The Insurance Coverage Law Information Center

Transcription

1 The following article is from National Underwriter s latest online resource, FC&S Legal: The Insurance Coverage Law Information Center. The Insurance Coverage Law Information Center VIRUSES, TROJANS AND SPYWARE, OH MY! THE YELLOW BRICK ROAD TO COVERAGE IN THE LAND OF INTERNET OZ PART II By Roberta D. Anderson Insurance can play a vital role in a company s overall strategy to address, mitigate and maximize protection against the increasing threat of cyber risk. In Part 2 of this four-part article, the author examines potential coverage for cyber and privacy-related risks under general liability insurance policies. Part 3 will examine potential coverage under property and other common types of traditional insurance policies. Part 4 will examine the types of coverages available under revolutionary new cyber insurance products. While some companies carry specialty insurance policies that are specifically designed to afford coverage for cyber risk, most companies have various forms of traditional insurance policies that may cover cyber risks, including commercial general liability ( CGL ), commercial property/business interruption, directors and officers, errors and omissions, professional liability, fiduciary, crime and other policies. Although insurers typically argue that cyber risks are not intended to be covered under CGL policies or other traditional types of insurance coverages, insureds pursuing coverage under CGL policies have met with some, albeit not universal, success in obtaining coverage for certain types of cyber risks. Coverage in a particular case necessarily will depend on the specific facts of each case, the terms, conditions and exclusions of each individual policy, and the applicable law. A brewing legal dispute between Sony and one of its insurers concerning the PlayStation Network data breach highlights the challenges that companies can face in getting insurance companies to cover losses arising from cyber risks under CGL policies. In Zurich American Insurance Co., et al. vs. Sony Corp. of America, et al., 1 the insurer seeks a declaration that there is no coverage under the CGL policies at issue on the basis that the underlying lawsuits arising from hacker attacks that resulted in unauthorized access to and theft of personal identification and financial information do not assert claims for bodily injury, property damage or personal and advertising injury. 2 The Sony coverage case may provide additional guidance on the scope of coverage for data breaches and other cyber risks under traditional CGL policies. In the meantime, the current case law is instructive. Claims Alleging Damage to, or Loss of Use of, Third-Party Data, Computers or Computer Systems Claims alleging damage to third-party data, computers, and systems may be available under the Bodily Injury And Property Damage section of the standard Insurance Services Office, Inc. ( ISO ) 3 CGL policy form, which states that the insurer will pay those sums that the insured becomes legally obligated to pay as damages because of property damage that occurs during the policy period. 4 In addition to providing indemnity coverage, the standard form states that the insurer will have the right and duty to defend the insured against any suit seeking potentially covered damage. 5 For many years, the ISO standard form has defined property damage to include [p]hysical injury to tangible property, including all resulting loss of use of that property and [l]oss of use of tangible property that is not physically injured. 6 One major issue in cases alleging lost or damaged data, software, computers, or computer systems is whether the definition of property damage is satisfied. A standard form definition of property damage includes both (1) [p] hysical injury to tangible property, including all resulting loss of use of that property ; and (2) [l]oss of use of tangible property that is not physically injured. 7 Insurers typically argue that data is not tangible property that can suffer physical injury and, therefore, cannot satisfy the definition of property damage. However, a number of courts have

2 held that damaged or corrupted software or data is tangible property that can suffer physical injury and have upheld coverage on this basis. For example, the Minnesota intermediate appellate court determined that a computer tape and data were tangible property in Retail Systems, Inc. v. CNA Insurance Co. 8 In that case, the claimant filed suit against the insured, a data processing consultant, seeking damages allegedly suffered as a result of the loss of a computer tape and its data, which had disappeared during remodeling of the insured s computer room. 9 The insured tendered the claim to its insurer, which denied coverage. The court considered the following question on appeal: Did the trial court err by finding that the computer tape and data were tangible property? 10 Finding no precedent in Minnesota or elsewhere concerning whether computer tapes and data are tangible property under an insurance policy, 11 the court concluded that [a]t best, the policy s requirement that only tangible property is covered is ambiguous and, therefore, the language must be construed in favor of the insured. 12 Therefore, the court upheld the trial court s finding that the computer tape and data were tangible property under the insurance policy. 13 In reaching its decision, the court found it significant that [t]he data on [a] tape was of permanent value and was integrated completely with the physical property of the tape. 14 Other decisions likewise support an argument that data is tangible property, 15 including decisions considering the issue in the first-party property context. 16 The decisions are not uniform, however, and a number of decisions have held that computer data is not tangible property and therefore is not susceptible to property damage. 17 A leading insurance law authority notes that the issue as to whether computerized information is tangible property has not been satisfactorily resolved. 18 Under the law of many states, however, this fact alone would militate in favor of a finding of coverage. 19 Even where a court determines that data itself is not tangible property that can suffer physical injury, there should be coverage for claims alleging damage to or loss of use of computers and system components under the second prong b of the definition of property damage. 20 The Western District of Oklahoma s decision in State Auto Property & Casualty Insurance Co. v. Midwest Computers & More 21 is instructive. In that case, the claimants brought a lawsuit alleging that the insured s negligent performance of service work on their computer system had deprived [them] of the use of their computers, and that the claimants lost extensive amounts of appraisal data and other business information which was [sic] stored on their computer system. 22 The insured sought defense and the insurer brought an action seeking a declaration that it has no duty to indemnify or defend its insured. 23 Although the court would have conclude[d] that computer data is intangible, not tangible, personal property, 24 the court noted that this is not dispositive in view of the second part of the policy s definition of [property damage], which includes loss of use of tangible property. 25 The court concluded that the allegation of loss of use of the claimant s computers was clearly property damage as defined in the policy: The [claimants] plainly allege in their state court petition that defendant s negligence caused a loss of use of their computers. Because a computer clearly is tangible property, an alleged loss of use of computers constitutes property damage within the meaning of plaintiff s policy. 26 There may be coverage, therefore, in data breach cases where the claimants allege loss of use. This issue may be considered in the Sony data breach insurance coverage litigation, since at least one of the class action complaints alleges loss of use of PlayStation consoles: Plaintiffs seek damages to compensate themselves and the Class for their loss (both temporary and permanent) of use of their PlayStation consoles and the PlayStation Network and Qriocity services (collectively referred to herein as PSN service), and their time and effort spent attempting to protect their privacy, identities and financial information. 27 Indeed, Zurich, one of Sony s insurers, has expressly recognized that liability insurance policies may provide coverage in the event of a data security breach: Security breaches via hacking, phishing, pharming, unauthorized internal access and the inadvertent disclosure of non-public personal information are all circumstances that can lead to legal exposure. Potential causes of action resulting from data security breaches may include increased risk of identity theft, actual or attempted identity theft, violation of consumer protection statutes, negligence, breach of contract, breach of fiduciary duty and even fraud. A company s standard property and casualty insurance policies may provide some coverage in the event of a data security breach, but specialized cyberliability coverages may be worth exploring and evaluating. 28

3 In addition to the question of whether data is tangible, another potential hurdle for insureds is that the current ISO standard-form policy, and other ISO standard-form policies effective on or after December 1, 2001, expressly exclude electronic data from the definition of property damage. 29 In addition, ISO standard-form policies effective on or after December 1, 2004 expressly exclude [d]amages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data. 30 Electronic data is defined as follows: As used in this exclusion, electronic data means information, facts or programs stored as or on, created or used on, or transmitted to or from computer software, including systems and applications software, hard or floppy disks, CDROMs, tapes, drives, cells, data processing devices or any other media which are used with electronically controlled equipment. Courts generally have upheld such limitations and exclusions. 31 It is important to recognize that data limitations and exclusions may not vitiate coverage, however. Coverage may have been added back through endorsement. For example, the ISO Electronic Data Liability Endorsement adds electronic data back to the definition of property damage 32 Coverage also may have been purchased through the ISO Electronic Data Liability Coverage Form, 33 under which the insurer pays those sums that the insured becomes legally obligated to pay as damages because of loss of electronic data that [i]s caused by an electronic data incident[.] 34 Standard form ISO policies written or effective on or before December 1, 2001, moreover, do not except electronic data from the definition of property damage 35 and do not exclude electronic data. And even recently issued policies may not contain such exceptions or exclusions. One might reasonably presume, for example, that the Zurich policies in the Sony PlayStation coverage litigation, which as alleged were effective for the policy period beginning April 1, 2011, 36 do not contain any express exceptions or exclusions none are raised in Zurich s complaint. 37 Even where a policy contains an express electronic data exclusion, moreover, there should be coverage if a cyber attack causes physical damage to or loss of use of computers or computer systems. For example, the Eighth Circuit in Eyeblaster, Inc. v. Federal Insurance Co. 38 held that an insurer had a duty to defend a complaint alleging injury to the plaintiff s computer, software, and data after he visited [the insured s] website. 39 The plaintiff alleged that his computer was infected with a spyware program from [the insured] on July 14, 2006, which caused his computer to immediately freeze up and that he lost all data on a tax return on which he was working and that he incurred many thousands of dollars of loss. 40 The plaintiff further alleged that he ha[d] experienced the following: numerous pop-up ads; a hijacked browser that communicates with websites other than those directed by the operator; random error messages; slowed computer performance that sometimes results in crashes; and ads oriented toward his past web viewing habits. 41 The insured s CGL policy obligated the insurer to provide coverage for property damage caused by a covered occurrence. 42 Property damage was defined in the policy at issue as physical injury to tangible property, including resulting loss of use of that property...; or loss of use of tangible property that is not physically injured. 43 The definition of tangible property excluded any software, data or other information that is in electronic form. 44 Notwithstanding the exclusion, the court held that the insurer was obligated to defend the insured because the complaint alleged loss of use of tangible property that is not physically injured under the second prong of the property damage definition: [The insured] points to language from the [claimant s] complaint in which he alleges his computer was taken over and could not operate, froze up, and would stop running or operate so slowly that it will in essence become inoperable. [The claimant] also alleges that he experienced a hijacked browser-a browser program that communicates with websites other than those directed by the operator, and slowed computer performance, sometimes resulting in crashes. [The claimant] asserts that his computer has three years of client tax returns that he cannot transfer because he believes the spyware files would also be transferred, and he therefore must reconstruct those records on a new computer. He thus argues that his computer is no longer usable, as he claims among his losses the cost of his existing computer. [The insurer] did not include a definition of tangible property in its General Liability policy, except to exclude software, data or other information that is in electronic form. The plain meaning of tangible property includes computers, and the [underlying] complaint alleges repeatedly the loss of use of his computer. We conclude that the allegations are within the scope of the General Liability policy. 45

