Claims And Issues

COMPUTER HACKERS STOP THE PRESSES, NOTHING TO SEE HERE! RIGHT.

An attack on newspaper computers over this past weekend stopped the presses at some newspapers and disrupted delivery of many of them.  But that's all, the newspapers would have us believe.  No damage to them otherwise.  On the other hand, the attack "originated from outside the United States[.]"  See Tonby Barboza, Meg James, and Emily Alpert Reyes, Malware Attack Disrupts Delivery of L.A. Times and Tribune Papers Across the U.S., Los Angeles Times Online, posted December 29, 2018.

Right.

Foreign hackers went to the trouble of accessing the Tribune papers' combined computer system that serves the entire United States just to interrupt deliveries?

It is to be doubted.

What's next?

Until the next hack attack, have a safe and Happy New Year!

Please Read The Disclaimer.  ©2018 Dennis J. Wall.  All Rights Reserved.

Webinars Continue for Florida Bar Consumer and Tenant Lawyers!

The third webinar is coming up soon in the Public Interest Law Section's (soon to be the Equal Justice Law Section) Consumer and Tenant Working Group’s 2018 Webinar Series. This third training in four is Lender Force - Placed Insurance Litigation on Tuesday, September 25, 2018 from noon to 1:00 p.m. EST.  These webinars are intended for consumer and tenant attorneys.  Registration hyperlink is forthcoming.

Thanks for your interest!

Please Read The Disclaimer.  ©2018 Dennis J. Wall.  All Rights Reserved.

RUSSIAN ARMED HACKING FORCES INDICTED, PII AND MUCH MORE STOLEN.

There have been reports that the Russian armed hacking forces sent a candidate stolen emails and other stolen documents when he requested them before the election in 2016.

here have not been any reports, at least that I have seen or heard, that the Russian armed hacking forces also sent other stolen emails and other stolen documents to:

 

• At least two persons identified in the indictment only as "reporters." The indictment alleges that one reporter asked for instructions and made an offer to the Russians:  "The reporter responded by discussing when to release the documents and offering to write an article about their release."  (Indictment, ¶¶ 43c and 45b.)

 

• A lobbyist. The stolen information that the Russian armed forces sent to the lobbyist allegedly "included donor records and personal identifying information ["PII"] for more than 2,000 Democratic donors."  (Indictment, ¶ 43b.)

The indictment is available for viewing here.

Please Read The Disclaimer.  ©2018 Dennis J. Wall.  All Rights Reserved.

EQUIFAX BREACH LEADS DELAWARE TO STRENGTHEN BREACH OF CYBERSECURITY LAWS.

I do not recall having had a guest post, or writing a post with someone else's content.  Until now.

The following article is reprinted with permission from an EMail sent on Friday, November 17, 2017 regarding "Consumer Protection" via the American Bar Association.  I have checked out the new statutes so far as I am able to do so on Westlaw (they do not take effect until April 14, 2018).

So, without further ado, here with his permission is the excellent article written by American University law student David Alexander McGee and circulated via the American Bar Association on November 17, 2017:

Delaware Amends its Breach of Security Laws in Reaction to the Equifax Breach Delaware Amends Title 6 of the Delaware Code Relating to breaches of security including personal information. Signed 8/7/17 and Effective 4/14/18.             Recently, Delaware amended Title 6 of the Delaware Code that updates how companies that collect and retain personal information of Delaware residents must secure that information and handle breaches. The Delaware General Assembly passed this amendment in relation to the Equifax Security Breach. The most significant changes include: Expands the definition of "personal information" to also include state or federal identification cards, credit card number, passport number, a username or email address in combination with a password or security question and answer, medical history, health insurance policy number, unique biometric data, and an individual taxpayer identification number. Prior to the amendments, only driver's license number, social security number, account number, and a debit card number in combination with the security code were considered as "personal information". Requiring that any person conducting business with Delaware residents' personal information must implement and maintain reasonable procedures and practices to prevent unauthorized acquisition of the personal information. There is an additional definition added to what constitutes a "breach of security" which defines "breach of security" as an unauthorized acquisition of encrypted data if the person acquiring the data believes that the encryption key will be included in the data breach of reasonable belief it will be included. When there is a breach of security and personal information is obtained, any "person" (statutory definition which includes corporations, business trust, estate trust, partnership, etc.) who conducts business in Delaware must notify any resident of Delaware whose data was breached no later than 60 days after the breach, unless the breach would result in no harm being done to the resident. If the number of residents affected is over 500, the "person" (statutory definition) is required to give notice shall also provide notice to the Attorney General. If a breach includes residents' Social Security number, then the person much give identity theft prevention services for 1 year and if applicable identity theft mitigation services at no cost. The link to view the full bill is: legis.delaware.gov/BillDetail?LegislationId=26009. ------------------------------ David McGee American University Washington College of Law Class of 2019 Junior Staffer, Journal of Gender, Social Policy & the Law Washington DC ------------------------------

 

 

NO GETTING AROUND IT. ERISA'S VACUUM LIKE POWERS ...

... PREEMPT RELEASE OF MEDICALS, AIDS INFORMATION PROHIBITED BY ILLINOIS STATE LAWS.

No question of cyberinsurance here, it seems.  A person sued a health insurer and other group plan defendants because her medical and AIDS information was all allegedly released to public view in violation of Illinois State laws.

