Cyber Insurance -
Buyer Beware: Cut Costs If You Want To But You Get What You Pay For

by Jack Barkstrom - Attorney, CPA

The Art Exhibit - Special Conditions

Insurance coverage "for a temporary exhibit of well-known paintings for a few months" is the one contract clause which will never be seen, or is very unlikely to ever appear, in an insurance contract for a visiting collection of original Rembrant, Van Gogh, or Monet paintings.

Hadley versus Baxendale, is an 1854 English case dealing with unique categories of losses. Generally, if you receive the wrong part, the supplier just finds the correct part and provides a new one. If there are reasons why the wrong delivery will result in other losses, the opposing party had to be told there were special circumstances. In Hadley v. Baxendale, a mill owner Hadley had ordered a replacement part for a crankshaft through Baxendale, which was a common carrier. Hadley had said that it needed delivery as soon as possible. It is likely that Baxendale was negligent and the part was delivered late, causing the production line to shut down. Hadley was awarded damages at trial. He lost on appeal. The fact that Hadley had said the replacement was needed as soon as possible was not enough. In order to recover damages for lost revenue, the carrier had to be informed of that possibility at the time of the order.

In the case of an art museum exhibit of famous paintings such as Rembrants, the circumstances are so special that insurance companies will have their own team, or teams, of security experts who will oversee and coordinate with the museum security, as well as international and local law enforcement. While art security experts may be publicly known, it is unlikely that a team handling a particular exhibit will be disclosed, nor will they disclose the security measures in place, or what measures will be taken to increase security during the exhibit. Even delivery methods and times will be kept secret.

Cyber Insurance - What's that?

On the topic of insurance, one of the more commonly-heard statements is - "No one reads the fine print." Well, if you're going to pay $100,000 or more per year for a policy, someone had better be reading the fine print. Cyber insurance is new, and conceptually, in a category of its own. Some insurance, such as auto insurance or fire insurance, are fairly straightforward and at least understandable. If your car is damaged or someone is injured, someone has to pay. Business owners will be aware that fire insurance policies will require a working fire sprinkler system and fire alarm system, along with fire prevention measures.

Cyber insurance, in contrast to auto insurance, has introduced some new elements. While auto damages are normally limited to the people involved in an accident, cyber attacks can impact thousands or millions of people and businesses. The immediate impact may be to a company and its systems and machines, although if an organization is large and geographically dispersed, this damage can be extensive. There is also the damages done to those doing business with an organization. Another area is the potential diclosure of sensitive customer data. Who pays for repairing that, and how much? A new area is "reputational damage." Once news gets out about a breach, what does an organization do to repair their reputation?

If the boundaries and costs associated with reputational risk are yet to be determined, there are other more traditional areas where costs are more easily calculated - or at least they seem to be. If computer equipment is destroyed, or impaired, should insurance cover just the original cost or the cost of needed upgrades? Fire insurance policies can require a building owner to maintain an operating fire prevention system. Will cyber insurance cover existing conditions, even if they are aware that an organization is vulnerable to cyber attacks. The insurance company may accept the risk and offer a policy. One solution is to offer premium discounts for measures a customer takes to improve their system, such as buying new equipment or paying to make upgrades.

Another developing insurance area is income lost following a cyber attack. Insurance is unlikely to cover lost income forever, but it may cover it for some definite period. Lost income is not a suddenly-discovered area of risk or insurance. Any risk or loss area has been encountered before and likely covered by some type of insurance. Cyber losses may be unique, but, like other losses, will ultimately be translated or converted into monetary losses. How much does it cost to repair a computer or system? How much does it cost to eliminate malware or to clean an encrypted disk? How much does it cost to restore, recover, or re-create lost or destroyed records?

Records are now kept electronically. That makes them more efficient and unique. Yet, if their destruction or loss connects them to the world of cyber systems and cyber security, do they require a new category of insurance, with a new label? To be sure, the destruction of electronically-stored data, has come to the attention of the cyber world, along with the idea of recovery planning and a new set of risks, which need to be taken into account and quantified. But is it that much different than the risks associated with natural disasters? They have always been there, but the likelihood of a 500-year flood, which was relatively low-risk, seems to be occurring every few years. Suddenly, the risk of large fires or hurricanes, must be recalculated.

