Arbitrating Cyber Coverage Disputes

Arbitration tends to work best when both parties buy into the process from the beginning. It tends to work worst when one party feels that arbitration was imposed on it.^{2<\/sup> In the commercial insurance context, arbitration is generally imposed, even on sophisticated commercial policyholders. 3 <\/sup>This comes about through mandatory arbitration clauses in form policies that are typically nonnegotiable, including domestic, excess, and surplus lines, London and Bermuda policies. 4<\/sup> If possible, however, a policyholder should try to negotiate an arbitration clause, perhaps by way of endorsement, that provides acceptable terms in the event of a dispute.}

There are circumstances in which policyholders may actually want to be part of a confidential arbitration, particularly when the dispute involves sensitive issues, business processes, or trade secrets. Under such circumstances, a policyholder may not want further publicity about the issues and may prefer to keep documents and testimony confidential. For example, in cases involving cyber breaches, insurance companies and policyholders may benefit from the confidentiality arbitration provides. Cyber breaches typically involve sensitive customer information, issues pertaining to intellectual property, and the intangible cost to insurance companies or a policyholder's public image.^5<\/sup> Also sensitive are disputes involving discussion of a policyholder's cybersecurity measures and cyber defenses. If this issue is being adjudicated, the company may not want its strategy and network architecture to become part of the public record.

Commercial insurance companies are marketing their cyber risk policies with the tagline that each and every modern company should obtain at least a bare minimum of cyber coverage. For example, "[j]ust about any organization that uses technology to do business faces cyber risk." ^{6 <\/sup> In response to such risk, insurance companies are offering scores of "cyber" insurance products that get tweaked regularly and vary greatly in both quality and terms. That lack of uniformity foretells coverage disputes--and, indeed, litigation over the insurance coverage for cyber claims has begun to emerge recently.}

We begin this article with a discussion of the typical insurance arbitration procedure. Then we address policyholders' common objections to mandatory arbitration clauses. Next we discuss some of these objections in relation to cyber risks. Finally, we argue that with respect to cyber insurance--assuming a neutral arbitration provision can be negotiated--policyholders may want to consider that possibility.

Typical Insurance Arbitrations

Although insurance arbitrations can take many forms, here we review two features of a typical insurance arbitration as set forth in a recent article by Mark Bunim. ^7<\/sup>

The composition of the panel. Insurance arbitrations typically require a panel of three arbitrators composed of

Two party-appointed arbitrators, one selected by each party; and

A "neutral" or "umpire," selected by the party-appointed arbitrators, who serves as the panel's chair. ^8<\/sup>

The clause often requires that each arbitrator have 10 years or more of experience as either an executive or former executive of an insurance company. ^{9 <\/sup>In practice, any former or current executive of an insurance company will be familiar with the procedure, but only from the insurance company's point of view. Although arbitrators are supposed to be neutral, mandating the use of an insurance company executive suggests a potential element of bias.}

The applicable rules and law. Many insurance arbitration clauses do not specify an administering body or rules. For that reason, insurance arbitrations are often ad hoc arbitrations in which "[t]he ad hoc arbitral panel, usually with the agreement of the parties, specifies the various steps and procedures leading up to and through the final hearing." ^10<\/sup>

Undoubtedly, the insurance companies and the arbitrators have a better understanding of the process than does the policyholder. Creating the steps ad hoc as the parties proceed through the arbitration may be disadvantageous to the unsuspecting policyholder, who lacks the experience to understand whether a particular agreement is in the best interest of all parties. In a game in which there are no rules, is the outcome ever truly fair?

This is especially true when arbitrators have discretion to ignore applicable law entirely. For example, some policies contain language to the following effect:

The arbiters shall consider this agreement an honorable engagement rather than merely as a legal obligation and they are relieved of all judicial formalities and may abstain from following the strict rules of law.  ^11<\/sup>

General Objections to Insurance Arbitrations

Potential bias. In a recent blog post, Mark Miller, a policyholder attorney at Miller Friel LLP, set forth four basic objections to insurance arbitrations: (1) arbitrators may not follow policyholder-friendly law, (2) arbitrators may ignore insurance company bad faith, (3) some arbitrators find it difficult to side with corporate policyholders, and (4) some insurance arbitration organizations are mere extensions of insurance companies. ^{12 <\/sup>Miller's criticisms stem from the perspective that some arbitrators may be too closely aligned with the insurance industry and thus lack an independent viewpoint.}

First, Miller suggests that arbitrators may be improperly swayed by insurance industry custom and practice regarding what insurance companies think critical language means, rather than following the legal standard of interpreting insurance policy language, which uniformly recognizes that ambiguous terms must be construed in the policyholder's favor. Second, he posits there is a risk that insurance company bad faith will be disregarded because the arbitrator depends on the insurance companies for an influx of future business. Punishing an insurance company puts the arbitrator at risk of losing that future business. Third, he believes that many insurance arbitrators' roots lie in an insurance company and, thus, the arbitrator may be reluctant to sympathize with a corporate policyholder. Insurance companies know which arbitrators will benefit them and which won't, and are not inclined to take a chance by proposing an arbitrator who does not pass the insurance company's internal results-oriented test. Finally, with regard to the fairness of the forum, Miller notes that some insurance companies have even formed specific trade associations disguised as arbitration tribunals. Miller highlights the ARIAS organization. According to Miller, "ARIAS arbitrators have experience working for insurers, and they translate this knowledge into finding for insurers in arbitration. An arbitration before ARIAS is like an arbitration with the insurance company claims adjuster who denied the claim acting as arbitrator." ^13<\/sup>