4 Other common policy exclusions, such as the your work, 46 impaired property 47 or intentional act 48 exclusion may apply, however, and it is important to recognize that resolution of each claim will depend upon the specific facts of such claim, the specific policy language at issue, 49 and applicable law. As claims increase, we can expect to see more courts addressing whether such claims raise sufficient issues to at least trigger a defense obligation under the CGL Coverage A. Claims Alleging Bodily Injury The main coverage part of the current standard form ISO CGL policy form states that the insurer will pay those sums that the insured becomes legally obligated to pay as damages because of bodily injury 50 that occurs during the policy period. 51 There is little if any case law to date that addresses whether claims arising from data breaches or other cyber risks allege bodily injury, which is defined in the current ISO CGL policy as bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time. 52 This potential source of coverage for data breach claims should not be overlooked, however, as case law may support an argument that bodily injury as defined in the policy includes emotional harm. In addition, the specific policy at issue may contain a broadened definition of bodily injury that expressly extends to emotional harm. 53 Depending on the policy language and applicable law, there may be coverage for data breach cases. For example, one of the class action complaints filed against Sony arising out of the 2011 high-profile attack on the Sony PlayStation Network alleges the following injuries: Defendant has failed to provide regular credit reports and credit monitoring at their own expense to those whose private data was exposed and left vulnerable. This has caused, and continues to cause, millions of consumers fear, apprehension, and damages including extra time. effort, and costs for credit monitoring, and extra time, effort, and costs associated with replacing cards and account numbers, and burden, and is harming both consumers and merchants ability to protect themselves from such fraud. This lawsuit seeks to remedy this reprehensible situation. 54 It warrants mention that, as part of its April 2013 revisions to the CGL policy forms, including the main forms and the ISO Electronic Data Liability Endorsement, ISO has clarified that the electronic data exclusion does not apply to liability for damages because of bodily injury. 55 ISO has characterized this as a broadening of coverage 56 and has stated that its intention with this change is to confirm that there should be coverage if the loss of use of data or the inability to access it leads to bodily injury. However, the 2007 and later ISO forms contain an exclusion for privacy-related laws, which is applicable to Coverage A. 57 The current standard form, which became effective in most states in April 2013, contains an updated version of this exclusion, which states that [t]his insurance does not apply to Bodily injury or property damage arising directly or indirectly out of any action or omission that violates or is alleged to violate [a]ny federal, state or local statute, ordinance or regulation. That addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information. 58 Very recently, ISO filed a number of data breach exclusionary endorsements for use with its standard-form primary, excess and umbrella CGL policies. These are to become effective in May By way of example, one of the endorsements, entitled Exclusion - Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability - Limited Bodily Injury Exception Not Included, modifies the electronic data exclusion 59 to state that [t]his insurance does not apply to : Damages arising out of: (1) Any access to or disclosure of any person s or organization s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information; or (2) The loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data. This exclusion applies even if damages are claimed for notification costs, credit monitoring expenses, forensic expenses, public relations expenses or any other loss, cost or expense incurred by you or others arising out of that which is described in Paragraph (1) or (2) above. 60

5 ISO states that when this endorsement is attached, it will result in a reduction of coverage due to the deletion of an exception with respect to damages because of bodily injury arising out of loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data. 61 Claims Alleging Publication That Violates a Right of Privacy The Personal And Advertising Injury Liability coverage section of the current standard-form ISO CGL policy 62 states that the insurer will pay those sums that the insured becomes legally obligated to pay as damages because of personal and advertising injury, 63 which is caused by an offense arising out of [the insured s] business. 64 Personal and advertising injury is defined in the ISO standard form policy to include a list of specifically enumerated offenses, 65 which include the offense of [o]ral or written publication, in any manner, of material that violates a person s right of privacy. 66 Similar to Coverage A, the policy further states that the insurer will have the right and duty to defend the insured against any suit. 67 The CGL Coverage B can indemnify and provide a defense against a wide variety of claims, including claims alleging violation of privacy rights, including data breach cases. For example, in Tamm v. Hartford Fire Insurance Co., 68 the Superior Court of Massachusetts confirmed that the insurer had a duty to defend a lawsuit alleging, inter alia, that the insured had access[ed] and distribut[ed] information obtained in private accounts and threatened to contact a list of specific addresses for individuals. 69 The underlying lawsuit set out ten counts against the insured, including violations of RICO, misappropriation of trade secrets, and violations of Federal wiretapping laws and requested that the court restrain [the insured] from disclosing to any person or entity, or using in any other manner, any confidential or proprietary information or materials belonging to or wrongfully acquired from [the plaintiff] or its officers, directors, employees, attorneys, or agents. 70 Based on the complaint, the court easily concluded that the insurer had a duty to defend under the standard insurance policy language at issue: In order to trigger the duty to defend under the invasion of privacy language of the policy, an underlying complaint must allege two things: (1) an oral or written publication of (2) materials that violate person s rights of privacy. The [underlying] complaint alleges that [the insured] accessed the private accounts of [the plaintiff] and its executives and sent these private communications and materials to several outside counsel for [the plaintiff]. The allegations of sending these private communications via to outside attorneys seemingly satisfies both prongs under the invasion of privacy clause of the policy. 71 Potential issues arising under Coverage B include whether there has been a publication that violates the claimant s right of privacy both terms are left undefined in standard-form ISO policies. These requirements have been addressed in a number of decisions considering underlying claims alleging improper use of credit reports in violation of the Fair Credit Reporting Act ( FCRA ). Many of these decisions have construed these terms in favor of the insured. For example, Pietras v. Sentry Insurance Co. 72 is instructive. In Pietras, the class plaintiff alleged that the insured had accessed [hers] and other class members credit information without authorization or a permissible purpose under the FCRA 73 by mailing her a solicitation stating that she had been pre-approved for an auto loan, but without making a firm offer of credit. 74 The court rejected the insurer s claim that the insured s alleged acts did not involve [plaintiff s] private information or publication of such information. 75 Considering first the right of privacy requirement, the Northern District of Illinois found that this requirement was satisfied under controlling precedent in Valley Forge Ins. Co. v. Swiderski Electronics, Inc.: 76 Based on the FCRA (upon which the class action complaint is based) and the allegations in the class action complaint, it is difficult to see how the complaint does not allege invasions of privacy that triggered the insurer s duty to defend [the insured] ***** The Valley Forge court concluded, based on standard dictionary definitions, that the plain meaning of right of privacy connotes both an interest in seclusion and an interest in secrecy of personal information. Therefore, even if the [alleged] solicitations did not contain personal credit information, they still implicated the consumers right to privacy protected by the FCRA-the right not to receive credit solicitations sent without a permissible purpose. 77 Turning to the publication requirement, the court found that this requirement was satisfied by publication to only one person:

