Cyber Insurance

So-called cyber attacks threaten businesses of all sizes, yet business use of various insurance products to protect against such attacks substantially differ among insurers, industry experts say.

According to American International Group Inc., cyber attacks compromised nearly 90 million identities in the United States since 2005.

Of 200 data breach claims, AIG said 33% were from hacking, 25% were from stolen equipment, 10% were from missing or lost data, 7% were from dishonest insiders and 22% from ``other security failures,'' with 3% unaccounted for.

``The victim must determine what happened, how information was accessed, what was accessed and if it was criminal,'' said Nancy Callahan, vp of AIG's identity theft and fraud division. ``If it was criminal, they have to bring in law enforcement.''

``The sheer magnitude of the loss of almost 90 million customer records and the variety of causes is shocking,'' Ms. Callahan said. ``It's urgent to protect middle-market companies and small businesses against the aftermath of an identity breach theft.''

Experts estimate indirect costs for lost productivity from stolen or misplaced data average $15 per customer record, while lost customers and recruiting new customers costs $75 per customer record.

Ms. Callahan said the average total cost of an information breach is $50 million.
Data security breaches pose an enormous threat and cost businesses a huge amount of money, said Kate Armfield, co-chair of RiskProNet International's marketing/placement practice group, a network of 28 independent brokers in the United States and Canada. She is also principal-account marketing at brokerage Armfield, Harrison & Thomas Inc. in Leesburg, Va.
Examine differences
``We have reviewed multiple forms that provide this type of coverage and caution there are differences that need to be reviewed during the placement process,'' Ms. Armfield said. ``Some, for example, provide coverage for `Dumpster diving' or data from stolen laptops and others do not.''

Businesses have been slow to buy technology and cyber liability coverage for several reasons, said Patrick Deaver, vp of operations at digital media company i-Mark Inc. in Holly Springs, N.C.
``This is still a concept. There is a lack of awareness due to slow rollout and penetration among business insurers,'' Mr. Deaver said.

``Where the coverage has been promoted, the value of the coverage has yet to exceed the cost. The insured is still willing to accept the risk of exposure due to a lack of monumental cases that illustrate true impact dollars resulting from security breaches,'' Mr. Deaver said.
Kirk Sexton, former chief information officer with CHOICE Medical Management Services L.L.C., a Tampa, Fla.-based workers compensation and disability management services provider, has used data breach insurance provided by Unisource Administrators Inc., its parent company in Sarasota, Fla. Mr. Sexton, now an independent consultant, said data breach claims were part of a roll-up technology/Internet rider attached to a general liability policy.

``There were some general conditions that we put into internal policy that helped protect ourselves and lower the premium cost as well,'' Mr. Sexton said. ``Among those were the policy of requiring our trading partners to carry a minimum of a $10 million policy as well.''
Data security breach coverage can be purchased as part of a technology liability policy or on a stand-alone basis, said Joshua Gow, vp of Philadelphia-based ACE Professional Risk, a unit of ACE USA.

``We are seeing a lot of demand from a lot of industries that do not have full-line professional liability exposure like retail, hospitality, restaurant chains,'' he said.
``Companies outsource a ton of different tasks from payroll to accounting to consulting contracts and call centers,'' Mr. Gow said. ``The natural result is that they are taking their confidential client information and entrusting it to third parties.''

``If I am entrusting my payroll to an outside company, I say, `Fine, as part of our contract you are required to maintain $5 million coverage in private liability limits,' '' Mr. Gow said.
Data security policy limits are available from $1 million to $50 million.

Responsible outsourcing

``It's a matter of going in and transferring liability,'' Mr. Gow said. ``Even though I have outsourced that service to a third party, if that third party loses my customer data, the customers are going to sue me. I'm the one who trusted this third party to handle the data.''
``So I want my own insurance and I want them to have insurance to subrogate against in case there is a problem,'' Mr. Gow said.
Numerous insurers write data security coverage.
Mark Ware, director of IMA Financial Group Inc.'s technology industry practice, a Denver-based brokerage, said the market penetration is low because some brokers do not understand the issue and companies with strong information technology departments think they are beyond claims.

``Cost of such insurance depends on what a company considers to be its exposure,'' said David Halstrom, an underwriter at Beazley Group P.L.C. in Farmington, Conn. ``A risk manager and a company protecting stakeholders (are) going to have elaborate and technologically related controls available to fend off these risks.

