The End of Computer Virus Coverage as We Know It?

What Is the Exposure?

To put things into perspective, let me start by making two observations. The first is that a company's exposure to computer virus risk is not limited to loss of online revenue because a website "goes down." I don't even like using that measurement as a risk assessment tool. Rather, I keep coming back to a real-life scenario that convinces me that companies should have coverage for first-party computer virus risk.

Consider the following example of a company that manufactures products which run on software. One day an employee dialed in remote, a virus was introduced into the company's network, got into the assembly line, and was loaded onto the products as software was being installed into the products as they were being assembled. By the time the virus was discovered, the insured had to shut down the assembly line, remediate the problem, and deal with the infected product. The total loss was approximately US$15 million (about $2 million in remediation costs, and $13 million in business interruption). This loss was covered by the company's property insurance program.

This real-life loss should be a wake-up call to all risk managers. Don't assume that you can self-insure first-party computer virus risk because you don't have a lot of online revenues. Ask yourself what company operations depend on computer programs running correctly, on the ability to access uncorrupted data, etc. Also ask yourself if your products have software, data, or programs in them. I believe that if you start asking yourself these questions and others like them, the conclusion will be that you have exposure to first-party computer virus risk.

The second observation is that it appears that the vast majority of insurers and reinsurers in the United Kingdom and Continental Europe, from a philosophical perspective, do not believe that a loss caused by computer virus involves the type of "physical loss or damage" required to trigger coverage under a property policy. Put another way, such insurers and reinsurers, according to them, never intended to cover computer virus loss under property policies.

Computer Virus Exclusions

This belief is having a dramatic impact on the insurability of first-party computer virus risk under property insurance. Without reinsurance support for this risk for traditional property policies, we're seeing an alarming increase in the use of computer virus exclusions on property programs placed around the world. There is one particular exclusion we are seeing most frequently. It was created by the Non Marine Association in London, and goes by the name "NMA 2914." It reads as follows:

Not only are we seeing more and more European direct insurers require this exclusion, but we are also seeing more and more US insurers "dupe" the foregoing language into their own computer virus exclusions and requiring them. A couple of features of this exclusion—whether coming in NMA 2914 itself or a knock-off—are notable.

First, the exclusion for data, programs and software in the first part of the endorsement is all-inclusive. But for the buy-back in the second part of the endorsement, not even data losses that are caused by fire, explosion, and other traditional perils would be covered. Accordingly, don't overlook the importance of the second part of the exclusion—it's more than just valuation language or a place to stick a sublimit (a point that has been overlooked more than once by insurer, risk manager, and broker alike).

Second, note that the "ensuing loss" exception is on a specified-perils basis, limited to fire and explosion. What about the myriad other ensuing losses that could occur after a data, software, or program loss?! This "ensuing loss" exception should be on an "all-risk" basis. I find it telling that several US insurers agree that the exception should be on an "all-risk" basis. In my view, it's just bad form to limit the exception to specified perils.

In any event, what's left when this type of exclusion is attached? If loss of data occurs because the "media" on which such data was stored is damaged, then coverage might be afforded, provided the loss is otherwise covered. However, if the loss involves just loss or corruption of data, whether by virus or otherwise, without any physical damage to the "media" on which the data resides, the exclusion appears to apply. Also, this exclusion has no express exception for employee malicious destruction. If an employee launches a virus, or otherwise corrupts, damages, destroys, deletes or adversely affects data, software, or programs without damaging the "media" on which such information is stored, will NMA 2914 bar coverage? These and other similar questions will be tested in court as NMA 2914 and exclusions like it are put on more and more property programs.

Not My Insurer!

You might be saying to yourself that not all property insurers are using this type of exclusion, so I'm being a "Cassandra." It is true that, as reported previously in this column, a few direct property insurers (most notably, FM Global) are still providing computer virus coverage on their property programs. However, if one of these insurers is used in a quota share program with European insurers, the European insurers are insisting on the use of NMA 2914, and these insurers are forced to use it on their forms for their quota share of the program. (This feature of quota share programs is called something like the "best terms" principle, but I see it as the "lowest common denominator" principle.)

And yes it is true that some (if not many) crime insurers will cover first-party computer virus risk. But to date I have not seen a crime insurer remove the "potential income" and/or "indirect loss" exclusions or otherwise confirm that the policy will cover business interruption, extra expense, and other time element losses due to computer virus loss. So, what type of protection is that (especially given the example at the outset of this article, where of the total $15 million loss, only $2 million of it was for remediation costs, whereas $13 million of it was for business interruption loss)?

Even for those property insurers who are not yet using computer virus exclusions when they are doing the whole program (rather than being involved in a quota share program), there are signs of problems ahead. For example, we are seeing sublimits on the coverage that are not much better than what one can get in the stand-alone e-business insurance market for computer virus coverage.

Even more problematic, rumor has it that even these insurers will lose reinsurance support for computer virus risk in mid-2002 with their upcoming reinsurance renewals because their reinsurers intend to use NMA 2914 or its equivalent on their reinsurance policies. If such direct insurer have to take computer virus exposure on net, one would assume that such insurers would have to even further decrease the sublimits on the computer virus coverage they can offer each of their insureds, or do away with the coverage altogether, to address their aggregate exposure risk.

Conclusion

Based on the foregoing, we repeat an observation we made last year—it would seem that now or in the near future corporate insureds that want to insure first-party computer virus risk really have only one alternative—the stand-alone e-business insurance market. But is that true? Maybe not. There might be another alternative. Stay tuned for the next installment in this column, because I hope to be in a position to write publicly about this alternative in the next couple of months. In any event, our prediction is that we will see in 2002 the end of computer virus coverage as we have known it.