6 The advertising injury provision of the Sentry policy also requires oral or written publication before coverage is triggered.valley Forge expressly holds that publication in a policy providing coverage for advertising injury includes communication to as few as one person, thereby resulting in coverage for violations of a statute invoking privacy interests, such as the FCRA. 78 The court concluded that the FCRA allegations in the underlying complaint fall within the advertising injury provision in the [insurance] policy and, therefore, [the insurer] had a duty to provide [the insured] a defense. 79 To the same effect is Zurich American Ins. Co. v. Fieldstone Mortgage Co. 80 The class plaintiff in Fieldstone Mortgage alleged that the insured had improperly accessed and used his and others credit information, violating FCRA s requirement that access be either consented to or for a permissible purpose by sending prescreened offers from [the insured, Fieldstone] to refinance his mortgage. 81 The plaintiff alleged that the prescreening was based on information contained in his consumer credit report, which was accessed without his consent and without a permissible purpose under FCRA (such as the extension of a firm offer of credit). 82 The court first rejected the insurer s argument that FCRA does not establish a right of privacy recognized by the policies. 83 The court also rejected the argument that in order to constitute a publication, the information that violates the right to privacy must be divulged to a third party. 84 The court noted that [o]f the circuits to examine publication in the context of an advertising injury provision, the majority have found that the publication need not be to a third party. 85 The right of privacy and publication requirements also have been considered in connection with underlying claims alleging violations of the Telephone Consumer Protection Act ( TCPA ), which bans unsolicited fax advertisements. The Tenth Circuit s decision in Park University Enterprises, Inc. v. American Cas. Co. Of Reading, PA 86 is instructive. In that case, the class plaintiff alleged that the insured violated the TCPA when it sent an advertisement to [its] telephone fax machine in Illinois without prior express invitation or permission. 87 The Tenth Circuit rejected the insurer s attempt to ascribe narrow meaning to the undefined terms privacy and publication : As noted above, the court correctly determined that in layman s terms, [t]he plain and ordinary meaning of privacy includes the right to be left alone. Certainly, the insurer could impose a more restrictive, technical and legal definition to the term privacy following that of the classic tort of invasion of secrecy interests or defamation. ***** We likewise agree with the district court s broad construction of the term publication in favor of [the insured]. Reading the terms in the policy from the vantage point of the insured, rather than an insurer or lawyer it is entirely reasonable to define publication as making something generally known. By faxing advertisements to the class of plaintiffs as alleged in the underlying state court complaint, [the insured] effectively published material in this broader sense, i.e., communicated information generally, which undermined the recipients rights to be left alone. 88 The court concluded that the insurer had a duty to defend the insured in the TCPA action. 89 To the same effect is Penzer v. Transportation Ins. Co., 90 in which the Supreme Court of Florida answered the following question certified by the Eleventh Circuit: Does a commercial Liability Policy Which Provides Coverage for Advertising Injury, Defined as Injury Arising out of... Oral or Written Publication of Material That Violates a Person s Right of Privacy, Such as the Policy Described Here, Provide Coverage for Damages for Violation of a Law Prohibiting Using Any Telephone Facsimile Machine to Send Unsolicited Advertisement to a Telephone Facsimile Machine When No Private Information is Revealed in the Facsimile? 91 Penzer involved a class action suit alleging that the class claimants received unsolicited facsimile commercial advertisements in violation of the TCPA. 92 The insurer denied coverage on the basis that oral or written publication of material that violates a person s right of privacy provides coverage only for injuries to privacy rights caused by the content of the material and coverage exists only when private matters about one person are communicated to another person. 93 The court first found the right of privacy requirement satisfied by the TCPA, which provides the privacy right to seclusion, and the class allegations:

7 In this case, the source of the right of privacy is the TCPA, which provides the privacy right to seclusion. The facts of the instant case demonstrate that there was a written dissemination of 24,000 facsimiles that violated the TCPA. Comparing the policy s language to [the facts of this case]: there was a written publication [dissemination] of material [of 24,000 facsimiles] that violated a person s right of privacy [that violated the TCPA]. Therefore, applying our plain meaning analysis, we hold that Transportation s insurance policy provides coverage for sending unsolicited fax advertisements in violation of the TCPA. 94 The court then found the publication requirement satisfied, rejecting the insurer s argument that the violation [of the right to privacy] must arise from the content of the material in order to trigger coverage : [W]e find that the clause that violates a person s right of privacy is applicable as much to publication as to material; therefore, the clause should be read as applicable to all. Accordingly, we reject Transportation s assertion that the violation must arise from the content of the material in order to trigger coverage. Furthermore, even if the phrase that violates a person s right of privacy only modifies the term material, it does not follow that only the secrecy right to privacy is implicated because material could also invade one s seclusion. 95 Based on its findings, the Supreme Court of Florida answered the certified question in the affirmative: Based upon our plain meaning analysis, we hold that an advertising injury provision in a commercial liability policy that provides coverage for an oral or written publication of material that violates a person s right of privacy provides coverage for blast-faxing in violation of the TCPA. We therefore answer the certified question in the affirmative. 96 In a very recent August 2013 decision, the Supreme Court of Missouri likewise upheld coverage for violations of the TCPA in Columbia Cas. Co. v. HIAR Holding, L.L.C. 97 In that case, the insurer refused to defend or indemnify an action alleging that its insured, a hotel proprietor, violated the TCPA by send[ing] approximately 12,500 unsolicited advertising facsimiles junk faxes to recipients in the 314 and 636 area codes in October The insured defended the suit at its own expense and, after the insurer rejected an offer to settle within the $1 million per occurrence insurance limits, ultimately agreed to a class-wide settlement for $5 million in January Insurance coverage litigation ensued and the trial court entered judgment against the insurer for the full settlement plus interest. 100 In addition to rejecting the insurer s argument that TCPA damages are not covered because they are penal in nature, 101 the court rejected the insurer s argument that the advertising injury coverage is limited to privacy violation claims that allege violations arising out of the content of the advertising material itself and that the privacy language in its policy is not a reference to protecting seclusion rights guarded by the TCPA : These privacy rights arguments are not persuasive in establishing that the trial court erred in determining that advertising injury coverage was invoked in this case. The class s claims alleged privacy rights violations pursuant to the TCPA, which has been recognized as providing privacy protections. [A] reasonable interpretation of HIAR s policy can include that coverage is available for the privacy rights claims of the class. 102 The court also rejected the insurer s claim that there was not coverage because coverage is intended for a private person and not for an incorporeal interest, finding that the TCPA includes privacy rights for businesses and persons. 103 The court concluded that the trial court did not err in determining that property damage and advertising injury coverage was invoked and triggered Columbia s duty to defend [the insured]. 104 Courts have upheld coverage for privacy-related claims in a variety of other settings, 105 although the decisions are not uniform. 106 It is important to note that policy language may vary, and the policy language at issue will control, together with the specific facts of the case and applicable law. In the cyber software context, the Ninth Circuit upheld coverage in Netscape Communications Corp. v. Federal Insurance Co. under language different from the current standard form Coverage B language. 107 In that case, the underlying claimants alleged that the insured s SmartDownload [software] violated the claimants privacy by, among other things, collecting, storing, and disclosing to Plaintiffs and their engineers claimants Internet usage. 108 The insured used this information to create profiles of its users, both to help with technical support, and additionally, to create opportunities for targeted advertising. 109 The claimants alleged that the use of the feature violated the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. 110 The insurance policy obligated the insurer to pay amounts [the insured] is legally required to pay as damages for covered personal injury that is caused by a personal injury offense, which was defined to include the offense of [m] aking known to any person or organization written or spoken material that violates a person s right to privacy. 111 The

8 district court held that the insurer had a duty to defend, reasoning that when [the insured] received information from SmartDownload, it was making it known to AOL by transmitting it to its parent company. Similarly, individual [insured] employees made the information known to each other by circulating files among themselves with the information gained from SmartDownload. 112 The Ninth Circuit affirmed that the district court correctly determined that the claims against [the insured] were personal injury offenses and within the policy s coverage. 113 The Ninth Circuit dismissed as dicta cases stating that coverage is triggered by a disclosure to a third party. 114 The publication and right of privacy requirements may soon be addressed in connection with the Sony PlayStation insurance coverage litigation. One of the issues in that case involves whether Coverage B is triggered. In its recent motion for partial summary judgment, Sony argues that the claims alleged fall within the scope of coverage afforded under the personal and advertising injury coverage: The MDL Amended Complaint, which is currently the operative complaint in the underlying litigation, alleges that plaintiffs suffered the loss of privacy as the result of the improper disclosure of their Personal Information --- defined as sensitive personal and financial information that includes customer names, mailing addresses, addresses, and birth dates, as well as credit and debit card numbers, expiration dates, and security codes, online network passwords, login credentials, answers to security questions, and other personal information. This kind of information has been held to constitute material that violates a person s right of privacy. ***** For purposes of triggering Personal Injury Coverage, disclosure to a small group of people or a single person is sufficient. In addition, courts have recognized that publication can occur when someone gains unauthorized access to information, even in the absence of an overt act of disclosure. Here, the Data Privacy Litigation includes allegations that the plaintiffs sensitive personal and financial information was placed... in the hands of cyber criminals. 115 As with Coverage A, there may be coverage hurdles under Coverage B. ISO standard form policies written or effective on or after December 1, 2001, for example, contain several exclusions relating to internet-related activities. 116 In addition, as noted above, the 2007 and later ISO forms contain an exclusion for privacy-related laws, including the TCPA, which is applicable to Coverage B. 117 The current 2013 industry form also includes violations of the FCRA and [a] ny federal, state or local statute, ordinance or regulation that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information. 118 The current form states that [t]his insurance does not apply to : p. Recording And Distribution Of Material Or Information In Violation Of Law Personal and advertising injury arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA), including any amendment of or addition to such law; (2) The CAN-SPAM Act of 2003, including any amendment of or addition to such law; (3) The Fair Credit Reporting Act (FCRA), and any amendment of or addition to such law, including the Fair and Accurate Credit Transactions Act (FACTA); or (4) Any federal, state or local statute, ordinance or regulation, other than the TCPA, CAN-SPAM Act of 2003 or FCRA and their amendments and additions, that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information. 119 Insurers have raised this exclusion in recent privacy breach cases. 120 In addition the exclusion pertaining to insureds whose business is [a]n Internet search, access, content or service provider 121 is currently at issue in the Sony PlayStation data breach coverage litigation. 122 More sweepingly, as part of its April 2013 revisions to the CGL policy forms, ISO introduced a new endorsement, entitled Amendment Of Personal And Advertising Injury Definition, which entirely eliminates the key offense of [o]ral or written publication, in any manner, of material that violates a person s right of privacy (found at Paragraph 14.e of the Definitions section of Coverage B). 123

