David R. Cohen and Roberta D. Anderson

INSURANCE COVERAGE FOR "CYBER-LOSSES"
Author(s): David R. Cohen and Roberta D. Anderson

Source: Tort & Insurance Law Journal, Vol. 35, No. 4 (SUMMER 2000), pp. 891-927
Published by: American Bar Association
Stable URL: http://www.jstor.org/stable/25763478
Accessed: 03-11-2015 01:55 UTC
Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at http://www.jstor.org/page/
info/about/policies/terms.jsp
JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of content
in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms of scholarship.
For more information about JSTOR, please contact support@jstor.org.
American Bar Association is collaborating with JSTOR to digitize, preserve and extend access to Tort & Insurance Law Journal
.
http://www.jstor.org
This content downloaded from 128.184.220.23 on Tue, 03 Nov 2015 01:55:40 UTC
All use subject to JSTOR Terms and Conditions
INSURANCECOVERAGE
FOR "CYBER-LOSSES"
David R. Cohen and Roberta D. Anderson
I. INTRODUCTION
The Internet provides an extraordinary wealth of new opportunities for

companies to interrelate with other businesses and to identify and attract
potential consumers of information, products, and services. However, "e
commerce" opportunities do not come risk-free.As companies increasingly
rely on the Internet and related technology to transact business, the risk
of loss or damage to computer hardware and software, data, and databases,
and the risk of consequent liabilities to third parties, likewise increases.
A striking example of e-commerce-related risk recently made interna
tional headlines when themost damaging and quickly spreading computer
virus to date, the so-called Love Bug, swept around theworld
duringMay
2000. Seducing e-mail users to open a "love letter" attachment with the
alluring subject line "ILOVEYOU," the virus coursed through computer
systems worldwide, crashing e-mail systems, stealing passwords, and de
leting files that contained valuable data. In less than twenty-four hours, the
Love Bug caused billions of dollars in damage.1 Just a fewmonths earlier,
a series of "hacker attacks" shut down some of theWeb's most
popular and
heavily trafficked sites in February 2000.2
As these events illustrate, computer virus, hacker, and other e-commerce
risks can lead to substantial financial losses, including remediation costs
1. See Reuters Eng. News Serv., May 8, 2000, available inWESTLAWALLNEWSPLUS

"
database (noting that the 'Love Bug' virus ... is causing $1 billion to $1.5 billion of damage
a
day").
2. See, e.g.,Nick Wingfield & Scott Thurm, The Internet Under Siege: Stalking theHackers:
As More Sites Get Hit, Web Companies Fortify,Wall St. J., Feb. 10, 2000, at B-l, available in
2000 WL-WSJ 3017448; Rob Kaiser & Frank James, FBI Probing Attacks on Popular Sites,
Cm. Trib., Feb. 10, 2000, at 1, available in 2000 WL 3635166.
David R. Cohen and RobertaD. Anderson are with the

firm Kirkpatrick& Lockhart
LLP inPittsburgh,Pennsylvania.
891
892 Tort & Insurance Law Journal, Volume 35, Number 4, Summer 2000
and lost profits.3As they confront such risks in this e-commerce era, com
panies should consider the availability of insurance coverage for their
losses. Indeed, Lloyd's of London has stated that the Love Bug is proof
that "e-commerce will emerge as the single biggest insurance risk of the
21st
century."4
The insurance framework for e-commerce-related losses is in its infancy
and unanswered questions abound: Do "traditional" business insurance
a
policies cover business interruption losses resulting from computer virus,
hacker attack, or computer system crash? What factors should policy
holders consider in determining whether to make a claim for coverage?
Do traditional policies cover a policyholder for its losses when the com
puters of its customers or suppliers fall victim to an e-commerce-related
risk?
some insurance are seeking
Predictably, industry spokespeople already
to discourage claims by announcing that losses resulting from the Love
Bug and the recent hacker attacks are not covered by traditional policies.5
Such blanket pronouncements aremisleading. Rather than relying on such
statements, policyholders that have suffered losses from viruses, hacker
attacks, or other e-commerce problems, or potentially may suffer such
losses, should carefully consider and consult with coverage counsel about
the specific language of their insurance policies and how it applies.
For example, first-party property insurance policies typically provide
coverage for business interruption losses resulting from "direct physical
loss of or damage to covered property." Computer viruses, hacker attacks,
and other e-commerce risks may cause such loss or damage. Moreover,
many policies now have language specifically covering disruption, destruc
tion, or corruption of any computer data, coding, program, or software.
Accordingly, many companies may be insured for these kinds of losses and
consequential business interruption losses.
In addition, a growing list of insurers have sold and are selling policies
specifically targeted toward losses that may arise in connection with
3. See, e.g.,Tom McLaughlin, Hackers Attacking Internet Sites with Impunity, Boston Her
ald, Feb. 10, 2000, at 016, available in 2000 WL 4316669.
4. See, e.g., Reuters Eng. News Serv.,May 9, 2000, available inWESTLAW ALLNEWS
PLUS database; J. Com. Abstracts 12,May 18, 2000, available in 2000 WL 4188456.
5. See, e.g., Reuters Eng. News Serv.,May 8, 2000, available inWESTLAW ALLNEWS
PLUS database ("Insurers won't be footing the bill for the estimated $10 billion of
damage
caused by the 'Love Bug' virus and its variations, they said on Friday, because most companies
don't have special coverage, and the ones that do
probably escaped serious damage."); J.Com.
Abstracts 12,May 18, 2000, available in 2000 WL 4188456 ("The cost of the Love Bug is
alreadybeing put at 10 billionpounds ($15.30 billion)worldwide,butmost of thatbill is
uninsured [.]") (quoting Julian James, managing director of Lloyd's inNorth America)); Joseph
B. Treaster, Companies Won't Say ifThey Were Insured for Net Attacks, NY. Times Abstracts,
"
Feb. 10, 2000, at C.6 (quoting an insurance company spokesman as stating: The cyberattack
is not covered under the standard business interruption
policy[.]' ").
Insurance Coverage for "Cyber-Losses" 893
e-commerce and other Internet-related activities. Included among these

are "secure systems," which
provide first-party property coverage, and
"Netsecure," which covers both first-party and third-party losses. Of
course, companies that already have purchased such policies should take
advantage of the coverage theymay provide. Companies that do not have
specialized coverage for electronic commerce-related losses, as the over
whelming majority of companies do not, and thatmay be exposed to such
risks should consult with coverage counsel regarding the potential benefits
of such supplemental coverage. In any event, careful attention should be
paid to the coverage that already may be afforded by existing first- and
third-party insurance programs.
This article provides an overview of typical first-partybusiness insurance
coverage that may respond to e-commerce-related risks. Part II briefly
describes some of the relevant risks, focusing on potential sources of eco
nomic loss thatmay be covered by traditional property insurance policies.
Part III provides an overview of some of the issues that may arise if a
policyholder seeks coverage for these risks under its first-party insurance
program. Finally, Part IV provides a summary of other types of traditional
insurance thatmay be available to cover e-commerce-related risks.
II. SOURCES OF E-COMMERCE-RELATED LOSS
With more business coming from the e-commerce environment, compa

nies need to consider corresponding e-commerce risks. Some of the
sources of first-partye-commerce-related loss include hardware, software,
or data loss; remediation costs; business interruption; and extra costs re
lated to business interruption.
A. Hardware, Software, orData Loss

The vast majority of companies rely on their computers and the data they
store merely to carry on day-to-day operations. A single hard-disk drive
on one computer may contain thousands of dollars' worth of computer
software. Potentially even more valuable are the thousands or even millions
of bytes of data that have been entered into the system.A company's soft
ware and data represent a significant financial investment. Even with rea
sonable backup systems in place, itmay not be possible to restore all de
a to invest
stroyed or corrupted data. At minimum, the company may have
substantial time and money to do so.
are subject to nu
Unfortunately, computer hardware, software, and data
merous internal and external threats. Among these are typical property
threats, such as fireand flood, aswell as environmental threatsmore unique
to computers, such as static electricity, power failures, or power surges. In
addition, there are external on-line threats, such as hacker attacks or com
puter viruses. For example, a hacker may send superfluous streams of data
to interfere with ordinary business operations or break a com
through
pany's security systems to destroy or steal valuable data.
Similarly, files, software, and data can be destroyed by computer viruses,
which are self-replicating programs that can spread from one computer to
another.When a virus infects the hard drive of a computer, the
company's
valuable data can be altered in such a way that it is rendered inoperable,
permanently damaged, or completely erased. Indeed, computer viruses can
cause billions of dollars in damage to hardware, software, and data. As
mentioned above, a striking example of the damage a virus can cause re
cently made international headlines when the "VBS/LoveLetter.worm,"6
known as the Love Bug, caused a flood of e-mails to sweep through com
puter networks worldwide in less than a day.
Originating in aMicrosoft Outlook e-mail message, the Love Bug has
been themost disruptive computer virus to date.When the e-mail's entic
ing attachment7 was opened, the Love sent copies of itself to all of the
Bug
addresses in the user's address book, jamming and crashing e-mail systems.
Next, the Love Bug overwrote several types of files, destroying data in the
process. Finally, it attempted to download and install an executable file that
would e-mail passwords to a predetermined address.8
The Love Bug spread even more quickly thanMelissa,9 which accessed
only the first fiftyaddresses in each user's address book, and was more
destructive than ExploreZip, which shut down computers for several days,
including some atMicrosoft and other large corporations.10 The Love
6. Discovered onMay 4,2000, theVBS/LoveLetter.worm is a dangerous VBScript worm.

A worm is not technically a virus but
usually spreads via e-mail or Internet Relay Chat. See
<www.mcafee.com/viruses/ (visited May 8, 2000). "VBS" refers to a
virus_glossary.asp#w>
new method of
spreading viruses by using Visual Basic Scripting. See id.
7. The virus arrives in an e-mail message with this format:
SubjectTLOVEYOU"
Message "kindly check the attached LOVELETTER coming from me."
Attachment "LOVE-LETTER-FOR-YOU.TXT.vbs"
8. The Love Bug downloads and installs an executable file called WTN-BUGSFIX.EXE
from the Internet. This exe. file is a
password-stealing program that will e-mail any cached
passwords to the mail address MAILME@SUPER.NET.PH. To facilitate the download, the
worm sets the start-up page ofMicrosoft Internet Explorer to point to theWeb page con
taining the password "stealing trojan."
9. Reported to the press on March 26, 1999, Melissa is a macrovirus and, like the Love
Bug, is famous for its use of e-mail propagation using MS Outlook! Melissa creates an Outlook
object using Visual Basic instructions and reads the list of members from the address book.
An e-mail message is created with the subject "Important From" Applica
Message
tion.UserName, and with a body text of "Here is that document you asked for ... don't show
anyone else ;-)." The active infected document is attached and the e-mail is sent. The con
tent of the document is a list of pornographic Websites. See <http://vil.mcafee.com/
> (visited 8, 2000).
dispVirus.aspPvirus May
10. See Gary Chapman, The Cutting Edge: Focus on
Technology Digital Nation, L.A. Times,
July 5, 1999, at C-l, available in 1999 WL 2174609.
Insurance
Coverage for "Cyber-Losses" 895
Bug's victims to date include theWhite House, Congress, the Pentagon,

the Central Intelligence Agency, and the British House of Commons.11
The cost of the Love Bug has been estimated atmore than $15 billion.12
The Melissa and ExploreZip explosions of 1999 and the more recent
Love Bug attacks underscore the vulnerability to computer viruses of com
in e-commerce or e-communication.13
panies engaged
B. Remediation Costs
Many companies now are evaluating their vulnerability to various

e-commerce-related risks. Certain risksmay be reduced technologically,
e.g., by acquiring backup systems to guard against business interruption,
installing special filters to block or deflect "spamming" hacker attacks,14
strengthening "firewalls" (network input and output screening devices or
software), or upgrading antivirus programs.15 However, just as in themili
tary arena, technological advances can result in new perils arising more
rapidly than defenses to those perils can be developed. Accordingly, even
the best-prepared companies may fall prey to e-commerce risks.
C. Business Interruption
When a company loses software or data to a virus or other e-commerce
related peril, it also may sufferbusiness interruption losses. Indeed, a com
puter virus or hacker attack literally can bring business to a halt.16 Business
interruption typically causes first-party loss. For example, information sys
temsmay freeze, requiring the company to repair or replace its equipment.
However, business interruption also may give rise to third-party liabilities
due to loss of data or denial of service. For example, third parties harmed
a denial of service may sue the company, adding
by third-party liability
losses to first-partyproperty and business interruption damages.
11. There are a growing number of variants of the Love Bug being transmitted via e-mail
attachment. See <http://vil.mcafee.com/dispVirus.aspPvirus> (visited May 8, 2000).
12. See, e.g., PR Newswire, May 22, 2000, available inWESTLAW ALLNEWSPLUS
database; J. Com. Abstracts 12, supra note 5.
13. See Thomas E. Weber, No Catastrophe, butDeath by a Thousand Clicks,Wall St. J.,May
5, 2000, at Bl, available in 2000 WL-WSJ 3028176; Annette Cardwell, "Melissa" Joins Ranks
a at 046, available in 1999 WL
of Destructive Few, Boston Herald, Apr. 6, 1999, 3394642;
Jon Swartz, Melissa's Evil Twin Attacks PCs, S.F. Chron., June 11, 1999, at B-l, available in
1999 WL 2688773; Matthew Nelson, Deadly ExploreZip Worm Reemerges In Compressed For
mat, 21 InfoWorld (Dec. 6, 1999), available in 1999WL 29440484.
14. Spamming or smurfing refers to a process by which hackers flood a server with mes
sages for the purpose of disrupting the business. See, e.g., Jared Sandberg, Internet Vandals
Pose Threat byUsing New Mode ofAttack Called "Smurfing,"Wall St. J., Jan. 9, 1998, at B18,
availablein 1998
WL-WSJ 3478307.
15. As discussed infra, companies may have coverage formeasures undertaken tomitigate
the potential effect of e-commerce-related risks.
16. Anick Jesdanun, How Hackers Bombard Sites and Shut Them Down, L.A. Times, Feb. 10,
2000, at A25, available in 2000 WL 2209616.
Hacker attacks have the potential to paralyze a company's e-commerce

