Your SlideShare is downloading. ×
Cyberinsurance 111006
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×

Introducing the official SlideShare app

Stunning, full-screen experience for iPhone and Android

Text the download link to your phone

Standard text messaging rates apply

Cyberinsurance 111006

245
views

Published on

PWSP October 2011 presentation on data breaches and cyberinsurance.

PWSP October 2011 presentation on data breaches and cyberinsurance.


0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
245
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
11
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Emerging Legal Trends inCyber InsuranceOctober 2011René SiemensJohn NicholsonPillsbury Winthrop Shaw Pittman LLP
  • 2. Are You at Risk for a Data Breach or OtherCyber-Related Losses? Does your product have an intensely loyal consumer fan base? (Sony) Is your organization (or any senior executive) visibly politically active on any controversial issue? (Koch Industries attacked in response to Wisc. protests) Does your organization outsource the processing/collection/storage of personal information to a third party? Does your organization outsource any IT functions with access to personal information? Does your organization ship backup tapes/drives from operational facilities to a backup/storage provider? (SAIC/Tricare) Does your organization process/collect/store personal information about your customers? (SSN, credit card, address, financial information, medical information …) (Betfair) Does your organization process/collect/store personal information about your employees? (SSN, drivers license #, address, insurance information, bank account information, credit card …)2 | Trends in Cyberinsurance
  • 3. The Current Legal Landscape Privacy / Data Security Compliance Obligations (for now) US Federal GLBA HIPAA / HITECH Red Flags Rules FTC US State privacy/consumer protection laws (e.g., Massachusetts) Canada, EU and many other countries Other - PCI DSS US Data Breach Notification Laws (for now) 46 states + DC, Puerto Rico and others Current trend is addition of medical information HIPAA / HITECH Act Other regulations3 | Trends in Cyberinsurance
  • 4. The Evolving Legal Landscape US Personal Data Privacy and Security Act of 2011 (S.1151) (Sen. Leahy) Personal Data Protection and Breach Accountability Act of 2011 (S. 1535) (Sen. Blumenthal) Data Breach Notification Act (S. 1408) (Sen. Feinstein) Among others Canada - Sept. 29, update to PIPEDA proposed in Bill C-12 to expand existing privacy law to include data breach notification requirements "It seems to me that its time to begin imposing fines--significant, attention-getting fines--on companies when poor privacy and security practices lead to breaches," - Jennifer Stoddart, Canadian Privacy Commissioner (May 2011) EU - mid-November, EC to publish revised Data Protection Directive which will include: Mandatory data breach disclosure law covering public and private sectors Binding Safe Processor Rules (BSPR) requiring cloud service providers (CSPs) in the EU to be certified by the EU and making them legally liable for data breaches occurring at CSP data centers4 | Trends in Cyberinsurance
  • 5. What Does Cyber-Liability Insurance Cover? Third-Party: Data security breaches Privacy breaches Content liability (libel, infringement, etc.) First-Party: Loss of data Revenue loss due to interruption of data systems “E-vandalism,” “e-extortion”5 | Trends in Cyberinsurance
  • 6. Third-Party Cyber Coverage: What’s Included? Crisis Management Expenses Notification costs Credit monitoring services Public relations consultants Forensic investigation Pursuit of indemnity rights Regulatory compliance costs Claim Expenses Costs of defending against lawsuits Judgments and settlements Regulatory Response Costs Costs of responding to regulatory investigations Settlement costs6 | Trends in Cyberinsurance
  • 7. First-Party Cyber Coverage: What’s Included? Costs of restoring, recreating or re-collecting: Lost data Stolen data Damaged data Revenue lost due to interruption of your operations due to, e.g., Hacking Virus transmission Other security failures7 | Trends in Cyberinsurance
  • 8. Cyber Insurance Market Trends 800 600 400 Total Premiums Underwritten 200 Source: The Betterly Report 0 2005 2008 2009 2010 Premiums ≈ $15,000 to $35,000 per $1,000,000 of limits, depending on retention and level of covers Source: Aon: Cyber Insurance Options Oct. 3, 2011 Soft market: Premiums declined an average of 8.5% during the first half of 2011 Source: Marsh Insights: Benchmarking Trends July 2011 Large corporations were early adopters Most growth is among middle market companies8 | Trends in Cyberinsurance
  • 9. Who Is Buying Cyber Insurance? Source: Marsh Insights: Benchmarking Trends July 20119 | Trends in Cyberinsurance
  • 10. Who Is Issuing It?10 | Trends in Cyberinsurance
