In May 2022, the U.S. Department of Justice (DOJ) revised its policy for charging cases under the Computer Fraud and Abuse Act (CFAA), indicating that the DOJ does not intend to prosecute ethical hacking. Ethical hackers are often referred to as “white hat hackers.” These hackers may use their capabilities to uncover security failings in a company’s system to help the company guard its business from outside hackers who may do damage to the company’s system. While white hat hackers are typically hired by a company to test the company’s information systems, some such hackers are freelance, motivated by public bug-bounty programs, or are focused on raising consumer awareness of vulnerable systems to address privacy concerns while still fully and discretely disclosing the actual vulnerabilities found to the system owners for full remediation.
Insurance companies’ widespread blanket denials of policyholders’ claims for business interruption due to COVID-19—for companies ranging in size from small mom-and-pop shops to large retailers—prompted a flood of litigation in both state and federal courts.
In Studio 417, Inc., et al. v. Cincinnati Insurance Co., a federal district court found that COVID-19 can cause physical loss under business interruption policies. The case marked the first victory for policyholders in the COVID-19 context. The court rejected the argument often advanced by insurers that “all-risks” property insurance policies require a physical, structural alteration to trigger coverage. This decision shows that, with a correct application of policy interpretation principles and strategic use of the pleadings and evidence, policyholders can defeat the insurance industry’s arguments that business interruption insurance somehow cannot apply to pay for the unprecedented losses businesses are experiencing from COVID-19, public safety orders and other governmental edicts, and loss of use of business assets.
Notably, the court explicitly declined to follow the early COVID-19 decision trumpeted by insurers in Social Life Magazine, Inc. v. Sentinel Insurance Co. In Social Life, the insurer argued that “the virus damages lungs, not printing presses.” The Studio 417 court rejected that position, reasoning instead that the policyholders had plausibly alleged that COVID-19 particles attached to and damaged their property, which made their premises unsafe and unusable. Studio 417 also specifically differed from two prior seemingly pro-insurer decisions, Gavrilides Management Co. v. Michigan Insurance Co. and Rose’s 1 LLC, et al. v. Erie Insurance Exchange, in which the trial courts held that the policyholders in both Gavrilides and Rose’s, unlike those in Studio 417, failed to allege or proffer evidence that COVID-19 was present at or had physically damaged their properties. The Studio 417 decision underscores that, in pursuing business interruption coverage for COVID-19 losses, it is key for policyholders to tie the elements of the coverage to the facts of the damage and loss, allegations that a court can use in denying arguments by insurers that somehow business interruption coverages cannot be triggered.
In a resounding victory for policyholders, the court inNorth State Deli, LLC v. Cincinnati Insurance Co. granted summary judgment to the policyholder and ruled, as a matter of law, that “all-risk” property insurance policies covered the business interruption losses suffered by 16 restaurants during the COVID-19 pandemic. The policyholders moved for partial summary judgment that their losses were covered because the government orders caused them to lose the physical use of and access to their restaurants. The court held that government orders mandating the suspension of business operations and prohibiting “all non-essential movement by all residents” caused “physical loss” of the policyholders’ property under the policies. The policies at issue promised to pay for loss of “business income” and for “extra expenses” caused by “direct ‘loss’ to property . . . caused by . . . any Covered Cause of Loss.” The policies defined “loss” as “accidental physical loss or accidental physical damage” to property.
In Elegant Massage, LLC v. State Farm Mutual Automobile Insurance Co., the U.S. District Court for the Eastern District of Virginia refused to dismiss a majority of the policyholder’s breach of contract claim and its request for bad-faith damages, declaratory judgment, and class certification, all stemming from the insurer’s denial of coverage of business income losses related to COVID-19. The court explicitly found that a fortuitous event that renders an insured’s property inaccessible can constitute a “direct physical loss” of that property, even absent physical or structural damage, and that the plaintiff’s loss of use of its property—caused by the government shutdown orders issued to prevent the spread of the deadly COVID-19 virus—could constitute a “direct physical loss.”
In reaching this outcome, the court found the phrase “direct physical loss” to be the subject of “a spectrum of legal definitions,” which the court ultimately determined to require a finding of ambiguity. The court found that other judges had reasonably determined “direct physical loss” to have differing meanings, concluded the phrase was ambiguous, and construed coverage in favor of the insured.
In addition, the court held that the insurer failed to meet its burden to show that a fungi, virus, or bacteria exclusion applied because the insurer had not established a direct connection between the exclusion and the plaintiff’s claimed loss. More specifically, the court held that the anti-concurrent causation language did not exclude coverage and would apply only where a virus had spread throughout the property, consistent with rulings from other federal courts. The court ultimately concluded that the exclusion required that the virus be the immediate cause of the chain of loss, which was not the case.
