PBI Online Course # 9441...Jan 14, 2011 · PBI Online Course # 9441 Business Insurance ... of Law...

PBI Online Course # 9441

Business Insurance © 2016 Pennsylvania Bar Institute. All rights reserved.

iii

Foreword

As insurance rates increase, selecting appropriate coverage and understanding policy terms can be a daunting task. Insurance experts will address issues ranging from the types of coverage available in the marketplace, navigating the minefields of the claims process to agent fraud and cyber risk management, providing you with practical advice and insightful tips so that your clients do not find themselves saddled with useless coverage.

We are especially grateful to our course planner, Christopher J. Knight, Esq. of Hawke McKeon & Sniscak LLP in Harrisburg, for recruiting an outstanding faculty for the program. Each faculty member has devoted significant time and effort developing the course and preparing written materials. All of them are described in the biographical section that follows.

On behalf of all who will benefit from this program we express our sincere gratitude to all of our volunteers.

Pennsylvania Bar Institute Gail P. Granoff, President Erin Tate, Program Attorney

August 2016

iv

v

Biographies

COURSE PLANNER

Christopher J. Knight, Esq.

Mr. Knight is an attorney and partner with the regulatory boutique law firm Hawke McKeon & Sniscak LLP in Harrisburg. He focuses his practice on the representation of insurance entities in regulatory, compliance and business matters, and, when necessary, has the litigation experience to protect clients’ interests in civil and administrative court proceedings. Mr. Knight also frequently represents businesses in insurance and risk management matters and corporate governance. After serving for nearly a decade as Counsel for the Pennsylvania Insurance Department, he is able to use that experience to counsel insurance clients as their advocate in regulatory and compliance matters. Mr. Knight also served for two years as lead counsel for Pennsylvania’s medical professional liability coverage fund (MCARE) and has represented clients in numerous jury trials, administrative hearings and appellate court cases. He is a frequent lecturer regarding insurance issues and serves annually as a guest faculty at the Widener University School of Law’s trial advocacy program. Mr. Knight is an active member of the Pa. Association of Mutual Insurance Companies (PAMIC), serving since 2012 on its Government Affairs Committee, and is also a member of the Association of Insurance Compliance Professionals. He is a member of the Pennsylvania and Dauphin County Bar Associations. Hawke McKeon & Sniscak LLP, founded in 1982, provides strategic advice and representation to a broad array of clients on regulatory issues involving energy, insurance, telecommunications, environmental, municipal, gaming and other areas of government law.

FACULTY

Christopher M. Brubaker, Esq.

Mr. Brubaker is in the Philadelphia office of Clark Hill PLC, where he concentrates his practice in complex commercial and general litigation as well as cybersecurity, data privacy and protection. He regularly provides advice to companies on insurance and cyber risk issues related to transactions, regulatory compliance and risk management. He has experience in a variety of subject areas including insurance and reinsurance coverage litigation and arbitration matters, business dissolution, trust and estate litigation, insurance defense and appellate work. Mr. Brubaker frequently speaks and writes on cybersecurity matters for legal and professional groups. Mr. Brubaker attended Gettysburg College, where he earned a Bachelor of Arts degree, prior to earning his law degree from Vermont Law School. He is admitted to practice in Pennsylvania, New Jersey, the U.S. Court of Appeals for the Third Circuit, and the U.S. District Courts for the Eastern District of Pennsylvania and the District of New Jersey.

Kara L. Cotter, Esq.

Ms. Cotter is a Deputy Attorney General for the Commonwealth of Pennsylvania in the Insurance Fraud section. Before joining the Attorney General’s Office, Ms. Cotter worked for

vi

the Allegheny County District Attorney’s Office. Ms. Cotter received her J.D. from the University of Pittsburgh School of Law and her B.A. from Hood College. She also earned a Master’s of Public and International Affairs degree from the University of Pittsburgh.

Christopher J. Day, Esq.

Mr. Day is a partner and litigator in the Philadelphia and Wilmington, Delaware offices of Clark Hill PLC where he is a member of the Cyber Law Practice Group. Mr. Day concentrates his practice in complex litigation and has received a Martindale-Hubbell AV Preeminent Peer Review Rating from his peers. Mr. Day has developed a specialty in handling cyber breach and protection matters, maintaining cutting edge knowledge and experience in this developing area of the law. Mr. Day aids his clients who have experienced data loss by guiding the response to the event as well as any litigation of potential liability, and has been engaged to speak to executives, corporate counsel, and private practice attorneys on topics of cyber-breach, cyber-risk, and social media. Mr. Day also has a history of success representing companies, lenders, bankruptcy trustees, educational institutions, health insurers, and individuals in complex commercial disputes. Mr. Day received his J.D. from the Temple University School of Law, and his B.A. from LaSalle University. He is licensed to practice law in Pennsylvania, Delaware, and New Jersey, and is admitted to practice in the United States Federal District Courts of Delaware, New Jersey, the Eastern District of Pennsylvania, and the Middle District of Pennsylvania, as well as the Third Circuit Court of Appeals.

Robert M. Gift

Mr. Gift is a Supervisory Special Agent with the PA Office of Attorney General/Insurance Fraud Section. He has been with the office for 17 years. Mr. Gift currently serves as a board member for the Western Region IASIU Chapter. Before employment with the PA OAG, he was a police officer with the Coraopolis Borough Police Department and the Howard County Maryland Police Department. Mr. Gift earned his Bachelor’s Degree in Criminal Justice from Edinboro University.

Dennis A. Kistler, Esq.

Mr. Kistler is a Senior Deputy Attorney General with the Office of Attorney General, Insurance Fraud Section. He has been with the Attorney General’s Office since 1988 and helped form the Insurance Fraud Section in 1995. He has also worked in the Office’s Civil Litigation and Criminal Prosecutions Sections. After earning his J.D. from the University of Pittsburgh School of Law in 1983, Mr. Kistler worked in the Westmoreland County District Attorney’s Office. He earned his B.A. in 1980 from Indiana University of Pennsylvania.

David G. Ries, Esq.

Mr. Ries is Of Counsel in the Pittsburgh office of Clark Hill PLC, where he practices in the areas of environmental, technology, and data protection law and litigation. For over 10 years, he has increasingly focused on cybersecurity, privacy, and information governance. He has recently addressed in his practice such current issues as information security programs and plans, response to data breaches, digital and environmental forensics, admissibility of expert opinions, e-discovery, and defense of enforcement actions. Mr. Ries frequently speaks nationally on cybersecurity, ethics, legal technology, and technology law issues for legal, academic and professional groups. He served on the ABA TECHSHOW Board from 2005 through 2008 and is a member of the ABA Information Security Committee, E-Discovery and Digital Evidence Committee and Cyberspace Law Committee. He is the Editor of e-Discovery 3rd Edition (PBI Press 2014), a co-author of Locked Down: Practical Information Security for Attorneys (American Bar Association 2016) and Encryption Made Simple for Lawyers (American Bar Association 2015), and a contributing author to Information Security and Privacy: A Legal,

vii

Business and Technical Handbook, Second Edition (American Bar Association 2011). Mr. Ries received his J.D. from Boston College Law School in 1974. He can be contacted at [email protected] or (412) 394-7787.

Neil Robertson, Esq.

Mr. Robertson is the Operations Manager and General Counsel for Robertson Insurance & Risk Management in Lititz. Robertson Insurance & Risk Management is an independent insurance agency that focuses its efforts on developing comprehensive insurance programs and risk strategies for commercial and personal lines customers. Robertson Insurance & Risk Management assists customers with locations throughout the Mid-Atlantic Region and across the United States. Mr. Robertson is a licensed Property & Casualty insurance producer in multiple states and also operates his own law firm. Prior to joining Robertson Insurance & Risk Management in 2001, he was a shareholder at Harmon & Davies, P.C. in Lancaster where his practice focused on representing management in Employment Law litigation in state and federal courts throughout the United States. Mr. Robertson received his J.D. from Widener University School of Law in 1996 and was admitted to the Pennsylvania Bar that same year. He received his B.A. in Business and Political Science from the University of Pittsburgh.

M. Eric Schoenberg, Esq.

M. Eric Schoenberg has been a prosecutor for over 25 years. Since 2001, he has served in the Pennsylvania Office of the Attorney General, Insurance Fraud Section. From 1989 to 2000, he served as an Assistant District Attorney in Philadelphia. There, he handled appeals from criminal convictions of crimes up to and including murder, prosecuted drug traffickers, and investigated and prosecuted government corruption and police misconduct. Mr. Schoenberg has also worked as civil litigator, first in two Boston, Massachusetts firms and, later, in a Philadelphia firm, handling business litigation in areas such as antitrust law, employment law, and banking law. Mr. Schoenberg received his J.D. in 1983 from the Georgetown University Law Center in Washington, D.C.

viii

ix

Summary of Contents See also detailed Table of Contents beginning on page xi.

Chapter One Business Insurance 101 ............................................................................................................. 1

Chapter Two Commonwealth of Pennsylvania Office of Attorney General Insurance Fraud Section: Agent Fraud ............................................................................. 169 Chapter Three Cyber Risk Management and Liability Issues .................................................................. 219

Chapter Four Data Security 101: A Lawyer’s Guide to Ethical Issues in the Digital Age ................. 267

x

xi

Table of Contents See also Summary of Contents beginning on page ix.

Chapter One Business Insurance 101 ............................................................................................................. 1

Section 1 Commercial Package Policy (CPP) ................................................................................. 3

Originally Submitted in 2014 by: Jason F. Ernest, Esq. Updated in 2016 by: Neil Robertson, Esq.

I. Components of a Commercial Policy ........................................................................... 5 A. Flow Chart ............................................................................................................. 5 B. Common Policy Declarations............................................................................... 6 C. Common Policy Conditions ................................................................................. 6

1. Cancellation .................................................................................................. 6 2. Changes ....................................................................................................... 10 3. Examination of Your Books and Records ................................................... 10 4. Inspection and Surveys ............................................................................... 10 5. Premiums .................................................................................................... 11 6. Transfer of Your Rights and Duties ............................................................. 11

D. Interline Endorsements ...................................................................................... 11 E. One or More Coverage Parts ............................................................................... 11

IV. Farm Coverage ........................................................................................................... 12 A. Farm Property Coverage Form ........................................................................... 12

1. Coverage A – Dwellings ............................................................................... 12 2. Coverage B – Other Private Structures ....................................................... 12 3. Coverage C – Household Personal Property ............................................... 12 4. Coverage D – Loss of Use ............................................................................ 13

B. Farm Personal Property Coverage Form ............................................................ 13 1. Coverage E – Scheduled Farm Personal Property ...................................... 13 2. Coverage F – Unscheduled Farm Personal Property .................................. 14 3. Coverage G – Barns, Outbuildings and Other Farm Structures ................. 15

C. Farm Liability Coverage Form ............................................................................ 15 1. Coverage H – Bodily Injury and Property Damage Liability ...................... 15 2. Coverage I – Personal and Advertising Injury Liability .............................. 16 3. Coverage J – Medical Payments ................................................................. 16 4. Additional Coverages .................................................................................. 17 5. Limits ........................................................................................................... 17 6. Conditions ................................................................................................... 17

G. Livestock Coverage Form .................................................................................... 17

xii

H. Mobile Agricultural Machinery & Equipment Form .......................................... 18 1. Causes of Loss ............................................................................................. 18 2. Causes of Loss – Chart ................................................................................ 21 3. Exclusions ................................................................................................... 22 4. Additional Coverages ................................................................................. 22 5. Conditions .................................................................................................. 23 6. Definitions .................................................................................................. 23