business. Some of theWeb's most popular sites were shut down in Feb
ruary 2000 as the result of hacker attacks.17The hackers used a variation
of spamming or smurfing, i.e., flooding a computer or serverwith messages
for the purpose of disrupting the business.18 Stated simply, the hackers sent
commands to hundreds or thousands of servers that, in turn, flooded the
target computers with meaningless data, inundating theWebsites with so
much volume thatmany regular users were denied service. In the weeks
following the initial attacks, the FBI's Website was taken off-line for several
hours by a hacker attack;19 and a Chinese Website selling goods from fifty
top domestic stores was shut down.20
Computer viruses often cause similar business interruption. For exam
ple, the Love Bug, Melissa, and ExploreZip21 all caused business interrup
tion and resulting denial of services. Additionally, "Web snatching" viruses
cause business interruption by
automatically moving an Internet browser
from his or her selected site to a different site without the browser's per
mission.22 Often, the user cannot escape from theWeb snatcher's sitewith
out completely shutting down the computer.23
Such e-commerce perils can have serious financial consequences. A com
pany generally must use financial resources to recover from the problem
and protect its systems against any recurrence. In addition, business inter
ruption losses may be significant. Furthermore, third parties harmed by a
denial of service may sue the company, thereby adding third-party losses
to first-party property and business interruption
damages. The company
also may lose consumer confidence and ultimately market capital.
D. Extra Costs Related toBusiness Interruption
During a period of business interruption, an insured may have to expend

financial resources over and above the normal costs that itwould have
incurred during the same period had there been no interruption.
Examples
of extra expenses in this contextmight include the costs of
operating aWeb
17. See supra note 2.

18. See Lee Gomes, "Digital Forensics" Sleuths Sniff for Clues from Routers Monday, Wall
St. J. Eur., Feb. 14, 2000, at 29, available in 2000 WL-WSJE 2945382.
19. See Thomas C. Greene, FBI Web Site Hacked
(posted Mar. 16, 2000), available in <http://
www.theregister.co.uk /000316-000007.html>.
20. See China WebsiteIT163.com Closed byHacker Attack, Reuters (posted Mar. 10, 2000),
available in <http://www.
mercurycenter.com/svtech/news/breaking/internet/docs/3059471
.htm>.
21. ExploreZip shut down computers around the world for several
days, including some
at Microsoft and other large corporations as well as the See Chapman,
Pentagon. supra
note 10.
22. See, e.g.,Gary M. Slep & E-Business Risks, 13 John Liner
Emily Q. Freeman, Managing
L. Rev. 25, 26 (2000)
(discussing "Web snatching" viruses).
23. Id.
Insurance
site through an alternate Internet service provider, a public

mounting
relations effort to counteract negative publicity, and the cost of restoring
lost data.24
III. OVERVIEW OF FIRST-PARTY COVERAGE ISSUES
There are a number of different typesof property insurance that

potentially
afford coverage for e-commerce risks, including standard property insur
ance, inlandmarine insurance, and commercial property insurance. Among
the various types of commercial property insurance, all-risk insurance pol
icies typically provide the broadest coverage and generally cover all causes
of damage except those specifically excluded.25 Accordingly, the insurer
bears the burden of establishing some limit to the coverage obligations by
specifically proving that a loss is not covered.26 Because of the current
prevalence and popularity of all-risk policies purchased byU.S. companies
and the potential for e-commerce coverage under them, this article focuses
specifically on these policies.
Although the extent of property insurance coverage for e-commerce
related claims depends upon the specific insuring language of the policy at
issue, the type of property insured, and applicable conditions and exclu
sions, all-risk insurance policies typically provide coverage for fortuitous
"physical loss or damage to" covered property. The following discussion
provides an overview of some of the issues thatmay arise if a policyholder
pursues first-partycoverage for the e-commerce-related losses, including
repair or replacement of damaged software or data, remediation costs, busi
ness interruption losses, and extra expense costs.
A. Repair orReplacement ofDamaged Property

In general, establishing first-partycoverage for property repair or replace
ment involves demonstrating the existence of "insured property" that has
suffered "physical loss, or damage" during the policy period. Accordingly,
there are three relevant inquiries:
(1) Do damaged or corrupted software, hardware, or data constitute "in
sured property"?
(2) If so, has the property suffered "physical loss, or damage"?
24. See generally Steven N. Ambort, Business Interruption in theElectronic Age, 13 John Liner
L. Rev. 50, 51 (2000) (providing examples of extra expenses that companies may face in this
context).
25. See generally Peter J. Kalis, Thomas M. Reiter & James R. Segerdahl, Policy
holder's Guide to the Law of Insurance Coverage, ? 13.02[B], at 13-8 to 13-9 (1997)
v. Marine & Cox Corp., 579
(quoting Texas Eastern Transmission Corp. Office-Appleton
F.2d 561, 564 (10thCir. 1978)).
26. See generally 13A George J. Couch, Cyclopedia of Insurance Law ? 48:142 (1982 &
Supp. 1992); Kalis, Reiter & Segerdahl, supra note 25, 13.02[B], at 13-8.
898 Tort& InsuranceLaw Journal, Volume 35,Number 4, Summer 2000
(3) If so, did the loss or damage occur during the policy period, such
that the policy is "triggered"?
Frequently, all three of these questions may be answered in the affirmative.
As the following discussion makes clear, the first two questions are con
ceptually related in this context. However, for clarity, this section discusses
each of these questions separately.
1. Do Damaged or Corrupted Software, Hardware,

or Data Constitute "Insured Property"?
A typical definition of "insured property" covers "[t]he interest of theAs
sured in all real and personal property owned, used, or intended for use by
theAssured, or hereafter erected, installed, or acquired...." Some insurers
may attempt to argue that software programs or electronically stored data
do not constitute "property." However, the better-reasoned cases have up
held coverage for damages to computer software and data. For example,
theMinnesota Court ofAppeals ofMinnesota inRetail Systems,Inc. v. CNA
Insurance Co.27 held that computer tape and the data contained on the tape
constitute tangible property. The court noted that the data on the tape
were "of permanent value and [were] integrated completely with the physi
cal property of the tape."28
as inap
Significantly, the Retail Systems court considered and rejected
a series of cases that had concluded that computer tapes are intan
posite
gible property for tax purposes.29 The court reasoned that, although the
data storage medium (the computer tapes) may have little value for tax
purposes, those tapes may have considerably greater value when used for
storage of valuable data:
Having inmind the decisions that tapes are intangibleproperty,we have con
sidered whether these tax should an insurance case and
precedents govern
conclude that they should not. Because data can be removed froma computer
tape at any time, the transferof the physical property (the tape) is only inci
dental to the purchase of the knowledge and informationstored on the tape.
27. 469N.W.2d 735 (Minn. 1991).

28. Id. at 737. The Retail Systems court was asked to construe a clause
providing coverage
for "physical injury or destruction of tangible property." Id. at 736. The court reasoned that
"[a]t best, the liability policy's requirement that only tangible property is covered is ambig
uous" and therefore concluded that "this term must be construed in favor of the insured." Id.
at 737.
29. Compare Texas Instruments v. United States, 551 F.2d 599, 611 (5th Cir. 1977) (infor
mation stored on computer tapes was tangible property), with Ronnen v. Comm'r, 90 T.C.
74, 100 (1988) (information stored on duplicate computer disks was not tangible property).
See generally Couch, supra note 26, ? 126:40 ("There is authority that computerized infor
mation is tangible property."); Christopher Vaeth, Annotation, Loss of Information Stored in
or on
Computer System Computer Disk Cartridge, Computer Tape, or Similar Computer Storage
Media as Within
Coverage ofLiability Policy, 85 A.L.R.4th 1102 (1991) (citing cases).
Insurance
Thus, the tape has littlevalue for taxpurposes. But if the tape is lostwhile it
still contains the data, as is the case here, its value is considerably greater.30
Notably, the court inRetail Systems expressly affirmed the trial court's hold
ing that coverage would have existed under either the general liability
section of the policy or the section of the policy that "covered loss of
property."31
Similarly, inCentennial Insurance Co. v.Applied Health Care31 the Seventh

Circuit, applying California law, ruled that an insurer was obligated to
defend claims against its policyholder that sought coverage for damage to
a third party's computer data processing system caused
by the policy
holder's product, a faulty electronic switchboard.33 Specifically, the court
rejected the insurer's argument that any injury suffered by the customer
was not property damage within the coverage of the
policy34 and held that
a fair reading of the complaint, which that the
alleged policyholder's de
fective controllers caused a loss of information stored in a data processing
system, clearly raised the "spectre that liability for property damage may
ensue."35 Although the policy in dispute inApplied Health Care was a lia
bility policy, the court's reasoning and holding should have equal appli
cation in the first-party context. Indeed, the standard form commercial
general liability policy definition of "property damage" expressly requires
"loss of use" or "physical injury to tangible property." By contrast, the
standard all-risk policy does not require injury to "tangible" property. For
this reason, any precedents finding insufficient tangibility and physicality
30. Retail Systems, 469 N.W.2d at 738 (citation and footnote reference omitted). Cf. Rock
port Pharmacy, Inc. v. Digital Simplistics, Inc., 53 F.3d 195, 198 (8th Cir. 1995) (Missouri
law) (suggesting that data are not tangible property under a commercial general liability
policy); Magnetic Data, Inc. v. St. Paul Fire & Marine Ins. Co., 442 N.W.2d 153, 156 (Minn.
1989) (liability insurance policy did not provide coverage for policyholder's erasure of its
customer's computer disk cartridges; the court did not find itnecessary to determine whether
the information stored on the computer disks was tangible or intangible property); St. Paul
Fire and Marine Ins. Co. v.Nat'l Computer Sys., Inc., 490 N.W.2d 626, 631 (Minn. Ct. App.
1992) (misappropriation of confidential proprietary information was not "tangible property"
within meaning of commercial general liability policy).
31. Retail Systems, 469 N.W.2d at 738.
32. 710F.2d 1288 (7thCir. 1983).
33. See id. at 1289 n.l.
34. The policy defined "property damage" to include:
(1) physical injury to or destruction of tangible property which occurs during the policy
use thereof at any time resulting therefrom, or (2) loss of use
period, including the loss of
of tangible property which has not been physically injured or destroyed provided such loss
of use is caused by an occurrence during the policy period.
Id. at 1290-91.
35. Id. at 1291. The court noted that the question of whether the third party would be
successful in proving property damage at trialwas irrelevant in determining the insurer's duty
to defend. See id. at 1291 n.7. Accordingly, the court found it unnecessary to resolve the
a as
question of whether information stored in data processing system could be characterized
tangible property. See id.
in the context of liability policies have only limited applicability in the first
context.
party
Likewise, the tangible nature of data has been recognized in other con
texts. For example, theU.S. District Court for the District of Arizona in
American Guarantee & Liability Insurance Co. v. IngramMicro, Inc.36 recently
relied on a definition of "damage" from criminal statutes in support of its
or damage" to an
holding that a power outage caused "direct physical loss
insured's computer system because the computer data on the systemwere
lost and needed to be replaced. The court stated as follows:
The federal computer fraud statute, which makes it an offense to cause

damage
to a protected computer, defines damage as "any impairmentto the integrity
or of data, a program, a system, of information." 18 U.S.C. ? 1030
availability
(West 1999). In Connecticut, a person is guilty of computer crimewhen he
"disrupts or degrades or causes the disruption or degradation of computer
services." Conn. Gen. Stat.
? 53a-251 (2000). InMinnesota, computer damage
includes the alteration of any computer, computer system, computer network
or computer software. Minn. Stat. ? 609.88 (1999). In Missouri, to a
damage
computer is defined as "any alteration,deletion, or destruction of any part of
a computer systemor network."Mo. Ann. Stat. ? 569.093 (West 1999). In
New York, a person isguiltyof computer tampering in the fourthdegreewhen
he "intentionally alters in any manner or
destroys computer data or a computer
program of another person."N.Y. Penal ? 156.20 (McKinney 1999).