The insurance company swiftly removed her case to federal court and just as swiftly argued for ERISA preemption without filing an answer or a motion to dismiss (yet).  A federal judge agreed that the vacuum-like powers of ERISA preemption scooped up the plaintiff's claims here.

"For the reasons discussed, plaintiff's state law claims are preempted because they fall entirely within ERISA."   Doe v. Aetna Inc., No. 16 C 8390, 2017 WL 118417, at *3 (N.D. Ill. January 12, 2017).

TODAY IS DR. MARTIN LUTHER KING, JR. DAY.  PERFORM AN ACT OF KINDNESS, especially IF THE RECIPIENT HAS NOT EARNED IT!  IT'S ABOUT YOU, NOT ABOUT THE ONE WHO receives YOUR KINDNESS!

Please Read The Disclaimer.  ©2017 by Dennis J. Wall.  All Rights Reserved.

AND ANOTHER CYBER INSURANCE RISK: LAWYERS' PRIVILEGED CLIENT INFORMATION.

Hard on the heels of an article posted here earlier today, news comes of another risk to add to the ever-growing list of risks that may or may not be underwritten by cyber insurance.  This risk is concisely stated by U.S. Attorney Preet Bharara in the Southern District of New York (Manhattan):

          This case of cyber meets securities fraud should serve as a wake-up call for law firms around the world.  You are and will be targets of cyberhacking because you have information valuable to would-be criminals.

Mr. Bharara was commenting on an indictment of three citizens of China who allegedly traded on information they obtained from hacking.  The trio allegedly hacked "more than 100,000" times (think of that) into several of the most prolific mergers and acquisitions law firms in New York.

The hackers reportedly stole EMails which addressed mergers and acquisitions, used this quintessentially "inside information" to buy stocks in target companies, then sold the stocks after the deals were released and the stock prices went up.  The Securities and Exchange Commission reportedly has also filed a "parallel" civil proceeding against the same individuals.  Leslie Picker, "Dealbook / 3 Men Made Millions by Hacking Merger Lawyers, U.S. Says" (New York Times Online, posted Tuesday, December 27, 2016).

While the occasion for Mr. Bharara's remarks was an indictment of hackers into a few law firms that specialized in mergers and acquisitions, his remarks on the risk of cyber hacking are not limited to that one, albeit wealthy, practice area.

To paraphrase, most if not all lawyers are and will be targets of cyber hacking because all lawyers have information valuable to would-be criminals.

So, there is the additional potential cyber security risk:  Lawyers' confidential online files.  Have you, and has your lawyer, invested enough time and effort to prevent hacking and other releases of confidential online information?  Or is the security protocol now in place actually an open invitation to hackers to return to your client files, say, "more than 100,000" times?

And if the worst becomes real, will any cyber insurance cover the losses?

Best wishes for a better 2017!  Happy New Year in the year to come!

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All Rights Reserved.

ONE MORE CYBER INSURANCE RISK TO COVER: ERISA FIDUCIARY DUTY?

We have taken a look at risks addressed by cyber insurance many times, beginning here on October 21, 2015 (http://insuranceclaimsissues.typepad.com/insurance_claims_and_issu/2015/10/cyberinsurance.html).  See the "Cyber Risks and Cyberinsurance" category on this blog for the growing list.

There is another risk to add to that expanding list.  It is the risk of breach of fiduciary duties under ERISA if privately held personal identifiable information is hacked or otherwise released into the cyber sphere by a health plan administrator.  See Matthew H. Hawes and Patrick Rehfield, "Fiduciary Risk in Data Privacy and Cybersecurity?  You Bet!" (April 7, 2016).  The authors note that a fiduciary under ERISA can even have individual liability, potentially extending to the officers and directors of a corporation for example.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All Rights Reserved.

Related articles

Insurance Claims and Bad Faith Law Blog: ERISA IMMUNITY FOR TEXAS OIL AGAINST SPOUSE'S UNCOVERED DEATH.

CYBER-RISK, CIA, AND CYBERINSURANCE.

"CIA" is a quick way to remember the steps to take to reduce risk, in this case, cyber-risk:

• Confidentiality
• Integrity
• Availability

Congratulations are due to the Silicon Valley Law Group for this acronym, which was a part of their presentation during a recent ABA Webinar.

These are steps on the path toward obtaining cyberinsurance in the first place if they are followed and, potentially, on another path toward reducing insurance premiums.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All Rights Reserved.

CYBER INSURANCE FOR PIGGLY WIGGLY FRANCHISEE? NOT IN THIS CASE.

In Camp's Grocery, Inc. v. State Farm Fire & Cas. Co., 2 No. 4:16-cv-0204-JEO, 2016 WL 6217161 (N.D. Ala. October 25, 2016), one Camp's sued its insurance carrier for cyber insurance coverage.   Camp's claimed coverage principally under its policy's Inland Marine coverage forms, including a claimed coverage for cyber insurance allegedly offered by the carrier on two forms:  an Inland Marine Computer Property form and an Inland Marine (Coverage) Conditions form.

Although seemingly not identified by the District Court, the policy at issue appears to be a standard CGL policy to which the two identified forms were added.   In any case, the District Court agreed with the carrier that the coverage forms from which Camp's argued for liability insurance coverage are instead first-party forms, not coverage forms for liability insurance coverage.  The District Court entered a summary judgment for the insurance company of no coverage for the alleged cyber breach in this case.