V. Commercial Property .................................................................................................25 A. Commercial Property Conditions .......................................................................25

1. Control of Property ......................................................................................25 2. Insurance under Two or More Coverages ...................................................25 3. Coverage Territory.......................................................................................25 4. Transfer of Rights of Recovery against Others to Us (Subrogation) .......... 26

B. Commercial Property Coverage Forms .............................................................. 26 1. Building and Personal Property Coverage Form........................................ 26 2. Building ...................................................................................................... 26 3. Business Personal Property ......................................................................... 27 4. Personal Property of Others ........................................................................ 27 5. Property Not Covered .................................................................................. 27 6. Covered Causes of Loss .............................................................................. 28 7. Additional Coverages ................................................................................. 29 8. Coverage Extensions .................................................................................. 30 9. Limits .......................................................................................................... 30 10. Deductible .................................................................................................. 30 11. Loss Conditions ........................................................................................... 31 12. Valuation ..................................................................................................... 31 13. Condominium Association ......................................................................... 32 14. Condominium Commercial Unit-Owners .................................................. 32 15. Builders Risk .............................................................................................. 32 16. Business Income Coverage Form ............................................................... 33 17. Optional Business Income Coverages ........................................................ 33 18. Extra Expense Coverage Form ................................................................... 34 19. Legal Liability Coverage Form ................................................................... 34

C. Causes of Loss Forms ......................................................................................... 34 1. Basic of Causes of Loss Form ..................................................................... 34 2. Broad Causes of Loss Form ........................................................................ 34 3. Special Causes of Loss Form ...................................................................... 34 4. Comparison of Causes of Loss Forms ........................................................ 36

D. Selected Endorsements ...................................................................................... 36 1. Ordinance or Law Coverage ....................................................................... 36 2. Spoilage ....................................................................................................... 37 3. Peak Season Limit of Insurance .................................................................. 37 4. Value Reporting Form ................................................................................. 37

VI. Commercial Crime .................................................................................................... 38 A. Structure of Commercial Crime ......................................................................... 39 B. Crime Coverage Forms ...................................................................................... 39

1. Discovery Form .......................................................................................... 39 2. Loss Sustained Form .................................................................................. 39 3. Coverages.................................................................................................... 40

C. Other Crime Coverages ...................................................................................... 42

xiii

1. Lessees of Safe Deposit Boxes .................................................................... 42 2. Securities Deposited with Others ............................................................... 42 3. Guests’ Property ......................................................................................... 42 4. Safe Depository .......................................................................................... 42

D. Coverage Territory ............................................................................................. 42 E. Valuation ............................................................................................................ 43 F. All Crime Forms ................................................................................................. 43 G. Crime Coverage Summary Chart ....................................................................... 44

VII. Commercial Inland Marine ........................................................................................45 A. Structure of Inland Marine Policy ......................................................................45 B. Nationwide Marine Definition ............................................................................45 C. Commercial Inland Marine Conditions Form ................................................... 46

1. Loss Conditions .......................................................................................... 46 2. General Conditions ..................................................................................... 46 3. Exclusions ................................................................................................... 46

D. Inland Marine Coverage Forms (Filed and Non-Filed) ..................................... 46 1. Filed (or Controlled) .................................................................................... 47 2. Non-Filed (or Non-Controlled) ................................................................... 47

E. Filed Forms ......................................................................................................... 47 1. Accounts Receivable Coverage Form .......................................................... 47 2. Commercial Articles Form .......................................................................... 47 3. Jewelers Block Coverage Form ................................................................... 47 4. Sign Coverage Form ................................................................................... 48 5. Valuable Papers and Records Coverage Form ........................................... 48 6. Equipment Dealers Coverage Form ........................................................... 49

F. Non-Filed Forms ................................................................................................ 49 1. Bailees Customers ...................................................................................... 49 2. Contractors Equipment Floater ................................................................. 49 3. Electronic Data Processing Policies ........................................................... 49 4. Installation Floater ..................................................................................... 50

G. Transportation Coverages .................................................................................. 50 H. Common Carrier Cargo Liability ....................................................................... 50 I. Motor Truck Cargo Forms .................................................................................. 51

1. Motor Truck Cargo – Trucker’s Form ......................................................... 51 2. Motor Truck Cargo – Shipper’s Form ......................................................... 51 3. Motor Truck Cargo – Owner’s Form ........................................................... 51

J. Two Transportation Policies ............................................................................... 51 1. Transportation Policy – Annual Form ........................................................ 51 2. Transportation Policy – Trip Transit Form ................................................ 51

VIII. Equipment Breakdown...............................................................................................52 A. Structure of the Equipment Breakdown Policy ..................................................52 B. Equipment Breakdown Protection Coverage Form ............................................52

1. Direct Damage Coverage .............................................................................52 2. Covered Property ......................................................................................... 53 3. Covered Cause of Loss ................................................................................. 53 4. Definition of “Breakdown” .......................................................................... 53 5. Covered Equipment .....................................................................................54 6. Equipment Breakdown Coverages ..............................................................54 7. Selected Exclusions .....................................................................................56 8. Valuation .................................................................................................... 58

xiv

9. Deductibles ................................................................................................. 58 10. Suspension Condition .................................................................................59

C. Selected Endorsement ........................................................................................59 1. Actual Cash Value ........................................................................................59

IX. Commercial General Liability ................................................................................... 60 A. Introduction ....................................................................................................... 60 B. Components of a Commercial General Liability Policy ..................................... 60 C. Types of Forms .................................................................................................... 61 D. Section I Coverages ............................................................................................. 61

1. Bodily Injury and Property Damage Liability (Coverage A) ....................... 61 2. Premises and Operations ............................................................................ 61 3. Products and Completed Operations .......................................................... 61 4. Section I Exclusions ................................................................................... 62 5. Personal and Advertising Liability (Coverage B) ....................................... 63 6. Medical Payments (Coverage C)................................................................. 63 7. Supplementary Payments – Coverages A and B ........................................ 64

E. Section II – Who Is an Insured (Who Is Covered under the Policy) ................. 64 1. Named Insureds ......................................................................................... 64 2. Automatic Insureds .................................................................................... 64 3. Additional Insureds .................................................................................... 64 4. Who Is Insured – Chart ...............................................................................65

F. Section III – Limits of Insurance ....................................................................... 66 1. General Aggregate ...................................................................................... 66 2. Products and Completed Operations Aggregate ........................................ 66 3. Personal and Advertising Injury (Per Person or Organization .................. 66 4. Per Occurrence ........................................................................................... 66 5. Medical Expense ......................................................................................... 66 6. Damage to Premises Rented to You ........................................................... 66 7. Commercial General Liability – Limits of Insurance – Chart .................... 67

G. Section IV – Conditions ...................................................................................... 67 1. Notice and Cooperation............................................................................... 67 2. Other Insurance .......................................................................................... 67 3. Separation on Insureds ............................................................................... 67 4. Premium Audit ............................................................................................ 67 5. Transfer of Rights of Recovery .................................................................... 67

H. Section V – Definitions ...................................................................................... 68 1. Advertisement ............................................................................................ 68 2. Auto ............................................................................................................ 68 3. Bodily Injury ............................................................................................... 68 4. Coverage Territory...................................................................................... 68 5. Employee .................................................................................................... 68 6. Executive Officer ........................................................................................ 68 7. Impaired Property ...................................................................................... 68 8. Injured Contract (Six) ................................................................................ 68 9. Loading or Unloading ................................................................................ 69 10. Mobile Equipment ...................................................................................... 69 11. Occurrence ................................................................................................. 69 12. Personal and Advertising Injury ................................................................ 69 13. Products and Completed Operations Hazard ............................................ 69 14. Property Damage ........................................................................................ 70 15. Temporary Worker ..................................................................................... 70

xv

16. Volunteer Worker ....................................................................................... 70 17. Your Product .............................................................................................. 70 18. Your Work .................................................................................................. 70

I. Occurrence versus Claims-Made ....................................................................... 70 J. Claims-Made Features ....................................................................................... 70

1. Trigger ........................................................................................................ 70 2. Retroactive Date ......................................................................................... 70 3. Extended Reporting Periods (Also Known as “Tail” Coverage) .................. 71 4. Basic Extended Reporting Period (BERP) .................................................. 71 5. Supplemental Extended Reporting Period (SERP)..................................... 71 6. Claim Information ....................................................................................... 72

X. Quiz ............................................................................................................................ 73

Section 2 Businessowners (’10) Policy .......................................................................................... 89

Originally Submitted in 2014 by: Jason F. Ernest, Esq. Updated in 2016 by: Neil Robertson, Esq.

I. Characteristics and Purpose ....................................................................................... 91 A. Eligibility ............................................................................................................. 91

1. Eligible Risks Summary ............................................................................. 93 2. Ineligible Risks ........................................................................................... 93

II. Businessowners Section I - Property ......................................................................... 94 A. Coverage ............................................................................................................. 94

1. Covered Property ........................................................................................ 94 2. Property Not Covered ..................................................................................95 3. Limitations in the ISO’s Version of the BOP .............................................. 96 4. Additional Coverages ................................................................................. 98 5. Coverage Extensions ................................................................................. 101

B. Causes of Loss ................................................................................................... 102 C. Exclusions ......................................................................................................... 102

1. Exclusions under Section I of the BOP ..................................................... 102 2. Concurrent Causation Exclusions ............................................................. 104

D. Limits of Insurance ........................................................................................... 104 1. Outdoor Signs ............................................................................................ 104 2. Automatic Increase in Building Limit ....................................................... 104 3. Seasonal Increase Limit ............................................................................ 104

III. Businessowners Section II – Liability ...................................................................... 105 A. Coverages .......................................................................................................... 105

1. Businessowners Liability ........................................................................... 105 2. Coverage Extension – Supplementary Payments ..................................... 105

B. Exclusions ......................................................................................................... 106 1. Aircraft, Auto or Watercraft Exclusion ..................................................... 106 2. Professional Services Exclusion ................................................................ 106

C. Medical Expenses ............................................................................................. 107 1. Selected Exclusions ................................................................................... 107

D. Who Is an Insured ............................................................................................108 1. Who Is an Insured – Chart ........................................................................108

E. Limits of Insurance ........................................................................................... 109 1. Liability and Medical Expense Limit ........................................................ 109 2. Medical Expenses Limit ............................................................................ 109

xvi

3. Damage to Premises Rented to You .......................................................... 109 4. Products/Completed Operations Aggregate Limit ................................... 109 5. General Aggregate Limit ........................................................................... 109

F. Liability and Medical Expense Conditions ....................................................... 109 G. Definitions ........................................................................................................ 110

1. Advertisement ........................................................................................... 110 2. Auto ........................................................................................................... 110 3. Bodily Injury .............................................................................................. 110 4. Coverage Territory..................................................................................... 110 5. Employee ................................................................................................... 110 6. Hostile Fire ................................................................................................ 110 7. Impaired Property ..................................................................................... 110 8. Insured Contract ....................................................................................... 110 9. Leased Worker........................................................................................... 110 10. Loading or Unloading ............................................................................... 110 11. Mobile Equipment ..................................................................................... 110 12. Occurrence ................................................................................................ 110 13. Personal and Advertising Injury ................................................................ 111 14. Products and Completed Operations Hazard ............................................ 111 15. Property Damage ........................................................................................ 111 16. Your Product .............................................................................................. 111 17. Your Work .................................................................................................. 111