``It's going to be a risk/reward related to the premium vs. the protection you get,'' Mr. Halstrom said. ``Also, it is a matter of do you include that into your total risk management process as a risk manager.''

``There are a lot of moving parts to these issues. At the end of the day, the good guys in network security are having trouble keeping up with the bad guys,'' Mr. Halstrom said. ``At the end of the day, that is when insurance is there to protect against those types of situations, where the companies we insure did all that they could, but weren't able to fend off.''

Copyright 2007 Crain Communications Inc.

U.S. Supreme Court Toughens Standards for Antitrust Suits

The justices, in a 7-2 opinion, ruled that an allegation that two or more companies are acting in parallel isn't enough for an antitrust lawsuit to proceed. Even if the result benefited the companies and diminished competition, the plaintiffs must go further and include some allegation indicating that the companies were actively working together.

When independent self-interest also could explain the conduct, Justice David Souter wrote for the court, plaintiffs must allege "some factual context suggesting agreement" to restrain trade.

The ruling doesn't radically upend the rules for antitrust actions. Nevertheless, it marks the latest in a sequence of cases where the court has tightened the scope of the Sherman Antitrust Act, the 1890 statute that took aim at monopoly by outlawing any "contract, combination . . . or conspiracy in restraint of trade or commerce."

Business interests contend that many companies are forced to settle even meritless lawsuits, because the cost of discovery may dwarf a payment that would make the case go away. But the court was vague about what it had in mind as the minimum allegation for a suit to proceed.

Justice Souter wrote that "the problem of discovery abuse" could cost innocent defendants huge sums. In the telecom case, "determining whether some illegal agreement may have taken place between unspecified persons at different [companies], (each a multibillion dollar corporation with legions of management level employees) . . . is a sprawling, costly and hugely time-consuming undertaking."

The 1996 Telecommunications Act sought to foster competition by allowing the so-called Baby Bells, the Bell System's successors, to sell long-distance service while also requiring them to open their local exchanges to rival carriers. But instead of promoting a robust marketplace for local telephone service, the Baby Bells largely declined to enter each others' regions and, plaintiffs alleged, they made it hard for upstart competitors to use their exchanges.
Citing this parallel conduct, plaintiffs, represented by the class-action firm Milberg Weiss Bershad & Schulman, filed suit. They alleged that the mutually beneficial parallel conduct by the Baby Bells -- which, after various mergers and name changes, now include AT&T Inc., Qwest Communications International Inc. and Verizon Communications Inc. -- suggested some sort of agreement. Plaintiffs sought to begin discovery in search of evidence supporting the claim.

A federal judge in Manhattan dismissed the case, ruling that plaintiffs must also allege facts that tend "to exclude independent self-interested conduct as an explanation for defendants' parallel behavior."

But the Second U.S. Circuit Court of Appeals, in New York, reinstated the case, citing a 1957 Supreme Court opinion that a suit shouldn't be dismissed "unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim." Since a conspiracy was a conceivable explanation for conduct that undercut competition, the court ruled the case could proceed.
Not so, wrote Justice Souter, joined by Chief Justice John Roberts and Justices Antonin Scalia, Anthony Kennedy, Clarence Thomas, Stephen Breyer and Samuel Alito.

In this case, Justice Souter wrote, the plaintiffs didn't list "a single fact in a context that suggests an agreement." The Baby Bells, he observed, descended from a world where telecom was a monopoly and "doubtless liked the world the way it was." Thus, "a natural explanation for the noncompetition alleged is that the former government-sanctioned monopolists were sitting tight, expecting their neighbors to do the same thing."

In dissent, Justice John Paul Stevens, largely joined by Justice Ruth Bader Ginsburg, contended that the majority was driven not by settled law but a "transparent policy concern" to protect antitrust defendants from litigation costs.

I have health insurance -- Why do I need Workers Compensation?

This question highlights the need to use a full service Independent Agent qualified to coordinate Health, Disability and Workers Compensation coverage. Many health insurers are starting to qualify or exclude coverage for work-related injuries under group health plans yet the old rule of thumb was exclude corporate officers from Workers Compensation to save money. A corporate President injured in an auto accident or by a falling file cabinet may face a huge medical bill with no insurance unless all the company's coverages are coordinated.

In most states, sole proprietors and partners are not covered as employees under the Workers Compensation act, but may elect to be covered. In some states the option to be covered applies only to sole proprietors and partners whose employees are covered under the act (either by law or by the employer's election).