The Court ismindful that these definitionsappear not in insurance coverage
cases, but in the penal codes of various states. Their relevance, however, is
that when a com
significant. Lawmakers around the country have determined
data is unavailable, there is damage; when a services are
puter's computer's
there is damage; and when a software or network is
interrupted, computer's
altered, there is damage. Restricting thePolicy's language to thatproposed by
American would be archaic.37
Similarly, in United States v. Riggs38 the U.S. District Court for the
Northern District of Illinois held that the act of digitally transmitting a
computer text file qualified as a theft of a "good, ware or merchandise"
under 18U.S.C. ? 1343 (the federal wire fraud statute). As the Riggs court
explained:
Although not printed out on paper, a more conventional formof tangibility,

the informationin [thefraud victim's] E911 textfilewas allegedly stored on
computer.Thus, by simplypressing a fewbuttons, [thedefendant] could recall
that information from computer storage and view it on his computer terminal.
The information was also accessible to others in the same fashion iftheysimply
pressed the right buttons on their computer.... The accessibility of the in
36. Civ. 99-185 (D. Ariz. Apr. 19, 2000), leave to appeal granted (D. Ariz. June 14, 2000).
37. Slip op. at 4-5 (emphasis added).
38. 739 F. Supp. 414 (N.D. 111. 1990).
Insurance
formation in readable form from a ... makes the in

particular storage place
formation transferable, salable and, in this court's it
tangible, opinion, brings
within the definition of "goods, wares, or merchandise" under ? 2314.39
In addition, courts have held that computer programs and data constitute
tangible "property" in the context of copyright disputes. For example, in
Stern Electronics, Inc. v. Kaufman*0 the Second Circuit held that both a
written computer program and the sights and sounds of that program's
audiovisual display were copyrightable "property" under the Copyright
Act.41 The Kaufman court also affirmed that "all portions of the program,
once stored inmemory devices anywhere in the game, are fixed in a tan
gible medium within themeaning of the Act."42

Policyholders may rely on these precedents to support their argument
that damaged or corrupted software, hardware, or data constitute tangible
"property." Assuming that computer systems and data are "property," a
court also should determine that the systems and data constitute "insured
property." Although this issue necessarily will turn on the specific policy
provisions at issue, most all-risk policies are written broadly to cover an
insured's property unless specifically excluded.43 Thus, absent an express
policy exclusion, damages or corrupted software, hardware, and data should
qualify as "insured property" under first-partyall-risk policies. In addition,
some all-risk policies contain specific "corruption of data" provisions,
which explicitly recognize that data, coding, programs, and software con
stitute covered property under the policies.
2. Has the Property Suffered "Physical Loss or Damage"?
Assuming that computer software and electronically stored data constitute

"insured property," a distinct but conceptually related question iswhether
the property has suffered "physical loss or damage." First-party all-risk
policies typically provide insurance "against all risk of physical loss of, or
damage to the insured property as well as the interruption of business,
39. Id. at 422. Cf. United States v.Wang, 898 F. Supp. 758, 761 (D. Colo. 1995) (computer
program does not constitute "goods, wares, merchandise, securities or money" for purposes
of 18 U.S.C. ? 2314 (National Stolen Property Act); therefore, source code is intangible
property protected by 18U.S.C. ? 1343); United States v. Brown, 925 F.2d 1301, 1308 (10th
Cir. 1991) (computer program and source code were intangible intellectual property and, as
such, did not constitute goods, wares, merchandise, securities, or monies that had been stolen,
converted, or taken within the meaning of 18U.S.C. ? 2314).
40. 669 F.2d 852 (2dCir. 1982).
41. Id. at 855-56.
42. Id. at 856 n.4; see also Lotus Dev. Corp. v. Paperback Software Int'l, 740 F. Supp. 37,
...
45 (D. Mass. 1990) (noting that "as a general proposition computer program?including
both source code and object code?if are copyrightable"). See
original, generally Terry Budd
& Curtis B. Krasik, The Y2KTimebomb?Policy holders Run for Coverage, 2 Coverage 8 (1998).
43. See generally Kalis, Reiter & Segerdahl, supra note 25, ? 13.02[B], at 13-8; see also
Budd & Krasik, supra note 42, at 5.
except as hereinafter excluded." Likewise, a "corruption of data" clause

also may refer to physical loss or damage: "Physical loss or damage shall
include the accidental, intentional or malicious distortion, corruption, ma
nipulation, erasure or loss of data, or software of any kind."
Where a policy does not contain a separate clause, insurers may resist
coverage for a claim on the alleged basis that computer software or elec
tronic data have not suffered actual "physical" damage within themeaning
of the policies. In other words, because viruses and hacker attacks allegedly
do not "physically" destroy a computer or machine in the same way that a
fireor flood destroys a building, insurersmay argue that there has not been
a "physical" loss. However, based on existing law, the language of the pol
icies, and the nature of the damage, policyholders usually should prevail
on such arguments.
Most hacker attacks, computer viruses, and other e-commerce-related
perils result in actual physical damage. For example, viruses physically in
sinuate themselves onto storage media and thenmay corrupt data that also
physically reside on the computer storage media, such as hard disk drives.
The fact that in the modern age magnetic changes on hard disk drives
destroy the valuable data, as opposed, for example, to a fire or flood in a
warehouse of paper records, does not change the fact that in each instance
the losses result from tangible physical changes to the insured property.44
Likewise, where a hacker attack targets a computer system orWebsite and
actual physical damage is occurring, data may be deleted. In either instance
the policyholder may point to tangible physical damage.
Moreover, the typical "all-risk" wording arguably does not even require
physical damage?as long as there is some form of damage?because the
policy wording requires either "physical loss" or "damage." As the court in
Aluminum Co. ofAmerica v. Accident & Casualty Insurance Co.45 explained,
44. One commentator has observed:
[BJecause of the importance of computers inmodern society, it seems almost antediluvian

to refuse to treat
injury to a computer as we would injury to a generator when injury to
the former may be in fact more devastating to the and to commerce. In
policyholder
addition, the damaged computer system does appear to have material manifestations of
injury. The machine will not perform basic tasks. The screen records an error message.
The keyboard is locked; only shutting off the power (even are not
though you supposed to
without first exiting the program) will unlock the system. Overall, this looks like physical
injury.
JeffreyW. Stempel, Law of Insurance Contract Disputes ? 23.07, at 23-63 (2d ed. Supp.
2000). This commentator further
recognized that "[e]ven though computer problems are not
as obvious as smashed
ceilings and the like, they are readily detectable by an ever-growing
part of the population with computer literacy." Id.? 23.07, at 23-64.
45. No. 92-2-28065-5 (Wash. Super. Ct., King Cty. Oct. 17,1995) (applyingPennsylvania
law), reprinted in IOMealey's Litig. Rep. ?Ins. 10, atH-1 (Jan. 16, 1996); see also Aluminum
Co. of Am. v. Accident & Cas. Ins. Co., No. 92-2-28065-5 (Wash. Ct. App. King Cty. Oct.
10, 1995) (applying Pennsylvania law), reprinted in 9Mealey's Litig. Rep. ?Ins. 47, at D-l
Insurance
the presence of the disjunctive "or" supports a construction that "damage"

need not be "physical" in nature:
The contract language recited above ("all risk of physical loss of, or damage
to, insuredproperty") isnot clear regarding the typeof "damage" thatqualifies
as a covered peril:must the damage be of a purely physical nature ... ?The
commas which set off "or damage to" appear to separate the adjective "physi
cal" from "damage." The cases cited by defendants for the proposition that
"physical loss or damage" must be interpretedto require physical damage are
not particularlypersuasive in thiscontext:many of those cases equate "physical
loss or damage" to "physical damage" with no discussion and do not address
the impact of the commas (whose general function is to set the enclosed
word(s) offfrom the remainder of the sentence or phrase). In addition, there
is no contractual definition of "physical loss of, or damage to."46
a
Accordingly, "damage" alone may satisfy the policy language.47 At
minimum, this reasonable interpretation supports a policyholder's argu
ment that the language is ambiguous48 and therefore should be resolved in
favor of coverage under well-established principles of insurance contract
interpretation.49
Similarly, other courts have found "physical loss, or damage" in the ab

sence of physical destruction of property based on a "loss of use" analysis.50
For example, in American Guarantee & Liability Insurance Co. v. Ingram
Micro, Inc.,51 the U.S. District Court for the District of Arizona recently
held that loss of use and functionality of a computer system constituted
"physical damage." In that case, the policyholder, Ingram Micro, Inc.,52
was a wholesale distributor ofmicrocomputer products that used a world
wide computer network53 to track its customers, products, and daily trans
(Oct. 17, 1995). But see Col D'Var Graphics, Inc. v. Forrester Enters., 1995 Wis. App. 10,
LEXIS 966 (Aug. 8, 1995) ("There is no language evincing an intent to cover economic,
or other to any
consequential non-physical damage. The language does not extend coverage
and all damages resulting from the damages to or loss of property. Rather, itprovides coverage
Dev. Corp. v. Graphic Arts Mut. Ins. Co., 527
only for damage to the property."); HRG
N.E.2d 1179, 1180 (Mass. App. Ct. 1988) ("Nor do we think the salient phrase ('physical loss
or damage') fairly can be construed tomean physical loss in the absence of physical damage.").
46. No. 92-2-28065-5, at 2 (citing Garber v. Travelers Ins. Co., 421 A.2d 744, 745 (Pa.
Super. Ct. 1980)).

47. See generally Budd & Krasik, supra note 42, at 5.
48. AIU Ins. Co. v. Superior Court, 799 P.2d 1253, 1268 (Cal. 1990).
to 20-6.
49. See generally Kalis, Reiter & Segerdahl, supra note 25, ? 20.02, at 20-4
Courts inmany states have held that where insurance policy terms are undefined, they should
be interpreted according to the policyholder's reasonable expectations of coverage. See, e.g.,
AIU Ins. Co., 799 P.2d at 1268. See generally Couch, supra note 26, ? 22:11, at 22-24 (3d ed.
1997). These courts tend to liberally construe the scope of what constitutes "physical loss or
Insurance Law and Practice ? 3092 (West Supp. 1998).
damage." See generally 5Appleman's
50. See generally Budd & Krasik, supra note 42, at 5.
51. Civ. 99-185 (D. Ariz. Apr. 19, 2000), leave to appeal granted (D. Ariz. June 14, 2000).
52. Hereinafter Ingram.
5 3. Hereinafter Impulse.
actions. All orders were processed through Impulse. In October 1998,

American Guarantee & Liability Insurance Company54 issued to Ingram a
property insurance policy, that insured Ingram's computers, including Im
pulse, against "[a]ll risks of direct physical loss or damage from any cause,
howsoever or wheresoever
occurring."55
Ingram's data processing and database maintenance operations were per
formed primarily at Ingram's Tucson Data Center.56 On December 22,
1998, the data center experienced a power outage. Consequently, all of the
electronic equipment at the data center, including the computers and tele
phones, stopped working. Although the data center was up and running at
the mainframe level within one and a half hours, it took eight hours to
restore the computers and other equipment that connected the data center
to the rest of the Impulse system. During that time, connections between
the data center and six Impulse locations in theUnited States and Europe
were interrupted and
Ingram could not conduct business. Ingram employ
ees finally patched the network
together as the result of bypassing a mal
functioning matrix switch. It was later discovered that all programming
information, including custom configurations, disappeared from the ran
dom access memory during the power outage. The matrix switch had to
be reprogrammed with the necessary custom configurations before reliable
communications with the six Impulse locations could be restored.
Ingram made a claim under itspolicy to cover its losses. American denied
the claim and filed a declaratory judgment action against Ingram. Ingram
filed a counterclaim for breach of contract. American argued that, although
certain data entry and reconfiguration processes were necessary tomake
Impulse operate as it had before the power outage, the computer system
and thematrix switchwere not "physically damaged" because "[t]he power
outage did not adversely affect the equipment's inherent ability to accept
and process data and configuration settings when
theywere subsequently
reentered into the computer system."57 Ingram
argued that "physical dam
age" includes loss of use and functionality.Adopting a broad view of "physi
cal damage," the court agreed with Ingram:
At a timewhen computer technology dominates our professional as well as

personal lives,theCourt must sidewith Ingram's broader definitionof "physi
cal damage." The Court finds that "physical damage" isnot restrictedto the
physical destruction or harm of computer circuitrybut includes loss of access,
loss of use, and loss of
functionality.
54. Hereinafter American.