H. Deductibles ........................................................................................................ 111 1. $500 Deductible ......................................................................................... 111 2. No $ Deductible .......................................................................................... 111

I. Property Loss Conditions ................................................................................. 112 1. Abandonment ............................................................................................ 112 2. Appraisal ................................................................................................... 112 3. Duties in the Event of Loss or Damage ..................................................... 112 4. Legal Action against Us ............................................................................. 112 5. Recovered Property ................................................................................... 112 6. Resumption of Operations ........................................................................ 112 7. Valuation ................................................................................................... 112 8. Vacancy ...................................................................................................... 113 9. Loss Payment – Pennsylvania Changes .................................................... 113

J. Property General Conditions ............................................................................ 113 1. Control of Property .................................................................................... 113 2. Mortgage Holders ...................................................................................... 113 3. No Benefit to Bailee ................................................................................... 114 4. Policy Period Coverage Territory .............................................................. 114

K. Optional Coverages ........................................................................................... 114 1. Outdoor Signs ............................................................................................ 114 2. Money and Securities ................................................................................ 114 3. Employee Dishonesty ................................................................................ 114 4. Equipment Breakdown.............................................................................. 115

L. Property Definitions ......................................................................................... 115 1. Computer ................................................................................................... 115 2. Counterfeit Money ..................................................................................... 115 3. Electronic Data .......................................................................................... 115 4. Fungi .......................................................................................................... 115 5. Money ........................................................................................................ 115

xvii

6. Period of Restoration ................................................................................ 115 7. Securities ................................................................................................... 115

IV. Businessowners Section III – Common Policy Conditions ...................................... 116 A. Cancellation ...................................................................................................... 116 B. Changes ............................................................................................................. 116 C. Concealment, Misrepresentation or Fraud....................................................... 116 D. Examination of Books ....................................................................................... 116 E. Inspections and Surveys ................................................................................... 116 F. Insurance under Two or More Coverages ......................................................... 116 G. Liberalization .................................................................................................... 116 H. Other Insurance ................................................................................................ 116 I. Premiums .......................................................................................................... 116 J. Premium Audit ..................................................................................................117 K. Transfer of Rights of Recovery against Others to Us (Subrogation) .................117 L. Transfer of Your Rights and Duties under This Policy (Assignment) ...............117

V. Selected Endorsements .............................................................................................117 A. Hired and Non-Owned Auto Liability ...............................................................117 B. Protective Safeguards ....................................................................................... 118 C. Utility Services – Direct Damage ...................................................................... 118 D. Utility Services – Time Element ....................................................................... 119

VI. Quiz .......................................................................................................................... 120

Appendices .................................................................................................................... 127 Appendix A: Property and Casualty Insurance Companies and Producers Issuing Certificates of Insurance in Pennsylvania; Notice No. 2009-02 ......................... 129 Appendix B: Kvaerner Metals v. Commercial Union Ins. .............................................. 131 Appendix C: Millers Cap. Ins. Co. v. Gambone Bros. Dev. ......................................................... 141 Appendix D: Idalex Inc. v. Nat'l Union Fire Ins. Co. of Pittsburgh ............................................. 151

Chapter Two Commonwealth of Pennsylvania Office of Attorney General Insurance Fraud Section: Agent Fraud ............................................................................. 169

Kara L. Cotter, Esq., Robert Gift, Dennis A. Kistler, Esq., and M. Eric Schoenberg, Esq.

I. Part I: The Statutes ................................................................................................... 173 A. Altered, Forged, or Counterfeit Documents and Plates.................................... 174 B. Corrupt Organizations ...................................................................................... 174 C. Criminal Conspiracy ......................................................................................... 175 D. Criminal Solicitation ......................................................................................... 175 E. Criminal Use of Communications Facility ........................................................ 176 F. Dealing in Proceeds of Unlawful Activity ......................................................... 176 G. Deceptive or Fraudulent Business Practices..................................................... 176 H. Doing Business with Unlicensed Persons ......................................................... 177 I. False Application for Certificate of Title or Registration .................................. 177 J. False Swearing .................................................................................................. 177 K. Forgery .............................................................................................................. 178 L. Identity Theft .................................................................................................... 178 M. Insurance Fraud ................................................................................................ 178 N. Misapplication of Entrusted Property .............................................................. 179 O. Possession of a Controlled Substance ............................................................... 179 P. Tampering with Public Records or Information ..............................................180

xviii

Q. Theft by Deception ............................................................................................180 R. Theft by Failure to Make Required Disposition of Funds ................................ 181 S. Unfair Business Practices ................................................................................. 181 T. Unlawful Use of Computer ............................................................................... 181 U. Unlicensed [Insurance] Activity ....................................................................... 182 V. Unsworn Falsification to Authorities ............................................................... 182 W. Workers’ Compensation Fraud ......................................................................... 182

II. Part II: The Cases ..................................................................................................... 183 A. Kevin Pickell and Robert Pickell ....................................................................... 184 B. Richard Piccinini, Jr. ........................................................................................ 185 C. Katherine M. Webb ........................................................................................... 187 D. David Vahey ...................................................................................................... 188 E. Norma Sommers ............................................................................................... 189 F. Charles Eckardt, Jr., Barton Sacks, & Fred Milbert ......................................... 190 G. Linda Escobedo, George Bradford, and Richard Weaver ................................. 191 H. Thomas Serfass ................................................................................................. 194 I. Barbra Ternak ................................................................................................... 195 J. Charles Eckardt, Jr. & Mark Eckardt ................................................................ 197 K. Ross Rabelow, Bruce Cherry, Tom Muldoon, & Robert Lerner ....................... 198 L. Thomas Hurd .................................................................................................... 201 M. John Doe .......................................................................................................... 203 N. Percy E. Law, III .............................................................................................. 205 O. Patricia L. McNear ........................................................................................... 206 P. Timothy M. Baranik ......................................................................................... 207 Q. Martin Coyne ................................................................................................... 208 R. William M. Elensky, Jr. ................................................................................... 209 S. Ronald Enders, Jr. ............................................................................................ 210 T. Chad Goodwin................................................................................................... 211 U. Gregory Spitz .................................................................................................... 212 V. Carol Hughes .................................................................................................... 213 W. Robert Klein ...................................................................................................... 215 X. Heather Kozuchowsky ...................................................................................... 216 Y. Barry Landsperger ............................................................................................ 217

Chapter Three Cyber Risk Management and Liability Issues .................................................................. 219

Section 1 Information Security Overview: A Risk-Based Process ......................................... 221

David G. Ries, Esq.

Section 2 Safeguarding Confidential Information: Attorneys’ Ethical and Legal Obligations................................................................... 227

David G. Ries, Esq.

Introduction ............................................................................................................ 229

I. The Threats .............................................................................................................. 230 A. Outside Attacks ................................................................................................ 230 B. Lost and Stolen Devices ................................................................................... 236 C. Inside Threats ................................................................................................... 237 D. Government Surveillance ................................................................................ 239

xix

E. Summary of Threats ........................................................................................ 240

II. Duty to Safeguard ..................................................................................................... 241 A. Ethics Rules ...................................................................................................... 241 B. Ethics Opinions ................................................................................................ 244 C. Ethics Rules – Electronic Communications ..................................................... 247 D. Ethics Opinions – Electronic Communications .............................................. 249 E. Common Law Duties ........................................................................................ 251 F. Laws and Regulations Covering Personal Information ................................... 252 G. Summary of Duties .......................................................................................... 254

III. Information Security Basics .................................................................................... 254

IV. Reasonable Safeguards ............................................................................................ 256 A. Security Frameworks and Standards ................................................................ 257 B. Consensus Security Controls ........................................................................... 259 C. Inventory and Risk Assessment ........................................................................ 261 D. Laptops and Portable Devices.......................................................................... 262

Conclusion ............................................................................................................... 262

Additional Information ........................................................................................... 264

Chapter Four Data Security 101: A Lawyer’s Guide to Ethical Issues in the Digital Age ................. 267

Christopher M. Brubaker, Esq. and David G. Ries, Esq.

I. Summary of Pennsylvania Rules of Professional Conduct Involving Data Security ............................................................................ 269

II. Threat Overview ....................................................................................................... 273

III. Reasonable Steps ...................................................................................................... 274

IV. Other Duties and Obligations ................................................................................... 277

V. Additional Resources .............................................................................................. 278

xx

Chapter One

Business Insurance 101

Neil Robertson, Esq. Robertson Insurance & Risk Management Lititz

1

2

Chapter One Section 1

Commercial Package Policy (CPP)

Originally Submitted in 2014 by: Jason F. Ernest, Esq. Insurance Agents & Brokers Mechanicsburg Updated in 2016 by: Neil Robertson, Esq. Robertson Insurance & Risk Management Lititz

© 2013. Insurance Agents & Brokers. Reprinted with permission.

3

4


© 2013. Insurance Agents & Brokers

NOTES

+

+

=

+

COMMERCIAL PACKAGE POLICY (CPP)

COMPONENTS OF A COMMERCIAL POLICY

Commercial Property (includes

Glass) Coverage

Part

Commercial General Liability

Coverage Part

Crime Coverage

Part

Inland Marine

Coverage Part

Equipment Breakdown Coverage

Part

Auto Coverage

Part

Farm Coverage

Part

CP Declarations

CGL Declarations

Page

Crime Declarations

Page

IM Declarations

Page

EB Declarations

Page

Auto Declarations

Page

Farm Declarations

Page

CP Coverage Forms

CGL Coverage

Forms (includes

conditions)

Crime Coverage

Forms

IM Coverage

Forms

EB Coverage Forms

(includes conditions)

Auto Coverage

Forms (includes

conditions)

Farm Coverage

Forms

CP Causes of Loss

Crime General

Provisions Form

IM Conditions

Forms

Farm Causes of Loss

CP Conditions

Farm

Conditions


Common Policy Declarations

Common Policy Conditions

Interline Endorsements

Two or more of the following coverage parts

5



NOTES

It is important for you to understand the component parts of the Commercial Package Policy. You will see the Commercial Package Policy is simply a method of organizing more than one coverage part. It is important to note that coverage is the same whether a policy stands alone or is combined in this package.

All types of risks are eligible for this program, except a homeowners-type risk.

COMMON POLICY DECLARATIONS

The Common Policy Declarations is part of each commercial policy, whether it includes only one or several of the eligible commercial coverage parts in the program. As expected it will list one or more Named Insureds, the mailing address, the policy period and the business description. It personalizes the policy to the insured.

The First Named Insured is the first party listed on the Named Insured line. The first named insured has a number of rights and duties to act on behalf of all other insureds. These duties are identified in the common conditions.

As you can see from the sample on page 4, the various coverage parts are listed and coverage is initiated by entering a premium in the space opposite the desired coverage. There is also an area to list the forms which would apply to all included coverage parts. Forms which apply to only one specific coverage part will be included in the declarations for that particular part.

COMMON POLICY CONDITIONS

The following six Common Policy Conditions will apply to all of the eligible coverage parts that are attached to a policy. They are detailed below and a sample of this form is also included on Page 5.

Cancellation This common condition describes the rules required for cancellation of any policy in the package. The first named insured may cancel the policy at any time by notifying the company prior to the cancellation date. The company may cancel only by giving prior written notice to the first named insured. The notice must be mailed to the first named insured at the last known mailing address.

