Cyber Challenges Still Evolving
Some chief information security officers fail to see the value of standalone cyber-risk coverage, while some brokers give the impression that traditional policies cover many of the same risks.
These factors have contributed to surprisingly low recent take-up on standalone cyber coverage, according to Charles Cowan, counsel to law firm Drinker Biddle & Reath’s insurance transactional and regulatory team.
Cowan and Andrea Best, a partner with Drinker Biddle, addressed four emerging areas of cyber-related risk on May 19 in the Old Lloyd’s Library, built in 1928 and now in the basement at Lime Street. That very day, Lloyd’s announced its move into cyber coverage in Poland.
In the heavily wood-paneled atmosphere of the past, the speakers addressed four potential horsemen of the digital apocalypse.
Cyber-risk itself, drones, autonomous vehicles, and ride/car share all fall under the cyber umbrella and share a primary reliance on data that is largely not yet available, given the newness of the risks. The lack of data means that none of these risks is yet properly understood.
“First and foremost in cyber risk,” said Cowan, “is the need for data. Not a lot of reliable data exists about incidents and where future potential attacks might be, or of what size.”
Cowan added that little litigation has yet taken place to clarify the validity of exclusions. The wording of the standard war exclusion “requires a hostile act by a foreign Government,” he said, “without naming names.” The Sony hack, reportedly by the Government of North Korea, came to mind.
Following another hack that exposed some 80 million customer and employee records at Anthem Health Insurance, the company notified and conducted its correspondence with its customers on paper, Cowan said. (Target experienced further opportunist email hacking after advising its customers by email that the personal data of up to 70 million customers, including credit card numbers, had been stolen in late 2013.)
“For larger breaches, costs can be astronomical,” Cowan said, citing a three-year-old U.S. report that valued the average stolen record at about $180. Cowan, who had left Lloyd’s three weeks earlier, is now working with the Department of Homeland Security on garnering more timely information.
About 80 percent of commercial unmanned aerial systems, or drones, are used in agriculture. The U.S. economy might expect to earn $82 billion from the use and knock-on effects of drones by 2025, and the FAA is due to issue a set of standards in this as-yet largely unregulated area.
Liability issues abound: criminal activity, matters of privacy and trespass, nuisance and general danger, air traffic problems, misdirected payloads, and of course hacking. “Any system is hackable,” Cowan said.
The Institute of Electrical and Electronics Engineers forecasts that as many as 75 percent of all vehicles, some with removable steering wheels, are expected to be autonomous by 2030, Best said. Legislation in the U.S. is being enacted at the state level (five states plus Washington, D.C.), or has failed (12 states), or is not being considered at all.
Autonomous vehicles will require sensors for vehicle-to-vehicle communication, “but we’ll also have to have sensors on buildings, bridges, traffic lights and other objects we’ll have to navigate around,” Best said.
“The ultimate question, if this technology really takes off, and is so safe, is how much of an automobile insurance coverage market will there be left?” — Andrea Best, partner, Drinker Biddle & Reath
It is not yet clear who will need coverage. Manufacturers of the vehicles? Of component parts? Of the sensors? One known unknown is whether driver premiums for autonomous vehicles will fall, due to the lowered risk, or increase for traditional hands-on drivers.
“The ultimate question, if this technology really takes off, and is so safe, is how much of an automobile insurance coverage market will there be left?” Best asked.
Coverage challenges include the reliability and vulnerability of the technology, the adaptability of the driving public, and the hackability of the autonomous systems.
“These are probably just interim challenges,” Best said. “Given the level of investment, and how much of a push there is for (autonomous vehicles), these issues will fall away.”
The former will be familiar from transportation network companies such as Uber, which arrange one-time shared rides on short notice, and others that arrange transportation for a fee using online technology platforms.
The latter includes peer-to-peer car rentals organized by program administrators (such as RelayRides and Getaround) for short periods of time.
“Both services present new insurance coverage challenges,” Best said.
Ride-sharing is typically excluded from personal auto policies, creating coverage gaps. NAIC has issued a white paper to help state insurance regulators, and legislation is pending in more than 35 states. Similar coverage gaps exist in the car-sharing realm.
As if these four risks were not enough to digest, on the subject of emerging risks, in Best’s words, “we could have covered any number of topics and be here for hours.”