55. Slip op. at 2.
56. Hereinafter Data Center.
57. Slip op. at 4.
Insurance
In thiscase, Ingram does allege propertydamage?that as a resultof thepower

outage, Ingram's computer system and worldwide computer network physi
cally lost the programming information and custom configurations necessary
for them to function. were for one
Ingram's mainframes "physically damaged"
and one half hours. Itwasn't until Ingram employeesmanually reloaded the
lost programming information that the mainframes were
"repaired." Impulse
was "physicallydamaged" for eight hours. Ingram employees "repaired" Im
pulse by physicallybypassing amalfunctioningmatrix switch.Until thisrestore
work was conducted, mainframes and were
Ingram's Impulse inoperable.58
Courts similarly have found "physical loss, or damage" in the absence
of physical destruction of property based on a "loss of use" analysis in other
contexts. For example, inFarmers Insurance Co. ofOregon v. Trutanich*9 the
policyholder made a claim under an all-risk homeowners' policy for the
cost of remediating damage to rental property caused by odors that in turn
were caused by a methamphetamine manufacturing operation.60 The in
surer denied coverage, among other things, on the basis that the mere
presence of odors did not constitute evidence of "direct physical loss."61
The Oregon Court of Appeals rejected the insurer's argument. In holding
that therewas direct physical loss, the court employed a "loss of use" anal
ysis, explaining that "the odor produced by themethamphetamine opera
tion had infiltrated the house" and therefore "[t]he cost of removing the
odor [wa]s a direct physical loss."62
cases have held that there is "direct
Similarly, courts in asbestos products
physical loss" when a policyholder is required to remove asbestos from a
structure, notwithstanding insurers' arguments that the asbestos does not
"physically" alter, destroy, or affect the structure itself.As theMinnesota
Court of Appeals in SentinelManagement Co. v.New Hampshire Insurance
Co.63 explained:
Although asbestos contamination does not result in tangible injury to the

physical structureof the building, a building's functionmay be seriously im
con
paired or destroyed and theproperty rendereduseless by thepresence of
taminants. .. .Under these circumstances, we must conclude that contami
nation by asbestosmay constitute a direct, physical loss to propertyunder an

all-risk insurance policy.64
58. Id. at 4, 5 (emphasis added).

59. 858 P.2d 1332 (Or.Ct. App. 1993).
60. Id. at 1334.
61. Id. at 1335.
62. Id. at 1336; see also Hughes v. Potomac Ins. Co., 18 Cal. Rptr. 650, 655 (Cal. Ct. App.
1962) (employing a "loss of use" analysis and holding that there was covered property damage
when a landslide left the policyholder's house perched on the edge of a cliff, even though
there was no physical or tangible injury to the insured structure itself).
63. 563 N.W.2d 296 (Minn. Ct. App. 1997).
"
64. Id. at 300. The Sentinel Management court also affirmed '[d]irect physical loss' pro
not
a
visions require only that covered property be injured, destroyed." Id.
Policyholders may rely on these precedents to establish that "physical

loss, or damage" does not require actual physical destruction of property;
rather, the requirement is satisfied where damage has caused the policy
holder to suffer a "loss of use" of the covered property. Such a loss of use
may occur, for example, when aWebsite crashes or is temporarily frozen
by a hacker attack. All-risk first-party coverage should be available in such
a case to indemnify policyholders for repair costs and consequential busi
ness interruption losses.
Furthermore, courts in some jurisdictions have held that any require
ment of "physical" damage is satisfied when a defective product has been
incorporated into a larger final product or structure, even in the absence
of physical destruction of the final product or structure. A leading case
employing this reasoning is Eljer Manufacturing Co. v. LibertyMutual In
surance Co.,65 which concerned the availability of coverage under a third
party liability policy for an allegedly defective plumbing system. Even
though the plumbing system had not yet leaked, the Seventh Circuit re
jected an insurer's argument that there had been no "physical injury" trig
gering coverage. The court reasoned that the defective plumbing was a
"ticking time bomb" whose mere presence constituted a "physical injury."
Other courts have applied the "ticking time bomb" concept in the context
of asbestos claims, finding coverage for physical damage to buildings, even
in the absence of the release of asbestos fibers into the air.66
Policyholders may rely on these precedents to support coverage forY2K
remediation, lurking computer viruses, and other perils that have not yet
fullymanifested.
Finally, courts have found e-mails andWebsites sufficiently tangible to
the exercise of over someone
support personal jurisdiction sending e-mail
or maintaining aWebsite.67 these courts may take a broad
Accordingly,
65. 972 E2d 805 (7thCir. 1992),cert,

denied,507U.S. 1005 (1993).
66. See, e.g., Armstrong World Indus., Inc. v. Aetna Cas. & Sur. Co., 45 Cal. App. 4th 1,
91 (Cal. Ct. App. 1996) (holding that even "when there have been no releases of asbestos
fibers, if [the policyholder] is held liable for themere presence of ACBM
[asbestos-containing
the injury to the buildings is a physical one.").
building materials], Although Eljer and Arm
concern the of under
strong availability coverage third-party liability policies, the "ticking
time bomb" reasoning applies with equal force in the
first-party context. See generally Budd
& Krasik, supra note 42, at 6.
67. See Stempel, supra note 44, ? 23.07, at 23-64 Inc. v. Patterson,
(citing CompuServe,
89 E3d 1257, 1266 (6th Cir. 1996) (Website in forum state, combined with other contacts,
supports personal jurisdiction in defamation action because the defendant "consciously
reached out from Texas to Ohio to subscribe to and to use its service tomarket
CompuServe
his computer software on the Internet"); Inset Sys., Inc. v. Instruction Set, Inc., 937 F.
Supp.
161, 164-65 (D. Conn. 1996) (foreign corporation that used the Internet, as well as its toll
free number, to conduct business within State of Connecticut had sufficient minimum con
tacts to support exercise of
personal jurisdiction in trademark infringement action); Edidas
Software Int'l, LLC v. Basis Int'l, Ltd., 947 F. (D. Ariz. 1996) (nonresident
Supp. 413,419-20
software producer purposefully availed itself of protections and benefits of Arizona for pur
poses of establishing specific jurisdiction in a defamation action).
Insurance
view of what constitutes physical injury to an e-commerce site or data

processing system.68
3. Did the Loss or Damage Occur During the Policy Period?
Assuming that the policyholder can establish that there is "physical loss,
or damage" to "insured
property," the final question iswhether the loss or
damage has occurred within the policy period, such that the policy is "trig
gered." All-risk policies generally are triggered by a loss that occurs during
the policy period.69
The California high court inPrudential-LMI Commercial Insurance v. Su
perior Court70 considered the trigger-of-coverage issue in the first-party
context and adopted the so-called manifestation trigger, under which the
only insurer responsible for the loss is the insurer on the risk at the time
that the property damage becomes manifest. Notably, however, the
Prudential-LMI court recognized that the insurer on the risk at this time
is liable for all associated damages, even those occurring subsequent to
expiration of the policy.71Moreover, other courts have adopted approaches
to trigger that permit the policyholder to access policies in force prior to
manifestation of the damage.72
4. Valuation
Assuming that a policyholder can establish that first-partycoverage exists

for repair or replacement of computer systems or data, policy valuation
68. See Stempel, supra note 44, ? 23.07, at 23-64. This commentator also has noted that
"authoritative industry sources appear to have sided with the view that in the modern era the
rendering useless of data processing materials is sufficiently tangible and physical to warrant
at 23-67 (citing Bruce Hillman, Which Insurance Coverage Has theCure
coverage." Id. ? 23.07,
at 6 (May 24, 1999)).
for Computer Virus Infection Damages? Nat'l Underwriter,
69. See, e.g.,United Technologies v. American Home Assur. Co., 989 F.
Corp. Supp. 128,
152 (D. Conn. 1997). Although the trigger issue has been litigated widely in the context of
courts have had relatively little opportunity to address the issue
third-party liability policies,
context. See & Segerdahl, supra note 25, ? 13.08, at
in the
first-party generally Kalis, Reiter
13-56. In the context of third-party claims, courts have applied a variety of trigger positions,
at the date of installation of a
including the installation trigger (coverage is triggered only
defective product); the manifestation trigger (coverage is triggered only by manifesta
tion of property damage); the continuous trigger (all policies in effect from date of incorpo
ration of the defective product until the discovery of damages are triggered); and the "injury
in-fact" trigger (holding that various policies may be triggered, including the policy in effect
when the defective product was installed, the policy in effectwhen damage occurred, and the
See generally id. ? 2.02 (discussing trigger in the
policy in effect when damage is discovered).
context of occurrence-based third-party liability policies).
70. 798 P.2d 1230, 1247 (Cal. 1990).
71. See id.
72. See, e.g., United Technologies, 989 F. Supp. at 152 (multiple injury trigger applied in
determining whether loss occurred during property insurance policy period in connection
with gradual environmental property damage); ALCOA, No. 92-2-28065-5, slip op. at 14
(applying Pennsylvania law) (adopting a form of continuous trigger for environmental prop
erty damage).
provisions may be implicated. Loss caused by damage to or corruption of

hardware, software, or data may fall under the valuation language usually
contained in all-risk forms regarding loss arising out of the destruction of
valuable papers and records. Coverage for such loss typicallymay include
the value of the blank records plus the cost of replacing the information
that the records contained. For example, a valuation provision may provide
that the value of property shall be determined as follows: "Valuable papers
and records: the cost to repair or replace the property with other of like
kind and quality including the cost of gathering and/or assembling infor
mation; or, if not so replaced, actual cash value." "Valuable papers and
records" in turnmay be defined as "written, printed, or otherwise inscribed
documents and records, including but not limited tomicro-inscribed doc
uments, and media."
manuscripts,
In addition, some all-risk coverage forms now contain express provisions
designed to deal with damage to computer-stored information. A sample
clause provides:
At the time of loss, the basis of adjustmentunless otherwise endorsed herein
shall be as follows:
Electronic data the replacement cost new if actually