Pennsylvania amends the rules of cancellation for all commercial policies by requiring the attachment of a specific endorsement, Pennsylvania Changes – Cancellation and Nonrenewal (IL 02 46), which must be attached to each different coverage part within the package.

6



NOTES

NOTICE OF CANCELLATION SUMMARY CHART

15 Days 30 Days 60 Days

Policies in effect less than 60 days

Any reason

Policies in effect 60 days or more

Material misrepresentation

Substantial increase in hazard

Loss of reinsurance

Non-payment of premium

Material failure to comply with policy terms, conditions or contractual duties

Any other reason approved by the Commissioner

If we do not renew this policy we will notify the first named insured at least 60 days prior to the expiration date.

7



NOTES

8



NOTES

AMENDED BY PENNSYLVANIA LAW

(SEE NEXT PAGE)

9



NOTES It is important to know the special Pennsylvania requirements. They apply differently depending on whether the policy is just being written or if it has been in force for a longer period of time:

• If the policy has been in effect for less than 60 days, the company can cancel for any reason by giving 30 days written notice.

• If the policy has been in effect for 60 days or more, the company can only cancel for approved reasons.

The company can cancel with 60 days written notice for reasons of:

• Substantial change in condition or loss experience;

• Loss or reduction of reinsurance available to the company;

• Material failure to comply with policy terms conditions or duties;

• Other reasons approved by the Insurance Commissioner;

The company can cancel with 15 days written notice for reasons of:

• Material misrepresentation

• Non-payment of premium

If the company is planning to nonrenew the coverage, they must provide 60 days written notice prior to the renewal.

If the company is planning to increase premium at renewal, they must provide 30 days written notice prior the effective date of premium increase.

Changes This condition states only the First Named Insured is authorized to contact the company to make changes in the terms of the policy with the insurer’s consent.

Examination of Your Books and Records The insurer has a right to inspect and audit the insured’s books and records at any reasonable time during the policy period and for a period of up to 3 years after the policy period.

Inspection and Surveys The insurer has a right to make inspections and surveys of the insured’s premises. The condition goes on to say that the inspection or survey is not a guarantee that the premises or circumstances are safe or comply with safety laws. This condition is amended by Pennsylvania Law (see section 3.2).

10



NOTES Premiums This condition simply states the First Named Insured is responsible for making payment and will be the payee for any return premiums.

Transfer of Your Rights and Duties Under This Policy The insured may not transfer his/her rights and duties under the policy without the insurer’s written consent, except in the case of the insured’s death.

INTERLINE ENDORSEMENTS

These are endorsements that apply to all parts of the policy. For example:

IL 09 10 – Pennsylvania Notice

Il 02 46 – Pennsylvania Changes Cancellations & Nonrenewal

ONE OR MORE COVERAGE PARTS

As the previous Commercial Package Policy chart shows, one or more coverage parts or forms may be written under the Commercial Package Policy. These coverage parts include the following:

• Commercial Property

• Commercial General Liability

• Crime

• Inland Marine

• Equipment Breakdown

• Farm Property

• Commercial Auto

In addition to the above listed coverage parts, recent revisions to the Commercial Package Policy Program have made additional coverage parts available. These include Employment Related Practices Liability, Liquor Liability, Pollution Liability and Professional Liability.

11



NOTES

FARM COVERAGE

There are a large number of farms in the U.S. with unique business and residential exposures since farmers live and work on their farms. The Farm Program has certain characteristics of both personal lines and commercial lines.

FARM PROPERTY COVERAGE FORM — FP 00 12

The Farm Property Coverage Form agrees to pay for direct physical loss or damage to Covered Property at the “insured location” described on the Declarations Page. Other locations may be included if they are identified within the form. To be a covered loss, the direct physical loss must arise from a Covered Cause of Loss.

Coverage A - Dwellings

The dwelling is almost identical to Homeowners Coverage A with a special limit of $1,000 for antennas and satellite dishes attached to the covered dwelling.

Conditions

In a provision similar to one you reviewed in the Homeowners Policy, it states that lost or damaged property will be paid on a replacement cost basis, if the insured carries a limit of insurance equal to at least 80% of the structure’s replacement cost value. If the insured does not comply with this provision, the policy will pay the larger of actual cash value or a proportional value of the amount carried divided by the amount required (80% X replacement cost value).

Coverage B - Other Private Structures

Other private structures is almost identical to Homeowners Coverage B, however, any structure used for farming must be scheduled and covered under Coverage G – other farm structures. Coverage is provided to unattached private structures owned by the insured including, but not limited to, storage sheds, playhouses, or gazebos.

Coverage C - Household Personal Property

Household Personal Property applies to property the insured would use in his/her normal living situation and not related to operating a farm or ranch.

Special Limits in Coverage C of the Farm Property Coverage Form are same or similar to the Homeowners Policy.

12



NOTES Coverage Extensions to Coverages A - Dwelling, Coverage B - Other Structures, and Coverage C - Household Personal Property

The Farm Property Coverage Form is unique in the way it presents Extensions of Coverage. Some Extensions of Coverage apply to Coverages A, B, and C, and others only apply to Coverage C.

Extensions of Coverages A, B and C

• Trees, shrubs and plants coverage is similar to the Homeowners except the trees, shrubs, plants and lawns must be located within 250 feet of a covered “dwelling” for coverage to apply.

Extensions of Coverage to Coverage C Only

• Household personal property of named insureds away from the “insured location” is subject to a limit of 10% of the Household Personal Property Limit or $1,000, whichever is greater. Coverage is provided anywhere in the world.

• Refrigerated Products - Not “Farm Personal Property”

The form will pay up to $500 for loss or damage to the contents of a refrigerated unit in the “dwelling” caused by a change in temperature due to interruption of electrical service to the refrigeration equipment.

If the named insured is a tenant, building improvements and alterations will be paid up to 10% of Coverage C.

Coverage D - Loss of Use

Coverage D is similar to the Homeowners Policy.

FARM PERSONAL PROPERTY COVERAGE FORM—FP 00 13

Coverage E - Scheduled Farm Personal Property

In this form, each class of property to be covered is indicated by an amount shown on the declarations.

Covered Property

Covered Property includes grain, hay, farm products and machinery, livestock (except in transit or at stockyards), poultry (excluding turkeys unless specified), computers related to farm management, miscellaneous equipment (tools), borrowed equipment, bees, worms, fish and other animals, and portable structures and buildings.

13



NOTES Property Not Covered

It does not cover growing crops, trees, plants, shrubs or lawns and household personal property, etc.

Special Limits

Since many items are specifically scheduled in this Form, there are few Special Limits. The Special Limits which do exist are:

1. $10,000 on any one stack of hay, straw or fodder (feed) in the open.

2. “Poultry” is paid at market value.

3. $3,000 on any one item of miscellaneous equipment.

4. Per head of “livestock” (if not specifically described) will receive the least of ACV of the animal destroyed or damaged or $2,000.

All losses here are settled on an ACV basis.

Coverage Extensions

Coverage Extensions under Coverage E include:

1. Newly acquired livestock up to 25% of Coverage E if reported within 30 days.

2. Property in the custody of a common or contract carrier up to $1,000.

3. Miscellaneous equipment away from the “insured property” up to 25% of Coverage E.

4. Other types of property, such as grain and hay, away from the “insured property” up to 10% of Coverage E.

5. Newly acquired additional farm machinery, equipment and vehicles, up to a limit of $100,000 for 30 days.

6. Replacement machinery, equipment and vehicles, the value of the old equipment plus $75,000 for 30 days.

Coverage F - Unscheduled Farm Personal Property

Provides property coverage for property and equipment used in the business of farming. Coverage F is provided using a single blanket limit of insurance on all unscheduled farm personal property. A limit of insurance for Coverage F must be shown on the declarations page for coverage to apply.

Covered Property

All types of “farm personal property” are covered at the “insured location,” except those listed under Property Not Covered.

14



NOTES Property Not Covered

1. Household Personal Property

2. Racehorses and show horses.

3. Growing crops.

4. Contents of chicken houses.

5. Irrigation equipment.

Off premises coverage includes farm implements, tools, farm machinery, feed and livestock, but not while in transport by others or at a stockyard. Coverage is limited to $2,000 on any one head of livestock one year or older and $1,000 per head if under one year. This coverage is subject to an 80% coinsurance requirement. Losses here are settled on an ACV basis.

Coverage Extensions under Coverage F include farm products in the open such as hay, grain, straw or fodder up to 10% of Coverage F for limited perils only. Also, farm personal property in the custody of a common or contract carrier up to a $1,000 limit.

Coverage G - Barns, Outbuildings and Other Farm Structures Coverage Form—FP 00 14

This form is used to insure farm structures such as barns, silos, pens, fences, corrals, portable buildings and structures and outdoor radio and TV equipment and other described structures used in operation of a farm or ranch. A Limit of Insurance for Other Farm Structures must be shown on the Declarations Page under Coverage G.

Coverage Extensions include damage to power and light poles is covered up to $1,000 per occurrence and new farm structures on the “insured location” are covered up to $100,000 if reported within 60 days.

FARM LIABILITY COVERAGE FORM - FL 00 20

The Farm Liability Coverage form is a mixture of the personal liability coverage (Section II) of the Homeowners Policy and the Business Liability Coverage in the Commercial General Liability Coverage Form. The Farm Liability Coverage Form can be combined with a Farm Liability Coverage Form Declarations, Common Policy Conditions and any appropriate endorsements to form a Farm Liability Policy. The Farm Liability Coverage Form can also be combined with the Farm Property Forms to provide a multi-line policy.

Coverage H – Bodily Injury and Property Damage Liability

The Farm Liability Coverage Form agrees to pay those sums that the “insured” is legally obligated to pay as damages because of “bodily injury” or “property damage”. The insurer also has the right and duty to settle or defend.

15



NOTES Exclusions

Most of the exclusions contained in the Farm Liability Coverage Form are a combination of those found in the CGL and Homeowners forms. They include pollution, motor vehicles and watercraft, damage to owned, rented or borrowed property, damage to your product or your work, communicable diseases, use or delivery of controlled substances, sexual molestation, distribution of materials in violation of statutes (CAN-SPAM, etc.) However, this form includes several additional exclusions that are unique to the Farm Liability Coverage Form. They include:

crop dusting,

strength or speed competition involving animals,

the use of animals to provide rides with our without an accessory vehicle, to any person for a fee at a fair, charitable function or similar type of event.

business pursuits other than farming or custom farming,

custom farming (farming performed for an agreed charge on a neighbors farm) if receipts exceeded $5,000 for the twelve months preceding the date of the loss.

Coverage I - Personal and Advertising Injury Liability

This coverage is the same as that provided under Coverage B – Personal And Advertising Injury Liability in the CGL. As with the CGL, covered losses are limited to those offenses described in the definitions of “Personal injury” and “Advertising injury”. (Note: Unlike the CGL, these two terms are defined separately in the Farm Liability Coverage Form.)

Exclusions include intentional acts, breach of contract, failure of goods to perform, and offenses committed by an insured who is in the business of broadcasting.

Coverage J - Medical Payments

Medical Payments are made without regard to fault or the insured’s legal obligation.

Medical Payments will pay for reasonable medical expenses, including first aid and medical, surgical, dental, hospital, and nursing bills, incurred or medically ascertained within three years of the date of the accident. The injury must occur on an “insured location” or arise out of the insured’s activities.