  • 11. Are Issuers Paying Claims? Yes, but statistical information is hard to come by Areas of potential friction: Adequacy of limits, size of retentions Consent and panel provisions Coverage of vendors’ errors and omissions Loss vs. theft of data “One size fits all” crisis management expense coverage Hidden traps Interplay with vendor indemnity agreements “Other insurance” provisions Inadequacy of defense coverage Cyber policies are highly manuscripted: prevent disputes by negotiating clear policy language!11 | Trends in Cyberinsurance
  • 12. Ten Tips For Buying Cyber Insurance#1 – Make sure your limits and sub-limits are adequate • Average remediation cost is $7.2 million per data breach event • Average remediation cost is $214 per record Source: Symantec Corp. and Ponemon Institute: Global Cost of a Data Breach (2010) • Warning! Many policies impose inadequate limits on “crisis management expenses” and “regulatory action” expenses12 | Trends in Cyberinsurance
  • 13. Ten Tips For Buying Cyber Insurance#2 – Watch out for “panel” and “consent” provisions • Policies often provide that you must use the insurance company’s pre- approved forensic consultants, defense counsel, etc. • Make sure that yours are pre-approved! • Forensic, notification and defense costs are often covered only if you obtain the insurer’s “prior consent” • Make sure you get it – and obtain policy language confirming that post- tender costs will be covered or at least that the insurer’s consent “shall not be unreasonably withheld”13 | Trends in Cyberinsurance
  • 14. Ten Tips For Buying Cyber Insurance#3 – Make sure you are covered for your vendors’ errors and omissions Example: ● Bad “The Insurer shall pay all Loss that an Insured incurs as a result of your actual or alleged breach of duty to maintain security of confidentiality Confidential Information” ● Good “The Insurer shall pay all Loss that an Insured incurs as a result of any alleged failure to protect Confidential Information in the care, custody and control of the Insured or a third party to which an Insured has provided Confidential Information”14 | Trends in Cyberinsurance
  • 15. Ten Tips For Buying Cyber Insurance#4 – Make sure you are covered for loss of data, not just theft or unauthorized access Example: ● Bad “A covered breach shall include the unauthorized acquisition, access, use, or disclosure of confidential information” ● Good “A covered breach shall include the unauthorized acquisition, access, use, disclosure or loss of confidential information”15 | Trends in Cyberinsurance
  • 16. Ten Tips For Buying Cyber Insurance#5 – If you handle data for others, make sure your liability to them is covered Example: ● Bad “The Insurer will not make any payment for any claim alleging or arising from … your performance of services under a contract with your client” ● Better “The Insurer will not pay for Claims arising out of breach of contract; provided, however, that this exclusion shall not apply to liabilities that the Insured would have in the absence of contract, or arising out of breach of a confidentiality agreement or a professional services agreement for the handling of confidential information” ● Best “The Insurer will pay on behalf of the Insured all Damages and Claim Expense which the Insured becomes legally obligated to pay because of liability imposed by law or Assumed Under Contract”16 | Trends in Cyberinsurance
  • 17. Ten Tips For Buying Cyber Insurance#6 – Avoid “one size fits all” coverage Example: ● Bank suffers loss of thousands of customer credit card numbers ● Insurance policy covers cost of providing notice and credit monitoring ● Bank would rather just cancel and re-issue the cards Lesson: When procuring insurance, negotiate for the coverage you will need17 | Trends in Cyberinsurance
  • 18. Ten Tips For Buying Cyber Insurance#7 – Beware of hidden traps Example: ● Bad “The Insurer shall pay Crisis Management Expenses incurred by an Insured arising out of a Claim” ● Good “The Insurer shall pay Crisis Management Expenses incurred by an Insured in response to an actual or alleged security breach”18 | Trends in Cyberinsurance
  • 19. Ten Tips For Buying Cyber Insurance#8 – Harmonize cyber insurance with your indemnity agreements ● Bad “The Insurer’s liability applies only to amounts in excess of the policy’s Self-Insured Retention. Such Retention Amount shall be borne by the Insured’s uninsured and at their own risk” ● Good “The Insurer’s liability applies only to amounts in excess of the policy’s Self-Insured Retention. Such Retention Amount may be paid either by the Insured, or by the Insured’s other insurance or indemnified by third parties”19 | Trends in Cyberinsurance