processing equipment:
if not so at actual cash value deduction for
replaced; replaced, (with proper
depreciation). Should the property insuredbe technologicallyobsolete or un
available because it is no longer available and should the property actually be
replaced then theCompanies shall be liable for the replacement cost new of
equipment thatwill perform the same function(s) as the original equipment
includingany reasonable betterment inherentin thedesign of such equipment.
B. Remediation
A company's costs to remediate computer systems vulnerable to e-com
merce-related risks may be covered under several policy provisions, in
cluding any "sue and labor" clause. Property policies often contain a sue
and labor clause that provides coverage for necessary and reasonable ex
penses to recover or safeguard covered property in the event of actual or
imminent physical loss or damage.73 A typical clause may provide as
follows:
In case of actual or imminentlossor damage bya peril insuredagainst, it shall,
without prejudice to this insurance,be lawful and necessary for the insured,
their factors, servants, or to sue, labor, and travel for, in, and about the
assigns
defense,thesafeguard,and therecoveryof thepropertyor any part of theproperty
insuredhereunder; nor, in the event of loss or damage, shall the acts of the
insured or of this Insurer in recovering, saving, and preserving the insured
property be considered a waiver or an of abandonment.
acceptance
& Segerdahl, .
73. Kalis, Reiter supra note 25, ? 13.10[C], at 13-81 to 13-82
Although sue and labor clauses historically are associated with marine
insurance, such coverage has been maintained inmany modern properly
insurance policies. In general, these provisions obligate the insured to take
all reasonable steps necessary to avert or minimize a loss so as to reduce
the amount forwhich the insurer is liable.74 In turn, the insurermust re
imburse the insured for taking such measures.75
sue and labor provisions in property
Notably, many courts have held that
insurance policies provide an additional and separate type of coverage from
that provided in the main coverage agreement.76 And the weight of au
thority holds that the "sue and labor" clause even applies to efforts taken
solely to prevent covered losses.77 Therefore, an insured is entitled to
74. See generally Stephen A. Cozen, Insuring Real Property ? 51.01, at 51-2 (2000).
75. See, e.g., Armada Supply v.Wright, 858 F.2d 842, 853 (2d Cir. 1988) (the clause affords
coverage for "those reasonable costs borne by the assured tomitigate the loss and thus reduce
the amount to be paid by the underwriter"). Courts differ regarding the types of expenses
that are recoverable. Compare Armada Supply, 858 F.2d at 853 (policyholder was entitled to
recover a wide variety of costs incurred in attempting to a
salvage shipment of fuel oil pursuant
to the sue and labor clause, custom bond and duty taxes, legal
including inspection costs,
expenses, and interest) with Hvide Marine Int'l v. Employers Ins. ofWausau, 724 F. Supp.
180 (S.D.N.Y. 1989) (denying coverage for litigation expenses related to determining cause
of loss because there was no "nexus" between litigation and the preservation of the property).
76. See, e.g.,Home Ins. Co. v. Ciconett, 179 F.2d 892, 895 (6th Cir. 1950) ("[T]he Sue and
Labor Clause is a separate paragraph in the policy independent of the insurance coverage,
and is supplementary to the contract of the underwriter to pay the damage or loss insured
.
The limitation of liability refers to the loss claims under the policy itself, and does
against...
.
not exclude recovery under the ancillary contract.. ."); see alsoWhite Star S.S. Co. v.North
British & Mercantile Ins. Co., 48 F. Supp. 808, 812-13 (E.D. Mich. 1943) ("The law iswell
settled that the sue and labor clause is a separate insurance and is supplementary to the
contract of the underwriter to pay a particular sum in respect to damage sustained by the
v. Lumber Mut. Fire Ins. Co., 371 F.
subject matter of the insurance."); M. J. Rudolph Corp.
Supp. 1325, 1327 (E.D.N.Y. 1974) (same); American Home Assur. Co. v. J.F. Shea Co., 445
F. Supp. 365 (D.D.C. 1978) (same); Armada Supply, 858 F.2d at 855 (recognizing "the fact
that sue and labor clauses have been viewed as separate insurance") (citation omitted); Young's
Market Co. v. American Home Assur. Co., 481 P.2d 817, 819-20 (Cal. 1971) (stating that
the sue and labor clause represents a "separate supplementary insurance agreement [that]
contemplates
a correlative duty of reimbursement separate from and supplementary to the
basic insurance contract"); American Merchant Marine Ins. Co. v. Liberty Sand & Gravel
Co., 282 F. 514, 520 (3d Cir. 1922) (describing the clause as "ancillary to the main contract
of insurance"), cert, denied, 260 U.S. 737 (1922). See generally Appleman, supra note 49, at
160-61 ("[S]uch clause is considered to be a separate insurance and is supplementary to the
contract to pay a particular sum in respect to the damage sustained by the subject matter of
the insurance, and the insurer would be liable for such expenses, in addition to the payment
of a total loss."); Cozen, supra note 74, ? 51.02, at 51-4 (noting that "sue and labor has been
characterized as a kind of 'separate insurance' for the benefit of the carrier alone").
77. See, e.g., Alexandre v. Sun Mut. Ins. Co., 51N.Y. 253, 257 (N.Y. 1873) (explaining that
the object of the sue and labor clause is "to secure diligence in [the] preservation and pro
tection [of the property insured], and thereby prevent a lossor reduce its amount, and to provide
compensation for the labor done and expenses incurred in accomplishing that end") (emphasis
added). But see Seaboard Shipping Corp. v. Jocharanne Tugboat Corp., 461 E2d 500, 503 (2d
Cir. 1972) (sue and labor expenses are "sums spent by the insured or its representative in an
effort to mitigate damage and loss once an accident has occurred"). Note that the inclusion
of the word "imminent" in the policy should remove any doubt that the clause applies to steps
taken to prevent covered losses.
recover sue and labor expenses even "though no actual loss or damage
occurs."78
In addition to the foregoing general principles, the case law indicates
that an expenditure must satisfy two related tests to be covered under the
sue and labor clause: the (1) "proximate cause" test and (2) "reasonable
insured" test. Under the proximate cause test, the expenditure is reim
bursable if it is directly incurred to avoid a covered loss.79Under the rea
sonable insured test, the expenditure is reimbursable if the insured has
acted reasonably or prudently in attempting to mitigate future damages.
The proximate cause test parallels, and overlaps, the "prudent insured"
test.80 If a given expenditure satisfies these tests, the insurer generally is
costs borne by the
obliged to reimburse its insured for the "reasonable
assured tomitigate the loss and thus reduce the amount to be paid by the
[insurer]."81
costs
Relying on the sue and labor clause, insureds may argue that the
to remediate their computer systems to stem damage from
expended
hacker attacks, viruses, or the Y2K problem, for example, have served to
prevent damage to covered property and therefore are recoverable under
their policies. Specifically, an insuredmay argue that its expenditures satisfy
the proximate cause test because the expenditures directly prevented a cov
ered loss. As noted above, many all-risk policies afford broad coverage
"against all risks of physical loss of or damage to property" and may also
contain a "corruption of data" clause that expressly states that "[p]hysical
loss or damage" includes "any destruction, distortion or corruption of any
computer or of any computer data, coding, program or software except as
hereinafter excluded." In addition, an insured would argue that its reme
diation expenses were reasonable, thereby satisfying the prudent-insured
test.Notably, a number of major corporations, including GTE, Unisys,
Nike, Xerox, ITT, and the Port of Seattle, have filed suit against their
78. States Steamship Co. v. Aetna Ins. Co., 59 B.R. 314, 317-18 (N.D. Cal. 1985). See
generally Cozen, supra note 74, ? 51.02, at 51-3 ("[T]he insurer must reimburse the insured
for taking such measures even if
they fail to achieve their aim.").
79. As theNinth Circuit has explained:
... is one of
The fundamental question proximate cause. If a loss is proximately caused by
an event covered
by the policy, the insurer is liable. If the loss is caused by an event excluded
from coverage, the insurer is not liable.... Similarly, expenses reasonably incurred to avoid
a loss that would be covered under the
policy may be reimbursed under the Sue and Labor
Clause, but only if the avoided loss would have been covered.
Commodities Reserve v. St. Paul Fire & Marine Ins. Co., 879 F.2d 640, 642 (9th Cir. 1989)
(federal law).
Bros. v. Northern
80. See, e.g., Blasser Pan-American Line, 628 F.2d 376, 386 (5th Cir.
1980) (federal law) ("An insured has the duty to exercise the care of a prudent, uninsured
owner to protect the insured
property.").
81. Armada Supply, 858 F.2d at 853 (federal law).
property insurers, seeking a judicial declaration thatY2K remediation ex

penses are compensable under the sue and labor clause language.
All-risk insurers likelywould advance a number of arguments to resist
application of the sue and labor clause to e-commerce-related liabilities.
For example, numerous courts have stated or implied that the sue and labor
clause does not afford coverage for costs incurred to prevent uncovered
losses that would not be covered for any reason.82 Accordingly, insurers
an insured prevented either were not cov
likelywill argue that the losses
ered by the policy's all-risk language or were barred by various exclusions
or other defenses. For example, as discussed above, insurers likelywould
argue that the losses do not (1) relate to covered "property" and/or (2) arise
from a "physical" loss of insured property. In addition, insurersmay argue
that the losses are not "fortuitous" or are barred due to late notice or other
defenses for exclusion.83
For example, insurers may argue that the remediation costs would be
82. See, e.g., Reliance Ins. Co. v. The Yacht Escapade, 280 F.2d 482, 489 (5th Cir. 1960)
("The obligation comes into being only when the action taken is to minimize or prevent a
loss for which the underwriter would be liable."); see also Continental Food Prods., Inc. v.
Insurance Co. of N. Am., 544 F.2d 834 (5th Cir. 1977) ("Because the purpose of the clause
is to reimburse the assured for expenses incurred in satisfying his duty to the underwriter,
there is no such duty where the policy, for one reason or another, does not afford coverage.");
Continental Ins. Co. v. Lone Eagle Shipping Ltd. (Liberia), 952 F. Supp. 1046,1071 (S.D.N.Y.
... there would be no contractual
1997) (" Tf the underwriter would not be liable at all
to repay sue and labor.' ") (quoting Reliance, 280 F.2d at 489); Destin Trading Corp.
obligation
v. 1990 WL 238988, *1 (E.D. La. 1990)
Royal Ins. Co. of America, No. Civ. A. 89-5279,
("While the sue and labor clause in a sense provides a supplementary form of coverage, it 'is
.
tied irrevocably' to the policy's insured perils coverage. ..") (citing Reliance, 280 F.2d at 489;
Continental, 952 E Supp. at 1071); States Steamship, 59 B.R. at 317 (In order to recover, the
"loss which is being or is sought to be avoided must be one caused by the operation of an
insured peril."); Southern Cal. Edison Co. v. Harbor Ins. Co., 148 Cal. Rptr. 106, 112 (Cal.
Ct. App. 1978) ("[A] sue and labor clause does not extend or create coverage.") (citations
omitted); Young's Market Co. v. American Home Assur. Co., 481 P.2d 817, 820 (Cal. 1971)
to minimize or prevent a
("The obligation comes into being only when the action taken is
loss for which the underwriter would be liable. If the underwriter would not be liable at all
... there would be no contractual to repay sue and labor."). See generally Cozen,
obligation
not serve to extend or create coverage
supra note 74, ? 51.01, at 51-2.1 ("Such provisions do
for perils that are not insured against in the basic policy language."). Based on this principle,
courts have denied coverage for sue and labor claims, inter alia, when policy exclusions would
have barred coverage for the prevented losses. See, e.g., Southern Cal. Edison, 148 Cal. Rptr.
at 112-13 (no coverage under sue and labor clause for costs incurred to prevent damage to
insured building because defective design exclusion specifically barred costs that the policy
holder incurred in preventing the damage); Youngs Market, 481 P.2d at 821 (no coverage
under sue and labor clause where insured merely prevented a "loss ... expressly excluded
under the terms of the policy"). See generally Cozen, supra note 74, ? 51.06[1], at 51-18 ("[T)t
is axiomatic that sue and labor expenses must be incurred to prevent or minimize loss by a
covered peril.").
83. These defenses are discussed infra Part III.E.
excluded from coverage by the "design defect"84 exclusion.85 However, it

is not necessarily a design defect for programs not to be invulnerable to
e-commerce risks any more than it is a design defect for homes not to be
fireproof or floodproof.86Moreover, even ifa computer program or system
itself contains a design defect, any failure to correct that defect may cause
as computerized company records
peril to other covered property, such
that the defective programs or systems could corrupt or destroy ifnot fixed.
Furthermore, the design defect language itselfmay restore coverage for
"loss or damage resulting from such defective design." Several courts have
held that such language at least creates an ambiguity, and coverage, there
fore,must be afforded.87
Insurers also may argue that the remediation costs would be excluded
from coverage by the "inherent vice"88 exclusion. However, courts have
interpreted this exclusion narrowly. For example, theU.S. District Court
for theDistrict of Connecticut in Standard Structural Steel Co. v. Bethlehem
89has
Steel Corp. explained:
84. A typical "design defect" exclusion may provide that the "[pjolicy does not insure
or ... errors in . .. unless a loss from a
against loss damage caused by design peril not
otherwise excluded ensues and then only for the loss or damage caused by the ensuing peril."
85. See generally Jane Massey Draper, Annotation, Coverage Under "All-Risk" Insurance, 30
A.L.R.5th 170 (1995).
86. Courts have held that an all-risk policy covers a "design defect" where the insured has
a reasonable basis for on the sufficiency of the
relying design. In other words, courts focus
on the "involvement of or other improper conduct on the part of the actor."
negligence
American Home, 445 F. Supp. at 367. See generally Cozen, supra note 74, ? 2.04[ 19](b)(2)[ii],
at 2-94.24 to 2.94.25. Itmay be was not
argued that if the "designer" negligent the defective
design exclusion does not apply.
87. See, e.g.,Husband v.
Lafayette Ins. Co., 635 So. 2d 309 (La. Ct. App. 1994) (the clause
providing "[h]owever, any ensuing loss not excluded is covered" was "patently" ambiguous
and nullified the effect of the entire exclusion); Tex-La v. South State Ins. Co.,
Properties
514 So. 2d 707 (La. Ct. App. 1987) (The policy contained a provision
excluding coverage for
losses caused by faulty workmanship and design "if a peril by this policy contributes to the
loss at any time"; the court found this quoted to be
language ambiguous and interpreted the
latter portion of the provision in favor of the insured); Farmers Chem. Ass'n v.Maryland Cas.
Co., 421 F.2d 319 (6th Cir. 1970) (the court found ambiguity in the application of the exclu
sion that excluded coverage for defective workmanship or or other acci
design "unless fire
dents otherwise recoverable hereunder ensues"; in determining whether the particular facts
constituted another accident, the court ruled in favor of the insured's interpretation).
88. A typical inherent vice exclusion clause may read as follows: "This
policy does not
insure against loss or damage caused by... inherent vice unless a peril not otherwise excluded
ensues and then
only for loss or damage caused by the ensuing peril." Policyholders have
arguments against the "inherent vice" exclusion's application. For example, in some jurisdic
tions the exclusion has no effect where the damage is caused
by negligence. See, e.g., Essex
House v. St. Paul Fire & Marine Ins. Co., 404 F. Supp. 978,992 (S.D. Ohio 1975). In addition,
a
policyholder may argue that the exclusion is applicable only where the problem is not
"readily discoverable" as, some case law suggests, is required for the exclusion to apply. See,
e.g.,Merz v. Allstate Ins. Co., 677 F.
Supp. 388 (W.D. Pa. 1988); Plaza Equities Corp. v.
Aetna Cas. & Sur. Co., 372 F. Supp. 1325, 1331 (S.D.N.Y. 1974); General Am. Transp. Corp.
v. Sun Ins. Office, Ltd., 239 F.
Supp. 844 (E.D. Tenn. 1965), affdper curiam, 369 F.2d 906
(6thCir. 1966).
89. 597 F. Supp. 164 (D. Conn. 1984).
Inherent vice is an exclusion which to losses from natural "or

applies decay,
wear and tear and inevitable Keeton, supra, ? 5.3(c), at
dinary depreciation."
282. The damage in this case was not the normal resultof ordinarywear and
tear or the expected decay of a product when exposed to natural conditions,
which would generally bring about such decay, i.e. the rustingof patio furni
ture left out in the rain for several years, or the natural deterioration of unfin
ishedwood when exposed to the elements over a period of time.90
In addition, insurers may contend that the remediation is not covered
because itwas not undertaken in response to an "imminent" loss, as re
quired by the typical sue and labor clause language.91 Importantly, and
on the language of the policy at issue, "imminence" of harm
depending
may not even be required. For example, inWolstein v. Yorkshire Insurance
Co.,92 the insured sought to recover under a version of the sue and labor
clause93 for lost charter income and cost overruns in completing a 105-foot
yacht that resulted when the original boatbuilder abandoned construction
and subsequently declared bankruptcy.94The insurers denied coverage, ar
to show that the risk of damage to the yacht
guing that the record failed
was "imminent."95 Rejecting the insurers' argument, theWolstein court held
that the insured's actions would be reviewed for reasonableness: "[W]e
hold that just as the expenses will be reviewed for reasonableness, an as
sured's actions will also be reviewed for reasonableness."96 In support of
this holding, the court reasoned that to require that a risk be "imminent"
would place the insured in the position of determining whether therewas
enough evidence to support the immediacy of their action:
To that a risk be imminent before results would create a
require coverage
dilemma for the assured.The assuredwould be placed in the unenviable po
sition of determiningwhether therewas enough evidence to support the im
mediacy of their action and thus allow reimbursementfrom their insurance
policy, or whether they should refrainfrom acting and risk that damage will
90. Id. at 197.