9 And most recently, as noted above, ISO has filed a number of data breach exclusionary endorsements for use with its standard-form primary, excess and umbrella CGL policies. By way of example, one of the endorsements, entitled Exclusion - Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability - With Limited Bodily Injury Exception, adds exclusionary language to Coverage B, which states that that [t]his insurance does not apply to : Personal and advertising injury arising out of any access to or disclosure of any person s or organization s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of non public information. This exclusion applies even if damages are claimed for notification costs, credit monitoring expenses, forensic expenses, public relations expenses or any other loss, cost or expense incurred by you or others arising out of any access to or disclosure of any person s or organization s confidential or personal information. 124 ISO states that [t]o the extent that any access or disclosure of confidential or personal information results in an oral or written publication that violates a person s right of privacy, this revision may be considered a reduction in personal and advertising injury coverage. 125 While acknowledging that coverage for data breaches is currently available under its standard forms, ISO explains that [a]t the time the ISO CGL and [umbrella] policies were developed, certain hacking activities or data breaches were not prevalent and, therefore, coverages related to the access to or disclosure of personal or confidential information and associated with such events were not necessarily contemplated under the policy. 126 The scope of this exclusion ultimately will be determined by judicial review. It must be emphasized that the specific policy language at issue will control. Even where a primary policy contains these newer exclusions, moreover, excess policies may provider broader coverage. The Southern District of Ohio s recent July 2013 decision in Encore Receivable Management, Inc. v. Ace Property and Cas. Ins. Co. 127 is instructive. In that case, the insureds faced two lawsuits, both alleging that the defendants recorded various telephone conversations without consent. 128 The primary insurance policies contained the Recording and Distribution of Material or Information in Violation of Law Exclusion language contained in the 2007 and later ISO forms. 129 The insureds contended that this exclusion excludes coverage for the [underlying actions] because they constitute claims arising from the recording of information in violation of law and therefore, their excess insurer ha[d] an immediate duty to defend the underlying actions. 130 The excess policies stated that the insurer had a duty to defend [w]hen damages sought for... personal and advertising injury are not covered by underlying insurance. 131 The excess policies did not contain the Recording and Distribution of Material or Information in Violation of Law exclusion. 132 However, the excess insurer denied coverage on the basis that there was no publication because there was no distribution of information to the public at large. 133 According to the insurer, publication, as that term is used in the [insurance policies] requires the distribution of information or news to the public. 134 The insurer further argued that eavesdropping is not an act of communication to the public, but rather an invasion of seclusion accomplished by a non-communicative act. 135 The court rejected this argument, finding that the initial dissemination of the conversation constitutes a publication at the very moment that the conversation is disseminated or transmitted to the recording device and, therefore, the court did not need to find that the recordings were disseminated to the public in order to find publication. 136 The conceded applicability of the exclusion in the primary policies notwithstanding, therefore, the court concluded that the insurer ha[d] an immediate duty to defend, and pay the costs of defending the underling actions. 137 Claims Alleging Use of an Advertising Idea or Infringement in the Insured s Advertisement The current ISO form definition of personal and advertising injury includes the offenses of [t]he use of another s advertising idea in your advertisement and [i]nfringing upon another s copyright, trade dress or slogan in [the insured s] advertisement. 138 There may be coverage for cyber -related infringement of intellectual property under this standard form language. Although insurers sometimes argue that offenses such as copyright, trade dress or trademark infringement are not covered because the unauthorized use exclusion 139 applies, insureds have met with some success in achieving coverage. The Eleventh Circuit s recent decision in St. Luke s Cataract and Laser Institute, P.A. v. Zurich American Ins. Co. 140 is instructive. In that case, the insured had worked as an oculoplastic surgeon at St. Luke s Cataract and Laser Institute, P.A. ( St. Luke s ) and, while there, worked with a webmaster to create a website to promote St. Luke s oculoplastic surgery practice. The webmaster registered the domain names LASERSPECIALIST.com and LASEREYELID.com to use for the website. 141 Each page of the website contained a copyright notice stating Copyright [Year] St. Luke s Cosmetic Laser

10 Center, All Rights Reserved. 142 After resigning from St. Luke s, the insured relaunched the website using the same domain names. 143 St. Luke s brought suit alleging, among other things, copyright infringement and removal of the copyright notice in violation of the Digital Millennium Copyright Act ( DMCA ). 144 Eventually, the insured and St. Luke s settled for a $2.4 million final judgment against the insured and pursued insurance coverage. 145 The insurers denied coverage, arguing that although the policies may provide coverage for copyright infringement, such claims are not covered when they: Aris[e] out of the unauthorized use of another s name or product in your address, domain name or metatag, or any other similar tactics to mislead another s potential customers. 146 The district court agreed and the insured and St. Luke s appealed. The Eleventh Circuit reversed. Considering first the copyright infringement claim, the court found that the claim was based on wrongful use of the contents, layout, and design of St. Luke s LASERSPECIALIST.com website, which is not the same thing as the use of another s name or product. 147 The court further found that the insured used the content for display on his own website, rather than in an address, domain name or metatag. 148 The court refused to allow the similar tactics language to swallow the narrow language used in the exclusion and turn it into a catch-all exclusion for the use on the internet in any way of material belonging to another. 149 Finally, the court found the requisite causal connection lacking: [n]either the district court nor the Insurance Companies point to any causal connection between [the insured] s copyright infringement and his use of St. Luke s domain name as required by Florida law. St. Luke s copyright claim may be related to but it does not arise out of [the insured] s use of the LASERSPECIALIST.com domain name. 150 Turning to the DMCA claim, the Eleventh Circuit likewise held the exclusion imapplicable: [t]he DMCA violation does not itself constitute either (i) unauthorized use of another s name or product in an address, domain name or metatag, or (ii) a similar tactic to mislead another s customers. Nor can it be said to arise out of such conduct. 151 In addition to the potential applicability of exclusions, coverage disputes and decisions often turn on whether there is an advertisement. The industry standard form has, since 1998, defined advertisement as follows: Advertisement means a notice that is broadcast or published to the general public or specific market segments about your goods, products or services for the purpose of attracting customers or supporters. 152 Since 2001, the standard form has contained the following additional language: For the purposes of this definition: a. Notices that are published include material placed on the Internet or on similar electronic means of communication; and b. Regarding web-sites, only that part of a website that is about your goods, products or services for the purposes of attracting customers or supporters is considered an advertisement. 153 In contrast, the 1996 and prior industry standard forms do not use or define the term advertisement ; rather, they use and define the term advertising injury as follows: 1. Advertising injury means injury arising out of one or more of the following offenses: a. Oral or written publication of material that slanders or libels a person or organization or disparages a person s or organization s goods, products or services; b. Oral or written publication of material that violates a person s right of privacy; c. Misappropriation of advertising ideas or style of doing business; or d. Infringement of copyright, title or slogan. 154 The decisions are mixed and turn on the specific policy language at issue, the particular facts of the case and applicable law. 155