Exclusions are similar to those found in the Homeowners and CGL forms. In addition, medical payments for injuries to “farm employees” or other persons engaged in work usual or incidental to the maintenance or use of the “insured location” as a farm are excluded.

16



NOTES ADDITIONAL COVERAGES

Supplementary Payments

The supplementary payments, which are paid in addition to the policy limits, are the same as the CGL in regard to claims or defending suits. Also included are other expenses incurred by an “insured” at the insurer’s request.

Damage to Property of Others up to $1,000 per occurrence.

LIMITS

Coverage H - is subject to a per occurrence limit; Coverage I –is subject to a per person or organization limit; and, Coverage J –is subject to a per person limit. Fire Damage Liability, which is part of Coverage H –is subject to a per fire limit.

All loss payments made under Coverage H, Coverage I and Coverage J are subject to the general aggregate limit shown in the Declarations.

There are two major differences from the CGL:

1. There is no separate aggregate limit for products – completed operations claims; and

2. The Farm Liability Coverage Form has an internal limit of $10,000 for vicarious liability that is statutorily imposed on parents for the acts of a child.

CONDITIONS

The conditions found in the Farm Liability Coverage Part follow those found in the CGL and Homeowners Policy.

LIVESTOCK COVERAGE FORM - FP 00 40

This particular form provides coverage to livestock on a named perils basis, and the livestock can be written on a schedule or blanket basis. Livestock includes cattle, horses, sheep, goats, swine, mules and donkeys. This coverage is primarily designed for sale to owners, but there is nothing to preclude a non-owner from purchasing this coverage.

This named peril coverage is similar to that found under the Basic Causes of Loss under the Farm Property Coverage Form - FP 00 10.

17



NOTES MOBILE AGRICULTURAL MACHINERY & EQUIPMENT FORM

This form is used to provide open peril coverage for mobile agricultural machinery and equipment used in the everyday operations of the farm. Examples of equipment that can be covered include tractors, combines and bailers. However, irrigation equipment and self-propelled combines for hire are excluded. Coverage can be written on a scheduled or blanket basis.

CAUSES OF LOSS

This section of the Farm Property Coverage Form includes all three of the Causes of Loss provisions: Basic, Broad and Special. Coverage is activated by an entry on the Declarations Page.

Basic

The Basic Cause of Loss Form provides protection arising out of 14 named Causes of Loss. They are:

1. Fire and lightning, except damage that results from use of open fire for curing or drying tobacco in a barn;

2. Windstorm or hail;

3. Explosion - does not include explosion of alcohol stills, steam boilers and similar steam equipment;

4. Riot or civil commotion;

5. Aircraft;

6. Vehicles;

7. Smoke, but does not include loss by smoke from agricultural smudging or industrial operations;

8. Vandalism, but there is no coverage for “vacant” buildings if vacant over 30 days.

9. Theft;

10. Sinkhole Collapse;

11. Volcanic Action;

12. Collision - Coverage E and Coverage F only:

For collisions causing:

a. Damage to Covered Farm Machinery;

b. Death of Covered Livestock including overturn of a transporting vehicle or if livestock is run into or struck moving along or standing on a public road;

18



NOTES c. Damage to Other Farm Personal Property while that property is in

or on a motor vehicle involved in a collision or is overturned;

13. Earthquake loss to livestock;

14. Flood loss to livestock.

Broad

The Broad Causes of Loss covers the perils listed in the basic form and adds the following losses to livestock: electrocution, attack by dogs or wild animals, accidental shootings on the insured location, drowning (except swine under 30 days old), loading or unloading.

Plus breakage of glass, weight of ice, snow or sleet, sudden and accidental tearing apart of heat, hot water or air conditioning systems, accidental discharge or leaking of water or steam from a system, freezing of plumbing system, and sudden and accidental damage from artificially generated electrical systems to electric devices, appliances or wires.

Special

The Special Causes of Loss covers risks of direct physical loss except those specifically excluded. Exclusions include:

1. Fire if caused by curing tobacco;

2. Collapse (except as provided in additional coverages;

3. Rain, snow, ice or sleet to personal property in the open;

4. Windstorm or hail to dairy or farm products in the open;

5. Freezing of plumbing, heating or air conditioning or appliances, due to the insured’s neglect, if the building is unoccupied;

6. Explosion to alcohol stills, boilers and steam pipes in farm buildings;

7. Freezing, thawing, weight of water or ice on fences, patios, swimming pools, foundations, retaining walls, piers or docks;

8. Theft in or to a “dwelling” under construction, or materials and supplies used in the construction;

9. Voluntary parting of property;

10. Inventory shortage;

11. Vandalism and malicious mischief, if the dwelling is vacant more than 30 days;

12. Wear and tear, inherent vice, mechanical breakdown, rust or other corrosion, mold, rot and similar causes of loss;

13. Damage to farm equipment as a result of foreign objects being taken into any farm machinery or mechanical harvester;

14. Artificially generated electric current;

19



NOTES 15. Dishonest acts of an insured or employees;

16. Smoke from agricultural smudging or industrial operations;

15. Birds, vermin, rodents, or insects;

16. Pollution;

17. Settling, cracking, bulging or expansion; and

18. Concurrent Causation types of loss.

20



NOTES

Causes of Loss Basic Broad Special

Fire and Lightning

YES

Explosion (a)

Windstorm & Hail (a) (b)

Smoke (a)

Aircraft & Vehicles (A)

Riot & Civil Commotion

Vandalism (a) (b)

Sprinkler Leakage (b)

Sinkhole Collapse (a)

Volcanic Action (a)

Theft (a) (b)

Collision (a)

Flood and Earthquake to “Livestock”

Weight of Ice, Snow or Sleet (a)

Water Damage (a)

Collapse (a) (c)

Glass Breakage (a) NO

Falling Objects (a)

Loading/Unloading Accidents (a)

Accidental Shooting of Covered Livestock (a)

Drowning of Livestock (a)

Risk of Direct Physical Loss

(a) These causes of loss are subject to limitations.

(b) These causes of loss can be excluded by endorsement.

(c) Theses causes of loss are provided by the Additional Coverages provisions.

21



NOTES EXCLUSIONS

Exclusions that are common to almost all the coverages found in the Farm Property Coverage Part include:

1. Ordinance or Law;

2. Earth movement which excludes earthquakes, etc.;

3. Intentional Loss;

4. Government Action

5. Nuclear Hazard

6. Off-premises power failure;

7. War and Military Action

8. Water that excludes flood, mudslides, sewer and drain backup.

ADDITIONAL COVERAGES

Additional coverages include:

Debris Removal – 25% of the loss included in the limit of insurance plus an additional 5% of the limit of insurance.

Reasonable Repairs

Damage to Property Removed – all risk coverage for 30 days

Fire Department Service Charge – will pay up to $1,000 for liability assumed by a contract or agreement.

Collapse

Pollutant Clean Up and Removal – up to $10,000

There are several Additional Coverages under the Farm Property Coverage Form under Coverages A, B, C and D including:

1. Removal of Fallen Trees – up to $1,000, but no more than $500 for any one tree.

2. Credit Card, Fund Transfer Card, Forgery and Counterfeit Money - $500 limit.

Additional Coverage to Coverage E and Coverage F - This Additional Coverage provides $2,000 for the cost of restoring, researching or replacing records of farm operations.

22



NOTES CONDITIONS

The conditions of the Farm Property Coverage Form are very similar to those found in the Commercial Property Policy. One unique condition to Farm Property is related to “unoccupancy” or “vacancy.” If a building or structure is “unoccupied” or “vacant” greater than 120 consecutive days, the Limit of Insurance applicable to buildings or structures and their contents is automatically reduced by 50%, unless an endorsement is attached to extend the period of “unoccupancy” or “vacancy.”

DEFINITIONS

“Business” means a trade, profession, occupation, enterprise or activity other than farming or custom farming, which is engaged in for money or other compensation.

“Business property” means property pertaining to any trade, profession or occupation other than farming.

“Custom Farming” means performance of specific planting, cultivating, harvesting or similar specific “farming” operations by an “insured” at a farm that is not an “insured location”, when the performance is for, and under the direction or supervision of, the owner or operator of the farm. It does not include:

1. Operations at a premises rented to, leased to or controlled by an “insured”;

2. Operations for which no compensation in goods or money is received; or

3. A neighborly exchange of services.

Custom Farming operations are excluded if the insured’s receipts from custom farming exceed $5,000 for the twelve months before the date of the loss.

“Dwelling” means a building used principally for family residential purposes and includes mobile homes, modular and manufactured homes.

“Farming” means the operation of an agricultural or aquacultural enterprise and includes operations of roadside stands on the named insured’s farm premises maintained solely for the sale of farm products produced principally by the named insured.

“Farm Employee” is an employee whose principle duties are connected with maintenance or use of the “insured’s” farm or farm equipment.

“Farm personal property” means equipment, supplies and products of farming or ranching operations including, but not limited to, seeds, feed, fertilizer, “livestock,” other animals, agricultural machinery and equipment.

23



NOTES “Insured” in the Farm Liability Coverage Form is similar to who is an insured under the CGL and Homeowners forms.

If the named insured is:

1. An individual, “insured” includes resident relatives, any other person under the age of 21 in the care of an “insured”, and a full-time student who was a member of the household before moving out to attend school and under the age of 24 if a relative or under the age of 21 if in the care of an “insured”;

2. A partnership or joint venture, partners and members and their spouses are “insureds” with respect to “farming operations”;

3. A limited liability company, the members and managers are “insureds” with respect to “farming operations”; or

4. A corporation, the executive officers, directors and stockholders are “insureds” with respect to their duties.

“Insured” also means:

1. All employees for acts within the scope of their employment;

2. Any person or organization acting as the named insured’s real estate manager;

3. Any person or organization that is not a business who is legally responsible for the “insured’s” animals or watercraft that are covered under the policy; and

4. Any person using a covered vehicle on an “insured location”.

“Insured location” means any location, including its private approaches described on the Declarations Page. This is very similar to insured locations under the Homeowners Policy.

“Livestock” means cattle, swine, sheep, goats, horses, mules and donkeys.

“Poultry” means fowl kept by the named insured for sale or use.

“Vacancy” means that a building or structure is in a state where it does not contain sufficient furnishings or other property customary to its intended use. A single piece of furniture would not be sufficient for customary use.

“Specified Causes of Loss” means fire, explosion, windstorm or hail, smoke, aircraft or vehicles, riot or civil commotion, vandalism, leakage from fire extinguishing equipment, sinkhole collapse, volcanic action, falling objects, weight of snow, ice or sleet, and water damage arising from a loss by fire or windstorm or hail in which it causes an opening in the building.

24



NOTES

COMMERCIAL PROPERTY (’07)

The Commercial Property Policy provides insurance coverage to meet various property exposure needs of your insureds. It is very flexible and can be designed to modify coverage by the selection of coverage forms and appropriate endorsements.

Commercial Property Policy

=

Commercial Property Declarations

+

Commercial Property Conditions

+

Commercial Property Coverage Form(s)

+

Commercial Property Causes of Loss Form(s)

+

Endorsements as needed Required state changes

COMMERCIAL PROPERTY CONDITIONS

Most of the commercial property conditions are repeated from other forms. However, there are a few that we need to review. These conditions also make up the businessowners common policy conditions.