The court in Elegant Massage also addressed other exclusions commonly asserted by insurers in COVID-19 claims, finding that the ordinance and law exclusion did not apply because the governmental orders restricting business due to the pandemic were not ordinances or laws and that the acts or decisions exclusion could not preclude coverage because it was so ambiguous and broad that it could not be taken literally under its plain meaning.
COVID-19 radically changed our daily lives and disrupted the court system. Courts at all levels closed their doors and postponed oral arguments and trials. When courts did reopen, measures taken to address the dangers of COVID-19 exacerbated the significant backlog of cases. Courts attempted to balance public safety and the safety of their staff against the constitutional rights of citizens and, accordingly, prioritized criminal cases over civil, resulting in a decrease of issued opinions compared with past years. Despite this decrease, however, the courts still managed to issue some fairly significant rulings outside of the COVID-19 context.
Delaware court follows “larger settlement rule.” In a matter of first impression, in Arch Insurance Co. v. Murdock, the Delaware Superior Court adopted the “larger settlement rule” to govern allocation of settlement amounts where (i) a settlement resolves, at least in part, insured claims; (ii) the parties cannot agree as to the allocation of amounts attributable to covered versus non-covered claims; and (iii) the policy’s allocation provision does not prescribe a specific allocation method. In reaching this conclusion, the court found that while the allocation provision is “unambiguous,” it is “mostly unhelpful under the facts presented here.” The court found that the allocation provision “speaks only to situations where the insurer and policyholder use their best efforts to arrive at a fair and proper allocation of covered loss” but “does not address the situation where the parties fail to agree.” In the absence of language specifying what is to be done if the parties do not agree, and in light of the policy language, the court ruled that the larger settlement rule applied.
Illinois court opens the door to Biometric Information Privacy Act claims. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., the Illinois Appellate Court found that underlying allegations of violations of the Illinois Biometric Information Privacy Act (BIPA) constituted “personal and advertising injury.” The court also found that the Telephone Consumer Protection Act (TCPA) exclusion, which prohibits coverage for claims alleging the distribution of materials and information without consumers’ consent, did not apply.
In West Bend, the insured was sued in a putative class action for alleged violation of BIPA. According to the underlying complaint, customers purchasing services at the plaintiff’s tanning salon were automatically enrolled in a national membership database to allow customers to use and access certain tanning locations. The lawsuit alleges that customers were required to have their fingerprints scanned for the purpose of verifying their identification but were never provided, nor asked to sign, a written release allowing the plaintiff to disclose customers’ biometric data to third parties. The lawsuit further alleged that the plaintiff violated BIPA by disclosing customers’ fingerprint data to an out-of-state third-party vendor, without customers’ consent.
The insured tendered the claim to West Bend under a business owners liability coverage policy. West Bend denied coverage and filed suit seeking a declaration that it had no duty to defend or indemnify the insured against the putative class action because the allegations did not fall within the definition of “personal injury” and because they fell within the scope of the TCPA exclusion, which barred coverage for personal injury arising out of any statute, ordinance, or regulation that prohibits the distribution of materials or information. The appellate court rejected both of the insurer’s arguments. West Bend, the first opinion finding coverage for alleged BIPA violations under a liability policy, is likely to open the door to a flood of claims related to one of the fastest-growing areas of privacy litigation in the country.
California Supreme Court favors vertical exhaustion. In Montrose Chemical Corp. v. Superior Court, the California Supreme Court ruled that vertical exhaustion applied to determine how a policyholder could access its excess insurance policies. The case involved coverage for Montrose Chemical Corp.’s environmental liabilities at its Torrance, California, facility under insurance policies issued from 1961 to 1985. Montrose and its insurers agreed that Montrose’s primary policies were exhausted but disputed the sequence in which Montrose could access coverage under the excess insurance policies. Montrose argued for vertical exhaustion, in which each excess policy would be triggered after the exhaustion of any underlying excess policies in the same policy period. The insurers argued for horizontal exhaustion, whereby the excess layer of policies could be triggered only after the exhaustion of all lower-layer policies across all relevant policy years.
The California Supreme Court sided with Montrose. Relying on settled principles of insurance law, the court first examined the other insurance provisions and concluded that those clauses “do not clearly specify whether a rule of horizontal or vertical exhaustion applies here.” Notably, the court cited the recent Restatement of Liability Insurance on other insurance clauses in support of its conclusion, which provides that “‘other insurance’ clauses have generally been used to address ‘[a]llocation questions with respect to overlapping concurrent policies.’”
