Fidelity Bonds and Cybercrime Insurance: Second Quarter 2016 Legal Update. by: David Bergenfeld, Esq. 1

Transcription

1 Fidelity Bonds and Cybercrime Insurance: Second Quarter 2016 Legal Update by: David Bergenfeld, Esq. 1 In the second quarter of 2016 a federal district court in Texas denied coverage for an insured under commercial crime policies by requiring strict compliance with ownership provisions. In the area of cybercrime policies, the 8 th Circuit Court of Appeals seemed to broaden coverage under Minnesota law, while a federal district court in Arizona strictly construed a policy to deny coverage under Arizona law. These developments portend that courts are responding to insurance claim matters under various different factual circumstances with varying results. The outcome of these cases demonstrate that insurers must be mindful of the precise wording in insurance policies and tailor such policies accordingly. Money Lent by an Insured is No Longer Owned by the Insured, as Held by a Federal District Court in Texas. In Cooper Industries, Ltd., v. National Union Fire Insurance Company of Pittsburgh, PA, 2 a federal district court in Texas held that pursuant to the applicable insurance provisions the applicable commercial crime policies precluded coverage for the insured because it did not own the assets that were lost. In Cooper Industries, the insured s pension plans invested certain monies by lending them to WG Trading Investors and receiving promissory notes in return. WG Trading Investors then invested the borrowed monies in WG Trading Company LP., an affiliate. Paul Greenwood and Stephen Walsh owned and managed WG Trading Investors and WG Trading Company LP. As discovered in February 2009, the investments with WG Trading Investors and WG Trading Company LP were actually a Ponzi scheme, whereby earlier investors received returns consisting of funds from later investors. Through their Ponzi scheme, Greenwood and Walsh commingled monies between WG Trading Investors and WG Trading Company LP. As a result of the investments made and redeemed, and earnings, whether redeemed or not, the insured claimed losses totaling nearly $20 million, well in excess of the policy s limit of liability of $10 million. On May 8, 2009, the insured provided notice to the insurer of its potential loss. After submission of the proof of loss and issuance of document requests and a preliminary coverage letter, the insurer denied coverage on March 9, On May 24, 2012, the insured filed the instant action. On summary judgment, the insurer argued that the insured did not own the assets lost because it loaned the monies to WG Trading Investors. In other words, once the monies were loaned, the insured no longer owned the monies. Considering that both WG Trading Investors and WG Trading Company LP were limited liability partnerships governed by Delaware law, the court held that, at best, the insured had a limited partnership interest in WG Trading Company LP. However, the court further reasoned that the insured only lent the monies to WG Trading Investors, which then invested in WG Trading Company LP. Therefore, the insured did not own the claimed lost earnings pursuant to the terms of the policy.

2 In reaching its holding, the court also held that (i) the trading loss exclusion bars coverage for losses resulting from market forces and not from theft; (ii) the indirect loss exclusion is not implicated because the investment was with the fraudsters who controlled WG Trading Investors, even though the investment was stolen subsequent to WG Trading Investors investment in WG Trading Company LP; and (iii) the recovery of lost earnings in a Ponzi scheme is permitted where there were actual earnings that were not remitted to the insured. In light of the court s holding that loaned monies are not covered, the takeaway is that parties to such an insurance policy should negotiate to clarify whether debt instruments are considered owned monies. Specifically, insureds within the affected industries should consider whether the potential additional premium for such an expanded ownership clause is reasonable for the risk transfer. Then insurers and insureds would be able to negotiate a clearly worded ownership clause. Eighth Circuit Court of Appeals Used Minnesota s Concurrent Causation Doctrine to Broaden Coverage Under a Computer Systems Fraud Insuring Agreement. In State Bank of Bellingham v. Bancinsure, Inc., 3 the court held that under Minnesota s concurrent-causation doctrine, applicable to Minnesota insurance contracts, coverage will be implicated when in the context of two causes of loss, the covered peril is the overriding cause of the loss. The insured in State Bank of Bellingham incurred a loss when one of its employees left the wire transfer computer system running overnight with the applicable two computer tokens still operational. During the course of the overnight hours, a computer virus caused unauthorized wire transfers causing a loss to the insured of $485,000. The insured submitted a claim under its Financial Institution Bond s computer systems fraud coverage insuring agreement. The insurer denied coverage claiming that the loss is excluded by the exclusions related to (i) employee loss; (ii) loss resulting directly or indirectly from theft of confidential information; and (iii) loss resulting directly or indirectly from mechanical failure. 4 The insured filed an action in United States District Court for the District of Minnesota. The court ruled in favor of the insured on summary judgment concluding that when there are multiple causes of an insured loss, one of which is a covered peril and the other of which is an excluded peril, Minnesota s concurrent causation doctrine provides that the availability of coverage or the applicability of the exclusion depends on which peril was the overriding cause of the loss. 5 In the context of the insured s loss, the court ruled that the computer systems fraud was the efficient and proximate cause of [the insured s] loss. But for the hacker s fraudulent conduct, the loss would not have occurred. 6 The insurer appealed the district court s ruling and the Eighth Circuit upheld the district court s ruling. In reaching its holding that coverage was applicable because the computer hacking was the overriding cause of the loss under Minnesota s concurrent-causation doctrine, the Eighth Circuit reasoned that Minnesota s concurrent-causation doctrine is applicable to