The risk of damage from cyber attacks was always there, and there are even examples of early attacks, if you were looking for them. There were even early discussions of the potential for more damaging consequences, even how they might be carried out. Like the 500-year flood, they were largely ignored - until they started happening. With more advances in computers and information technology, there also came advances in attack methods. There were new attackers, new motivations, and the discovery of new vulnerabilities.

Cyber Insurance as a Service - Fulfilling a need or just another marketing tool?

The insurance industry likes to emphasize the value of its services by encouraging needed chances. There is no question that in some areas, it has been behind many of the changes which have contributed to better safety and health conditions, such as fire protection. At the same time, some have seen the threat of cyber attacks as a marketing tool. Some policies will offer specialiized services as part of their cyber policy - a form of "cyber insurance as a service." To recover from reputational damage, they will provide public relations specialists who will provide everything from long-term strategies for repairing damaged image to experienced spokespeople who will deal with the public and the media. If an attack involves some form of ransomware, they will provide experts to handle communication and negotiations with the attackers. To deal with cleaning up systems and improving security, they will offer another team which specializes in that.

The Insurance Industry - To regulate or not.

For those interested in a history of the insurance industry, there is really just one piece of legislation to be aware of - the McCarran-Ferguson Act of 1945. In 1943 the U.S. Supreme Court decided the case of United States v. South-Eastern Underwriters. The issue was whether the insurance industry was exempt from the federal antitrust laws. If it was covered by the Sherman Antitrust Act, then insurance companies and any insurance organizations could be regulated by the federal government. The Supreme Court held that Congress had not provided a specific exemption from the antitrust laws for insurance and therefore they could be regulated under federal law.

The decision was not popular with the insurance industry. In response, Congress passed the McCarran-Ferguson Act of 1945, which declared that the insurance business should be regulated by the states, and not the federal government. Whether this resulted in less regulation or not, state legislators felt under pressure to show they could regulate the industry and passed model regulatory statutes. If Congress did not get back into insurance regulation, it nevertheless entered the insurance business by offering flood insurance and federal crop insurance.

Cyber Insurance - Standard Form or Detailed Coverage.

Many people who have traveled may be familiar with "trip" insurance, or similar insurance offerings, such as supplemental insurance offered on a per-day basis for auto rentals. Sometimes the terms are provided, or available. They are usually a standardized form of insurance offering, and most of the major coverage is explained or emphasized, and generally understandable. For those trying to save money, they are something of a nuissance expense. For others, they are a relatively cheap form of insurance which will save time and money in the event of an accident.

Like other businesses, the insurance industry is under pressure to reduce costs. It is expensive to maintain a large sales force of experienced agents. The trend is to sell insurance directly to customers without the use of insurance agents, encouraged by the availability of Internet, or other, price-comparison tools. Sometimes this works, if the terms are relatively similar. In other situations, it may be better to use the services of an agent, depending on how complex the coverage is. In the area of cyber insurance, the question is whether the insurance terms are, or can be, "standardized" or must be tailored to individual organizations or businesses.

Should the term "cyber attack" cover everything that might happen, or are there differences? Is malicious activity by an employee the same thing as an attack by a foreign country or individual. Are threats to disrupt operations or to ask for a ransom payment the same thing as accessing a system to obtain confidential information? Is malware (malicious software) the same thing as ransomware? There are so many types of cyber attacks and so many different types of consequences it would seem almost impossible to create a standard form. At the same time, insurance companies are working to upgrade policies to standardize what types of cyber insurance can be offered.

Cyber Insurance - Buy the cheapest directly or use an agent?

At a time when businesses are under pressure to cut costs and provide better and more efficient service, there is a debate within the insurance industry about the direction it shouuld take. Some of the focus is on the need for an insurance sales force or insurance agents and brokers. One solution is to offer apprenticeships. Related to this is the trend toward direct-sales operations. Auto insurance writers, such as Geico and Progressve, are competing on price, with clever Internet ads, even featuring recognizable "mascots," such as the Geico Gecko, or the sunglassed Emu, along with familiar actors. Presumably, if the offerings are car insurance, what is covered is the same, with the only difference being the price.

In more complex markets, such as that served by Chubb, while the pressure to cut costs is still there, there is a push to not quite eliminate managing general agents (MGAs) altogether, but to eliminate unnecessary services. Past practices have allowed MGAs to farm out underwriting to other brokers, because they offered cheaper prices and good commissions. While the policies, on their face, appeared to insure the client, they were not actually realistically dealing with risks. Advances in computer technology and artificial intelligence, have allowed primary insurers to take over risk assessments, tailor insurance, and deal directly with risk.