Elimination of contra proferentem. Perhaps the single most important disadvantage to policyholders involved in the arbitration of insurance disputes is the elimination of the doctrine of contra proferentem, which is the legal concept whereby potentially ambiguous language is construed against the drafter. The doctrine exists to encourage the drafting party to draft as clearly and concisely as possible. In the context of insurance coverage policies, the "drafter" is the insurance company.

Today, insurance companies are increasingly attempting to eliminate contra proferentem, particularly in standard form arbitration clauses. For example, in Bermuda Form arbitration clauses, Condition O of the policy purports to negate certain New York (among other applicable state) rules of policy construction with respect to ambiguous or unclear policy language or structure. ^{14 <\/sup>To wit, the language provides as follows:}

[T]he provisions, stipulations, exclusions and conditions of the Policy are to be construed in an even-handed fashion as between the Insured and the Company; without limitation, where the language of this Policy is deemed to be ambiguous or otherwise unclear, the issue shall be resolved in the manner most consistent with the relevant provisions, stipulations, exclusions and conditions without regard to authorship of the language, without any presumption or arbitrary interpretation or construction in favor of either the Insured or the Company or reference to the 'reasonable expectation' of either thereof or to contra proferentem and without reference to parol or other extrinsic evidence. ^15<\/sup>

As a general rule, when policy language is potentially ambiguous, whether on its face, under the specific factual circumstances, based on its structure, or because it contains contradictory provisions and multiple reasonable interpretations are possible, the interpretation in favor of coverage prevails. ^{16 <\/sup>This general rule of construction helps level the playing field and furthers an important public policy goal that should, theoretically, compel insurance companies to draft standard form language that is clearer and more precise.}

In short, the doctrine of contra proferentem holds an insurance company accountable for the policy language it drafted. Eliminating this interpretive rule not only disincentivizes proper contract drafting but also has the potential to inject unfairness and bias into the arbitral process to the detriment of the policyholders.

Arbitrating Cyber Coverage Disputes

Permitting the selection of arbitrators with technical backgrounds. In light of the foregoing, policyholders should avoid potentially biased insurance executives and seek to maximize their freedom in selecting panel arbitrators. Particularly in the cyber context, rather than presenting complicated technological issues to judges of basic technical competence, it is advantageous for policyholders to arbitrate before neutrals with strong technical backgrounds. This refocuses the issue from an insurance-centric point of view to a cyber-based point of view.

The need for technical expertise in the arbitration panel is particularly clear in cases in which the policyholder's cyber defenses are at issue. The types and methodology of cyber attacks change constantly, as do companies' measures to defend against them.

Negotiating a predictable process with applicable law. With regard to the applicable rules of procedure and standards to be applied, policyholders should aim for a clear and predictable process in which the applicable law is well established and the policy interpretation principles are respected. This is critical in the cyber realm when the policy at issue may not clearly address all the different variables that resulted in the dispute.

Furthermore, an ideal arbitration process and its accompanying rules should balance the need to obtain sufficient information to prove one's case against the risks of discovery abuse and waste. An adept arbitrator can discern the difference between essential information and wasteful discovery requests.

So, too, should policyholders negotiate for a forum that protects confidential and sensitive business information--an essential safeguard in cyber disputes. Information is valuable, but it is also costly.

Conclusion

When presented with arbitration clauses in cyber policies, the prospective policyholder should be prepared to negotiate on several fronts. As discussed above, these clauses could vary in triggering events, panel composition, and governing rules. With regard to the agreement to arbitrate, the clause could require both parties to consent, or it could permit one-way mandatory arbitration at the policyholder's option. The latter would give the policyholder the right to invoke and proceed to arbitration, and the insurance company would have no right to object. As for panel composition, an arbitrator with technical expertise, as opposed to insurance-executive expertise, is preferable to the policyholder. What is most important, however, is for a policyholder to understand that each of these are choices and can thus be negotiated as such.  

Peter A. Halprin is a shareholder in the New York office of Anderson Kill P.C. and deputy cochair of the firm's Cyber Insurance Recovery Group. He is a fellow in the Chartered Institute of Arbitrators and a member of the AAA Panel of Neutrals.

Daniel Garrie is co-founder of Law & Forensics, a forensics, cybersecurity, and e-discovery consulting, and software company with locations nationwide, and a forensic neutral, arbitrator, discovery referee, and special master with JAMS, based in Los Angeles, New York, and Seattle--hearing cases nationwide. He is also the editor-in-chief of the Journal of Law & Cyberwarfare.

_{Copyright © 2019, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}