11 (Endnotes) 1. No /2011 (N.Y. Sup. Ct. New York Cty.) (filed July 20, 2011). 2. Complaint at 71. As alleged in the coverage complaint, the underlying lawsuits against Sony do not assert claims for bodily injury, property damage or personal and advertising injury so as to entitle [the insured] to defense and/or indemnity under the insurance policy. Id. The complaint further alleges that [ [e]ven if claims for bodily injury, property damage, and/or personal and advertising injury were alleged the [policy] includes certain exclusions that apply to exclude coverage for the claims asserted in the [underlying] Complaints. Id. 72. In another recently filed suit, Nationwide Mut. Fire Ins. Co. vs. First Citizens Bank and Trust Co. Inc., et al., No. 4:13cv598 (D.S.C.) (filed Mar. 6, 2013), the insurer alleges that it has no duty to defend or indemnify its insureds against claims that a janitor was allowed to access bank customers confidential information, which was kept in the same closet where janitorial supplies were stored. Among other things, Nationwide s complaint states that [t]he alleged damages are not bodily injury or property damage arising from an occurrence or personal injury and advertising injury as defined in the policy. Complaint at 40, 43. This case highlights the point that data breaches need not involve cyber threat. 3. ISO is an insurance industry organization whose role is to develop standard insurance policy forms and to have those forms approved by state insurance commissioners. 4. ISO Form CG (2012), Section I, Coverage A, 1.a., 1.b.(2). ISO s new standard CGL policy forms, including both its occurrence -based form (CG ) and claims-made form (CG ), came into effect on April 1, However, the pertinent insuring language has remained the same for many years. See, e.g., ISO Form CG (1986). 5. ISO Form CG (2012), Section I, Coverage A, 1.a. 6. See, e.g., ISO Form CG (2012), Section V, 17; ISO Form CG (1986), Section V, ISO Form CG (2012), Section V, 17. Property damage is defined in the current form as follows: 17. Property damage means: a. Physical injury to tangible property, including all resulting loss of use of that property. All such loss of use shall be deemed to occur at the time of the physical injury that caused it; or b. Loss of use of tangible property that is not physically injured. All such loss of use shall be deemed to occur at the time of the occurrence that caused it. For the purposes of this insurance, electronic data is not tangible property. As used in this definition, electronic data means information, facts or programs stored as or on, created or used on, or transmitted to or from computer software, including systems and applications software, hard or floppy disks, CD-ROMS, tapes, drives, cells, data processing devices or any other media which are used with electronically controlled equipment. ISO Form CG (2012), Section V, N.W.2d 735 (Minn. Ct. App. 1991). 9. Id. at Id. at Id. 12. Id. 13. Id. at 738. The court also found inapplicable an exclusion for damage to property entrusted to the insured for storage or safekeeping. Id. at Id. Conversely, the court did not find relevant certain property and sales tax cases that address the question whether recorded material is tangible property for tax purposes, finding it inappropriate to apply tax law to the interpretation of an insurance policy. Id. at 737 n See, e.g., Centennial Ins. Co. v. Applied Health Care Sys., Inc., 710 F.2d 1288, (7th Cir. 1983) (California law) (holding that the insurer had a duty to defend a suit alleging that the insured, a company that sold computer hardware and software products, introduced a faulty controller into the plaintiff s data processing system, causing loss of customer billing and patient care information, finding that [a] fair reading of the complaint clearly raises the spectre that liability for property damage may ensue ); Computer Corner, Inc. v. Fireman s Fund Ins. Co., No. CV , slip op. at 3-4 (2d Dist. Ct. N.M. May 24, 2000) (finding that computer data was physical, had an actual physical location, occupied space and was capable of being physically damaged and destroyed and concluding that computer data is tangible property where the claimant sought the cost of reconstructing data files after the insured reformatted its hard drive and erroneously stated that the data could not be retrieved ), rev d in part on other grounds, 46 P.3d 1264 (N.M. Ct. App. 2002). 16. Further discussion on this point will be provided in Part III, in which the author discusses potential coverage under commercial property insurance policies. 17. See, e.g., Liberty Corporate Capital Ltd. v. Security Safe Outlet, Inc., --- F. Supp. 2d ----, 2013 WL , at *7 (E.D.Ky. Mar. 27, 2013) (Kentucky law) ( [W]hat [the plaintiff] alleges was misappropriated were [the plaintiff] s customer s addresses obtained from an electronic backup copy of [the plaintiff] s customer database. Because such property has no physical form or characteristics, it simply does not fall within the definition of tangible property. ); Cincinnati Ins. Co. v. Professional Data Servs., Inc., 2003 WL , at *6-7 (D. Kan. July 18, 2003) (predicting Kansas law) ( [T]he Underlying Action is limited to allegations of the loss of use of the APM Software and the lost or corrupted patient account data incorporated therein. Neither the APM Software nor the data incorporated therein constitute tangible property because neither has any physical substance and neither is perceptible to the senses ); America Online Inc. v. St. Paul Mercury Ins. Co., 207 F. Supp. 2d 459, 467, (E.D. Va. 2002) ( Similar to the information written on a notepad, or the ideas recorded on a tape, or the design memorialized in a blueprint, computer data, software and systems are intangible items stored on a tangible vessel the computer or a disk. In light of the plain meaning of the term tangible and established caselaw, the court holds that the Policy does not cover damage to computer data, software and systems because such items are not tangible property. ); aff d, 347 F.3d 89 (4th Cir. 2003); State Auto Prop. & Cas. Ins. Co. v. Midwest Computers & More, 147 F.Supp.2d 1113, 1116 (W.D. Okla. 2001) (Oklahoma law) ( Although the medium that holds the information can be perceived, identified or valued, the information itself cannot be. Alone, computer data cannot be touched, held, or sensed by the human mind; it has no physical substance. It is not tangible property. ). Cf. Lucker Mfg., A Unit of Amclyde Engineered Prods., Inc. v. Home Ins. Co., 23 F.3d 808 (3d Cir. 1994) (holding that an insurer had no duty to defend or indemnify claims alleging loss of use of a product design because none of the losses [the claimant] sought from [the insured] represented a loss in value of the storage medium in which the design was embodied or in the costs in reducing the design to blueprints or computer tape (e.g. the costs of having engineers draw up the plans for the system), but rather was for the loss of use of the design itself for the loss in usefulness of the original concept, which was not loss of use of something which could be touched or felt ); St. Paul Fire & Marine Ins. Co. v. National Computer Sys., Inc., 490 N.W.2d 626, (Minn. Ct. App. 1992) ( [The claimant] s claims alleged that [the insured] misappropriated proprietary information. [The claimant] was not suing [the insured] for misappropriation of the binders in which [The claimant] s information was kept; [the claimant] was suing [the insured] for taking information that gave [the insured] a competitive advantage over Boeing. Boeing had sought to keep the information in the binders confidential; it was the loss of the confidential nature of the information that led to [the claimant] s damages, not the loss of the binders containing the information. Misappropriation

12 of confidential proprietary information does not constitute property damage within the meaning of the [insurance] policy. ) (distinguishing Retail Systems) Couch on Insurance 126:40 (3d ed. 2012); see also Catherine L. Rivard and Michael A. Rossi, Is Computer Data Tangible Property or Subject to Physical Loss or Damage? Part 1 (August 2001), available at (last visited July 12, 2013) ( the lack of clear and unequivocal case law on the subject can leave some commercial insurance buyers in the dark as to the scope of coverage for computer data losses provided by their insurance programs ). 19. See, e.g., Cohen v. Erie Indem. Co., 432 A.2d 596, 599 (Pa. Super. Ct. 1981) ( [t]he mere fact that several appellate courts have ruled in favor of a construction denying coverage, and several others have reached directly contrary conclusions, viewing almost identical policy provisions, itself creates the inescapable conclusion that the provision in issue is susceptible to more than one interpretation ). 20. See Jerold Oshinsky et al., Fighting Phishing, Pharming, and Other Cyber-Attacks:Coverage for High Tech Liabilities, URMIA Journal Reprint, at 20 (2010), available at URMIA_Journals_2010_.pdf? (last visited May 13, 2013) ( If a cyber-attack causes physical damage to an organization s servers or hard drives, the insurer must cover the losses because there is no question that there has been direct physical damage. ) F. Supp. 2d 1113 (W.D. Okla. 2001) (Oklahoma law). 22. Id. at See id. 24. Id. 25. Id. at Id. The court denied coverage, however, based on application of the your work exclusion. See id. at 1117; see also Nationwide Ins. Co. v. Hentz, 2012 WL , at *3-5 (S.D.Ill. Mar. 6, 2012) (holding that a homeowner s general liability policy potentially covered notification, credit monitoring and insurance costs as damages. Because of property damage resulting from the theft of a CD-ROM containing personally identifiable information where the medium on which the data were stored the CD ROM was stolen and thus the insured clearly suffered a loss of use of that tangible property, but holding that coverage was barred by an exclusion for property in the care of the insured ). 27. Johns et al. v. Sony Computer Entm t Am. LLC et al., 3:11-cvN263-EDL, at 8 (N.D. Cal. Apr. 27, 2011). 28. Zurich, Data security: A growing liability threat (2009), available at C0D6B160BE11/0/DOCold2DataSecurity pdf (last visited August 30, 2013). 29. See note 7, supra. 30. See CG (2012), Section I, Coverage A, 2.p. Id. 31. See, e.g., Liberty Corporate Capital Ltd. v. Security Safe Outlet, Inc., --- F.Supp.2d ----, 2013 WL , at *7 (E.D.Ky. Mar. 27, 2013) (Kentucky law) ( [T]he terms of the Policy clearly and unequivocally exclude electronic data, including information stored, created or used on computer software, from the definition of tangible property. Information obtained from [the insured] s customer database falls squarely within this exclusion. ); Union Pump Co. v. Centrifugal Tech., Inc., 2009 WL , at *2 (W.D.La. Sept. 18, 2009) (holding that there was no coverage for claims alleging the unauthorized and wrongful use, and ultimately, the destruction of its design drawings, autocad drawings, and pump models where the policy definition of property damage stated that electronic data is not tangible property and [t]he policy itself specifically excludes electronic data, which would encompass all electronic copies of the design and autocad drawings ); Recall Total Info. Mgmt., Inc. v. Federal Ins. Co., 2012 WL , at *1, *5 (Conn. Super. Ct. Jan. 17, 2012) (holding that there was no coverage for $2,467, for notifying current and/or former employees, $595, for maintaining call centers and $3,130, for credit monitoring services incurred by the claimant after an IBM cart containing electronic media fell out of [the insured s] transport van and [t]he cart and approximately 130 computer data tapes, containing personal information for more than 500,000 IBM employees, were then removed by an unknown person and never recovered where the policy definition of property damage stated that electronic data is not tangible property and that electronic data is explicitly excluded from the definition of tangible property ). 32. The endorsement provides in relevant part: 17. Property damage means: a. Physical injury to tangible property, including all resulting loss of use of that property. All such loss of use shall be deemed to occur at the time of the physical injury that caused it; b. Loss of use of tangible property that is not physically injured. All such loss of use shall be deemed to occur at the time of the occurrence that caused it; or c. Loss of, loss of use of, damage to, corruption of, inability to access, or inability to properly manipulate electronic data, resulting from physical injury to tangible property. All such loss of electronic data shall be deemed to occur at the time of the occurrence that caused it. For the purposes of this insurance, electronic data is not tangible property. ISO Form CG (2012), D. The endorsement defines electronic data as information, facts or programs stored as or on, created or used on, or transmitted to or from computer software (including systems and applications software), hard or floppy disks, CD-ROMs, tapes, drives, cells, data processing devices or any other media which are used with electronically controlled equipment. Id. C. 33. CG (2012). 34. Id. I.1.a., b(1)(a). Loss of electronic data is defined as damage to, loss of, loss of use of, corruption of, inability to access, or inability to properly manipulate, electronic data. Id. VI.10. Electronic data incident is defined as an accident, or a negligent act, error or omission, or a series of causally related accidents, negligent acts, or errors or omissions, which results in loss of electronic data. Id. VI See, e.g., ISO Form CG (1997), Section V, 17; ISO Form CG (1994), Section V, 15; ISO Form CG (1992), Section V, 15; ISO Form CG (1991), Section V, Complaint at 41, 48, In contrast, in a case filed in February 2012, Arch Ins. Co. v. Michaels Stores, Inc., 1:12 cv (N.D. Ill.), the insurer denied coverage for underlying lawsuits alleging that the insured had failed to safeguard its retail store PIN pad devices, based on the electronic data exclusion and the updated definition of property damage. As Arch alleged, [t]o the extent the lawsuit alleges bodily injury or property damage under Coverage A, any coverage for such bodily injury or property damage is eliminated by the Electronic Data exclusion. Complaint at 25(d); see also id. at 21 (quoting the property damage definition). The Arch lawsuit was stayed and dismissed in September 2012 without prejudice in order for the parties to finalize the terms of a settlement. See Docket minute entry #50 (September 10, 2012). The most recent docket entry, as of July 11, 2013, indicates that the parties have filed a Joint Motion to Dismiss. See Docket minute entry #57 (July 1, 2013) F.3d 797 (8th Cir. 2010). 39. Id. at Id. at 800.