It is unlikely that current trends will eliminate the role of managing general agents, although their duties are likely to change. Market forces, over the long run, will eliminate those who provide bad advice, inadequate coverage, or bad service. For those looking for general insurance or cyber insurance, knowledgable agents are likely to be current on known and emerging risks, what coverage is needed, and what is the most cost-effective. If cyber insurance advertising, like auto insurance advertising, is likely to emphasize costs and superior service, an experienced agent is in a better position to evaluate underwriting risks, the performance service record over time, and to tailor coverage to the needs of individual businesses and organizations.

Cyber attacks and cyber insurance are in a special category. If the temptation is to focus on the insurance aspect, in reality, cyber attacks have been so frequent and so devastating, that protection has become a shared societal responsibility. Federal agencies and the Department of Homeland Security are monitoring cyber space, private cyber firms are providing software protection, while news organizations are likely to immediately report the latest breach. Businesses are likely to be warned by the FBI of the potential for attacks and any organization which falls victim to a ransomware attack is likely to be visited by an FBI agent.

Insurance companies and their agents, like everyone else, read the news, and are well aware of the latest attacks. It will not be long before information about any attack will be known. While it may not be immediate, this information will work its way into discussions about cyber insurance, and eventually, into policy provisions and terms. Insurance agents working in the cyber area are likely to be familiar with both current and proposed policy terms and changes. For that reason they will be in a position to make recommendations. In addition, they are likely to be aware of evolving liability areas or changes in the risk level associated with various types of activities. Reputational risk, the damage to a company's image or reputation, as a result of a cyber breach or attack, is a relatively new area. Privacy considerations, along with the disclosure of confidential information, has received more attention recentrly. Another new area is copyright infringement assoicated with the use of artificial intelligence (AI) which involves claims that AI agents have used copyrighted materials to train their program.

Compliance Responsibilities - What can insurance policies require?

Nearly all fire insurance policies are likely to require a working fire suppression system. It should be noted that the technology involved in fire suppression systems has changed. Fire suppression systems which rely on water pose the risk of damaging expensive computer equipment. In large data centers, fire suppression systems have switched to dry pipe systems which make use of pressurized air or nitogen instead of water for fire suppression. The cyber insurance sector has its own corresponding requirements. Are these hard and fast requirements or are they subject to negotiation? Should an insurance company be required to pay for a claim, if an organization or owner, fails, or refuses, to make recommended changes?

Some insurance trends are reducing the likelihood of a Hadley v. Baxendale notification error or misunderstanding. Insurers are trying to anticipate potential policy problems by looking for areas of undiscovered threats. Before cyber policies will be issued, vulnerabity and risk analysis in some form, will be done for an applicant company. In some cases, recommendations will be made for changes. If the level of vulnerability is so high, in other cases, an organization may be refused coverage.

A number of years ago, there was a sense that security was sufficient if an anti-virus software had been installed, and a pen (penetration) test was done maybe once a year. A pen test usually involves hiring a specialist to try to break into a system. It would often reveal vulnerabilities, depending on how easy or difficult it was for the pen tester to break into the system. Now, the advances in attack and defense capabilities have improved to a level where monitoring and testing must be continuous. In addition, the potential areas of vulnerability have increased expontially, with the increased reliance on remote work and the use of mobile devices.

While there are many disputes between insurance companies and their insured related to claims, it is almost universally understood that one of the basic duties of an insured is to pay the premium in order to retain coverage. Beyond that, there are other requirements. An auto owner must maintain a safe vehicle. Failure to repair or replace an unsafe braking system may be grounds for denial of coverage, even if a policy is in effect. In the cyber insurance area, the insurance company may require that certain security measures be required. In reality, businesses must contend with other priorities. They may promise to make needed upgrades, but then decide to put them off when they look at the cost. Their IT department may start to make changes but then find management wanting them to work on other things.

One solution is to wait until there is a breach and then to litigate the terms of the insurance policy. That solution is both risky and costly. On the other hand, the insurance company may step in before there is a breach, and require that an organization take steps to improve security, or the insurance company will cancel the policy. One problem with that approach is measuring or quanti fying compliance. One solution may be to impose a deadline for compliance. Another is to require a company to hire an external security firm or individual to take measures to upgrade security. With the availability of experienced security personnel, it may be relatively cheap to create a new staff position. For the company, another alternative is to not carry insurance. The company will assume the entire risk of a breach, although it may calculate that it can absorb the costs itself. The assumption is that it is aware of all the costs which may be involved and knows all the risks. That can be very risky.