Camp's operates a grocery as a franchisee of Piggly Wiggly in Alabama.

The plaintiffs against Camp's in the underlying case were Credit Unions.  They sued for alleged damages resulting from an alleged cyber breach.  The Credit Unions alleged that Camp's is liable for damage on the basis that a data breach was caused by Camp's failure to provide adequate computer systems and employee training and/or to maintain adequate encryption and intrusion detection and prevention systems.

The Credit Unions alleged claims against Camp's under Alabama law for negligence, wantonness, misrepresentation, and breach of contract.  The Credit Unions also alleged a claim under federal law for violation of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.

Camp's, in turn, filed the case we are concerned with here.  Camp's demanded a declaratory judgment of its insurance coverage.  Specifically, Camp's prayed for a declaration that State Farm must defend and indemnify Camp's in the underlying action.

It got a declaration concerning its insurance coverage, but not the one it was looking for.  Even with the two Inland Marine endorsements added to this apparent standard CGL insurance policy, there still is no CGL coverage for the alleged cyber breaches at issue in the eyes of the District Court in this case.  The coverage forms in question are first-party coverage forms, the District Court held.  As such, they do not and never can provide for a duty to defend or to indemnify like a liability insurance coverage.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All Rights Reserved.

DUTY TO DEFEND UNDER MOST LIABILITY POLICIES DEPENDS ON CLAIMS ALLEGED …

... Liability insurance companies are generally against extrinsic evidence to decide the duty to defend in their insurance contracts, until some of them are in favor of extrinsic evidence to decide a lawsuit.

In Travelers Prop. Cas. Co. of Am. v. Federal Recovery Serv's, Inc., 156 F. Supp. 3d 1330 (D. Utah 2016), the Court had to determine whether there is a duty to defend under a cyberinsurance policy.  The law in Utah is that extrinsic evidence cannot be used to determine whether there is a duty to defend under a liability policy, unless the liability carrier wrote the insurance contract to allow or require extrinsic evidence to determine its duty to defend.  Most liability policies were not and are not written to permit extrinsic evidence to determine the duty to defend.

The Court in Federal Recovery Services was faced with claims alleged in the underlying case that the policyholder refused to return electronic data to its customer.  As in most cases in most Courts in the United States, the Court in that case determined the duty to defend by resort to the language of the insurance contract compared to the allegations of the claim against the insured.

The Court held that the carrier which issued a CyberFirst liability insurance policy did not have a duty to defend the claims alleged in the underlying case:

The duty to defend here is conditioned on “any claim or ‘suit’ seeking damages for loss to which the insurance provided ... applies.” … [T]he policy language indicates that the duty to defend is determined with reference to what a claim or suit seeks. Therefore, Travelers must defend a suit that alleges liability within the CyberFirst Policy. Thus, consideration of extrinsic evidence is irrelevant in determining Travelers’ duty to defend.

Travelers Prop. Cas. Co. of Am. v. Federal Recovery Serv's, Inc., 156 F. Supp. 3d 1330, 1336-37 (D. Utah 2016) (emphasis added).

Regardless of wishful thinking sometimes expressed by some people to the contrary after claims have been made, wishful thinking which often consists of opinions expressed in particular by some underwriting departments that are responsible for writing the language of liability insurance contracts as well as by some other non-judges, the question of whether a Court can even consider extrinsic evidence to determine a duty to defend may depend on the language in the insurance contract written by the liability carrier.

Please Read The Disclaimer.  © by Dennis J. Wall.  All Rights Reserved.

CYBER-RISKS, CYBERINSURANCE … AND STANDING.

Standing to sue is a foundation question which must be answered before proceeding with any claim for recoverable damages from a breach of cybersecurity.  It is accordingly also a foundation issue in any claim for insurance coverage for a breach of cybersecurity.

As a District Court succinctly put it in a case of claims for alleged damages resulting from cyber-theft:

    Theft of electronic data has become commonplace in our digital economy, victimizing millions of Americans each year. But while the resulting harm to consumers can be catastrophic, not all data breaches result in legally actionable injuries. As a result, when consumers whose data has been compromised seek redress in the courts, it must be determined whether their alleged injuries are sufficiently specific and concrete to give them standing to sue. That is the task presently before the Court in this case.

Attias v. CareFirst, Inc., No. 15-cv-00882 (CRC), 2016 WL 4250232, at *1 (D.D.C. August 10, 2016).

Please Read The Disclaimer.  ©by Dennis J. Wall.  All Rights Reserved.

ADULT ENTERTAINMENT DISPLAYED ON INTERNET BUT NOT ADVERTISED: NO COVERAGE.

Perfect 10, Inc. is an adult entertainment company.  In its operative complaint in a federal court in California, Perfect 10 alleged copyright infringement by two internet purveyors, Giganews, Inc. and Livewire Services, Inc.  The operative facts alleged by Perfect 10 were that these defendants displayed its copyrighted adult materials even as they offered them for sale on the Internet.

St. Paul insured Giganews and Livewire under a commercial general liability policy.  After disclaiming all coverage for the claim in California, St. Paul filed its own action in a federal court in Texas requesting a declaration that it did not owe any coverage including no duty to defend.