Control of Property The Control of Property condition states that an act or neglect by any person beyond the insured’s direction or control, will not affect this insurance.

Insurance Under Two Or More Coverages This condition states if two or more coverages apply to the same loss, the insurer will not pay more than the actual amount of loss.

Coverage Territory Coverage Territory is the United States of America (including its territories and possessions), Puerto Rico and Canada.

25



NOTES Transfer of Rights of Recovery Against Others to Us (subrogation) This condition is the subrogation condition by a different name. However, this condition specifically allows the insured to waive their right of recovery to anyone as long as they do it in writing and prior to the loss. In addition, it specifies that the insured can waive rights of recovery after a loss to any of the three parties listed below:

• Anyone who qualifies as an insured under the policy

• A parent or subsidiary company of the insured

• A tenant of the insured’s building

COMMERCIAL PROPERTY COVERAGE FORMS

The following are the coverage forms available:

• Building and Personal Property Coverage Form (similar to Businessowners Policy)

• Builders Risk Coverage Form

• Business Income (And Extra Expense) Coverage Form (similar to Businessowners Policy)

• Business Income (Without Extra Expense) Coverage Form

• Extra Expense Coverage Form

• Condominium Association Form

• Condominium Commercial Unit-Owners Coverage Form

Building and Personal Property Coverage Form This form is used to insure all types of commercial property with the exception of those classified as Builders Risk or Condominiums.

The coverage form specifies that the company will pay if the loss is a direct physical loss of or damage to covered property at the premises described in the declarations caused by or resulting from any covered cause of loss. The form provides coverage for described buildings, business personal property and personal property of others, as listed on the Declarations Page.

Building Building means the building or structure described in the Declarations, including:

completed additions;

fixtures (including outdoor fixtures);

permanently installed machinery and equipment;

personal property used to maintain or service the premises including:

26



NOTES o fire extinguishing equipment

o outdoor furniture

o snow throwers

o lawn mowers

o floor coverings

appliances used for refrigerating, ventilating, cooking, dishwashing or laundering;

Building also means additions, alterations and repairs under construction if not covered elsewhere including materials, equipment, supplies and temporary structures that are on or within 100 feet of the described premises.

Business Personal Property Business Personal Property is the insured’s personal property located in or on the building described, or in the open (or in a vehicle) within 100 feet of the described premises. This property may include the following items:

• Furniture, fixtures, machinery and equipment.

• Stock materials used for making the insured’s products or inventory.

• All other personal property owned by the named insured and used in the insured’s business.

• Labor, materials, or services furnished or arranged by the named insured on personal property of others.

• Improvements and betterments added by an insured tenant.

• Any leased personal property the insured has a contractual obligation to insure such as a leased copier or phone system.

Personal Property of Others Property of others in the insured’s care, custody or control located in the described building or within 100 feet of the described premises.

Property Not Covered

• Accounts, bills, currency, food stamps, evidence of debt, money, notes or securities;

• Animals, unless owned by others and the insured boards, or if owned by the insured and is the insured’s stock;

• Autos held for sale;

• Bridges, roadways, walks, or other paved surfaces;

• Contraband, or property in the course of illegal trade or transportation;

27



NOTES • Foundations of buildings, structures, machinery or boilers if their foundation is

below the lowest basement floor or surface of the ground;

• Land, water, growing crops, or lawns;

• Personal property while airborne or waterborne;

• Pilings, piers, wharves or docks;

• Property specifically described under any other policy;

• Retaining walls that are not part of a building;

• Underground pipes, flues or drains;

• Electronic Data, except as provided under Additional Coverages.

• Cost to replace or restore information on valuable papers and records, except as provided by Coverage Extensions;

• Vehicles or self-propelled machines (including aircraft or watercraft)

(1) except vehicles or self-propelled machines or autos you make, process or warehouse,

(2) vehicles or self-propelled machines held for sale (other than autos),

(3) rowboats and canoes not in water at the described premises;

• Certain described property while outside of buildings (crops, grain);

• Other property such as unattached signs and fences except as provided by Coverage Extensions.

Covered Causes of Loss The Building and Personal Property Coverage Form does not show any causes of loss, as the insured must select one of the available causes of loss forms. Causes of Loss forms will be discussed later in this section.

28



NOTES Additional Coverages There are six Additional Coverages:

1. Debris Removal Debris Removal pays to remove debris of covered property caused by a covered loss. The policy pays up to 25% of the amount of the loss and this amount is included in the limit of insurance. If this amount is not enough, the insured is entitled to $10,000 in addition to the limit of insurance.

The building is valued at $100,000 and is insured for that amount. Following a $10,000 fire, the insured learns that it will cost an additional $7,500 to remove the debris. Debris removal will pay 25% of the $10,000 loss ($2,500) and then will use $5,000 of the additional available $10,000 to pay for the remaining amount for debris removal. If the entire structure had been destroyed, the insured would have had only the additional $10,000 to cover the cost of any required debris removal.

This provision does not pay for pollution cleanup for land or water.

2. Preservation of Property

If you must remove property from the premises to protect it from a covered peril, the policy provides true “all risk” coverage for a period of 30 days.

3. Fire Department Service Charge

The policy will pay up to $1,000 for your liability for fire department service charges. This is additional coverage and no deductible applies.

4. Pollutant Clean Up and Removal

The policy pays up to $10,000 to extract pollutants from land or water at the described premises resulting from a covered cause of loss. The $10,000 limit is the most the company will pay at any one location for the entire policy period.

5. Increased Cost of Construction

The policy pays up to $10,000 or 5% of the limit of insurance, whichever is less. This coverage is used to pay for the increased cost of construction of damaged property only incurred to comply with the enforcement of local laws or building ordinances (bringing the building up to code).

6. Electronic Data

The policy pays up to $2,500 for all loss or damage in any one policy year for the cost to repair, replace or restore electronic data that is destroyed or corrupted by a covered cause of loss.

29



NOTES Coverage Extensions There are six (6) coverage extensions that apply if a coinsurance percentage of 80% or more is shown in the Declarations. These extensions are additional insurance.

1. Newly Acquired or Constructed Property

The policy provides up to $250,000 for building coverage and $100,000 for personal property coverage for up to 30 days.

2. Personal Effects and Property of Others

The policy pays up to $2,500 per premises, except the peril of theft is excluded.

3. Valuable Papers and Records

The policy pays up to $2,500 per described premises.

4. Property Off Premises

The policy pays up to $10,000 for covered property while it is temporarily away from the described premises at a location you don’t own or operate, or is at any fair, trade show or exhibition. No coverage is provided for property in the care, custody or control of salespersons or in or upon any vehicle.

5. Outdoor Property

The policy will pay for damage to outdoor fences, radio and television antennas including satellite dishes, trees, shrubs and plants but only from the following perils: Fire, Lightning, Aircraft, Riot and Explosion. The limit of coverage is $1,000 but no more than $250 for any one tree, shrub or plant.

6. Non-owned Detached Trailers

The policy provides up to $5,000 coverage for non-owned trailers which are in the care of the insured or being used in the insured’s business or for which the insured is contractually responsible. This coverage is excess over any other insurance.

Limits The coverage form will pay for any one occurrence the amount shown in the Limit of Insurance on the Declarations. Outdoor signs whether attached to the building or not contain a $2,500 limit.

Deductible As in other policies, the deductible applies to the total amount of loss not the total covered loss.

30



NOTES Loss Conditions

Abandonment – there can be no abandonment of any property.

Appraisal – allows either the insured or the insurance company to demand appraisal of a loss.

Duties in the Event of Loss – Notifying the company, protecting your property, cooperating in the investigation, etc.

Loss Payment – allows the insurer at its option to pay, rebuild or repair the damaged or lost property.

Recovered Property – if either the insured or the insurance company recovers property, that party must give the other prompt notice.

Vacancy – if the building is vacant for more than 60 consecutive days the policy will not pay for any loss or damage from the following causes of loss:

o Vandalism;

o Sprinkler leakage (unless the system has been protected from freezing);

o Building glass breakage;

o Water damage;

o Theft or attempted theft;

o All other covered losses will be reduced by 15%.

Note: Under this form, if the policy is issued to a tenant, the building will be considered vacant when it does not contain enough business personal property to conduct customary operations. If the insured is the building owner, a building is considered vacant unless at least 31% of the total square footage is rented to others and/or used by the insured to conduct customary operations.

Valuation Unless otherwise specified, all property (building and personal) will be valued on an ACV basis.

• Tenants Improvements and Betterments will be valued at ACV if replaced by the tenant. If not replaced by the tenant, they will be paid at a percentage of the original cost.

• If coinsurance has been satisfied and the loss is less than $2,500, the company will settle a building loss on a Replacement Cost basis. This provision does not apply to awnings, appliances, floor coverings and outdoor equipment and furniture.

• Stock that has been sold but not delivered will be valued at the selling price.

31



NOTES • Glass will be valued at Replacement Cost with safety glazing material if

required.

• Valuable papers and records will be valued at the cost of blank media plus the cost of labor to transcribe and copy the records.

• Coinsurance - a coinsurance condition is common to this form and was previously discussed in Chapter 3 – Property & Casualty basics.

Condominium Association This coverage form is used to provide coverage for the building and personal property of the Condominium Association and not for any one individual.

Condominium Commercial Unit-Owners Unlike the Condominium Association form described above, this form is designed for a specific commercial unit-owner. The form provides no building coverage, but there are provisions for signs attached to the building and for improvements, betterments and fixtures.

Builders Risk This coverage form is used to cover a new building in the course of construction or existing structures in the course of alteration or repair. The forms is written on a Completed Value Basis or on a Reporting Form Basis (see the end of this section for additional information on the value reporting form.) Coverage begins on the effective date of the policy and ends with the earlier of the following:

• The policy expires or is canceled;

• The property is accepted by the purchaser;

• The insured’s interest in the property ceases;

• The insured abandons the construction;

• 90 days after construction is complete; or

• 60 days after any building is occupied or put to its intended use.

The Completed Value Form has a 100% Coinsurance Clause which requires the insured to insure for the full completed value from day one, otherwise there can be a penalty for underinsuring for a loss during the policy period.

32



NOTES Business Income Coverage Form This form provides the actual loss of income to a business when the loss results from a partial or total shutdown from the insured’s operations. The shutdown must be caused by direct loss or damage to property at the described location due to a covered cause of loss. Coverage is provided during the period of restoration. This is the time that begins 72 hours after the direct loss and ends on the earlier of:

a. the date the property at the described premises should have been repaired or replaced with reasonable speed and similar quality, or

b. when business is resumed at a new permanent location.

The business income form includes the following coverages:

Business Income Business Income is defined as the net income (profit or loss before income taxes) that would have been earned plus all continuing operating expenses including payroll. This coverage has a coinsurance requirement, typically 50%.

Expenses to Reduce Loss Covers the extra expenses incurred by a business to continue operations after a covered cause of loss. This coverage only pays those necessary expenses incurred to avoid further loss of business income. The 72 hours does not apply to this coverage.

Civil authority Provides coverage for the actual loss of business income if a civil authority prohibits access to your premises due to direct physical loss by a covered cause of loss to neighboring property (within one mile of your premises). Coverage is provided for four weeks and begins 72 hours after the time of the action.

Alterations and New Buildings Provides for loss of income resulting from a direct loss to new buildings and structures, alterations and additions, machinery equipment or building materials located within 100 feet of the premises.