13 41. Id. 42. Id. at Id. 44. Id. 45. Id. at See, e.g., Midwest Computers, 147 F. Supp. 2d at 1116 (the insurer had no duty to defend or indemnify because the policy your work exclusion barred coverage for allegations that defendant s negligent performance of service work caused [the claimants] to lose the use of their computers ). 47. See, e.g., America Online, 207 F. Supp. 2d at 93, (holding that the impaired property exclusion barred coverage for complaints alleging in general that AOL s Version 5.0 access software altered the customers existing software, disrupted their network connections, caused them loss of stored data, and caused their operating systems to crash and declining to address whether the underlying complaints allege[d] loss of use ). 48. See, e.g., A Compaq Computer Corp. v. St. Paul Fire and Marine Ins. Co., 2003 WL , at *7 (Minn. Ct. App. Sept. 2, 2003) (Texas law) ( even if we were to decide that data stored on a floppy disk are tangible property, the intentional-acts exclusion prohibits coverage under the Tech GL agreement ). 49. Although the ISO standard forms are used by a majority of insurers, some insurers use their own terms and conditions that may be broader or more restrictive than the ISO forms. 50. ISO Form CG (2012), Section I, Coverage A, 1.a. 51. Id. 1.b.(2). 52. ISO Form CG (2012), Section V, See generally Richard Clarke, Where to Find the Best Possible Cyber Coverage, Insurance Journal (Feb. 19, 2013), available at insurancejournal.com/news/national/2013/02/19/ htm (last visited May 13, 2013) (hereinafter Where to Find the Best Possible Cyber Coverage ) ( Any good insurance broker would go to extreme lengths to try to find coverage based upon the claim situation at hand. An example might be lawsuit allegations to the effect of invasion of privacy/confidentiality. Certainly, cyber insurance policies and perhaps certain technology errors and omissions liability policies, and even some professional liability policies may provide this coverage. But it s also true that many commercial general liability (CGL) policy forms, under the definition of Personal Injury, will likely provide some form of cyber coverage, as well. ). 54. Johns et al. v. Sony Computer Entm t Am. LLC et al., 3:11-cvN263-EDL, at 3 (N.D. Cal. Apr. 27, 2011). An argument can be made that credit monitoring is analogous to medical monitoring. 55. See, e.g., CG (2012), Section I, Coverage A, 2.p General Liability Multistate Forms Revision To Policyholders (CG P ). 57. The standard form added in 2007 states that [t]his insurance does not apply to : q. Distribution Of Material In Violation Of Statutes Bodily injury or property damage arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA), including any amendment of or addition to such law; or (2) The CAN-SPAM Act of 2003, including any amendment of or addition to such law; or (3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information. ISO Form CG (2007), Section I, Coverage A, 2.q. 58. See CG (2013). 59. See text accompanying note 29, supra. 60. See CG (2013). Electronic data is defined as information, facts or programs stored as or on, created or used on, or transmitted to or from computer software, including systems and applications software, hard or floppy disks, CD-ROMS, tapes, drives, cells, data processing devices or any other media which are used with electronically controlled equipment. Id. 61. ISO Commercial Lines Forms Filing CL DBFR, at p Pre-1998, the ISO standard forms separated personal injury and advertising injury, while the more current forms combine personal and advertising injury. Prior to 1986, this coverage was available through a Broad Form Endorsement to the standard ISO policy. 63. ISO Form CG (2012), Section I, Coverage B, 1.a. 64. Id. 1.b. 65. The 2013 CGL policy form defines personal and advertising injury as: 14. Personal and advertising injury means injury, including consequential bodily injury, arising out of one or more of the following offenses: a. False arrest, detention or imprisonment; b. Malicious prosecution; c. The wrongful eviction from, wrongful entry into, or invasion of the right of private occupancy of a room, dwelling or premises that a person occupies, committed by or on behalf of its owner, landlord or lessor; d. Oral or written publication, in any manner, of material that slanders or libels a person or organization or disparages a person s or organization s goods, products or services; e. Oral or written publication, in any manner, of material that violates a person s right of privacy; f. The use of another s advertising idea in your advertisement ; or g. Infringing upon another s copyright, trade dress or slogan in your advertisement. Id. Section V, 14. Advertisement includes: 1. Advertisement means a notice that is broadcast or published to the general public or specific market segments about your goods, products or services for the purpose of attracting customers or supporters. For the purposes of this definition: a. Notices that are published include material placed on the Internet or on similar electronic means of communication; and b. Regarding websites, only that part of a website that is about your goods, products or services for the purposes of attracting customers or supporters is considered an advertisement. Id Id. 14.e. 67. Id. Section I, Coverage B, 1.a WL (Mass. Super. Ct. 2003). 69. Id. at * Id. at * Id.