The federal judge in Texas granted St. Paul's motion for summary judgment that it had no CGL coverage for Perfect 10's alleged copyright infringement claim.  The Court ruled that the CGL did not extend "advertising" coverage in large part because there was no "advertising" alleged.  St. Paul Fire & Marine Ins. Co. v. Giganews, Inc., No. A-15-CA-89-SS, 2016 WL 3457620, at *6-*8 (W.D. Tex. June 17, 2016).

Since St. Paul in this case owed no coverage, it owed no duty to defend and, in addition, the Texas federal court joined a host of other Courts in holding that where there is no coverage, there can be no bad faith.  In this case, moreover, the carrier did not commit any independent torts recognized in Texas even as it disclaimed all coverage.  St. Paul Fire & Marine Ins. Co. v. Giganews, Inc., No. A-15-CA-89-SS, 2016 WL 3457620, at *8 (W.D. Tex. June 17, 2016).

In addition to internet porn sales, this case highlights an interesting feature of declaratory relief actions in federal courts.  This case illustrates that a policyholder can be sued in California but may have to defend its claims to coverage, if any, not in California but somewhere else, in this case, Texas.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All rights reserved.

"Cyber Commission Sets Public Forum Targeting Financial, Insurance Sectors"

"The Commission on Enhancing National Cybersecurity, appointed by President Barack Obama, will hold a public forum on May 16 at the New York University School of Law, Center on Law and Security on cyber risks facing the financial and insurance sectors. The commission will hold three separate panel discussions focused on cybersecurity challenges and opportunities in the finance and insurance sectors, as well as cybersecurity research and development in the finance sector. The commission, which will hold four such forums, plans to allow up to 15 minutes for public comments at the end of the day-long event."

From "Cyber Commission Sets Public Forum Targeting Financial, Insurance Sectors" 
Politico Pro (05/05/16) Goode, Darren (subscription required).  Reprinted from AIA "First Read," posted May 6, 2016. 

 

©2016 by Dennis J. Wall.  All rights reserved.  No claim to Politico Pro or AIA "First Read" original works.

AN AD FOR AON? NOT SO MUCH….

….  MORE OF A GOOD ROADMAP FOR CYBERINSURANCE INSURANCE UNDERWRITING AND CLAIMS QUESTIONS.

Aon Risk Services has provided a good roadmap for questions to ask before purchasing or underwriting a cyberinsurance policy.  Reading its website between the lines regarding Cyberinsurance, Aon has also provided an outline of some important insurance coverage questions that come up during the claims process.  Key points are boldfaced here by the author.

The following roadmap and outline, minus contact information and with boldface added here, can be found on Aon Risk Service's website as of the date this article is written:

"Cyber Insurance

In evaluating Cyber Insurance, it is important to understand the risks and exposures an insurance policy may or may not address. While there are numerous standard products available in the marketplace, we believe that one size does not fit all. Since the terms and conditions of each Cyber Insurance product vary greatly, we examine and modify each offering to present a recommended solution that is tailored to our clients' unique needs.

Many professional service firms consider expenses related to a privacy or security data breach, such as statutory notification costs, to be of paramount concern.

• More and more contracts are specifically requiring insurance coverage for these types of costs
• Data breach disclosure laws have been enacted or introduced in a majority of states, as well as in the European Union, and continue to evolve

Cyber Insurance policies provide access to data breach consultants and panels of experts to assist firms that suffer data breaches. This insurance pays expenses for forensic investigation and public relations, as well as notification costs, credit monitoring, and consumer education and assistance costs arising out of a data breach. Some policies also cover the cost of retaining outside counsel to evaluate the firm's potential obligations for a breach.

Cyber Insurance can also be designed to cover the following additional exposures:

• Privacy and Security Liability
• Business Interruption and Extra Expenses
• Contingent Business Interruption
• Cyber Extortion
• Data Corruption
• Media Liability

 

Strategic Approach

Our process for discussing Cyber Insurance is educational and consultative:

Phase 1

• A "Gap Analysis" is performed to determine where any possible coverage can be found in existing insurance policies
• Results are presented in a clear and concise format, with open dialogue
• Based on the findings, we provide recommendations on how to address any gaps

 

Phase 2

• We provide an application for Cyber Insurance and assist with any questions
• We negotiate Cyber Insurance options specific to our clients' individual needs
• A detailed comparison of the terms and conditions of each offering is presented
• We place a Cyber Insurance solution as directed by the client"

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All rights reserved.

FOURTH CIRCUIT AFFIRMS E.D. VIRGINIA: TRAVELERS MUST DEFEND ALLEGED CYBERBREACH.

Travelers issued a CGL or commercial general liability policy to Portal Healthcare Solutions in 2012 and renewed it in 2013.  Portal has been sued in a class action lawsuit pending in Virginia.  Travelers denied all coverage including a defense.

The Fourth Circuit succinctly described the underlying class action against Portal in these words:

The class-action complaint alleges that Portal and others engaged in conduct that resulted in the plaintiffs’ private medical records being on the internet for more than four months.

Travelers decided to test its duty to defend a cyberbreach under its CGL policies by filing suit in the Eastern District of Virginia for declaratory relief.  The Travelers clearly felt very sure of its disclaimer decision; it decided to file this dec action after leaving its insured without a defense.

The District Judge entered a summary judgment against Travelers and in favor of Travelers' insured, Portal.