Cyber Damages - What kinds are there?

Some damages from a cyber breach or attack, are known or easily understood and expected. Others are more abstract, not frequently encountered, and therefore unfamiliar. They can be quantified, although it may take some time to gather the information and re-do the formulas and calculations. There are the costs of equipment, such as computers or equipment, which may have to be repaired or replaced, depending on the damage. One problem with the calculation is whether the cost should be what the original cost was, or whether the cost should be for necessary security upgrades. Another predictable cost is related to the repairs involved in damage to the system. But that can involve different variables. Can the software be restored as it was, or does it need to be replaced? Does the system hardware need to upgraded? How much will the cost be for an experienced security expert?

The use of malware and ransomware introduced a new cost element. Attackers continued to spy and destroy, but they began to encrypt data and demand ransom. Ridding a system of bad files was a cost of its own. In addition, there was the cost of ransom payments, if they were paid, as well as the calculation of how much they might be, before they occurred. The cost of recovering or re-creating stored data, if it was destroyed, was a related cost. Contingency planning for disasters was not new, but it took on a greater sense of urgency. Did businesses have a plan to move operations and staff to a different location? Could they continue operations at a different location? Should they build a back-up facility, or wait until they needed one? What costs would be involved under either plan? How long would a computer system be down? Would a business lose customers if operations were disrupted? Were there plans if suppliers went out of business?

In addition to the, more or less, traditional threats and costs, there were other risk elements, such as privacy and condidentiality-related costs. Stolen customer credit card or health information was one such area. Restoring the reputational damage done to a brand by a breach was another. Another new area of risk was regulatory risk. What would be the cost of possible regulatory changes required by government agencies? If new cyber attacks became so severe that an agency decided it had to impose new regulations, how would that risk be calculate?

Reinsurance - spreading the risk

Understanding insurance policies and the types of policies is difficult enough. Some people may have encountered the use of double coverage, where there is a primary or secondary insurer. The primary insurer will likely be responsible for most coverage, but there may be limits to that coverage, in which case the secondary insurer will cover the remainder. Sometimes this results in a dispute over which company is the primary insurer and which is the secondary insurer. There is another insurance market, which is almost invisible to ordinary consumers - reinsurance. It mostly involves extraordinarily large liability claims, such as those in commercial shipping or large natural disasters, such as fires or hurricanes. If insurance companies decide the potential claims are too large to handle, they may seek partners or, in essence, buy their own insurance. Insurance companies, with sufficient assets, may agree to insure part or all of the risk which the primary insurer is unable or unwilling to cover. It may be helpful to be aware that it exists, although smaller businesses and organizations, are unlikely to encounter it in their insurance dealings, since it is primarily a market available only to insurance companies.

Reading the fine print

While many insurance topics require an understanding of the insurance market, there are some areas which are understandable, and necessary. What is covered by a cyber insurance policy requires some understanding, explanation, and sometimes negotiation. Other areas are less obscure. Before an insurance company will issue a policy, whether for general insurance, or cyber insurance, it will require an inventory. In the cyber area, it will need to know how many computers are included, how many are working, and how many will need to be replaced. It is also going to require information about the system, such as how many computers are on site, and how many are connected remotely. This may be done by the IT staff, although it is also likely to require verification, with possibly an outside expert putting together the report itself or doing the review. The possibility of fraud, even at an application stage, is something insurance companies will be aware of, so they will take steps to ensure that submissions are accurate.

One area where the purchaser will be responsible is related to some of the non-insurance details. The purchaser needs to look at the address and physical location named in the policy. If it is insuring computers and equipment at a location in Los Angeles and the policy lists the location as Omaha, Nebraska, the policy needs to be corrected. Similarly, if the policy states that the policy limits are $5,000 in total, when the agreement is for $1,000,000, then that correction needs to be made. More generally, if it looks like the policy issued is for life insurance or fire insurance rather than cyber insurance, that needs to be reviewed.

Business owners do not necessarily have to be experts in every facet of a business. To manage a factory, it may not be necessary to understand how to repair equipment or to install a fire protection system. For insurance, they may not need to know enough to write a policy. They should be able to rely on the advice of an experienced insurance agent. At the same time, they should be aware of the limitations of their own knowledge and know when they need to hire an insurance specialist or have a specialist do a review.