14 WL (N.D.Ill. Mar. 6, 2007) (Illinois law). 73. Id. at * Id. at * Id. The insurance policy covered damages sustained due to personal and advertising injury caused by an offense arising out of your business and defined personal and advertising injury as oral or written publication of material that violates a person s right of privacy. Id N.E.2d 307 (Ill. 2006) (holding that the insurer had a duty to defend junk fax lawsuits brought under the TCPA. 77. Pietras, 2007 WL , at *2-3 (court s emphasis). 78. Id. at * Id. at *4; see also American Family Mut. Ins. Co. v. C.M.A. Mortg., Inc., 2008 WL , at *5 (S.D.Ind. Mar. 31, 2008) (Indiana law) ( We share the view explicated by the court in Pietras. that the common law principles covering the tort of invasion of privacy have no relevance to insurance contract interpretations ), rescinded on other grounds, 2008 WL (S.D.Ind. Nov. 21, 2008) WL (D.Md. Oct. 26, 2007) (Maryland law). 81. Id. at * Id. 83. Id. at *4. The court distinguished Resource Bankshares Corp. v. St. Paul Mercury Ins. Co., 407 F.3d 631 (4th Cir. 2005) on the basis that it was not solely the manner of the solicitation that form[ed] the crux of [the claimant] s complaint; it [wa]s the action that undergirds the message s content: the unauthorized accessing of his credit records. Id. 84. Id. at * Id. at * F.3d 1239 (10th Cir. 2006) (Kansas law). 87. Id. at Id. at 1250 (citations omitted). 89. Id. at Significantly, the court also held that the insurer had a duty to defend under Coverage A because an unsolicited fax can result in loss of use of tangible property. Id. at 1244; see also Columbia Cas. Co. v. HIAR Holding, L.L.C.,--- S.W.3d ----, 2013 WL , at *7-8 (Mo. Aug. 13, 2013) (affirming the trial court s decision that TCPA allegations triggered Coverage A because there were allegations of lost ink toner, paper, and loss of use of recipients fax machines). Compare American States Ins. Co. v. Capital Assocs. of Jackson County, Inc., 392 F.3d 939, 943 (7th Cir. 2004) ( [T]he property-damage clause in the policy is no more useful to Capital Associates; junk faxes use up the recipients ink and paper, but senders anticipate that consequence. Senders may be uncertain whether particular faxes violate 227(b)(1)(C) but all senders know exactly how faxes deplete recipients consumables. That activates the policy s intentional-tort exception (which applies to the property-damage coverage though not the advertisinginjury coverage): it forecloses coverage when the recipient s loss is expected or intended from the standpoint of the insured. Because every junk fax invades the recipient s property interest in consumables, this normal outcome is not covered. ) So.3d 1000 (Fla. 2010). 91. Id. at 1002 (quoting Penzer v. Transp. Ins. Co., 545 F.3d 1303, 1312 (11th Cir. 2008)). 92. Id. at Id. 94. Id. at (citations omitted). The Supreme Court of Florida in Penzer collected cases holding that similar policy provisions provide coverage for TCPA violations and cases holding that similar policy provisions do not provide coverage. Penzer, 29 So.3d at 1005 n.5. The court was more persuaded by the reasoning in those cases that found coverage by applying a plain meaning analysis. Id. 95. Id. at 1007 (citations omitted). 96. Id. at S.W.3d ----, 2013 WL (Mo. Aug. 13, 2013). 98. Id. at * See id See id. at * See id. at *8 ( statutory damages of $500 per occurrence are not damages in the nature of fines or penalties ). See also Standard Mut. Ins. Co. v. Lay, 989 N.E.2d 591, 600 (Ill. 2013) ( We disagree with decisions concluding that the TCPA-prescribed damages of $500 per violation constitute penal or punitive damages. ) HIAR Holding, 2013 WL at * Id Id.. at * See, e.g., Encore Receivable Mgmt., Inc. v. Ace Prop. and Cas. Ins. Co., 2013 WL , at *8 (S.D.Ohio July 3, 2013) (Ohio law) (holding that the publication requirement was satisfied in connection with lawsuits alleging that the defendants recorded various telephone conversations without consent, finding that the initial dissemination of the conversation constitutes a publication at the very moment that the conversation is disseminated or transmitted to the recording device and, therefore, the court did not need to find that the recordings were disseminated to the public in order to find publication ); National Fire Ins. Co. of Hartford v. NWM-Oklahoma, LLC, 546 F. Supp. 2d 1238, 1241, 1248 (W.D. Okla. 2008) (Oklahoma law) (holding that the insurer had a duty to defend a suit alleging that the insured listen[ed] in on conversations between [the claimant] and customers for training purposes, finding that the publication requirement was satisfied because the [recording] system would function in a way that anyone in the offices of [the supervisor] or other employees, or anyone near the [recording] would have had the ability to listen in on the employee and customer conversations ); Bowyer v. Hi-Lad, Inc., 609 S.E.2d 895, 902, 912 (W.Va. 2004) (upholding coverage for allegations that a hotel employee had been subjected to illegal oral surveillance by electronic surveillance apparatus owned and operated by the [appellant] in violation of the West Virginia Wiretapping and Electronic Surveillance Act, finding nothing in the policy language indicating that the word publication necessarily means transmitting the intercepted communications to a third party ); Norfolk & Dedham Mut. Fire Ins. Co. v. Cleary Consultants, Inc., 958 N.E.2d 853, 860 (Mass. App. Ct. 2011) ( the amended complaint explicitly alleges that Adelman invaded [Towers s] right to privacy and slandered [her] reputation by circulating his humiliating, vulgar, false, and demeaning statements among co-workers ) See, e.g., Creative Hospitality Ventures, Inc. v. U.S. Liab. Ins. Co., 444 Fed.Appx. 370, , 376 (11th Cir. 2011) (Florida law) (CGL insurer had no duty to defend a class action alleging that the insured violated the he Fair and Accurate Credit Transactions Act ( FACTA ) by issuing receipts revealing more than five digits of the consumer s credit card number or the card s expiration date because issuance of a credit card receipt does not constitute a publication, but rather is a contemporaneous record of a private transaction between [the insured] and the customer that was neither broadcasted nor disseminated to the general public ) (applying Penzer v. Transp. Ins. Co., 29 So.3d 1000, 1005 (Fla. 2010)); Capital Assocs., 392 F.3d at 943 ( we hold that an advertising-injury clause of the kind in American States policy does not cover the normal consequences

15 of junk advertising faxes ); Whole Enchilada, Inc. v. Travelers Prop. Cas. Co. of America, 581 F.Supp.2d 677, 683, 697 (W.D.Pa. 2008) (Pennsylvania law) (insurer had no duty to defend a class action alleging that the insured violated FACTA by providing an electronically printed receipt which included the expiration date of [the claimant] s credit or debit card because the complaint allege[d] only that the information printed on the receipt was handed to the class member at the point of sale and [did] not allege that the cardholder s information was in any way made generally known, announced publicly, disseminated to the public, or released for distribution and, therefore, there was no publication of material that appropriates a person s likeness... or gives unreasonable publicity to a person s private life as required by the policy language at issue); Recall Total Info. Mgmt., 2012 WL , at *6 (no coverage for $2,467, for notification, call centers and credit monitoring services after approximately 130 computer data tapes, containing personal information for more than 500,000 IBM employees, were then removed by an unknown person and never recovered because there [wa]s no evidence of communication to a third party ); see also Nationwide Ins. Co. v. Central Laborers Pension Fund, 704 F.3d 522, (7th Cir. 2013) (Illinois law) (holding that a homeowner s policy exclusion for property in the care of the insured and separate business exclusion each barred defense and indemnity coverage for claims seeking nearly $200,000 in credit monitoring and insurance expenses after a laptop containing a compact disc containing confidential and protected information, including the names, birth dates, and Social Security numbers of approximately 30,000 individual[s] was stolen from an employee s car) Fed.Appx. 271 (9th Cir. 2009) Netscape, 2007 WL , at *1 (N.D. Cal. Apr. 27, 2007) Id Id Id. at *6 (citations omitted). The phrase making known to any person or organization took the place of the phrase oral or written publication, in any manner found in the ISO form See id Netscape, 343 Fed.Appx. at 272. See generally Jean-Paul Jaillet, Insurance Coverage For Cyber-Risky Business, Law360 (Feb. 21, 2012), available at (last visited Dec. 27, 2012) (discussing recent cases) Netscape, 343 Fed.Appx. at 272. The court in Netscape also found that [a]lthough the district court correctly determined that the claims were personal injury offenses, it erred in how it interpreted the policy exclusion for providing internet access to 3rd parties. Id. The policy stated that [f]or the purposes of advertising injury and personal injury, all Online Activities are excluded from these coverages, Netscape, 2007 WL , at *2, and defined Online Activities as providing services, instant messaging services, 3rd party advertising, supplying 3rd party content and providing internet access to 3rd parties. Id. at *3. In particular, the Ninth Circuit found that the [i]nternet access is commonly equated with a working [i]nternet connection, and [t]he SmartDownload utility does not provide an [i]nternet connection, and, in fact, is useless without one. Netscape, 343 Fed.Appx. at Memorandum of Law in Support of the Motion of Sony Corporation of America and Sony Computer Entertainment America LLC for Partial Summary Judgment Declaring That Zurich and Mitshui Have a Duty to Defend, at 14, 16 (filed May 10, 2013) (hereinafter Sony Summary Judgment Motion ) The ISO standard form 2001 and later policies contain three exclusions expressly relating to internet activities: (the first of which is an expanded version of the prior language that simply excluded injury committed by an insured whose business is advertising, broadcasting, publishing or telecasting. ). The standard form states that [t]his insurance does not apply to : j. Insureds In Media And Internet Type Businesses Personal and advertising injury committed by an insured whose business is: (1) Advertising, broadcasting, publishing or telecasting; (2) Designing or determining content of web sites for others; or (3) An Internet search, access, content or service provider. However, this exclusion does not apply to Paragraphs 14.a., b. and c. of personal and advertising injury under the Definitions section. For the purposes of this exclusion, the placing of frames, borders or links, or advertising, for you or others anywhere on the Internet, is not by itself, considered the business of advertising, broadcasting, publishing or telecasting. k. Electronic Chatrooms Or Bulletin Boards Personal and advertising injury arising out of an electronic chatroom or bulletin board the insured hosts, owns, or over which the insured exercises control. l. Unauthorized Use Of Another s Name Or Product Personal and advertising injury arising out of the unauthorized use of another s name or product in your address, domain name or metatag, or any other similar tactics to mislead another s potential customers. ISO Form CG (2000), Section I, Coverage B, 2.j., 2.k., and 2.l The 2007 standard form states that [t]his insurance does not apply to : p. Distribution Of Material In Violation Of Statutes Personal and advertising injury arising directly or indirectly out of any action or omission that violates or is alleged to violate: (1) The Telephone Consumer Protection Act (TCPA), including any amendment of or addition to such law; or (2) The CAN-SPAM Act of 2003, including any amendment of or addition to such law; or (3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information. Id., Section I, Coverage B, 2.p ISO Form CG (2012), Section I, Coverage B, 2.p Id For example, Nationwide Mutual Fire Insurance Company raised this exclusion in connection with claims alleging that its insured, First Citizens Bank, allowed a janitor to access bank customers confidential information by keeping file cabinets containing the information in the same closet where it stored janitorial supplies. See Nationwide Mutual Fire Ins. Co. v. First Citizens Bank and Trust Co. Inc., et al., No. 4:13cv598 (D.S.C.), Complaint 23, 55 (filed Mar. 6, 2013). In addition, Hartford Fire Insurance Company raised this exclusion in connection with class action litigation alleging that its insured, Crate & Barrel, violated the California Song-Beverly Act by intentionally requesting and recording customers zip code information during credit card transactions. See Hartford Fire Ins. Co. v. Euromarket Designs, Inc., No. 1:11-cv (N.D. Ill.), Complaint 9, 35 (filed May 5, 2011) ( To the extent that the Campbell, Salmonson. Heon. and Dardarian complaints allege claims for personal and advertising injury, the complaints claim relief based on violations of the Song-Beverly Act, a statute that prohibits and/or limits the recording, transmission, communication and/or distribution of personal information. Accordingly, the complaints fall within the Violation of Statutes Exclusion. ). Hartford also raised an exclusion for [p]ersonal and advertising injury arising out of the violation of a person s right of privacy created by any state or federal act. Id. at 8. The last docket entry indicates that the parties reached a global settlement and the case is dismissed. Docket minute entry # 57 (July 17, 2012).