On Monday of this week, the Fourth Circuit Court of Appeals affirmed the District Court's summary judgment, again wasting no words:

    Put succinctly, we agree with the Opinion that Travelers has a duty to defend Portal against the class-action complaint. Given the eight corners of the pertinent documents, Travelers’s efforts to parse alternative dictionary definitions do not absolve it of the duty to defend Portal.

Download Travelers Indemnity Co. of Am. v. Portal Healthcare Solutions, L.L.C., No. 14.1944 (4th Cir. April 11, 2016). 

Parenthetically, the Fourth Circuit opinion was issued as "non-precedential" in the Fourth Circuit.  However, the District Court decision has been published in F. Supp.  One will be formal precedent within the Fourth Circuit; both will be precedent everywhere else in all likelihood.

          Put succinctly, The Travelers could have done better than disclaim a duty to defend a class action in which the plaintiffs alleged that their medical records were posted on the internet for more than four months on account of what the defendant did or did not do.  It certainly could have done a lot better than compounding that disclaimer decision by filing a lawsuit against its insured to prove how right it was to disclaim all coverage for the claims of the people whose medical records ended up on the internet.

          Why did they ever think that this was a good case to disclaim all coverage including to disclaim a duty to defend?  This case is an outlier in that sense.  Most liability carriers would have provided a defense and issued a reservation of rights to deny coverage later, then they would have filed a dec action.  As it stands, the issue of CGL coverage for a cyberbreach is what people will take away from what is really a decision on the Virginia (and majority) view of the duty to defend.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

CYBERINSURANCE FOR THE PANAMA PAPERS -- TOO LATE?

Wow!  Someone sure needs insurance.  See Liam Stack, "The Panama Papers:  Here's What We Know" (New York Times Online, April 4, 2016).

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

Related articles

Current Cases Sealing Court Records Including Insurance Cases.

<strong>Panama Papers Expose How Politicians And Their Cronies Use Offshore Tax Havens</strong>

CYBERINSURANCE, "INJURY-IN-FACT" & THE BLOGOSPHERE OF LARGE LAW FIRMS.

Courts are finding it difficult to detect any damage as a result of cyber-attacks, incredible as that may seem.  They are shackled by their interpretation that a "case or controversy" under Article III of the U.S. Constitution carries with it something that is not written there:  an "injury-in-fact" requirement.  It seems that the people who are the victims of any cyber-breach have difficulty proving in a courtroom what everyone in the world outside of the courtroom knows:  that they were injured or harmed as a result of the massive release of their personally identifiable information, things such as Social Security numbers, computer passwords, names and addresses, among many other things.

The blogosphere populated by large law firms is heated at the moment.  Their heat is related directly to the judge-imposed requirement that people prove that they have been injured as a result of their personally identifiable information being disclosed to everyone in the world.  (The "injury-in-fact" requirement is required by the Constitution, and binds the Courts of the United States, they say!)  These law firms are generally incensed by the action taken by the Consumer Financial Protection Board against one Dwolla, Inc.

Dwolla, Inc. "operates an online payment system."  Its operations grew to "more than 650,000 users and [it] had transferred as much as $5 million per day."  This was as of May, 2015.

For the immediately preceding four years -- from December, 2010 through 2014 -- Dwolla advertised its "safe" and "secure" services.  These advertisements included displays on Dwolla' s website "and in communications with consumers," in all of which Dwolla further claimed that "its data security practices exceeded industry standards," including among other things that all the personally identifiable information of Dwolla's customers was safely encrypted.

The reality of Dwolla's practices is that its security practices "fell far short of its claims."  It failed to use "reasonable and appropriate measures to protect data obtained from consumers from unauthorized access" and it did not encrypt all of the personally identifiable information of its customers as Dwolla claimed it did.  (These facts were recited by the CFPB in a press release announcing why the CFPB took action against Dwolla.)

In what the CFPB announced was its "first data security action," the CFPB required Dwolla to "stop misrepresenting its data security practices."  The CFPB also required Dwolla to train employees in data security, to fix security flaws, and to "securely store and transmit consumer data."

The CFPB also imposed a civil penalty of $100,000.00.

It seems that the penalty in particular has made the blogosphere of large law firms hot with denunciations that the CFPB did not follow the "injury-in-fact" requirement (even though the "injury-in-fact" limitation has apparently not been interpreted to apply to administrative agencies like the CFPB, even in the wildest imagination of the fevered blogosphere).  The heat is particularly intense when lawyers must inform a client whether large or small that it has to pay a lot of money.

That states the controversy.  How would you decide a case of misrepresented practices (assuming misrepresentation for the sake of discussion here)?  Would you wait for a data breach to take place?  A data breach because of a failure to use security practices in defiance of legal obligations, a breach that involves the personally identifiable information of, say, hundreds of thousands of people?

If you decide that there is no harm from dangerously misrepresented security practices, why then do you and does your business use security measures if security measures actually have no value?

Would you wait until a data breach takes place before you would allow action against the misrepresenter and purveyor of the dangerously leaky security practices, which by that time would have allowed the world or a large part of it to trade in your personally identifiable information?

Would you impose a requirement that negates the obvious harm suffered by those people?

What if one of those people is you?  Or one or both of your parents?  Or your children?  Does your answer change depending on who suffered the obvious harm but who may find it hard to prove that in fact they have been injured in some way that lawyers and judges can recognize, despite the fact -- known everywhere except perhaps inside of courtrooms and large law firms -- that clearly these people have been injured?

