Pushing the Limits of E-Coverage

Risk & Insurance, June, 2001 by Lori Widmer

Think your traditional business interruption policy covers your Internet venture?

Think again. E-commerce is clashing with current industry standards and presenting new challenges to the very definitions of traditional coverage.

Power outages, hacker attacks, loss of templates or data-all are risks that plague the e-commerce Web site. Should these result in a disruption of service, are you covered? Depending on the wording in your current business interruption policy, the answer could be no.

One of the most common misconceptions in e-commerce is that current policies will automatically extend to Web-related activity. Not necessarily so, say the experts and insurers. When it comes to business interruption, your policy may cover some Internet exposures. But most are falling short, with limited coverage for anything e-related.

A review of traditional business interruption coverages by Risk & Insurance has found that few policies cover Internet business interruption exposures. Those that cover these exposures do so only by endorsement. Two such companies are Travelers Insurance in Hartford, Conn., and FM Global in Johnston, R.I. Travelers offers a denial-of service-attack endorsement with a capacity of up to $1 million. FM Global's eConomy add-on covers nonphysical damage to computer systems and coverage for off-premises computer networks. Capacity varies per account or location.

Kemper's traditional product, Kemper Property Resource, has clarified language that speaks to Internet-related issues and the definitions of physical damage. Coverage is available up to $100 million and a contingent BI endorsement is also available.

The bulk of available coverage for Internet business interruption is coming from new products specific to e-commerce (see chart on page 44). Eleven carriers offer cyber policies that address specific business interruption issues such as downtime expense, damage to data or software, and extra expense. Limits of up to $50 million are avail able, as are higher limits through reinsurance.

What's Not Covered

The key business interruption risks online are electronic vandalism in the form of hacker attacks or viruses, damage caused to Web sites by viruses or vandals, income that is lost due to an online interruption, and server and downtime problems.

The problem with using traditional business interruption coverage for an Internet risk is that the coverage quite possibly could fall short, leaving the company fully exposed. The biggest gap in coverage is the asset being covered. "For there to be coverage under the traditional property policy, there has to be some physical loss or damage," says Matthew J. Schlesinger, partner at McKenna & Cuneo LLP, Washington. In a cyber exposure, the assets are intangible thus making it very hard to prove physical damage occurred.

Yet even the words "physical damage" are being challenged. Delaware-based Ingram Micro Inc.'s suit against American Guarantee & Liability Insurance Corp. in New York is precedent-setting. The words physical damage were found by a circuit court in Arizona to apply to Ingram Micro's loss of computer programming information due to a power outage. The final outcome of the case is pending appeal in the Arizona court. "If it turns out that Ingram Micro's loss of data is physical in nature," says Schlesinger, "that opens up the door to (the possibility of) a host of Internet problems that would be covered under a traditional property policy."

Traditional policies are only going so far. Defining Internet risks has the industry stumped, according to David Koehn, assistant VP of casualty product development at Fireman's Fund, Novato, Calif. "There are three questions commonly asked. Is there a legal liability? Is there coverage for that? What were the damages?All three can be in a gray area. For instance, am I really legally liable because I sent you a virus that someone sent to me? Now we have to go back in to examine the terms of the liability policies. That's why we have new liability policies because the old ones didn't match."

"Traditional BI coverage was developed for nineteemth-century manufacturing industries with value chains and insurable assets that you could touch," says Daniel Imfeld, associate director for Swiss Re's telecom, media and technology division, in Zurich. "This whole concept is collapsing and more industries are going into intangible asset-based production modes. In the industrial insurance area, when it comes to protecting AOL and animals like that, the (traditional) insurance concept is too old-fashioned."

"One key risk that companies don't think about is that the Internet turns a company that may have been doing business locally into a company doing business worldwide," says Schlesinger. "Oftentimes, policies that local companies have don't cover them internationally. You really need worldwide coverage even if you're a small local company and you have a Web site."

Defining Coverage

The advent of Internet risk has given challenge to the definitions under traditional policies. A number of insurers are giving serious attention to the definitions in their policies to try to address the issue of cyber BI risk. "Simple denial of access to data without physical loss or damage we would not consider covered" says Mike Turner, VP of marketing at FM Global. "But if the trigger of the event involved some sort of accidental occurrence, we might cover it. We're recognizing that our customers are going to have more and more situations potentially that their data isn't damaged but they can't access it or use it. They're going to lose revenue. If that's going to become a continued issue for our customers, we're going to try to respond in part."