  • 20. Ten Tips For Buying Cyber Insurance#9 – Harmonize cyber insurance with your other insurance• Review your agreements with vendors Make sure your vendors are required to have adequate insurance Ask to be added as an additional insured on their policies Make sure your policy’s “other insurance” clause specifies that their policy will apply first• Example: “This Policy shall be primary, unless the Insured is also covered for the loss under the insurance of a third party, in which case this insurance shall apply excess of amounts actually paid by that other insurance”20 | Trends in Cyberinsurance
  • 21. Ten Tips For Buying Cyber Insurance#10 – Negotiate favorable defense provisions • “Pay defense costs on behalf of” vs. “duty to defend” Will you control your own defense? • At least negotiate the right to choose your own counsel if the policy has a “panel” provision • Negotiate specific deadlines for payment by the insurer (e.g., within 30 days of invoicing) • If rates are an issue, negotiate them up front!21 | Trends in Cyberinsurance
  • 22. Preparing for/Responding to an Incident1. Know what information you collect. Conduct an audit to identify what you have and what you really need. Determine whether you can encrypt what you must have. Securely dispose of information when it is no longer required - You can’t lose what you don’t have!2. Create an incident response team including: IT, HR, Legal, CEO/CIO/CFO, Media relations3. Develop incident response plan BEFORE you have an incident Plan for different scenarios (DDOS, insider breach, hacking attack, etc.) Know which third parties you plan to contact – computer security forensics, external legal, law enforcement, crisis communications Conduct practice exercises4. Acquire insurance based on risks and potential losses22 | Trends in Cyberinsurance
  • 23. What If You Don’t Have Cyber Insurance? Insurance industry and brokers assert that there is no coverage under conventional insurance, but many courts disagree. Therefore, tender to all of your other insurers!23 | Trends in Cyberinsurance
  • 24. General Errors & Liability Property Omissions Crime Cyber Data security breach POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Privacy breach POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Media liability POSSIBLE NONE POSSIBLE NONE COVERAGE Professional services NONE NONE POSSIBLE NONE COVERAGE Virus Transmission POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Damage to data POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Breach notification POSSIBLE NONE POSSIBLE POSSIBLE COVERAGE Regulatory investigation POSSIBLE NONE POSSIBLE POSSIBLE COVERAGE Extortion POSSIBLE NONE NONE NONE COVERAGE Virus/hacker attack POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Denial of service attack POSSIBLE POSSIBLE POSSIBLE POSSIBLE COVERAGE Business interruption NONE POSSIBLE POSSIBLE NONE COVERAGE loss24 | Trends in Cyberinsurance
  • 25. Case Study – Sony PSN Attack Sony PS3 user posts code to “jailbreak” Sony PSN consoles and Sony sues user in US federal court April 4 - Members of Anonymous launch attack on Sony April 20 – Sony takes PSN and Qriocity networks offline April 26 - Sony announces that 77 million names, addresses, email addresses, birthdates, PlayStation Network/Qriocity passwords and logins, handle/PSN online ID, profile data, purchase history and possibly credit cards obtained April 27 – Sony shares fall 2% April 28 – Sony shares fall 4.5%; 1st class action lawsuit filed May 2 – Sony Online Entertainment attacked; 24.6 million customer dates of birth, email addresses and phone numbers, including 12,700 non-U.S. credit or debit card numbers and expiration dates and about 10,700 direct debit records including bank account number breached25 | Trends in Cyberinsurance
  • 26. Case Study – Sony PSN Attack (cont) May 14 – Sony brings PSN/Qriocity back online; Offline for a total of 24 days May 23 – Sony estimates that PSN breach and restoration cost $171M At least 58 class action lawsuits filed against Sony Numerous additional attacks from other hacking groups target various Sony companies and online properties. Full timeline July 20 – Zurich Insurance filed suit seeking a declaration that various Zurich policies do not provide coverage for hacking claims Zurich issued: Primary CGL policy to Sony Online Computer Entertainment America LLC (“SCEA”) Excess liability policy to Sony Corp. of America. Policy attaches above a lead umbrella policy issued by National Union Primary CGL policy to SCEA for its Canadian operations Zurich policies provide coverage for “bodily injury,” “property damage” and “personal and advertising injury” arising out of an “occurrence.” Zurich argues Sony claims do not allege any such injury or damage and therefore Zurich does not owe a defense or indemnification to Sony under any of its policies26 | Trends in Cyberinsurance
  • 27. Questions & Answers René Siemens Partner Pillsbury Winthrop Shaw Pittman LLP +1 213.488.7277 reynold.siemens@pillsburylaw.com John Nicholson Counsel Pillsbury Winthrop Shaw Pittman LLP +1 202.663.8269 john.nicholson@pillsburylaw.com27 | Trends in Cyberinsurance