Here again is the CFPB's press release, titled "CFPB Takes Action Against Dwolla for Misrepresenting Data Security Practices," issued March 2, 2016.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" including issues confronting Cyberinsurance (forthcoming Thomson Reuters 2016).  All rights reserved.

CYBERINSURANCE COVERAGE: IS IT COVERAGE FOR THE DATA?

 

Image courtesy of NASA.

The kinds of cyberinsurance coverages that interest me the most are the kinds that provide coverage to individual people. The risks that most concern me, and that I want to address in this space, are risks to individuals from the vulnerabilities of individuals and from attacks on and bad practices of corporations which affect individual people.

The magnitude of these risks is exemplified by the types of data subject to cyber-risks, including:

• Social Security numbers.
• Names.
• Phone numbers.
• EMail addresses.
• Passwords to EMail accounts, bank accounts, and virtually every other kind of account available on the Internet today.
• Employment benefits.
• Income tax returns.
• Work history.
• Salaries and payroll records.
• Medical and dental information.
• Passports.
• Travel receipts and itineraries.
• Maps obtained online with directions for travel, particularly directions for use on certain days at certain times.

See generally Edward Lucas, Cyberphobia (2015).

None of these things determines a cyberinsurance coverage question.

Do they affect settlements? Absolutely.

Affect trial outcomes? Certainly.

But not cyberinsurance coverage questions. The things that do affect the outcome of cyberinsurance coverage questions will be discussed in future articles posted here.

Please Read The Disclaimer. ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016). All rights reserved.

Related articles

WHAT "PERSONAL IDENTIFICATION INFORMATION" OF 80 MILLION PEOPLE REALLY MEANS.

THE "PLAUSIBILITY" OF JUDGING WITHOUT MOTION FOR JUDGMENT OR TRIAL.

I thought that I would break this cyberattack case down into understandable concepts but I hit a wall.  (No pun intended.)

Instead I ran into the reality of what has been called "Mr. Roberts' Rule of Order," or "Lots of orders, very few rules."

I refer to the so-called "plausibility" standard of jurisprudence under which trial judges in Federal courts can look at exhibits to decide motions to dismiss, unlike the previous standard under which a motion to dismiss would be denied so long as basically the complaint alleged "ultimate facts."

To many if not all District Judges, "plausibility" goes beyond mere plausibility to deciding motions to dismiss based on the exhibits.  It also means dismissing claims with prejudice based on the exhibits.  So really, the test is not whether the complaint states claims that are plausible but whether the exhibits submitted by the plaintiffs and the defendants are plausible.

Sometimes it even means that a complaint will be dismissed if the plaintiffs have not submitted exhibits on any given claim.

Such was the case in the cyber-risk decision under discussion, In re Anthem, Inc. Data Breach Litigation, No. 15-MD-02617-LHK, 2016 WL 589760 (N.D. Cal. February 14, 2016).  The District Judge dismissed California breach-of-contract claims, New Jersey breach-of-contract claims, and New York unjust enrichment claims because of the exhibits submitted by the plaintiffs, because of the evidence submitted as exhibits by the defendants, and because the plaintiffs did not submit "any relevant exhibits" on one claim.  In re Anthem, Inc. Data Breach Litigation, No. 15-MD-02617-LHK, 2016 WL 589760, at *14-*17 (N.D. Cal. February 14, 2016). 

Never mind that the "exhibits" might never have been admitted into evidence.  The question of admissibility was never even asked before the rulings were made.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

Related articles

"PLAUSIBILITY" AND PREEMPTIVE MOTION TO DENY INSURANCE CLASS CERTIFICATION.

WHAT "PERSONAL IDENTIFICATION INFORMATION" OF 80 MILLION PEOPLE REALLY MEANS.

The District Judge described what she meant with the otherwise anodyne acronym "PII" and in the antiseptic-sounding phrase, "Personal Identification Information."  Bear in mind, once again, that these are the things that were accessed by cyberattackers for 80 Million people in a health insurance carrier's database:

‘These records include personal information (such as names, dates of birth, Social Security numbers, health care ID numbers, home addresses, email addresses, and employment information, including income data) and individually-identifiable health information (pertaining to the individual claims process, medical history, diagnosis codes, payment and billing records, test records, dates of service, and all other health information that an insurance company has or needs to have to process claims).‘  Id. The Court shall refer to members' personal and health information as Personal Identification Information, or ‘PII.‘

In re Anthem, Inc. Data Breach Litigation, No. 15-MD-02617-LHK, 2016 WL 589760, at *2 (N.D. Cal. February 14, 2016 [and once again, yes, dated on a Sunday]).

To be continued.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

CLASS ACTION, CYBERACCESS TO PERSONAL IDENTIFICATION INFORMATION, AND HEALTH INSURANCE.

For two months, from December, 2014 through January, 2015, Anthem, Inc.'s database of policyholder information was breached by cyberattackers.  Anthem itself said so.

The cyberattackers accessed the "Personal Identification Information, or 'PII'," of approximately 80 Million policyholders.  Anthem itself said so.

This was not the first time.  Anthem and Wellpoint, "Anthem's former trade name," experienced "problems with data security" in 2009 and in 2013, as a Federal Court put the matter in In re Anthem, Inc. Data Breach Litigation, No. 15-MD-02617-LHK, 2016 WL 589760, at *1 - *2 (N.D. Cal. February 14, 2016 [yes, dated on a Sunday]).