91. In many instances, the same insurers had been warning their policyholders of the need
for prompt action long before the turn of the millennium to prevent Y2K-related losses. For
notice was posted at theWebsite of the American Insurance Associ
example, the following
...
ation: "[T]o avoid more serious problems [t]hose who have not begun this [Y2K] reme
diation process should begin immediately and not assume that the problem does not affect
them, or that itwill go away." The "Year 2000" Issue: An Insurance Industry Perspective (July
1998) (visited June 8, 2000) <www.y2k.aiadc.org/year2000/perspective.html>.
92. 985 P.2d 400 (Wash. 1999).
93. The sue and labor clause inWolstein provided in pertinent part: "[I]n case of any Loss
or Misfortune, it shall be lawful and necessary for the Assured, their factors, Servants and
to sue, labor and travel for, in and about the defense, safeguard and recovery of the
Assigns,
Vessel, or any part thereof[.]" 985 P.2d at 409.
94. Id. at 404.
95. Id. at 410.
96. Id.
occur and that insurance coveragewill be denied because they failed to act to
prevent the casualty.On the other hand, an assured should be able to deter
mine what actions and are reasonable without too much
expenses difficulty.97
Based on the foregoing, theWolstein court concluded that "those actions

determined by the finder of fact to be reasonable and takenwhile thepolicy
was in effectare covered under the sue and labor provision."98
Finally, the trigger-of-coverage question deserves mention. As noted
above, all-risk policies are triggered by a loss that occurs during the policy
period.99 Courts have not squarely addressed the appropriate trigger of
coverage in the context of sue and labor claims. Accordingly, it is unclear
how a court would apply any of the existing trigger-of-coverage theories
in the context of a sue and labor claim for computer remediation costs. A
court may determine that the relevant time is the period when the insured
installed or purchased various affected software or applications. Alterna
a an insured
tively, court may determine that the relevant time is when
costs to remediate the software or applications.
began incurring
Even in the absence of a sue and labor clause, some decisions hold that
the cost of preventing imminent and inevitable physical loss or damage is
covered in some circumstances. For example, inHampton Foods, Inc. v.
Aetna Casualty & Surety Co.,100 a grocer noticed that his uninsured building
was about to collapse. To mitigate the potential damage, the grocer sold
his insured inventory and fixtures at salvage, thereby preventing any physi
cal damage to the insured property. The insurer denied coverage on the
grocer's claim for his economic loss on the grounds that there had been
no physical loss. The court rejected the insurer's argument, reasoning as
follows:
Because of the unquestioned danger of reentering the building, [thegrocer]

could simplyhave leftitsproperty in thebuilding pending itscollapse; in that
event, therewould have been directphysical damage to thepersonal property.
[The grocer]merely mitigated the damages?as it should have done?by re
moving and salvaging as much property as it could before the building's
destruction.101
C. Business Interruption Coverage

"Business interruption" coverage generally is included through an endorse
ment to comprehensive first-partypolicies to insure against business losses
97. Id.
98. Id. (emphasis supplied).
99. United Technologies, 989 F. Supp. at 152.
100. 787 F.2d 349 (8thCir. 1986).
101. Id. at 352.
Insurance
sustained as a result of suspensions in business operations.102 Typical busi

ness interruption insuring
language provides:
In consideration of additional premium, this policy is extended to cover the
actual loss sustained by the insured during a period of interruptiondirectly
resultingfrom physical loss or damage of the type insured against by this
policy, to propertynot otherwise excluded by thispolicy,utilized by the insured
and located as described elsewhere in thispolicy.
Subject to all itsprovisions, thispolicy insures against loss resultingdirecdy

from necessary interruptionof business caused by physical loss or damage of
the type insuredagainst to real or personal propertyof the typecovered located
on described
premises.103
Business interruption coverage should be available for policyholders that

suffer interruptions in business operations as a result of e-commerce
related property damages, such as interruption caused by viruses or hacker
attacks. For example, as discussed above, theU.S. District Court for the
District of Arizona recently held that a policyholder was entitled to recover
for business interruption sustained after the policyholder's computer sys
temswere rendered inoperable due to a power outage that caused a loss of
all programming information.104
Similarly, inDatatab Inc. v. St. Paul Fire andMarine Insurance Co.,105 the
U.S. District Court for the Southern District of New York held that an
all-risk policy covered a suspension of business due to loss of use of the
insured's computer system. In Datatab, awater main break in the basement
of a building damaged several water pumps, which rendered inoperative
the insured's air-conditioning system and, in turn, forced a shutdown of
the insured's computers and data processing equipment. The policy in
question provided coverage for "loss resulting directly from necessary in
terruption of business as a direct result of all risk of physical loss or damage
from any cause to" property that included the insured's data processing
systems and had a clause extending coverage "to include actual loss as
covered hereunder when as a direct result of a peril insured against the
so as to prevent access
premises inwhich the property is located is damaged
to such property."106The insurer contended that, because there was no
direct physical damage to the insured's premises on the fifthand sixth floors
of the building and because no physical access to the data processing equip
102. See generally Couch, supra note 26, ? 42:414 (2d rev. ed. 1982); William H. Danne,
Jr., Business Interruption Insurance, 37 A.L.R.5th 41 (1996).
103. See, e.g., Industrial Risk Insurers Form C-B1/GE Ed 9/90, reprinted in Budd & Krasik,
supra note 42, at 7.
104. American Guarantee & Liability Ins. Co. v. Ingram Micro, Inc., Civ. 99-185 (D. Ariz.
to
Apr. 19, 2000), leave appeal granted (D. Ariz. June 14, 2000).
105. 347 F. Supp. 36, 37 (S.D.N.Y. 1972).
106. Id. at 37.
merit was impaired after the breakdown, the contingencies triggering the
business interruption coverage had not occurred. However, the courtfound
that the insured's interpretation of the policy language, i.e., that theword
not just the fifthand sixth
"premises" referred to the entire building and
floors and that theword "access" contemplated the ability to use its equip
ment normally was reasonable. Accordingly, observing that any ambiguity
in the policy was to be resolved in favor of coverage under New York law,
the court held that the insured was entitled to coverage.107
The extent towhich business is "interrupted" may be an important factor
in determining whether business interruption losses will be covered. For
example, there is some authority for the proposition that, under certain
a
types of business interruption policies, coverage is not available where
covered riskmerely causes the volume of the insured's business to diminish,
as opposed to causing a complete suspension. For example, theU.S. Dis
trict Court for the District of Kansas inHome Indemnity Co. v. Hyplains
in
Beef108held thatmalfunction of computer equipment that only resulted
business delays and not a suspension of the business was not covered. The
court explained as follows:
[T]he policy does not provide coverage for a slowdown or reduction inopera
tions, rather it requires a of operations. [The insured]
"necessary suspension"
does not controvert the fact that its fabrication operations continued through
out the period that the computer difficultiesexisted, albeit at a reduced level
of efficiency from what normal would have been.... In the present
operations
case, [the insured] has showed atmost that the alleged loss of its electronic
data caused its operations to slow and become less efficient. Because [the in
sured] has failed to show that the alleged loss of its electronic data caused a
"necessary suspension" of itsoperations, as required by the policy language,
the courtfinds that [the insured] isnot entitled to coverage under thepolicy.109
The Hyplains court relied heavily on the specific policy language, which
a "necessary suspension of... 'operations' ":
required
In order forbusiness income coverage to apply, thePolicy requires that there
be a "necessary suspension" of operations.
Webster's Third New InternationalDictionary defines "suspension" as "the

act of suspending or the state or period of being suspended, interrupted,or
abrogated." "Suspended" is defined as "temporarilydebarred, inactive, inop
erative." These definitions with what appears to be the common un
comport
of the term that is, that it connotes a
derstanding "suspension," temporary,
but complete, cessation of activity.110
107. Id. at 38.

108. 893 F. Supp. 987 (D. Kan. 1995),affd,89 F.3d 850 (10thCir. 1996).
109. Id. at 991.
110. Id.
Insurance
Accordingly, Hyplains may be distinguishable if the policy at issue does

not specifically provide that business must be
"suspended."
Moreover, the better-reasoned view, as held by several courts, is that the
requirement that business be completely suspended is completely at odds
with another policy provision that allows an insurer to reduce the amount
of the loss to the extent that the insured can resume operations, inwhole
or in part, by using
damaged or undamaged property at the insured location
or elsewhere.111 For
example, the Third Circuit inAmerican Medical Im
aging Corp. v. St. Paul Fire andMarine Insurance Co.112 reasoned thatwith
such a mitigation clause in the policy, an interpretation requiring a com
plete cessation of operations would create an inconsistency within the pol
icy because an insured would have no motivation to continue its business
at a reduced level and thuswould have no motivation tomitigate its losses.
The court explained:
Under the district court's constructionof the policy, the insuredwould have
no motivation to its losses. Continuing in business at any level would
mitigate
bar recoverybecause the insuredwould be carryingon the same kindof activ
itiesthatoccurred at the covered location.
We decline to accept the suggestion
that thiswas the intentof the parties. Indeed, other provisions of the policy
bear witness to a contrary intent. For the policy on the
example, imposes
insured an affirmativeduty tomitigate its losses:
Ifyou can reduce your loss by resumingoperations at the covered location
or elsewhere or .. . to
by using damaged undamaged property you agree
do so.
.. Under
. the district court's this provision would have
reading, imposed upon
[the insured] a duty, the performance ofwhich would have forfeitedits right
to recover under the policy. We are confident that such an anomalous result
was not intended and choose to read the policy termsregarding [the insurer's]
duty to indemnifyas consistentwith [the insured's]duty tomitigate.Moreover,
as appears from the earlier quoted portion of the policy, [the insurer's]obli
to continues until the resumption of "normal business opera
gation indemnify
tions."This necessarily implies thattheobligation to indemnifycan arisewhile
business continues, albeit at a less than normal level.113
v. Continental
Similarly, the Fourth Circuit inMaher Casualty Co.114 re
an insurer's argument that the insured could not recover its losses
jected
for business interruption under the policy merely because the business had
not completely shut down:
111. Many to the following: "We will reduce the amount

policies provide language similar
... can resume
of your [bjusiness income loss, other than extra expense, to the extent you
your 'operations,' inwhole or in part, by using damaged or undamaged property (including
merchandise or stock) at the described premises or elsewhere."
112. 949 F.2d 690 (3dCir. 1991).
113. Id. at 692-93 (emphasis added).
114. 76 F.3d 535 (4thCir. 1996).
[The insurer]relied on the following clause to deny coverage:

We will pay for the actual loss of Business Income you sustain due to
the necessary suspension of your "operations" during the "period of
restoration."
Though not defined in the policy, [the insurer] took the position that "sus
meant "cessation"?a shutdown of the entire business.
pension" complete
However, as thebankruptcy judge laterpointed out ingranting summaryjudg
ment to [the insured]on the issueof coverage, the insurer'spositionwas wholly
at odds with another policy provision:
We will reduce the amount of your Business Income loss ... to the extent
you can resume your in whole or in part,

"operations," by using damaged
or undamaged property (includingmerchandise or stock) at thedescribed
or elsewhere.
premises
thata policyholdermay be compensated
The aboveparagraph clearlycontemplates for
lost income, to operate at a reduced
regardless ofwhether the business continued level
immediately following the covered loss.115
Finally, even under relatively restrictive policy wording, coverage should

be afforded for suspension of the policyholder's operations for losses in
curred by even a short suspension in a business's activities.116
D. Coverage for "Extra Expense"

While business interruption coverage replaces a company's income when
normal operations cannot be continued, extra expense coverage provides
the funds necessary to ensure that operations can continue without inter
ruption. Typical "extra expense/expense to reduce loss" insuring language
provides:
(i)Extra Expense means necessary expenses you incurduring the "period of
restoration" that you would not have incurred if there had been no direct
physical loss or damage to property caused by or resulting from a Covered
Cause of Loss.
(1)We will pay anyExtra Expense to avoid orminimize the suspension of

business and to continue
operations.
(2)We will pay anyExtra Expense tominimize the suspension of business
if you cannot continue operations.
(3)We will pay anyExtra Expense to:
(a) Repair or replace any property; or
(b) Research, replace or restore the lost informationon damaged valu
able papers and records;
(ii) Expense to Reduce Loss Expenses, over and above normal operating
expense, necessarily incurredby the insured inmaking up lostproduction or
115. Id. at 539 n.l (emphasis added).

