Help Clients Insure Against Cyberattacks

This article was originally published in the July 22, 2013 issue of Texas Lawyer.

The constant threat of cyberattacks presents many and varying challenges for businesses. Insurance provides one way to deal with them. Because the market for insurance covering these risks and the law interpreting these policies both continue to develop, this is an area in which attorneys can help clients by maximizing their opportunity to secure the broadest possible coverage.

A look at federal and state action on cybersecurity risks provides some critical background. President Obama issued his Executive Order on Improving Critical Infrastructure Cybersecurity in February. In October 2011, the U.S. Securities and Exchange Commissions Division on Corporate Finance issued relevant guidance on financial-disclosure obligations concerning cybersecurity issues in CF Disclosure Guidance Topic No. 2 – Cybersecurity.

Texas law also imposes some key legal requirements on businesses. Texas Business & Commerce Code Chapter 521 imposes duties on companies to protect sensitive personal information collected or maintained in a company’s regular course of business and to notify affected individuals if the security of a computerized system containing that data is breached.

A look at cyberattackers also provides important perspective. Wrongdoers can target a company’s trade secrets or product-development pipeline for competitive, nationalistic or societal reasons. In addition, certain industries with a strong presence in Texas, such as energy, petrochemicals, transportation and technology, face particularly frequent attacks due to their unique characteristics and vulnerabilities.

When prevention efforts are insufficient, a data security breach often imposes first-party losses in the form of response costs and impacts on the company’s revenue stream. These can include expenses for detecting, investigating and eliminating the intrusion, notifying those affected by it, managing the company’s reputation and dealing with revenue impacts from damaged customer relationships. Third-party claims also can result, in the form of lawsuits and regulatory actions.

Because these issues touch on so many aspects of a company’s business, from negotiating vendor agreements to compliance to litigation, lawyers have many opportunities to help clients address these risks. Insurance coverage provides one such opportunity.

A company’s traditional insurance policies may offer at least some protection. In Retail Ventures Inc. v. National Union Fire Insurance Co. of Pittsburgh, PA (2012), the 6th U.S. Circuit Court of Appeals held that a “computer fraud” endorsement to a crime insurance policy covered more than $5 million in losses arising out of the illicit access to customer accounts stored in a retailer’s database. These losses included expenses for customer communications, public relations, customer claims, and investigations by multiple states and the Federal Trade Commission, as well as chargebacks, card reissuance costs, account monitoring and fines imposed by the credit card issuers.

The insurance industry’s offerings for specific cybersecurity policies also have grown rapidly in response to this threat. Just going through the process of applying for cyberinsurance can improve a company’s risk awareness. Large insurance brokers often use illuminating self-assessment questionnaires that pose dozens of queries on topics such as background checks, employee and contractor training, network security protocols, prior incidents and crisis-management procedures.

Attorneys will need to guide clients through varying policy options. Current cyberinsurance offerings lack the standardization that develops after court challenges refine policy language and the marketplace comes to accept that language.

Given the lack of industry-wide agreement on policy language, an “off the shelf” policy may be ill-suited to a particular business. Because the market is still developing, lawyers can have a greater impact in negotiating more favorable terms for a specific client’s unique needs. The policy should cover both first-party and third-party losses, as a cyberattack often triggers both.

Here is a list of some other issues to consider when purchasing a cyberinsurance policy:

• A simulated cyberattack can create an opportunity for detailed analysis. Several publicly available sources track costs associated with data security breaches. Because of the wide-ranging impacts a cyberattack can have, the total costs of these incidents are often significantly higher than the largest individual component. On the other hand, some aspects of a cyberattack may be relatively minor for a particular company.

Gaining a thorough understanding of the company’s risk profile through a simulated cyberattack will help guide decisions on issues such as the amount of overall limits, particular sublimits and deductibles.

• Does the policy cover acts of third parties with access? If the company provides confidential data to third parties or allows vendors access to its secure systems, the policy should offer coverage for that exposure. Recent headlines involving rogue employees at third-party contractors demonstrate the importance of closing off this potential gap.
• Seek coverage for unknown breaches that may have occurred already. A recent fraud summit revealed that early detection of cyberattacks remains a significant challenge. Accordingly, policyholders should seek retroactive coverage to protect against intrusions that began prior to the policy but only caused losses during the policy period.
• Broad exclusions can have unintended consequences. Suppose a cyberattack leads to an environmental liability. Is there a pollution exclusion geared towards more traditional risks that would preclude coverage for the cyberattack? Counsel should address these issues and narrow relevant exclusions, if possible.
• The right to choose counsel is critical. Choice-of-counsel provisions may matter here more than other areas. A company’s comprehensive cybersecurity plan may already have designated counsel as part of a crisis-response team.

This is something a business typically can negotiate with the insurer before a loss occurs. Left unaddressed, a company may find itself arguing about selection of counsel at a time when it most needs the help of trusted lawyers who know the company well.

For companies involved in significant technology outsourcing arrangements, it is important to examine vendor agreements for cybersecurity issues, as well as for insurance and indemnity provisions that a cyberattack involving the vendor may trigger. That analysis may suggest needed modifications to these agreements for more robust protections.

Managing cyberattacks may be a more achievable goal than preventing them. Fortunately, paying close attention to insurance issues is one way lawyers can help companies with that effort.