To be continued.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

CYBERINSURANCE COVERAGE FOR FINES AND PENALTIES WIND 2016

In a departure from other lines of insurance and from the current experience of most insurance coverage experts, cyberinsurance policies include coverage for regulatory fines and penalties in their Insuring Agreements.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

CYBERINSURANCE POLICIES IN PROCESS WIND 2016

Cyberinsurance policy forms are constantly changing.  Just like the evaluation of cyber risks and exposure to damages.

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

DATA BREACHES ADDRESSED AT THE WIND 2016 CONFERENCE! CYBERINSURANCE, ANYONE?

Data Breaches are a storm in their own right.  Data breaches will be addressed together with related issues of Cyberinsurance, have no doubt.

The future is HERE!

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" which will include Cyberinsurance Claims and Issues (forthcoming Thomson Reuters 2016).  All rights reserved.

WIND 2016 IN ORLANDO BECOMES BASE OF MY BLOGGING OPERATIONS.

Starting tomorrow and running through Wednesday, my base of operations for this Blog and for Insurance Claims and Bad Faith Law Blog will be WIND 2016, the 2016 Conference of the Windstorm Insurance Network which is being held in Orlando, Florida.

Among the topics will be Interactions Between Insureds and Insurers, Florida Property Law, Insurance Bad Faith, Data Breaches and so related Cyberinsurance coverage issues, Civil Remedy Notices, and Lender Force-Placed Insurance Practices.

I am looking forward to it and I hope you are too!

Please Read The Disclaimer.  ©2016 by Dennis J. Wall.  All rights reserved.

"INSURANCE CLAIMS AND ISSUES," THE BOOK: COMING IN 2016!

 

 Storm Clouds lined up over the Gulf of Mexico.  Photograph and text copyright 2015-2016 by Dennis J. Wall.

I am hard at work on an anthology of the best blogs from "Insurance Claims and Issues."  The anthology I submit to my publisher will keep all hyperlinks intact, including links to the Insurance Claims and Bad Faith Law blog.  When articles posted on Insurance Claims and Bad Faith Law blog are important to the anthology of "Insurance Claims and Issues," I am including them in the anthology too.

As each previously posted article is updated, the posted articles will remain just as available here as they always have been.  New articles will benefit from me being better informed and better equipped to discuss future insurance claims and issues.

I have contracted with Thomson Reuters (West Publishing Company to those fortunate to have the experience) to publish "Insurance Claims and Issues," the Book, in the late Spring or early Summer of 2016.  Best wishes to everyone for a joyous and Happy New Year!

Please Read The Disclaimer.  ©2016 by Dennis J. Wall, author of "Insurance Claims and Issues" (forthcoming Thomson Reuters 2016).  All rights reserved.

Related articles

Convincing Anyone Yet? Coverage, Contraception, and the Court.

CYBERINSURANCE:  MANY DATA-LESS RISKS TO UNDERWRITE & PREMIUMS TO CHARGE.

THE ALI RESTATEMENT PROJECT OF THE LAW OF LIABILITY INSURANCE.

Majority Holds No Negligence Cause of Action by Insured Against I.A.

IS YOUR LAWYER READY FOR CYBER SECURITY? PAPER OVER RISKS ...

 

Image by NASA.

 

... WITH CYBERINSURANCE!  Whatever "cyberinsurance" means, in the final act.

 

Are lawyers ready for the risks of cyber security?  Not so much, is the conclusion of Lateral Link, described as a "legal recruiting firm" on abovethelaw.com, where Lateral Link posted the thoughts of its own Michael Allen, "Is Your Firm Spying on You?"

Is anyone ready for the risks of cyber security, if it comes to that?

Perhaps the risks can be papered over with cyberinsurance!

 

Please Read The Disclaimer.  ©2015 by Dennis J. Wall, Co-Author of "Catastrophe Claims / Insurance Coverage for Natural and Man-Made Disasters" (Thomson Reuters November, 2015).  All Rights Reserved.

Related articles

CYBERINSURANCE -- WHERE ARE THE COVERAGE CASES?

CYBERINSURANCE: MANY DATA-LESS RISKS TO UNDERWRITE & PREMIUMS TO CHARGE.

 

 Image by NASA.

A white paper on the topic of "Cyberinsurance" provided by the National Association of Insurance Commissioners this year highlights the difficulties for insurance companies in underwriting the stuff.

The starting point of the question comes toward the end of the NAIC's "topic" paper or white paper.  The NAIC reports that "cyber risk remains difficult for insurance underwriters to quantify due in large part to a lack of actuarial data."

Insurers "compensate" for the lack of facts surrounding cyber risks and cyberinsurance "by relying on qualitative assessments".  Translated into English, this means that insurance underwriters understandably enough substitute opinions for facts because they have so few facts.

"Managing cyber risks through insurance is relatively new," the NAIC acknowledges.  The market for cyberinsurance "is expected to grow dramatically".  The problems in this area come from the risks to be assumed, in more ways than one.  "With each announcement of a system failure leading to a significant business loss, the awareness grows."  Note the NAIC's quiet but exclusive emphasis on "significant business losses" here.

Yet, the risks to be assumed under one or more forms to be determined in the burgeoning field of cyberinsurance are so broad and spreading so wide as to include risks to individual persons as well as to businesses.  The NAIC paper even mentions the following cyber risks, among others:

• Hacking or inadvertent disclosure of personal information.
• Business interruption.
• "Introduction of malware, worms and other malicious computer code."
• "Lawsuits alleging trademark or copyright infringement."