Extended Business Income Provides business income starting when the period of restoration ends (when business income ends) and is good for a maximum of 30 days. This allows a business extra time to get up to speed.

Optional Business Income Coverages These optional coverages permit the insured to waive or suspend the business income coinsurance provision.

Maximum Period Of Indemnity

Loss of income payment is limited to 120 days.

33



NOTES Monthly Limit of Indemnity

This limits the loss amount payable during each 30 day period to the amount of insurance purchased multiplied by the fraction that is shown in the Declarations. The monthly options are, 1/3,

1/4 or 1/6.

Agreed Value

Allows the insured to agree to a specified amount of insurance.

Extra Expense Coverage Form This form covers the extra expenses incurred by a business to continue operations after a covered cause of loss. This form differs from the Business Income form because it is designed primarily for a business that does not need business income coverage such as a service oriented business that cannot afford to stop operations. These would include insurance agencies, law offices, accounting firms, etc. These types of businesses must spend extra money to move their operation and/or rent equipment to keep the business operating.

Legal Liability Coverage Form This coverage form pays for the insured’s legal liability for loss or damage to property of others, rented, occupied or in the insured’s care, custody or control resulting from a covered cause of loss. It includes coverage for loss of use and defense expenses. It is different from other property forms as coverage only applies if the insured is legally liable for the loss.

CAUSES OF LOSS FORMS

The commercial property coverage forms do not contain the Cause of Loss within the coverage form. It is necessary to attach a separate Causes of Loss form to the policy.

Basic Causes of Loss Form This Causes of Loss form includes 11 named perils: fire, lightning, explosion, windstorm or hail, smoke, aircraft or vehicles, riot or civil commotion, vandalism, sprinkler leakage, sinkhole collapse and volcanic action. (FL WHARVVVESSS)

Broad Causes of Loss Form The broad form is almost identical to the Basic, except it gives coverage for 3 additional perils: (1) damage caused by falling objects; (2) weight of snow, ice, or sleet; (3) and water damage from leakage of appliances. The form also covers collapse and breakage of glass.

Special Causes of Loss Form This form provides the most comprehensive coverage, because it promises to cover risks of direct physical loss, unless specifically excluded. Exclusions include: artificially generated electrical current, delay, loss of use or loss of market, smoke, vapor or gas from agricultural smudging or industrial operations, wear and tear, rust or other corrosion, decay or deterioration, inherent vice, smog, settling, cracking, shrinking or expansion, insects, birds, rodents or other animals, mechanical breakdown, damage due to dampness or dryness,

34



NOTES marring or scratching, explosion of steam boilers, continuous or repeated seepage of water, water or other liquids that leak from plumbing unless heat is maintained, dishonest acts of insureds and/or employees, voluntary parting of any property, rain, snow, ice or sleet to personal property in the open, collapse (except as an additional coverage), discharge or release of pollutants, weather conditions, acts or decisions and faulty, inadequate or defective planning.

Since the special form includes coverage for theft, there is a special limitation of $2,500 that applies to: furs, jewelry, watches, precious and semi-precious stones, bullion, gold, silver or platinum patterns, dies, molds and forms. In addition, a special limit of $250 applies for tickets, including lottery tickets, stamps and letters of credit.

There is an additional coverage extension of $5,000 for personal property in transit while on a motor vehicle owned, leased or operated by the insured while between points in the coverage territory. However, this coverage only applies to limited perils.

There are also general exclusions that are common to all causes of loss forms. They include ordinance or law, earth movement, governmental action, nuclear hazard, utility services, war and military action, water (flood and surface water), fungus, wet rot, dry rot and bacteria.

All forms also provide an additional coverage for fungus, wet rot and dry rot for $15,000 aggregate limit for all loss or damage sustained in any one policy year.

35



NOTES COMPARISON OF CAUSES OF LOSS FORMS

Causes of Loss Basic

CP 10 10 Broad

CP 10 20 Special

CP 10 30

Fire

YES

Lightning

Explosion

Windstorm & Hail

Smoke

Aircraft & Vehicles

Riot & Civil Commotion

Vandalism

Sprinkler Leakage

Sinkhole Collapse

Volcanic Action

Falling Objects

Weight of Ice, Snow or Sleet

Water Damage

Collapse

Glass Breakage

Theft NO

Risk of Direct Physical Loss YES (exclusions)

SELECTED ENDORSEMENTS

Ordinance or Law Coverage (CP 04 05) This endorsement provides coverage for increased costs to comply with current codes and laws for both damaged and undamaged property, the cost for demolition and debris removal of undamaged property, and the loss of the value of the undamaged portion of the building.

36



NOTES Spoilage (CP 04 40) The Spoilage Coverage Endorsement will cover loss to “perishable stock” (meat, dairy, poultry, fruit, ice cream, etc.) on the premises owned by the insured. Causes of Loss that are available include:

• Breakdown or contamination, which means change in temperature or humidity resulting from mechanical breakdown, or on-premises failure of refrigerating or cooling, or contamination by the refrigerant.

• Power Outage, which means a change in temperature or humidity resulting from complete or partial interruption of electrical power, either on or off the described premises.

Peak Season Limit of Insurance (CP 12 30) The Peak Season Limit of Insurance endorsement allows the insured to increase the limit for business personal property, including stock, during a specified period of time. The endorsement shows the amount of increase and the period of time that the increased limit will be in effect. This is used for businesses which have a much higher volume of sales at certain times of the year and thus a fluctuating inventory level.

Value Reporting Form (CP 13 10) Some businesses are subject to fluctuation of values which creates problems in writing the appropriate limits. This could be a manufacturer or retailer who has material or stock which varies widely from month to month. By using a Value Reporting Form the insured can avoid over-insuring or underinsuring their property.

When the Value Reporting Form endorsement is first written, the insured is charged a provisional premium. The insured is then required to make periodic reports of the actual values, usually on a weekly, monthly or quarterly basis. The final premium is calculated by multiplying the personal property rate times the average of the actual reported values.

As long as the insured follows the requirements of the Value Reporting Form Endorsement, the full policy limit is available to pay a covered loss at any time during the policy period. The problem is that insureds may not report on a timely or accurate basis. If the insured fails to submit reports, or if reports are late or inaccurate, a penalty may be incurred. There are three penalty provisions which are explained below:

1. If the first report is not submitted within 60 days of the last day of the first month of coverage and there is a covered claim, the insured will receive no more than 75% of the amount that the company would otherwise have paid.

2. If subsequent reports have not been made within 30 days from the last day of the previous month, then the payment for a loss will be based on the previous month’s report.

37



NOTES

3. If the insured under reports the values from the last report, the loss will be paid proportionally as there is a 100% coinsurance clause penalty.

If the amount reported is $100,000, but the actual value is $200,000, the proportion of the loss which would be paid would be 50%.

If the insured is not timely or accurate, he can be severely penalized at the time of loss.

COMMERCIAL CRIME (’06)

Commercial Crime Coverage can protect an organization or business from loss due to the unlawful taking of property or items of value like money. Many of the other policies restrict these type losses or exclude theft coverage. Crime coverage can be written to cover either commercial or government exposures. The commercial crime coverage part can be written as part of the Commercial Package Policy (CPP) or as a monoline policy.

“Burglary” means the unlawful taking of property from within a premises by a person or unlawfully entering or breaking out of a premises as evidenced by marks of forcible entry or exit.

“Robbery” is the unlawful taking of property from a person by actual violence or threat of violence.

“Theft” is the unlawful taking of “money”, “securities” or “other property”. This definition provides the broadest coverage since it includes any unlawful taking.

An “employee” is a person in the service of the insured (including 30 days after termination), who is compensated directly by the insured, and who is directed and controlled by the insured;

The property that is subject to loss under under the crime forms are:

1. “Money” means currency, coins and bank notes, and travelers checks, register checks and money orders held for sale to the public.

2. “Securities” are negotiable or nonnegotiable instruments or contracts that represent “money” or property. This includes tokens, tickets, stamps and evidences of debt issued in connection with credit or charge cards.

3. “Other property” is any tangible property other than “money” and “securities” that has intrinsic value.

38



NOTES STRUCTURE OF COMMERCIAL CRIME

The Commercial Crime Policy contains the following components shown below.

Common Policy Declarations (IL 00 19)

+ Common Crime Declarations

+ Common Policy Conditions

(IL 00 17) +

Crime Coverage Forms Discovery (CR 00 20)

or Loss Sustained (CR 00 21)

+ Endorsements

CRIME COVERAGE FORMS

There are two Commercial Crime Coverage forms - the Discovery Form (CR 00 20) and the Loss Sustained Form (CR 00 21). There are also two Government Crime Coverage forms – the Discovery Form (CR 00 24) and the Loss Sustained Form (CR 00 25)

The coverages provided by the Commercial Crime Form and the Government Crime forms are the same with one important difference. The limits on the Commercial Crime Forms are on a per loss basis while the Government Crime Forms can be written on a per loss and on a per employee basis.

1. Discovery Form (similar to CGL Claims-Made Form)

Pays for losses resulting from acts committed at any time and discovered during the policy year or during the Extended Period To Discover Loss, which is 60 days from the date of termination or one year from the date of termination for “employee benefit plans”. This Extended Period To Discover Loss terminates immediately upon the effective date of other Crime insurance.

2. Loss Sustained Form (similar to the CGL Occurrence Form)

Applies to losses that result from acts committed during the policy period and discovered during the policy period or within one year from the date of termination. The Extended Period To Discover Loss under the Loss Sustained Form also terminates immediately upon the effective date of other Crime insurance.

39



NOTES Coverages

Both the Discovery Form and the Loss Sustained Form contain eight coverages. These coverages are:

1. Employee Theft

Employee theft is not covered under Commercial Property forms. Nor is it covered under any of the other Crime coverages. This is the only coverage part that covers if an employee takes ANYTHING.

The Employee Theft Insuring Agreement agrees to pay for loss of or damage to money, securities and other property. This means all property owned or used by the insured, or in the insured’s custody. The loss must result from theft committed by an employee, whether identified or not, acting alone or in collusion with others.

There are two methods of writing Employee Theft - Blanket or Schedule. Blanket coverage applies to all employees. Scheduled coverage applies to specific persons or specific positions listed in the Declarations.

2. Forgery Or Alteration

This coverage pays for loss resulting from forgery or alteration of checks, drafts, promissory notes or similar written documents made or drawn upon the insured or an agent of the insured.

If the insured is sued for refusing to pay any forged or altered instrument, the insurance company will pay reasonable legal expenses incurred by the insured in defense of that suit. These expenses are paid in addition to the Forgery Or Alteration Limit of Insurance.

3. Inside the Premises – Theft of Money and Securities

This provides coverage for loss of money and securities inside the insured’s premises or banking premises that results directly from theft, disappearance or destruction. If a fire destroys it . . . . . . . If a thief steals it . . . . . . If it simply disappears, it is covered. However, there is no coverage if an employee steals or takes it because the only place for coverage of employees is under employee theft.

In addition to the loss of money and securities, coverage is provided for damage to the premises or a locked safe, vault, cash register, cash box or cash drawer resulting from a theft or attempted theft.

40



NOTES 4. Inside The Premises - Robbery And Safe Burglary Of Other Property

This coverage applies to property other than money and securities if the loss is due to robbery of a custodian or safe burglary. The robbery or safe burglary must occur inside the premises. Coverage is also provided for damage to the premises or a locked safe or vault resulting from an actual or attempted robbery or safe burglary.

