('8&$7,21352*5$0
Cyber Liability Why the Need?
CYBER LIABILITY:
Why the Need?
Robin Federici, CPCU, AAI, ARM, AINS, AIS, CPIW
PO BOX 781
NORTH KINGSTOWN, RI 02852
Phone: 401-294-3557
Fax: 401-294-3557
Robin’s Cell-401-529-9617
Fred’s Cell-401-524-4567
E-mail: [email protected]
[email protected]
Web site: WWW.IETA.BIZ
1
This material has been designed for use in training programs for insurance industry personnel. It
is not intended to be used as a complete reference resource on the programs and coverages
outlined herein.
The program uses “standard” policy forms and endorsements for the purposes of discussing the
exposures to loss that may exist, some of the coverage options available to treat them, and to
provide a framework for discussions with carriers you represent concerning the programs they
have available.
Coverages, rules and materials presented during this program may differ from those used by
individual insurance companies. Contact individual carriers for details about interpretations of
their eligibility requirements, particular insurance contracts and rates.
Copyright 2014 by Insurance Education & Training Associates, LLC. All rights reserved. This
document or any part thereof may not be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying, recording, or by any information retrieval
system, without the express written consent of Insurance Education & Training Associates, LLC.
Inquires should be addressed to: PO Box 781, North Kingstown, RI 02852 E-Mail:
[email protected].
2
WHAT IS CYBER COVERAGE?
x Cyber Liability addresses the risks associated with e-business, the
Internet, networks and informational assets.
x Cyber Liability Insurance coverage offers cutting-edge protection for
exposures arising out of Internet communications.
x The concept of Cyber Liability takes into account first- and third-party
risks.
x The risk category includes:
¾ privacy issues
¾ the infringement of intellectual property
¾ virus transmission, or
¾ any other serious trouble that may be passed from first to third parties
via the Web
WHY THE NEED?
x
x
x
x
Anyone with a Web site now has the legal liabilities of a publisher:
The Internet - has spun a whole new “web” of liability exposures.
Creating a Web site is simple. The exposures that come with it are not.
Commercial companies that disseminate information to the public via
Web sites face the same legal exposures as publishers, yet most have little
or no concept of their resulting legal responsibilities.
x New legislation continues to create potential liabilities, particularly in the
areas of user privacy and domain name infringement.
x Traditional liability products do not address Internet exposures and the
risks involved in Internet business have blossomed with the Net itself.
x The universe of potential plaintiffs is staggering, given the number of
people and organizations that are currently surfing the Net.
3
LAWS AND REGULATIONS
Privacy:
To date, 46 states, the District of Columbia, the U.S. Virgin Islands, and
Puerto Rico have enacted legislation requiring notification of breaches or
potential breaches of personally identifiable information (PII)
Several relevant federal statutes pertain to privacy.
This patchwork of laws and regulations can make it nearly impossible
for most business owners and risk managers to keep up, particularly for
those who do business in multiple states.
Privacy - Jurisdiction:
The jurisdiction of the state laws is based on both:
1. The consumer’s state of residence
2. The home state of the business.
Compliance, especially for those in highly regulated industries, such as
health care, legal, educational, and financial services, can be a difficult task
4
LAWS AND REGULATIONS
FEDERAL
The Privacy Act of 1974 :
Health Insurance Portability and Accountability Act (HIPAA) of 1996:
Financial Modernization Act of 1999, commonly called the Gramm-Leach
Bliley Act (GLB)
Fair Credit Reporting Act Of 1970
Sarbanes-Oxley(SOX) 0f 2002
FTC’s Red Flag Rule
Identity Theft Enforcement and Restitution Act
Payment Card Industry Data Security Standards
NOTEWORTHY FEDERAL PRIVACY LAWS
Drivers Privacy Protection Act
DMV and MVRs
o Restricts the public disclosure of personal information contained in state
department of motor vehicle records
o “Personal information" –
Individual's photograph or image
Social security number
Driver identification number
Name
Address (but not 5 digit zip code)
Telephone number
Medical or disability information
5
STATE LAWS
It All Started with California
In 2001, California became the first state to have an agency dedicated to
promoting the protection of consumer privacy rights when the Office of
Privacy Protection was created.
) The only four states that do not have data loss/breach notification
laws are Alabama, Kentucky, New Mexico, and South Dakota.
Massachusetts:
General Law Chapter 93H/201 CMR 17.00) requires notification of any breach
that involves one or more Massachusetts residents regardless of where the
breach takes place or from where the entity that held the private information
is domiciled and/or operating.
New Jersey:
In New Jersey, breaches must be reported to the Division of State Police for
investigation.
Nevada:
Nevada passed the first law incorporating all of the Payment Card Industry
(PCI) Data Security Standards (DSS) as a state requirement.
Texas:
In Texas, effective September 1, 2012, notice must be provided to any
individual who is either a resident of Texas or a resident of a state that does
not require notification of a security breach.
Connecticut:
August 18, 2010, the State of Connecticut Insurance Department issued
Bulletin IC–2512 wherein all licensees and registrants are required to notify
the Department of any “information security incident” that affects any state
resident as soon as the incident is identified, but not later than 5 calendar days.
One note of concern is the broad definition of “information security incident,”
which includes even encrypted information.
6
WHAT IS CYBER LIABILITY INSURANCE?