16 121. See note 116, supra Sony Summary Judgment Motion, supra note 115, at 14, 19 ( In prior proceedings before this court, Zurich and Mitsui have argued that coverage for the Data Privacy Litigation is barred by the Internet Business Exclusion. This provision excludes coverage for an insured whose business is [among other things]... (3) An Internet search, access, content or service provider. ) See CG (2012) ( With respect to Coverage B Personal And Advertising Injury Liability, Paragraph 14.e. of the Definitions section does not apply ) CG (2013) ISO Commercial Lines Forms Filing CL DBFR, at p Id. at p WL (S.D.Ohio July 3, 2013) (Ohio law) One action alleged than the defendant operated a call center, and that [its] employees allegedly recorded various telephone conversations between Hyundai customers and customer service representatives without obtaining the customers consent, and that these recordings were then distributed internally for training and quality control purposes. Id. at *1. The other action similarly alleged that the defendant operated a call center and allegedly recorded various telephone conversations between Hyundai customers and Hyundai customer service representatives without obtaining the customers consent. Id The exclusion in the primary policies stated that [t]his insurance does not apply to Personal and advertising injury arising directly or indirectly out of any action or omission that violates or is alleged to violate... [a]ny federal, state or local statute, ordinance or regulation [other than certain irrelevant exceptions] that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information. Id. at * Id. at * Id. at * The excess policies included a different exclusion for liabilities arising out of communications in which the recipient has not specifically requested the communication and to communications which are made or allegedly made in violation of... [a]ny statute, ordinance or regulation, other than the TCPA or CAN Spam Act of 2003, which prohibits or limits the sending, transmitting, communicating or distribution of material or information. Id. at * Id. at * Id. at * Id Id. The court also found inapplicable the prior publication, professional services, contractual liability and criminal act exclusions Id. at * ISO Form CG (2012), Section V, 14.g The current ISO form states that [t]his insurance does not apply to : l. Unauthorized Use Of Another s Name Or Product Personal and advertising injury arising out of the unauthorized use of another s name or product in your address, domain name or metatag, or any other similar tactics tomislead another s potential customers. CG (2012), Section I, Coverage B, 2.l. Insurers also typically raise the knowing violation of rights exclusion: a. Knowing Violation Of Rights Of Another Personal and advertising injury caused by or at the direction of the insured with the knowledge that the act would violate the rights of another and would inflict personal and advertising injury. CG (2012), Section I, Coverage B, 2.a Fed.Appx. 970 (11th Cir. 2013) (Florida law) See id. at Id. at See id See id Id. at Id Id. at Id Id Id. at Id. at Compare CollegeSource, Inc. v. Travelers Indem. Co. of Connecticut, 507 Fed.Appx. 718, 720 (9 th Cir ) ( The only reasonable reading of the complaint s allegation (that CollegeSource used AcademyOne s domain name in its own domain name in a way likely to cause confusion in the marketplace) is that it claims injury from an activity that (1) is similar to the unauthorized use of another s name or product in one s domain name, and (2) would mislead customers. ) ISO Form CG (1997), Section V, ISO Form CG (2000), Section V, ISO Form CG (1994), Section V, 1. The coverage agreement in the 1996 and prior forms states that the insured will pay those sums that the insured becomes legally obligated to pay as damages because of advertising injury caused by an offense committed in the course of advertising your goods, products or services. Id., Section I, Covergae B 1. Prior to 1986, this coverage was offered under a Broad Form Endorsement that defined advertising injury as injury arising out of an offense committed during the policy period occurring in the course of the named insured s advertising activities, if such injury arises out of libel, slander, defamation, violation of right of privacy, piracy, unfair competition, or infringement of copyright, title or slogan Compare Sentex Sys., Inc. v. Hartford Acc. & Indem. Co., 93 F.3d 578 (9th Cir. 1998) ( Hartford s principal contention is that the district court erred because advertising injury, defined in part in the policy as arising out of the misappropriation of advertising ideas, includes only alleged wrongdoing that involves the text, words, or form of an advertisement. This policy s language does not limit itself to the misappropriation of an actual advertising text. It is concerned with ideas, a broader term. ) and Liberty Corporate Capital Ltd. v. Security Safe Outlet, Inc., --- F.Supp.2d ----, 2013 WL , at *12 (E.D.Ky. Mar. 27, 2013) (Kentucky law) (finding that blasts would appear to constitute a notice that is broadcast to a specific market segment about [the insured] s goods, products or services for the purpose of attracting customers, and, accordingly, potentially fall within the Policy s definition of an advertisement, but ruling that, although the plaintiff s claim for misappropriation of trade secrets

17 [wa]s potentially covered as a personal or advertising injury under the Policy, a policy breach of contract exclusion precluded coverage) with Oglio Entm t Group, Inc. v. Hartford Cas. Ins. Co., 132 Cal.Rptr.3d 754, 763 and n.7 (Cal. Ct. App. 2011) ( There is no description of any advertisement used by [the insured], or any allegation that [the insured] used an advertisement that copied an advertisement or advertising idea of [the claimant]. This is especially clear, given that the policy defines advertisement as the widespread dissemination of information or images with the purpose of selling a product[.] Under earlier Hartford policy language that provided coverage for misappropriation of advertising ideas or style of doing business, and which did not define advertising, [the claimant] might have had a better argument. ) and Union Pump Co. v. Centrifugal Tech., Inc., 2009 WL , at **6-7 (W.D.La. Sept. 18, 2009) (Louisiana law) (finding no coverage for claims alleging the unauthorized and wrongful use, and ultimately, the destruction of its design drawings, autocad drawings, and pump models where the policy defined advertisement where the court found that no evidence was presented during the course of the trial that [the insureds] directly engaged in any act that would be consistent with advertisement and even if the Defendants had engaged in advertisement, such advertisement would fall within the exclusion contained in the policy [for injuries caused by the insured with knowledge that the act would violate the rights of another ] ). Importantly, courts have found that even patent infringement may be covered if the patented concept is an advertising method. See, e.g., DISH Network Corp. v. Arch Specialty Insurance Co., 659 F.3d 1010, 1022 (10th Cir. 2011) (Colorado law) (holding that the insurer had a duty to defend claims alleging that the insured had infringed one or more claims in each of 23 patents by making, using, offering to sell, and/or selling automated telephone systems, including without limitation the DISH Network customer service telephone system, that allow [DISH s] customers to perform pay-per-view ordering and customer service functions over the telephone because the complaint allege[d] that Dish misappropriated a product: it allegedly used, made, sold, or offered for sale a telephone system patented by RAKTL and may be read to allege actions that misappropriated patented advertising ideas, insofar as the product at issue was designed expressly for product promotion and dissemination of advertising information ); Hyundai Motor Am. v. Nat l Union Fire Ins. Co., 600 F.3d 1092, (9th Cir. 2010) (California law) (holding that the insurer had a duty to defend claims alleging patent infringement resulting from certain features on its website, including a build your own vehicle ( BYO ) feature and a parts catalogue feature because the underlying claims alleged a misappropriation of advertising ideas because they allege[d] violation of a method patent involving advertising ideas and there [wa]s a direct causal connection between the advertisement (i.e., the use of the BYO feature on the website) and the advertising injury (i.e., the patent infringement) ). About the Author Roberta D. Anderson is a partner in the Pittsburgh office of K&L Gates LLP, a law firm that regularly represents policyholders in insurance coverage disputes. The opinions expressed in this article are those of the author, and should not be construed as necessarily reflecting the views of her law firm, or the firm s clients, or as an endorsement by the law firm or the law firm s clients of any legal position described herein. Ms. Anderson can be reached at Roberta.Anderson@ klgates.com. This article was published in the February 2014 Insurance Coverage Law Report.

18 For more information, or to begin your free trial: Call: Online: FC&S Legal guarantees you instant access to the most authoritative and comprehensive insurance coverage law information available today. This powerful, up-to-the-minute online resource enables you to stay apprised of the latest developments through your desktop, laptop, tablet, or smart phone whenever and wherever you need it. NOTE: The content posted to this account from FC&S Legal: The Insurance Coverage Law Information Center is current to the date of its initial publication. There may have been further developments of the issues discussed since the original publication. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold with the understanding that the publisher is not engaged in rendering legal, accounting or other professional service. If legal advice is required, the services of a competent professional person should be sought. Copyright 2014 The National Underwriter Company. All Rights Reserved.