116. Note that some policies expressly provide "for coverage in lesser amounts for each
day of partial prevention of business." Simkins Indus., Inc. v. Lexington Ins. Co., 401 A.2d
181, 191 (Md. 1979).
Insurance
in loss otherwise under this endorsement are covered here

reducing payable
under, but in no event shall this company be liable for an amount greater than
that forwhich itwould have been liable had the insuredbeen unable tomake
up lost production or to continue any business or services.117
any operations
Notably, because the plain wording of the typical extra expense coverage
provision states that coverage is for costs incurred to "replace or restore
... lost information on ... records,"
damaged coverage should be available
for the costs of "replacing or restoring" software programs or electronic
data that are damaged or destroyed.
E. Additional Coverage Defenses

Additional coverage defenses that may be raised by insurers include:
(1) the fortuity defense; (2) late notice defenses; and (3) Y2K exclusions.
1. The Fortuity Defense

The word "fortuity" does not appear in all-risk policies. However, courts
have held that the fortuity doctrine works as an implied exclusion on all
risk coverage.118 In general, a loss is "fortuitous" for purposes of all-risk
insurance if the policyholder did not know of the inevitability of the loss
at the time of the insurance contract.119
Insurers may argue that e-commerce-related losses are not fortuitous
because policyholders allegedly generally are aware of the inevitability of
computer viruses. However, policyholders likewise are aware of the inev
states find a
itability of floods, fires, and other perils. In this regard, many
loss fortuitous so long as the insured subjectively was unaware that a loss
was certain to occur when the policy was issued;120 in other words, a loss
is fortuitous unless the policyholder knew when and where a loss would
strike at the time the insurance was purchased. The better-reasoned deci
sions hold that the fact that a policyholder may have some measure of
or damage will not by itself bar coverage.
knowledge of the risk of loss
Indeed, companies purchase insurance because of risks.
The Fourth Circuit's decision in Insurance Co. ofNorth America, Inc. v.
117. See, e.g., Budd & Krasik, supra note 42, at 8 (quoting Factory Mutual Service Bureau
Form 3201EditionMarch 1992).
118. See Buckeye Cellulose v. Atlantic Mut. Ins. Co., 643 E Supp. 1030, 1036
Corp.
(S.D.N.Y. 1986). See generally Appleman, supra note 49, ? 3092, at 60 (Supp. 1998) ("Case
law often requires that any loss sought to be covered under an all-risk property insurance
policy be
a 'fortuitous' loss."); Kalis, Reiter & Segerdahl, supra note 25, ? 13.06[A], at
13-26.
119. See generally Kalis, Reiter & Segerdahl, supra note 25, ? 13.06[A], at 13-26 to
13-29.
120. See, e.g., United Technologies, 989 F. Supp. at 148 (holding that "fortuity is judged using
a subjective standard and focusing on what the insured actually knew at the time itpurchased
the policy, not what it should have known in hindsight").
U.S. Gypsum Co.m is illustrative. In that case, mining operations caused

subsidence holes on the policyholder's property as early as 1940, and the
policyholder was aware that further subsidence was virtually certain.When
a massive subsidence event occurred in 1984, the insurer argued that the
loss was not fortuitous because the policyholder knew that subsidence at
the sitewas inevitable. The court rejected the insurer's argument and held
that the losswas insurable because therewas still some contingency: "[T]he
fact that it is known that subsidence will occur does not mean that itwill
occur during the policy period. Moreover, there is a fundamental distinc
tion between the certainty of subsidence and the certainty of resulting
loss."122
Similarly, in United Technologies Corp. v. American Home Assurance Co.,123

a case involving environmental property damage, theU.S. District Court
for the District of Connecticut rejected the insurer's argument that the
fortuitydefense should bar coverage where the insured was unaware of the
loss when the policy was purchased. The court explained:
The majority of courts analyzing the loss in progress doctrine in the context
of thirdparty liabilitypolicies have expressly found the insured's knowledge
to be an essential element. . . . [I]n theabsenceofanyfactual or legalauthorityto
support its argument that this distinction should be made, the Court concludes that
as an element best serves the overall
requiring knowledge principle of insurance law.
Rendering a loss uninsurable once ithas begun, regardless ofwhat the con
knew at the time of the contract, seems antithetical to a fair
tracting parties
view of the insuringprocess whereby insuredspaymoney to be relieved of the
riskof the unknown and the insurerdetermineswhat itwill charge to accept
that risk. In an all-risk such as the one at issue here, the premium
policy,
reflectstheunderstanding that the riskof any damage from anynon-specified
event causing damage shiftsfrom the insured to the insurer.
Furthermore, the purpose of the loss in progress doctrine, preventingfraud,

will be served by a subjective knowledge analysis.The insurer is protected
because the insured cannotmisrepresent itsknowledge to the insured.The
insured is protected because the insurer cannot refuse responsibilitymerely
by learningof facts thatboth parties previouslywere unaware of.124
Many other courts similarly have held that the fortuity requirement may
be satisfied even if the policyholder was aware of the likelihood that a loss
would occur during the policy period.125 For example, inKlockner Stadler
121. 870 F.2d 148(4thCir. 1989).

122. Id. at 152.
123. 989 F. Supp. 128 (D. Conn. 1997).
124. Mat 151.
125. See, e.g.,Montrose Chem. Corp. v. Admiral Ins. Co., 913 P.2d 878, 904 (1995) ("[A]ll
that is required to establish an insurable risk is that there be some see also
contingency.");
United 989 F. Supp. at 148 ("[I]t is the
Technologies, fortuity of the resulting loss, not the
fortuity of the intentional actions causing the loss that is at issue."); Avis v. Hartford Fire Ins.
Co., 195 S.E.2d 545, 548 (N.C. 1973) (fortuitymeans "not certain to occur").
Insurance
Hurter, Ltd. v. Insurance Co. of theState ofPennsylvania,126 theU.S. District

Court for the Southern District ofNew York denied an insurer's motion
for summary judgment on the fortuity issue, holding that the insured's
knowledge of a potential loss did not establish that the loss was a "cer
tainty."Even though the parties had stipulated that the loss arose from the
policyholder's negligence and that "available information, although lim
ited, indicated the potential for slope stability problems," the court held
that "we are unable to say that [the policyholder] knew or expected that
the accident would occur."127 Because the loss was not a "certainty," the
court held that itwas fortuitous.128
2. Late Notice and Suit Limitation Defenses

All-risk policies often contain language similar to the following: "As soon
as practicable after any loss or damage insured under this Policy is known
to the Insured's Insurance Department, the Insured shall report such loss
or damage with full particulars...." Insurers may deny coverage on the
basis that the policyholder failed to provide timely notice of the claim. Any
notice defense may raise factual issues surrounding when the insurance
department learned of each loss under the policy and whether the subse
quent notice was sufficientlytimely
Initially, if the insured is seeking remediation costs under the sue and
labor clause, the insured may be able to argue successfully that the notice
provision is inapplicable. As discussed above, courts have held that the sue
and labor provision constitutes a separate insuring agreement and, there
fore, arguably is not subject to conditions such as notice.129An insured thus
can assert that the policy notice provision is inapplicable where the insured
seeks coverage under the sue and labor clause.130 In addition, an insured
may point out that this is supported by the tradition of the sue and labor
clause.131 Finally, an insured may argue that itsposition is bolstered by the
126. 780 F. Supp. 148 (S.D.N.Y. 1990).

127. Id. at 156-57.
128. Id.
129. See authorities cited supra note 76.
130. See Rhonda D. Orin & Michele A. Gallagher, Insurance Coverage for Y2K Remediation
Costs Under the Sue and Labor Provisions ofProperty Insurance Policies, SE78 ALI-ABA 87, 92
re
(Dec. 2, 1999) (discussing this argument in the context of insurance coverage for Y2K
mediation costs under the sue and labor clause).
131. As one commentator has noted:
This argument comports with the tradition of the sue and labor provision. Historically, sue
and labor costs were expended on the high seas or in faraway ports under the sole control
of the policyholder and were reported to the seller of insurance?typically, underwriters
at Lloyd's?only months later, when the insured craft returned to port and the bill for
costs expended was forwarded to London. Contemporaneous notice, or insurance company
control of sue and labor charges, simply was neither possible nor required by the courts,
and most sue and labor provisions have not changed since that time. Indeed, the newer
fact that some sue and labor provisions expressly provide that the insurer
are omitted, notice
give prompt notice132 and thatwhere such provisions
prior to sue and labor efforts is unnecessary under the policy133
Where notice provisions are applicable, most states place the burden on
the insurer to demonstrate prejudice from alleged late notice. In the typical
case, itmay be difficult for the insurer to prove "prejudice." For example,
a policyholder may make a strong case that the insurer would not have
done anything differently if it knew of the loss earlier. In any event, a
as soon as
policyholder is well advised to notify its insurer of any loss
possible. Finally, policyholders should be cognizant of any suit limitation
provision in their policies, providing that suits are barred unless brought
within a specific period after discovery of the loss.134
3. Y2K Exclusions
Most policies issued after 1997 or 1998 contain so-called Y2K exclusions.
An example of such an exclusion is as follows:
Notwithstanding any portion of thispolicywhich may appear to the contrary,

this Policy does not insure any loss, damage, cost, claim or expense, whether
preventative, remedial or otherwise, directly or indirecdy arising out of or

to:
relating
1. the recognition, calculation, differentiation,
interpretation, comparison,
or of data involving one or more dates or times, in
sequencing processing
cluding theYear 2000, by any computer system,hardware, program or soft
ware, or any circuit or similar device in computer
microchip, integrated equip
sue and labor

provisions do contain notice provisions?proof that the insurance companies
did not intend for older sue and labor provisions to contain any notice conditions.
Orin & Gallagher, supra note 130, at 93 (footnote references omitted).
132. See, e.g.,Home Ins. Co. v. Ciconett, 179 F.2d 892, 894 (6th Cir. 1950) (sue and labor
provision stated that "[i]n Case of Any Loss or Misfortune, it shall be lawful and necessary
to and for the Assured or their agents, factors, servants and
assigns, to give this Company
prompt notice of the disaster,...; to sue, labor or travel for, and tomake all reasonable exertions
in and about the defense,
safeguard and recovery of the said vessel, or any part thereof, without
prejudice to this insurance") (emphasis added).
133. Alternatively, if not viewed as a separate coverage provision with no appurtenant
conditions, an insured legitimately may argue that the sue and labor clause should itself be
viewed as a condition. See Orin & Gallagher, supra note 130, at 92. The insured would then
argue that itwould not make sense to apply other conditions (e.g., notice) to the sue and
labor condition. See id.Again, the lack of case authority precludes a definitive
prediction with
respect to whether courts would adopt this reasoning. Finally, if the insured is seeking cov
erage under the sue and labor clause, the insured may argue that its duty to provide notice
has not been triggered because no "loss or
damage" has occurred under the policy. See id.
at 93.
134. Many all-risk property policies contain language similar to the
following: "No suit
action or on this
proceeding policy for the recovery of any claim shall be sustainable in any
court of law or equity unless the same is commenced within
twenty-four (24) months next
after discovery by the Insured of the occurrence which gives rise to the claims."
Insurance
merit or non-computer whether the property of the Insured or

equipment,
not; or
2. alteration, correction or modification one or more
any change, involving
dates or times, including theYear 2000, to any such computer system,hard
ware, or software, or circuit or similar
program any microchip, integrated
device in computer or non-computer whether the
equipment equipment,
or not.
property of the Insured
Except as provided in the next paragraph, thisElectronic Data Recognition

clause shall of any other cause or event that contributes con
apply regardless
currently
or in any sequence to the loss,
damage, cost, claim or expense.
If direct physical loss or damage not otherwise excluded by thisPolicy results,

then subject to all termsand conditions, thisPolicy shallbe liable only on such
loss or damage ....
resulting
to seek coverage for damage to
Policyholders considering whether
computer systems or data should review the terms of Y2K exclusions care
to the Y2K
fully, even as to computer system failures not directly related
problem.135
IV. OTHER TRADITIONAL INSURANCE THAT MAY COVER

