First-Party E-Commerce Risks

First-Party Risks

"First-party risks" are the risks generally covered by commercial property policies, commercial crime policies, fidelity bonds, and kidnap and ransom policies. It is true that these types of policies can also provide liability coverage in the context of such first-party losses, when a third party seeks to impose liability on the insured for a loss that is recognized as a first-party loss under the policy. However, the focus of the discussion here is on the first-party loss itself.

Commercial Property Policy Issues

With respect to commercial property policies, one gap relating to e-commerce risks comes in the form of the requirement in most all-risk policies that there be "physical loss or damage" to property to trigger both the property damage and time element (e.g., business interruption and extra expense) coverages of the policy. Some e-commerce risks involve "nonphysical events," where it is not clear that "physical loss or damage" to property has occurred.

Commercial Crime Policy and Fidelity Bond Issues

Standard commercial crime policies and fidelity bonds contain a time element exclusion. The exclusion bars coverage for business interruption, extra expense, etc. The exclusion does not use such words, but that is how courts have interpreted it. The exclusion typically is labeled the "potential income" or "indirect loss" exclusion, or some other similar name.

So, if your e-commerce loss is an employee theft loss, the big surprise is this: It will not be covered under your commercial property policy because of the employee theft exclusion. Therefore, you must look to your commercial crime policy or fidelity bond. But that policy does not cover time element losses. Can you say "gap" in coverage? This important coverage gap with respect to e-commerce risks and commercial crime policies and fidelity bonds is big enough to drive a truck through.

Another gap for e-commerce risks has to deal with valuation issues for stolen computer data, software, or programs. Whereas standard commercial property policies that have been slightly amended contain detailed valuation provisions for lost or damaged data, software, or programs, standard commercial crime policies and fidelity bonds do not. Such policies typically provide coverage for the lesser of the actual cash value of the stolen property or replacement cost. It is not clear how much, if any, coverage will be provided for stolen EDP media under such valuation provisions.

Kidnap and Ransom (K&R) Policy Issues

E-commerce activities invite extortion risks. Consider the following scenarios.

• A computer hacker demands money or something else of value from an insured under threat of unleashing a denial of service attack against the insured's computer system or website.
• A computer hacker threatens to attack an insured's computer system or website with a virus that will delete, destroy, or otherwise corrupt the key operating data, software, or programs necessary to operate such system or website.
• A computer hacker threatens to hack into the insured's computer system and delete important information, perhaps not information necessary to run key operations, but important information nonetheless (e.g., proprietary manufacturing, marketing, human resources, legal, or other information).

Some K&R policies limit coverage for extortion to threat of bodily injury. Obviously, such wording does not respond to the risk mentioned here. Some K&R policies do extend coverage to threat of damage to property. However, it is not clear whether such wording will respond to threats of denial of service attacks and other computer viruses that do not damage or destroy computer data, software, or programs, but instead merely render such property useless.

Closing the Gaps with New E-Commerce Insurance Policies

Several insurers have created and are selling stand-alone policies to cover one or all of these issues. The policy forms currently available include the following.

• Marsh's Net Secure program, underwritten by a consortium of insurers
• The E-Risk policy from Fidelity and Deposit Companies, a member of Zurich
• The Secure System policy from ACE USA
• The Networker policy from St. Paul
• Several policy forms from different Lloyd's facilities

AIG and Chubb also have policies under development. Some of these programs provide both first-party coverage and liability coverage, where the insured can pick and choose the coverages. And some of these programs can be purchased on either a difference-in-conditions/difference-in-limits (DIC/DIL) basis or primary basis.

These policy forms are in a state of flux, with the insurers apparently reviewing each other's forms to try to address the same issues as much as possible. A more detailed comparison of these and other forms, and the issues to consider when buying them, will be the subject of future articles in this series. Suffice it to say, however, that with respect to first-party risks, practically all of these policies provide some form of coverage for each of the issues raised above.

So, one way for an insured to close these gaps in coverage is simply to buy one of these new policies, at least on a DIC/DIL basis. In that way, if an e-commerce loss falls through the cracks of the insured's program as constituted by traditional policies, the stand-alone e-commerce policy should respond to the loss.

Closing the Gaps by Amending Traditional First-Party Policies

There is an alternative to buying one of the new e-commerce policies, at least theoretically. In brief, an insured could amend one or more of the policies to cover the gaps at issue.

For example, an insured could add express language to its commercial property policy describing all the different types of loss events it could experience with respect to its computer systems, website, data, software, programs, etc., and then stating that all of such events shall be deemed physical loss or damage for the purposes of coverage under the policy. The insured can also amend the "indemnity period" provisions to more closely tie into such special "physical loss or damage" language so that the time element coverage matches up with e-commerce risks. Also, the insured will want to make sure that the employee dishonesty exclusion is limited to employee theft and excepts all other forms of "physical loss or damage" to property caused by an employee.

An insured also could delete the potential income or indirect loss exclusion (however worded) in its commercial crime policy or fidelity bond. The insured might want to consider adding express language for time element losses (both business interruption and extra expense at a minimum), rather than simply relying on the deletion of the exclusion.

The insured also might want to amend the valuation provisions to more closely mirror the valuation provisions in its commercial property policy. In this way, whether the property is stolen by a third person (where the commercial property policy would respond) or by an employee of the insured (where the commercial crime policy or fidelity bond would respond), the coverage provided by the different policies in the insured's program should be the same.

Finally, the insured will want to amend its extortion coverage in its kidnap and ransom policy to address e-commerce extortion risks or perhaps add the coverage to its commercial crime policy, fidelity bond, or commercial property policy. Several options could be available, but the point is that it needs to be covered somewhere in the insured's program.

Indeed, there are any number of ways to add such coverages into an insurance program. Much will depend on how the insured's program currently is structured (i.e., what is already in the insured's policies) and its insurers' willingness to amend their policies. That is the hitch. To date, most insurers selling the traditional policies discussed in this article are not willing to amend their policies to cover the gaps relating to e-commerce risks. So, while such amendments are theoretically possible, it remains to be seen whether they will become practically possible.

Conclusion

As discussed in the first article of this series, Fortune 1000 companies in the United States by and large are taking the position that the insurance industry should respond to first-party e-commerce risks by amending traditional policies to cover the gaps. These firms do not want to buy and administer yet another stand-alone insurance program. In contrast, startup and middle market companies, especially dot com companies, which lack a sophisticated risk manager and premium clout, are buying the new policies to address these risks.

The insurance industry to date has not shown much interest in the desires of most Fortune 1000 companies in regard to these issues. Commercial property insurers do not want to insure "nonphysical events." Commercial crime and fidelity insurers do not want to insure time element losses. And K&R insurers are wary.

The insurance brokerage community appears to be assessing the situation. Smart brokers appreciate the different policyholder markets and are selling the new products to the smaller/startup companies, while helping their Fortune 1000 clients try to amend their current policies or otherwise finance e-commerce risks with alternative risk transfer solutions.

Although it is anyone's guess how these issues will play out, Fortune 1000 companies will probably eventually be successful in persuading insurers to amend their policies to cover first-party e-commerce risks. By that time, however, there will be an established market for stand-alone e-commerce policies that are being purchased by middle market and startup companies, and brokers will respond accordingly.

Coming Up Next ...

The next edition of this column discusses insurance issues for "third-party" liability risks associated with e-commerce activities. There is a discussion of the gaps in traditional liability policies for such risks, how the new e-commerce liability policies respond to them, and how insureds are reacting to these issues.