With respect to executive officers of a corporation, the general rule is the opposite of the general rule for sole proprietors and partners. In most states, the officers of a corporation (including the executive officers) are covered, but provision is made for at least some officers to exempt themselves from coverage under the act. Many states allow only the corporation's executive officers to exempt themselves; which officers are considered executive officers may or may not be spelled out in the act. Other states do not specify which officers can exempt themselves, but allow only a specified number of corporate officers to exempt themselves.

A number of states address the status of limited liability company members and managers. This relatively new type of legal entity is a hybrid that combines features of both corporations and partnerships.

Keep in mind that, in many states, those who voluntarily exempt themselves from coverage under the act retain the right to sue the employer for damages caused by the employer's negligence. However, the standard endorsement used to exempt corporate officers and others from coverage under the employer's workers compensation insurance policy eliminates both workers compensation and employers liability coverage for injury to these individuals.

Bottom line, coordinate coverages -- don't just try to save a WC penny and end up having multiple pounds of your own pocketbook eroded.

Employment Liability Practices Coverage -- Think you don't need it? Consider this.

Scary Compliance Facts:

-Tens of Thousands of employment practices claims filed every year (DOL)
-Employees win 63% (Jury Verdict Research)
-Average verdict exceeds $250K (JVR)
-Sex discrimination easiest for plaintiffs to win (JVR)
-Age discrimination highest average verdict- over $275K (JVR)
-Awards even higher in state court (JVR)
-Retaliation is fastest growing claim category (DOL, JVR)
-Median Settlement $89K (JVR)
-Entry level settlement $30K (JVR)
-Top filings in health services, business services, eating and drinking places (GenRe)
-None of these figures includes cost of legal fees, loss of time and emotional strain

While You Are Sleeping?

You have read a lot and taken steps to limit your children's access to certain areas of the Internet, but have you given a minute of thought or checked with your Independent Insurance Agent about exposure to personal injury claims? You should have, especially if you have adolescent children.

Up until 10 or 15 years ago, chances were remote that a household would be sued for libel, slander, invasion of privacy, or some other offense. Unless they were picked up in a publication, damaging comments tended to remain within small circles of people and faded away soon after they were uttered.

In the Internet age, however, the potential for personal injury claims has increased substantially. Thanks to the global reach of e-mail, blogs, and shared sites such as MySpace and YouTube, damaging comments can be instantly transmitted to millions of people throughout the world and live on, so to speak, in electronic files that may never be fully expunged.

The growth in personal electronic communications is staggering. According to an August 2006 report by General Reinsurance Corporation, an estimated 57% of American teens had posted material on the Internet; and more than 53 million American adults had created online content. Those figures do not include the text and photos shared in supposedly private e-mails.

As a result of this communications revolution, households and personal lines insurers are seeing personal injury suits filed by individuals who have been ridiculed in electronic communications or had embarrassing information or photos of themselves posted online. Businesses are also taking legal action against “gripe sites” and individuals who post disparaging comments about their products and services online.

“The concern [today] is that the trickle of claim activity may become a torrent, as Internet usage continues its sharp growth among younger, and perhaps less worldly, insureds.” one report begins.

The American Association of Insurance Services (AAIS) has responded to the transformation in personal injury exposure by introducing new policy language for personal injury coverage.
AAIS is a national advisory organization that develops policy forms and rating information used by more than 600 property/casualty companies throughout the United States. Several states have already approved a comprehensive revision of the AAIS Homeowners forms, due to take effect in some states on July 1, 2007.

Among other things, the revision introduces several changes in wording in the optional endorsement for providing personal injury coverage.

First, the definition of “personal injury” is modified to explicitly include injury that arises from electronic publication of material that slanders or libels a person or organization, disparages the products or services of a person or organization, or violates another’s right to privacy.

With coverage for electronic publication established, the revised AAIS endorsement then clarifies the extent of coverage for electronic
publication by implementing a new exclusion that includes a key exception. This new provision generally excludes coverage for personal injury arising from “chat rooms,” "bulletin boards,” “gripe sites,” and other electronic forums that an insured hosts or controls. However, it contains an exception that preserves coverage for personal injury arising from content posted or provided by an insured.

Thus, in a general sense, the exclusion and exception are crafted to preserve coverage for an insured’s own comments, but not for his or her potential liabilities as a publisher of the comments and ideas of others.