E-COMMERCE RISKS
In certain circumstances, insurance coverage for e-commerce-related dam
ages also may be found under (1) commercial general liability policies,
(2) errors and omissions policies, (3) directors' and officers' policies, or all
three.
A detailed discussion of the provisions of these policies and the potential
coverage theymay offer is beyond the scope of this article. However, this
section summarizes some of the relevant provisions of these policies. In
addition, this section highlights some of the issues thatmay arise in this
context.
A. Comprehensive General Liability Policies

covers amounts that
Comprehensive general liability136insurance typically
a becomes to pay to third parties for personal
policyholder legally obligated
or the or damage was not "ex
injuries property damage provided injury
or intended" from the standpoint of the policyholder.137 CGL in
pected
135. See also Joshua Gold, General Liability Coverage for Asbestos, Environmental, and Year
2000 Claims, 13 John Liner L. Rev. 64 (2000) (noting this with respect to Y2K exclusions
drafted for commercial general liability policies).
136. Hereinafter CGL.
137. In addition, standard-form CGL insurance policies typically provide that the insur
ance company "shall have the right and duty to defend any suit against [the policyholder]
on account of such bodily injury or property damage." See Insurance Services
seeking damages
inKalis,
Office, Inc.,CGL Policy FormNo. CG 00 01 01 96 (1994), ? I, 1(a), reprinted
Reiter & Segerdahl, supra note 25, Form 1.
sums
suring language typically provides: "We [the insurer] will pay those
that the insured becomes legally obligated to pay as damages because of
... or to which this insurance
'property damage' applies."138 "Property
is defined as "physical injury to tangible property, in
damage" typically
cluding all resulting loss of use of that property."139Thus, CGL coverage
is available both where there is physical injury to tangible property and
where there is only loss of use of tangible property that has not sustained
actual physical injury.
One issue that may become more prevalent is whether electronically
stored data constitute "tangible" property under the standard-form CGL
on the grounds thatCGL
policy.140 Insurers may resist coverage for claims
insurance allegedly does not afford coverage for this type of liability.As
discussed above, however, software and electronic data have been held
to constitute "tangible property."141 Therefore, damaged or corrupted
software or data should qualify as "tangible property" unless specifically
excluded.
In addition, liability for Internet "advertising" activities and alleged in
tellectual property infringement also may be covered under CGL policies.
Liability risks arising out of a policyholder's advertising activities, poten
tially including claims of libel, slander, defamation, violation of privacy
rights,misappropriation of advertising ideas or style of doing business, and
infringement of copyright, title, or slogan.142 In this context, insurersmay
138. See Insurance Services Office, Inc., CGL Policy Form No. CG 00 01 01 96 (1994),
? I, 1(a), reprinted inKalis, Reiter & Segerdahl, supra note 25, Form 1.
139. See Insurance Services Office, Inc., CGL Policy Form No. CG 00 01 01 96 (1994),
?V(15).
140. See, e.g., Loralie S. Masters, Covering Cyberspace and Computer Liabilities, 13 John
Liner L. Rev. 74 (2000).
141. See discussion supra accompanying notes 27-42.
142. See Kalis, Reiter & Segerdahl, supra note 25, ?? 8.01-.03; Stempel, supra note 44,
? 14.06. Coverage for advertising injuries originated with the 1976 Broad Form Liability
Endorsement, which provided:
The [insurer] will pay on behalf of the insured all sums which the insured shall become legally
as
obligated to pay damages because of personal injury or advertising injury to which this
insurance applies ... arising out of the conduct of the named insured's business....
See Kalis, Reiter & Segerdahl, supra note 25, ? 8.01, at 8-3 (quoting 1 Commercial Lia
bility Ins., IVT.23 to IVT.28 (International Risk Management Institute, 1996) (reprinting
Broad Form Comprehensive General Liability Endorsement GL 0404)). Initially, "advertising
was denned as
injury" "injury arising out of an offense committed during the policy period
occurring in the course of the named insured's advertising activities, if such injury arises out
of libel, slander, defamation, violation of right of privacy, piracy, unfair competition, or in
or & Segerdahl,
fringement of copyright, title slogan." See Kalis, Reiter supra note 25,
? 8.03 [A], at 8-18 (quoting 1Commercial Liability Ins., IVT.24 (International Risk Man
agement Institute 1996)). The advertising injury definition was amended in 1986 to include
injury arising out of the following acts:
or written
A. Oral publication of material that slanders or libels a person or organization
or a person's or or services;
disparages organization's goods, products
argue that a policyholder'se-commerce-related activities do not constitute

"advertising." Importantly, however, several courts have rejected insurer
attempts to narrow the definition of "advertising."143
B. Errors and Omissions

Errors and Omissions144 coverage provides insurance for damages resulting
from negligence, omissions, mistakes, and errors made by the insured in
the course of providing professional services.145A typical E&O insuring
agreement requires the insurer to "pay on behalf of the insured those sums
which the insured becomes legally obligated to pay as damages because of
a error or omission in the performance of the insured's profes
negligent act,
sional services." The term "claim" typically is defined as notice to an in
sured that a demand formoney or services is being made.
A numberof differenttypesof E&O policiesmay be implicatedby
e-commerce-related liabilities, such as professional liability insurance for
software designers, electronic data processors, and computer consultants.146
Insurers may try to reduce the scope of coverage under an E&O policy
or omis
by arguing, among other things, that "negligent" modifies "error
sion" in addition to "act" such that only negligent errors or omissions are
covered. At least one court, however, has rejected this argument.147
B. Oral or written publication of material that violates a person's right of privacy;

C. Misappropriation of advertising ideas or style of doing business; or
D. Infringement of copyright, title or slogan.
See Kalis, Reiter & Segerdahl, supra note 25, ? 8.03[B], at 8-24 (quoting 1986 Form).
143. For example, in Sentex Systems, Inc. v. Hartford Accident & Indem. Co., 93 F.3d 578,
581 (9th Cir. 1996), the Ninth Circuit, applying California law, held that advertising injury
coverage for enumerated offense of "misappropriation of advertising ideas" was not limited
to wrongdoing or form of advertisement. The action
involving text, words, competitor's
of trade secrets, including customer lists, bidding
alleging the policyholder's misappropriation
and billing methods, marketing techniques, and other inside and confidential information,
and further alleging policyholder's use of such trade secrets in its sales materials, came within
the scope of advertising injury coverage. See also Kalis, Reiter & Segerdahl, supra note 25,
to awide range of activities
? 8.03 [A], at 8-2 3 ("arguments may be available policyholders that
constitutes 'advertising' ") (citing cases).
144. Hereinafter E&O.
145. See generally Appleman, supra note 49, ? 4504.01.
146. See also Budd & Krasik, supra note 42, at 3 (discussing the types of E&O policies
so-called Y2K bug).
potentially implicated by the
147. See U.S.M. v. First State Ins. Co., 652 N.E.2d 613, 614 (Mass. 1995) (finding
Corp.
to be ambiguous and therefore rejecting insurer's argument that the policy applied
language
to circumstances involving negligence; the court noted that "[o]ther courts have not
only
limited liability under 'errors and omissions' policies to circumstances involving negligence,
but have recognized certain nonnegligent errors as being within the coverage afforded")
to sources cited by court of appeals, including Continental Cas. Co.
(referring with approval
v. Cole, 809 F.2d 891, 896 (D.C. Cir. 1987); First Newton Nat'l Bank v. General Cas. Co.,
426 N.W.2d 618,629 (Iowa 1988); Touchette Corp. v.Merchants Mut. Ins. Co., 429 N.Y.S.2d
952 (1980); Aitchison v. Founders Ins. Co., 333 P.2d 178 (Cal. Ct. App. 1958)).
C. Directors' and Officers' Insurance

Directors' and officers' insurance148policies afford coverage for the defense
and indemnification costs of directors and officers sued in connection with
discharge of their corporate duties. A typical D&O policy insures against
any "loss" arising out of a "wrongful act." For example, an insuring agree
ment typically provides language similar to the following:
This policy shall pay the Loss of each and everyDirector or Officer of the
company arisingfrom any claim or claims firstmade against theDirectors or
Officers and reported to the Insurerduring thePolicy Period or theDiscovery
Period (ifapplicable) forany allegedWrongfulAct in theirrespectivecapacities
as Directors or Officers of the Company... .149
D&O policies specifically are designed to cover mistakes in judgment

and negligence. For example, the term "wrongful act" generally includes
the following:
error, niisstatement, statement, act, omission, or

[A]ny misleading neglect,
breach of duty committed, attempted, or allegedly committed or attempted,
by any Insured Person, individuallyor otherwise, in his Insured Capacity, or
anymatter claimed against him solely by reason of his serving in such Insured
All such connected errors, statements, acts, omissions, ne
Capacity. causally
glects or breaches of duty or other suchmatters committed or attemptedby,
allegedly committed or attempted by, or claimed against one ormore of the
Insured Persons shall be deemed interrelated Wrongful Acts.150
Accordingly, subject to conditions and exclusions, coverage should be

available under aD&O policy where a "loss" arises out of any claims against
a director or officer for any alleged "wrongful act" taken in their corporate
roles.151 Several types of e-commerce-related claims may be covered under
a D&O policy, including, for example, derivative actions brought by share
holders. Indeed, in light of the loss of revenue that businesses may expe
rience in connection with hacker attacks and other e-commerce risks, it is
conceivable that shareholders may bring derivative actions predicated, for
example, on allegations of "breach of fiduciary duty" for failure to imple
ment measures to prevent such attacks.Where directors and officers are
sued by shareholders in connection with e-commerce-related costs/liabil
ities,D&O policies should afford the directors and officers with both de
fense and indemnification costs. Although the coverage analysis necessarily
148. Hereinafter D&O.

149. See Budd & Krasik, supra note 42, at 1-2 (quoting Professional Liability Insurance,
International Risk Management Institute X.E.2-3 (1993)).
150. Id. at 2 (quoting Professional Liability Insurance, International Risk Management
Institute X.E.4 (1993)).
151. Id. at 2-3.
is fact-specific, D&O coverage usually will apply so long as the alleged

failures were not intentionally fraudulent or criminal.152
V. CONCLUSION
E-commerce-related risksmay threaten a company's revenues, information

assets, reputation, and market share. Because e-commerce presents rela
tively new types of exposure, some of the issues surrounding coverage un
der insurance policies have yet to be resolved. However, the fact that tra
ditional insurance forms predate e-commerce-related risks does not mean
that new forms of loss and liability are not covered. Indeed, one of the
primary "selling points" of all-risk policies is the coverage they provide for
losses from previously unanticipated causes. Accordingly, when faced with
e-commerce-related losses or liabilities, companies should take full advan
tage of the insurance coverage they already have purchased through first
party and third-party insurance programs.
152. See generally Couch, supra note 26, ? 48:141 (2d rev. ed. 1982); Budd & Krasik, supra
note 42, at 2.

David R. Cohen and Roberta D. Anderson - Insurance Coverage For - Cyber-Losses

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

David R. Cohen and Roberta D. Anderson - Insurance Coverage For - Cyber-Losses

Uploaded by

Copyright:

Available Formats

INSURANCE COVERAGE FOR "CYBER-LOSSES"

Author(s): David R. Cohen and Roberta D. Anderson

The Internet provides an extraordinary wealth of new opportunities for

1. See Reuters Eng. News Serv., May 8, 2000, available inWESTLAWALLNEWSPLUS

David R. Cohen and RobertaD. Anderson are with the

e-commerce and other Internet-related activities. Included among these

II. SOURCES OF E-COMMERCE-RELATED LOSS

With more business coming from the e-commerce environment, compa

A. Hardware, Software, orData Loss

6. Discovered onMay 4,2000, theVBS/LoveLetter.worm is a dangerous VBScript worm.

Bug's victims to date include theWhite House, Congress, the Pentagon,

Many companies now are evaluating their vulnerability to various

Hacker attacks have the potential to paralyze a company's e-commerce

D. Extra Costs Related toBusiness Interruption

During a period of business interruption, an insured may have to expend

17. See supra note 2.

site through an alternate Internet service provider, a public

III. OVERVIEW OF FIRST-PARTY COVERAGE ISSUES

There are a number of different typesof property insurance that

A. Repair orReplacement ofDamaged Property

1. Do Damaged or Corrupted Software, Hardware,

27. 469N.W.2d 735 (Minn. 1991).

Similarly, inCentennial Insurance Co. v.Applied Health Care31 the Seventh

The federal computer fraud statute, which makes it an offense to cause

program of another person."N.Y. Penal ? 156.20 (McKinney 1999).

Although not printed out on paper, a more conventional formof tangibility,

formation in readable form from a ... makes the in

gible medium within themeaning of the Act."42

2. Has the Property Suffered "Physical Loss or Damage"?

Assuming that computer software and electronically stored data constitute

except as hereinafter excluded." Likewise, a "corruption of data" clause

44. One commentator has observed:

[BJecause of the importance of computers inmodern society, it seems almost antediluvian

the presence of the disjunctive "or" supports a construction that "damage"

Similarly, other courts have found "physical loss, or damage" in the ab

Super. Ct. 1980)).

actions. All orders were processed through Impulse. In October 1998,

At a timewhen computer technology dominates our professional as well as

54. Hereinafter American.

In thiscase, Ingram does allege propertydamage?that as a resultof thepower

Although asbestos contamination does not result in tangible injury to the

nation by asbestosmay constitute a direct, physical loss to propertyunder an

58. Id. at 4, 5 (emphasis added).

Policyholders may rely on these precedents to establish that "physical

65. 972 E2d 805 (7thCir. 1992),cert,

view of what constitutes physical injury to an e-commerce site or data

3. Did the Loss or Damage Occur During the Policy Period?

Assuming that a policyholder can establish that first-partycoverage exists

provisions may be implicated. Loss caused by damage to or corruption of

Electronic data the replacement cost new if actually

property insurers, seeking a judicial declaration thatY2K remediation ex

excluded from coverage by the "design defect"84 exclusion.85 However, it

Inherent vice is an exclusion which to losses from natural "or

90. Id. at 197.

Based on the foregoing, theWolstein court concluded that "those actions

Because of the unquestioned danger of reentering the building, [thegrocer]

C. Business Interruption Coverage

sustained as a result of suspensions in business operations.102 Typical busi

Subject to all itsprovisions, thispolicy insures against loss resultingdirecdy

Business interruption coverage should be available for policyholders that

Webster's Third New InternationalDictionary defines "suspension" as "the

107. Id. at 38.