no exclusions uniquely applicable to this insuring agreement and its definitions. The definitions more or less are taken from the language of definitions found in policies, designed for the so-called "real world" apply, of course, as to the definitions formulated for all--or many--of the sections