Cyber Liability is an insurance term for a policy that
includes one or more of the following coverages:
Multimedia Liability - Allegations from your internet site or printed media which
cause defamation. Libel, slander, trade libel, product disparagement or torts relation
to harm the reputation of others.
Security and Privacy Liability - Failing to prevent or hinder unauthorized access
or use of your computer system and the confidential material thereon such as loss
of employee information, theft or loss of customer personal identifiable data and
transmissions of malicious codes to others. First and Third party coverage is
available.
Privacy Regulatory Defense and Penalties - Regulatory Compensatory Awards
or fines and penalties and related claims expenses in regards to Billing Errors
Proceedings, STARK proceedings and EMTALA proceedings.
Privacy Breach Response Costs, Customer notification and Customer Support and
Credit Monitoring Expenses.
Network Asset Protection - Restoring, updating or replacing digital assets to a
level beyond that which existed prior to your Covered Cyber Loss including
Business Interruption and Extra Expense Coverage.
Cyber Extortion - Covers expenses and monies as applicable in the event of a
cyber-extortion threat or series of threats.
Cyber Terrorism - expenses such as income loss, interruption expenses during
the period of restoration as a result of a total or partial loss or degradation in
service which is directly caused by an act of terrorism.
Regulatory claim expenses and shadow audit expenses - Covered claim
expenses, shadow audit expenses and regulatory fines and penalties from certain
regulatory proceedings against you.
7
CYBER POLICIES – 3rd Party
THIRD-PARTY LIABILITY INSURANCE
ƒ The focus of this coverage is to cover liability arising from violations of
privacy and data breach notification laws.
ƒ These exposures also require some first-party coverage
ƒ These policies also can include coverage for a number of other types of
liability
ƒ Typically policies are on a claims-made and reported basis.
ƒ It is important to pay attention to the prior acts date included
Types of Information Covered:
ƒ Key to coverage is the types of information the policy specifies as being
covered, and there are substantial variations between forms.
ƒ Coverage should be provided for both electronic and physical (paper,
laptop, portable disk, personal digital assistant (PDA), etc.) breaches
ƒ Look for coverage to include both personal and corporate information.
ƒ Coverage should apply to employee data as well as customer information
ƒ Information in the “care, custody, or control” of the insured’s vendors
should be covered
ƒ Coverage should apply to accidental losses/leaks and not just breaches
perpetrated by criminals
ƒ Avoid (1) “PCI compliant” requirements, (2) encryption
requirements, (3) insider exclusions
8
CYBER POLICIES – 3rd Party
Virus/Malware/Hacking Coverage
x Coverage should apply to liability to others for unintentionally sending
them a virus or malware.
x This should apply if the transmission is by e-mail or through malicious
code placed on the insured’s website.
x Some policies limit the coverage for viruses and hacking to direct
intentional attacks that target the insured specifically
x Look for coverage that includes “wild” viruses that are not specifically
targeting the insured.
Media Liability/Content Injury:
Intellectual Property Infringement and
Personal Injury
x Avoid policy language that limits coverage to only claims made in the US
x Look for coverage that extends beyond the insured’s website to also
include social networking sites (e.g., LinkedIn, Facebook, and Badoo) as
well as e-mail and other messaging services like Twitter.
x Coverage for user-generated content is particularly important because
user posts are oftentimes opinionated and inflammatory
x Some insurers will extend trademark and copyright coverage beyond the
insured’s website content to the insured’s products. This can be a very
valuable coverage extension.
E&O or Professional Liability
x There are policies tailored to address the specific needs of entities
operating in various industry classes such as technology services
providers, healthcare providers, and vendors.
9
CYBER POLICIES – 1st Party
Fines, Penalties, Contract Obligations
Coverage should include:
1. Regulatory fines and penalties
2. Contractual obligations such as charge-backs from credit card companies and
the cost of replacing customers’ credit cards
Business Interruption Coverage
Coverage should:
x Respond when an interruption occurs as a result of the insured’s own
systems and failure of a third party system, including large-scale Internet
failure
x If traffic or revenues are seasonal, limits should adjust accordingly (i.e.
Cyber Monday)
x Include reasonable waiting periods (i.e. 12-hours). Nowadays, only the
most catastrophic events will keep a network down for more than a few
hours.
Crisis Management
This coverage varies – generally includes:
x Data breach notification expenses
x Public relations expenses, and
x Costs associated with brand protection
Questions to Consider:
1.
2.
3.
4.
5.
6.
7.
SERVICE PROVIDER
DATA BREACH NOTIFICATION EXPENSES
CREDIT MONITORING EXPENSES
REQUIREMENTS FOR NOTIFICATION
COVERAGE TRIGGER
DEDUCTIBLE
PRE-LOSS AND LOSS PREVENTION
10
CYBER POLICIES – 1st Party
Crime Coverages
This coverage may apply to the perils of:
x Theft
x Fraudulent communication
x Extortion, and
x Vandalism
Coverage Issues:
x Beware of “other insurance” clauses – since this coverage often overlaps
with traditional policies, which cover employee theft, computer fraud, and
wire transfer fraud.
x Extortion coverage for demands of payment to prevent a criminal from
taking down the insured’s network or exposing PII can also be provided.
DETERMINING LIMITS OF LIABILITY
x Determining the appropriate limits of liability that a company should
purchase is more of an art than a science.
x Historical data are limited; even well-reported losses do not usually
divulge internal costs.
x The cumulative average cost per breach is more than $2,500,000;
however, costs can soar into the tens of millions and even higher.
11