Ninth Circuit denies excess insurer’s recoupment efforts. The Ninth Circuit limited excess insurers’ ability to second-guess lower-level carriers’ payment decisions when it rejected Axis Reinsurance Co.’s argument that it overpaid on Northrop Grumman Corp.’s settlement of a class action suit because Northrop Grumman’s other insurers prematurely exhausted their policies in Axis Reinsurance Co. v. Northrop Grumman Corp.
A three-judge appeals panel, ruling on an issue of first impression, rejected Axis’s claims of improper erosion and reversed a California federal judge’s order allowing Axis to recoup an undisclosed portion of the $9.7 million it paid toward Northrop’s $16.75 million settlement of an Employee Retirement Income Security Act (ERISA) class action lawsuit in 2017. The court also held that even if the excess carriers had prematurely exhausted their policies, an issue it did not rule on, Axis was not legally entitled to question the other insurers’ decisions to pay the settlement.
Delaware Supreme Court denies securities claim coverage for appraisal. In the In re Solera Insurance Coverage Appeals, the Delaware Supreme Court dealt a blow to companies incorporated in the state when it held that a stockholder appraisal action challenging Solera Holdings Inc.’s buyout by Vista Equity Partners did not trigger the coverage for securities-related claims in Solera’s excess directors’ and officers’ (D&O) policies. The ruling marked a significant victory for D&O insurers.
The Superior Court of Delaware had previously denied the insurers’ motion for summary judgment in August 2019 and held that the appraisal action, which included $39 million in attorney fees, prejudgment interest, and costs incurred in defending litigation that arose out of Solera Holdings Inc.’s acquisition by Vista Equity Partners LP, constituted a covered “securities claim” under Solera’s D&O liability insurance policy. The insurers appealed.
In a unanimous decision, Delaware’s high court ruled that the state judge erred. It found that an appraisal action is a “neutral proceeding” that serves only to determine the value of the shares held by stockholders who object to the merger, and the action did not fit the policies’ definition of a securities claim.
Court awards prejudgment interest for time before and after arbitration award. In ExxonMobil Oil Corp. v. TIG Insurance Co., a federal court added prejudgment interest for the period before and after an arbitration award, despite the panel’s prior refusal to award interest. The arbitration panel found that TIG owed Exxon the full $25 million policy limit. Exxon asked the panel to award more than $6 million of prejudgment interest running from the date of breach. The panel refused, finding that the arbitration agreement did not allow it to award prejudgment interest. Exxon then asked a federal court to confirm the panel’s award and to order TIG to pay prejudgment interest. The court granted that request. Specifically regarding interest from the date of breach until the panel’s award, the court found it could consider the issue, given that the panel found it was without jurisdiction to do so. While the arbitration provision in the parties’ contract did not permit the panel to award prejudgment interest, that provision did not bar the court from awarding prejudgment interest. As the court explained, to decline the imposition of interest would embolden parties, like insurers, to wrongfully withhold payment with no material repercussion.
Although it is not a judicial ruling, an advisory opinion issued on October 1, 2020, by the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) is also noteworthy and will undoubtedly shape the future coverage landscape. The advisory opinion cautions insurers that they may be violating anti-money-laundering and sanctions regulations if ransomware payments are paid to cybercriminals. The advisory opinion is significant and can present a problem for policyholders who thought they purchased insurance specifically to cover ransomware attacks and now may be facing a recalcitrant insurer.
OFAC makes clear its concern that the payment of ransom emboldens threat actors to engage in future attacks. The practical problem for insurers and their insureds, however, is that it is exceptionally difficult to determine who the threat actor is during the short time constraints involved in ransomware attacks. And every hour that the insured’s company is crippled by the ransomware attack may translate into thousands, if not hundreds of thousands or millions, of dollars lost.
The advisory opinion appears to serve as a cautionary reminder of existing law that would require insurers to first make sure that the threat actor has not been identified by OFAC as a specially designated national or blocked person, before making any ransom payment. However, in response to OFAC requirements and the advisory opinion, some insurers are broadening OFAC or related exclusions (or both) in cyber insurance policies.
Insurers may be winning the COVID-19 business interruption insurance cases by the numbers, particularly in federal court, but policyholders appear to hold the advantage in the state cases, which have generated some of the more thoroughly reasoned decisions. Although 2021 shows promise for gaining control over the disease, the resulting insurance disputes are certain to remain center stage, and much still remains to be seen in those cases, likely for years to come, as appellate courts consider the trial court rulings. In addition to the continuing COVID-19 business interruption cases, we expect to see a number of impactful rulings on insurance coverage disputes in 2021, including rulings related to coverage for ransomware attacks and choice-of-law determinations for D&O liability policies.