In today’s world, one’s liability for personal injury does not necessarily end after a libelous, slanderous, or compromising comment is transmitted for the first time. A key characteristic of modern electronic communications is that the person initiating a communication usually loses control of it once it is released into cyberspace. No one can completely prevent others from forwarding malicious e-mails, or from copying malicious Web content and passing it along, even if the original is “taken down.”

This characteristic of electronic communications is raising legal questions that are now being weighed in the courts. When does publication happen? Is existing content on a blog re-published anew—and, thus, potentially a new offense—every time the blog is updated with additional new content? What is the extent of liability for the originator of injurious content when others link to it, or when it finds its way into search engines?

The one thing you can do is make sure your Homeowners Insurance has the broadest coverage possible for this activity, that you have an Umbrella policy that gives you comfort so you can go back to sleep.

Canadian Excise Tax on Insurance

The Canadian federal excise tax imposes a 10 percent premium tax on entities resident in Canada, including international corporations, that place insurance against risk in Canada with insurers not authorized by federal or provincial insurance authorities. The tax is also applicable when coverage is placed by a non-resident broker or agent — even if the insurer is authorized in Canada.

The tax furthermore applies to master controlled programs where a non-Canadian parent company purchases insurance for a Canadian subsidiary. The involvement of a
Canadian broker or the Canadian branch of a global broker or underwriter may or may not
change the situation. For the Canadian government, the primary source of coverage takes
precedence.

The local buyer must be able to prove that the Canadian agent/broker was not merely processing the document(s). On admitted master controlled programs, the primary non-resident broker is typically considered the original point of contact and therefore the Canadian government considers the tax applicable.

Canadian tax authorities recently changed the way the federal excise tax on insurance premiums is collected. The tax authorities will no longer forward tax notices to insurance buyers but instead the insurance buyer must file an excise tax return (form B243E) and remit the federal excise tax by April 30 of each year. Previously, the tax authorities invoiced insurance buyers by forwarding to them a Notice of Excise Tax. These notices were derived from the excise tax returns submitted by brokers or insurers.


If the Canadian federal government discovers unpaid premium taxes, they will likely charge the 10 percent tax, plus interest, for current and prior years. They may also disallow the insurance premium (current and prior years) as a legitimate business expense for other tax purposes. Sorting out such problems can be time-consuming and costly.
In addition to the federal excise tax, there are provincial taxes on unlicensed coverage. The tax rates range from two percent to 50 percent. The latter is imposed by the province of Alberta.
Ontario, Quebec and Newfoundland have an additional provincial sales tax on insurance premiums. Ontario charges eight percent on all lines except Auto, for which there is no tax in respect of any premium payment due after March 31, 2004. Quebec levies nine percent for all lines except Auto (for which the rate is five percent). Newfoundland charges 15 percent on all lines. Some lines are exempt in some provinces — automobile, surety, agriculture and reinsurance contracts to name a few.


Some classes of insurance are exempt entirely under the Federal Excise Tax Act. These include Personal Accident, Life, Sickness and Marine. The point -- If you are insured or insuring in Canada check with your accountant.

Risk Managers Urged To Prepare For Pandemic

It's not a question of if a pandemic will happen, but a question of where and when, said Michael Osterholm, director for the Center for Infectious Disease Research and Policy.

Osterholm was the keynote speaker April 30 at the Risk and Insurance Management Society's annual conference in New Orleans. He urged risk managers to take the lead in planning how to respond to a pandemic for their companies, their communities and their families.

The risk of a flu pandemic spreading across the globe is greater today than it was in 1918, when a deadly flu killed about a half a million people in the United States alone. Osterholm said with improved transportation, diseases can be spread through airplane travelers very quickly.
Also, while some argue that improved medical technology would help prevent a flu pandemic from taking so many lives, Osterholm said there's a shortage of beds in hospitals and medical staffs.

For instance, there are only 105,000 ventilators in U.S. hospitals, which tend to keep a two-day supply of oxygen on hand, Osterholm said. "We'd run out of oxygen before we ran out of ventilators," Osterholm said.

In addition to the medical system being overwhelmed, Osterholm said communities would have to find a way to manage the number of corpses. "We'd run out of caskets overnight," Osterholm said. "Most communities don't have plans."

And a pandemic would also have tremendous economic ramifications. In the recent SARS outbreak, 80% of flights in to and out of Hong Kong were cancelled for 10 weeks.

(By Meg Green, senior associate editor, Best's Review: Meg.Green@ambest.com) Copyright 2007 A.M. Best Company, Inc.