Clearly, many of these sorts of risks affect persons as well as business entities.  Further adding to the island of unknown risks, so to speak, are pressures to protect information of all kinds, from personal information to trade secrets; to repel the sources of "cyber-attacks," including other nations, terrorist and other organizations, criminals, "and activists"; and to protect the policyholder's money including to prevent unauthorized access to the policyholder's and others' money.

The NAIC attempted to clarify the area in 2015 beyond a paper on "Cyberinsurance," however.  In April, its Cybersecurity (EX) Task Force issues its Principles for Effective Cybersecurity Insurance Regulatory Guidance.  The regulatory guidance in question is directed to "insurers, producers, and other regulated entities".

Please Read The Disclaimer.  ©2015 by Dennis J. Wall, author of an anthology in progress of "Insurance Claims and Issues" articles, to be published by Thomson Reuters in 2016.  All rights reserved.

CYBERINSURANCE -- WHERE ARE THE COVERAGE CASES?

 

Image by NASA.

Cyberinsurance is an exciting subject in the world of insurance.  Carriers have policies, commentators have opinions about the carriers' coverage provisions, would-be policyholders especially large corporations have wish lists for the cyber-risks they want covered.

But as I dive more deeply into the subject of cyberinsurance, I am finding only a few of the most important things of all:  Cases deciding insurance coverage issues.  Cyberinsurance may be the hottest new flavor of insurance.  Yet how courts interpret and apply insurance policies can make all the difference for carriers, commentators, policyholders, and coverage counsel.

Until courts declare what the words of an insurance policy mean, they may not mean what you or I might think they mean.  Until a court or courts recognize that a given insurance coverage claim is valid, it may not exist.

So, if you have a cyberinsurance coverage case on your hands or in your research bank, I invite you to share it with me.  Send me an EMail at [email protected].  Thank you.

In the meantime, I will carry on with my research into cyberinsurance including my continuing search for coverage cases.

Please Read The Disclaimer.  ©2015 by Dennis J. Wall, Co-Author of "Catastrophe Claims / Insurance Coverage for Natural and Man-Made Disasters" (Thomson Reuters May, 2015).  All Rights Reserved.

Remember Pearl Harbor, today and always!

CYBER SECURITY: WHAT RISKS SHOULD INSURANCE ADDRESS?

Image by NASA.

The Federal Information Security Management Act of 2002 "requires agencies to assess their own risk factors and conduct risk management activities" on cyber security issues, "such as developing a security plan."  Grace Knofczynski, "Auditor Says Federal Cybersecurity Efforts Are Inadequate" (RegBlog, the Penn Program on Regulation, posted on Tuesday, November 10, 2015).

As a measure of the performance of federal agencies in assessing cyber risks and in developing risk management activities, the General Accounting Office released a report in about the last Quarter of 2014 examining whether six representative federal agencies "had developed and carried out policies for overseeing contractor-operated networks and systems."  Tim Yang, "GAO Recommends Improved Oversight of Information Technology Contracts" (RegBlog, Penn Program on Regulation, posted Thursday, September 18, 2014).

The GAO found in its report in late 2014 that only the Department of Homeland Security ("DHS") had "fully implemented policies on contractor oversight," and "had consistently planned and executed assessments of their policies," and "had consistently reviewed its assessments."

These findings support the need for at least the following questions on any application for cyber insurance (among other questions on the application, of course):

• Does the applicant have policies in place on contractor oversight?
• Does the applicant consistently plan and execute assessments of its policies on contractor oversight, and if the answer is "yes," state how often these assessments are planned and executed: _______________.
• State how often the applicant reviews its assessments of its policies on contractor oversight:  _________________.

As is usually the case, the application should of course provide that false or incomplete and misleading answers to the questions on the application are grounds for the insurance company rescinding the insurance, in this case for cyber insurance.

Before concluding this article, it is worth revisiting FISMA.  The FISMA or Federal Information Security Act of 2002 was mentioned above.   Two things were reported in the two above RegBlog posts over one year apart that bear mention about compliance with this federal law:

1. FISMA mandates that both the National Institute of Standards and Technology ("NIST") and the General Services Administration ("GSA") should provide "guidance" to federal agencies "on how to establish effective oversight of contractors …."  Further, RegBlog reports that unspecified "[f]ederal law" mandates that the Office of Management and Budget ("OMB") and the DHS "provide guidance to agencies about enhancing their cybersecurity and reporting compliance."  Whether the mandated "guidance" is actually the same or duplicative in each case is not clear.  What is clear, according to the GAO, is that the OMB's and the DHS's "guidance" are both "often incomplete or unclear."
2. Despite the FISMA mandate that federal agencies assess their risks and conduct risk management activities in response to threats to cyber security, "[l]ess than two-thirds of the agencies covered in the GAO report," said RegBlog this month -- on November 10, 2015 -- "had fully assessed their risk factors during 2013 and 2014."  Which leads to an interesting overall question of insurance coverage for cyber insurance policies:

 

What are the risks to cyber security that cyber insurance is being asked to cover, and how do applicants seeking cyber insurance manage those risks, if at all?

 

Please Read The Disclaimer.  ©2015 by Dennis J. Wall. All rights reserved.