3 financial institution bonds. The Eighth Circuit reasoned that while parties can contract around Minnesota s concurrent-causation doctrine, such language needs to be clear and specific. Considering that the Eighth Circuit recently held in Bancinsure, Inc. v. Highland Bank 7 that Minnesota would likely follow the majority of the states in utilizing Direct Loss as compared to Proximate Cause, in the context of financial institution bonds and in State Bank of Bellingham, the court has appeared to apply what potentially amounts to a proximate cause analysis to fidelity coverage, the law of Minnesota would thus appear to be unsettled in this area. In such an environment, fidelity bonds and cybercrime policies should be clearly negotiated to take into account the Minnesota concurrent-causation doctrine by either clearly and specifically contracting around the doctrine or properly pricing the doctrine into the agreement. The Federal District Court in Arizona Strictly Interpreted a Cybersecurity Policy to Deny Coverage. In P.F. Chang s China Bistro, Inc. v. Federal Insurance Company, 8 the court held that there is no coverage under a cybersecurity policy for a credit card company s (Mastercard) imposed assessments totaling nearly $2 million related to computer hacking of a restaurant s credit card processing operations. In P.F. Chang s, the insured, a restaurant operator, had its computer systems hacked and approximately 60,000 credit card numbers belonging to its customers were compromised and posted on the internet. The insured sought coverage under its cybersecurity insurance policy. The insurer paid more than $1.7 million in reimbursement for the insured s (i) costs of conducting a forensic investigation; and (ii) costs in defending against actions filed by the customers and a bank in connection with the credit card information that was stolen. However, with respect to the following assessments issued by Mastercard to Bank of America Merchant Services ( BAMS ), which processed the insured s credit card transactions, that the insured subsequently reimbursed BAMS, the insurer denied coverage for the following: (i) approximately $1.7 million for a Fraud Recovery Assessment; (ii) approximately $160,000 for an Operational Reimbursement Assessment; and (iii) $50,000 for a Case Management Fee. The insured brought suit and the insurer brought a summary judgment motion. The court analyzed the Fraud Recovery Assessment of approximately $1.7 million under the cybersecurity policy s privacy injury coverage insuring agreement. The insuring agreement provided coverage for a written demand for monetary damages in connection with an injury sustained or allegedly sustained... because of actual or potential unauthorized access to [the credit card record, including]... any information concerning a natural person that is defined as: (i) private person information; (ii) personally identifiable information... pursuant to any... statute or regulation In reaching its holding that the insuring agreement did not provide coverage for the Fraud Recovery Assessment, the court reasoned that the customer records were not BAMS records, but rather, the records of the credit card issuers. Therefore, BAMS did not incur an Injury as defined in the policy and thus could not maintain a valid Claim under the policy.

4 With regard to the Operational Reimbursement Assessment totaling approximately $160,000, and the Case Management Fee totaling $50,000, the court held that the contractual liability exclusion to the policy precluded such assessments from coverage. In reaching its holding, the court noted that since the insured agreed under the Master Service Agreement with BAMS to reimburse or compensate BAMS for any fees, fines, penalties or assessments imposed on BAMS by [Mastercard], the contractual liability exclusion was therefore triggered. 10 In conclusion, the court dismissed the insured s reasonable expectations argument by noting that both the insured and the insurer are sophisticated parties and that all the negotiated terms were included in the cybersecurity policy as issued. In the ever changing world of cybersecurity insurance coverage, the insured needs to closely review and monitor its business model when seeking to transfer certain risks through insurance. Then, both the insured and the insurer would be in a position to clearly set forth the required coverage sought when negotiating the terms of the policy. Thereafter, the parties should correspond and confirm such coverage prior to the issuance of the insurance policy. Conclusion In the few cases from the second quarter, the insurers were successful in defeating coverage in two of the cases and the insured was successful in obtaining coverage in the third. More importantly, the courts explicitly stated that they require specificity in the language of the insurance policy whether in applying exclusions for contracting around Minnesota s concurrentcausation doctrine, insuring agreements, ownership clauses or contractual liability exclusions. Following PF Chang, insureds thus need to properly review and analyze their enterprises and their insurance policies so they match up for the appropriate risk transfer. Then, both the insurer and the insured would be in a better position to agree upon clearly set forth insurance policy provisions. 1 David Bergenfeld, Esq., is a Senior Associate in D Amato & Lynch, LLP s Fidelity Bond Practice Group. 2 Civ. Act. No. 4:12-CV-01591, 2016 WL (S.D. Tex. June 21, 2016). 3 No , 2016 WL (8th Cir. May 20, 2016). 4 The insurer s forensic computer specialist found that the insured s computer system had the following defects: (i) the wire transfer computer was used for regular and personal browsing; (ii) the Administrator and FedLine (system for wire transferring money) user accounts were not password protected; (iii) the insured s computer system s antivirus and firewall protections (the Symantic System ) Proactive Threat Protection was disabled because it was last updated three years prior to the loss; (iv) in the two weeks before the loss, the Symantic System detected a computer virus named Zeus and alerted the user of the virus numerous times; (v) the Symantic System failed to identify subsequent computer viruses that Zeus downloaded which caused the loss; and (vi) the Symantic System failed to remediate the various computer viruses.

5 5 State Bank of Bellingham v. Bancinsure, Inc., No. 13 cv 0900, 2014 WL (D. Minn. Sept. 29, 2014) at *19. 6 Id. at * F.3d 565 (8th Cir. 2015). 8 No. CV PHX-SMM, 2016 WL (D. Ariz. May 31, 2016). 9 Id. at *4. 10 Id. at *8.