A custodian is the insured or a partner or employee of the insured who has custody of the property inside the premises. However, a watchperson or janitor is not considered a custodian.

Safe burglary is defined as the unlawful taking of property from within a locked safe or vault evidenced by marks of forced entry or the taking of the safe or vault.

5. Outside the Premises

The Outside The Premises Coverage covers theft, disappearance or destruction of money and securities in the custody of a messenger or an armored motor vehicle company. A messenger is the insured or a relative, partner, member or employee of the insured who has custody of the property outside the premises.

This coverage also applies to loss due to “robbery” of other property in the custody of a messenger or an armored motor vehicle company.

6. Computer Fraud

The Computer Fraud Coverage agrees to pay for the loss of or damage to money, securities and other property resulting from the use of a computer to fraudulently cause the transfer of that property from inside the premises or banking premises to a person or place outside those premises.

7. Funds Transfer Fraud

This coverage pays for the loss of money or securities resulting from a fraudulent instruction directing a financial institution to transfer, pay or deliver the money or securities from the insured’s account.

8. Money Orders and Counterfeit Paper Currency

This coverage pays for loss resulting from accepting, in exchange for merchandise, money or services, money orders that are not paid by the issuer or counterfeit paper currency.

41



NOTES Other Crime Coverages

Lessees of Safe Deposit Boxes (CR 04 09) This endorsement provides coverage for two categories of property.

1. Securities are covered for theft, disappearance or destruction while they are in a safe deposit box, in a vault, inside the depository premises or temporarily elsewhere inside the depository premises during the course of deposit or removal from the safe deposit box.

2. Other property is only covered from actual or attempted burglary, robbery or vandalism. The name and address of the depository must be named on the schedule.

Securities Deposited With Others (CR 04 10) This endorsement provides coverage for securities of others in a custodian’s care for theft, disappearance or destruction. Coverage is provided inside and outside the custodian’s premises and on deposit for safe keeping in a depository. Each custondian and depository must be named in the schedule.

Guests’ Property (CR 04 11) This endorsement covers property of guests while the property is in a safe deposit box, inside the premises or while the property is in the insured’s possession. Coverage also applies for reasonable legal expenses the insured incurs from refusal to pay for loss or damage to guest’s property.

Safe Depository (CR 04 12)

This endorsement provides bailee’s coverage for the property of others a a depository that is not a financial institution. Coverage is provided for two areas.

1. Provides legal liability for clients’ property located in a vault, or safe deposit box or elsewhere inside the premises.

2. Provides coverage for direct damage (legal liability not required) to clients’ property from actual or attempted robbery or burglary. Coverage also applies to resulting damage to the premises, a locked safe, vault or safe deposit box if you are the owner of the premise or are liable for damage to it.

Coverage Territory

With the exception of the Forgery Or Alteration and Computer Fraud coverages, the Crime Policy covers losses that occur in the United States, its territories and possessions, Puerto Rico or Canada. The Forgery Or Alteration and Computer Fraud coverages apply to losses occurring anywhere in the world.

42



NOTES Valuation Crime forms valuation is as follows:

Money will be paid at face value.

Securities will be paid at closing value when the loss is discovered.

Loss of property other than money and securities will be paid at actual cash value.

All Crime Forms Loss of precious metals, precious or semi-precious stones, pearls, furs, manuscripts, drawings or records is limited to $5,000 for any one “occurrence”. This special limit can be increased by endorsement.

43



NOTES

5

Crime Coverage Summary Chart

Coverage Covered Property Covered Causes of Loss

Employee Theft Money, securities and other property. Employee theft

Forgery or Alteration Checks, drafts or similar written documents. Forgery or alteration

Inside the Premises – Theft of Money and Securities

loss of money and securities inside the premises or banking premises damage to the premises or attempted theft of money and securities - loss or damage to a locked safe, vault, cash register/box/drawer, inside the premises resulting from theft or attempted theft

Theft, disappearance and destruction

Inside the Premises – Robbery or Safe Burglary of Other Property

- Property other than money and securities inside the premises from actual or attempted robbery of a custodian Inside the premises in a safe or vault from actual or attempted safe burglary

Damage to the premises resulting from actual or attempted robbery

Safe burglary of other property and loss or damage to a locked safe or vault from actual or attempted robbery or safe burglary

Robbery or safe burglary

Outside the Premises Loss of money and securities outside the premises in the care of a messenger or armored vehicle company

Loss or damage to other property outside the premises in the care of a messenger or armored vehicle company

Theft, disappearance or destruction

Robbery or attempted robbery

Computer Fraud Money, securities and other property Computer fraud

Funds Transfer Fraud Loss of money or securities

Fraud

Money Orders and Counterfeit Money

Money Accepting invalid money orders or counterfeit paper currency.

Lessees of Safe Deposit Boxes

Securities

Property other than money and securities

Theft, disappearance and destruction

Burglary, robbery or vandalism

Securities Deposited With Others

Securities Theft, disappearance and destruction

Guests’ Property All property Negligence

Safe Depository Property Property other than money

Negligence Burglary and robbery

44



NOTES

COMMERCIAL INLAND MARINE

In the early history of the United States, most large shipments of goods were by water, and as the country changed over time, more available methods of shipping goods over land developed. Over land shipping changed the nature of the cargo exposures and produced a change in insurance coverages.

The property forms we have examined already are designed to cover property located at a fixed location. Inland Marine forms are not governed by the same composition of coverage and rate rules, and work well to provide coverage for property off-premises and in-transit.

STRUCURE OF AN INLAND MARINE POLICY

Declarations Page

+

Inland Marine Conditions

+

Coverage Forms

+

Other Endorsements

NATIONWIDE MARINE DEFINITION

The purpose of this definition was to specify the types of property and coverages that may be insured on inland marine forms. The Nationwide Marine Definition was adopted in 1933 and significantly modified in 1953, 1976 and 1996. Inland Marine insurance may be written to provide coverage for virtually any type of risk that may be transported (moveable property). The five specific groups for which Inland Marine insurance can provide coverage are:

1. Imports

2. Exports

3. Domestic Shipments

4. Bridges, Tunnels and Other Instrumentalities of Transportation and Communication (such as piers, pipelines, transmission lines, towers, radio and television equipment).

5. Property Floater Risks (both personal and commercial)

45



NOTES COMMERCIAL INLAND MARINE CONDITIONS FORM

Inland Marine policies consist of not only a coverage form, but also a Commercial Inland Marine Conditions Form. In the next few pages we will review the standard Commercial Inland Marine Conditions Form. First, let’s look at the specific conditions in the form:

Loss Conditions

1. Abandonment

2. Appraisal

3. Duties in the Event of Loss

4. Insurance Under Two or More Coverages

5. Loss Payment

6. Other Insurance

7. Pair, Sets or Parts

8. Recoveries

9. Reinstatement of Limit After Loss

10. Transfer of Rights of Recovery Against Others to Us

General Conditions

The General Conditions of the Inland Marine Conditions Form are:

1. Concealment, Misrepresentation or Fraud

2. Legal Action Against Us

3. No Benefit to Bailee

4. Policy Period

5. Valuation

Exclusions

Exclusions are similar in all Inland Marine coverage forms. They include earthquake, war, flood, surface water, government action, nuclear hazards, marring, scratching or exposure to light, loss of use, dishonest acts by the insured, accounting errors and inventory shortage.

Inland Marine Coverage Forms (Filed and Non-filed)

Inland Marine forms may be divided into two categories which are filed (or controlled) and non-filed (or noncontrolled). Let’s look at the differences between the two.

46



NOTES Filed (or controlled)

Of the many Inland Marine forms available, there are only a few that are actually filed. Filed means that the specific coverage form and/or premium rate must be filed with state regulatory authorities. As you know, insurance companies have the right to design their own coverage policies, and price those policies based on internally developed rates. Historically, however, filed forms have been written on relatively uniform and similar exposures. Therefore, the filed forms written from one insurance company to another are more consistent.

Non-filed (or noncontrolled)

Non-filed lines of Inland Marine coverage tend to have greater variances in the exposures covered, thus making it difficult to provide uniformity related to coverages and pricing. When using non-filed forms, insurance companies are not required to file forms, rules or rates they use. The greatest number of coverages written in Inland Marine insurance are non-filed.

FILED FORMS

Accounts Receivable Coverage Form

Many businesses have accounts for their customers, and typically will bill them monthly. Therefore, at any time customers owe money to these businesses. Records of the money owed to a business are called accounts receivable. This form will cover monies due to the insured from customers that become uncollectable due to the loss, damage or destruction of the accounts receivable records. It will also cover the cost to re-establish the accounts receivable and interest charges on any loan that was required to offset amounts that the insured is unable to collect prior to being paid by the insurance company.

Commercial Articles Form

Commercial Articles covers cameras, projection machines, films and related equipment as well as musical instruments and related equipment. It also includes similar property of others in the insured’s care, custody, or control.

The floater covers “Risks of Direct Physical Loss” to covered property except those Causes of Loss which are excluded.

Jewelers Block Coverage Form

The Jewelers Block form covers the following types of property:

1. Stock in trade including jewelry, precious and semiprecious stones, precious metals, and stock used in the insured’s business;

47



NOTES 2. Property sold, but not yet delivered;

3. Property of others in the insured’s care, custody or control.

Valuation

This provision replaces the Valuation in the Commercial Inland Marine General Conditions.

a. The Actual Cash Value (ACV) of the property.

b. The cost of reasonably restoring the property to its previous condition before “loss.”

c. The cost of replacing that property with substantially identical property.

d. The lowest figure the insured placed on the property in inventories, stock books, stock papers or lists existing at the time of “loss.”

Protective Safeguards

The insured must maintain those safeguards (like burglar alarms) which protect the covered property, and listed as existing and in proper working order at the time the policy is written. If the insured fails to keep the protective devices in working order, or does not put them into operation when the business is closed, the coverage to which the safeguard applies will be suspended.

Sign Coverage Form

The Sign Coverage Form provides coverage for all types of signs that the insured owns or is contractually responsible for covering.

Signs under this form must be specifically scheduled to be insured.

This form covers “Risks of Direct Physical Loss” to covered property except those Causes of Loss that are excluded (open perils).

100% coinsurance is required.

Valuable Papers and Records Coverage Form

Provides coverage for:

Loss or damage to valuable papers and records which are the Named Insured’s or someone else’s property which is in the insured’s care, custody, or control.

Inscribed, printed or written documents, manuscripts or records, including abstracts, drawings, films, maps or mortgages.

48



NOTES Equipment Dealers Coverage Form

Provides coverage for:

A dealer’s stock in trade

Mobile agricultural equipment and construction equipment

Similar property of others while in the care, custody, and control of the insured

This coverage is designed for businesses with sales and/or who service mobile agricultural and/or construction equipment.

NON-FILED FORMS

Bailees Customer

A bailee is someone who has rightful possession of another’s property, such as a dry cleaner. They are legally responsible to return property entrusted to them in a condition as good as or better than when the property was left with them.

Since CGL Policies have a care, custody or control exclusion, this form is necessary for a bailee to cover a customer’s property while in their care, custody or control.

Contractors Equipment Floater

Many contractors typically have an extensive inventory of equipment which can be spread over multiple locations, storage areas, and job sites.

The property covered varies with the different forms but could include machinery (bulldozers, backhoes, tractors, cranes, etc.) The two ways of writing this coverage are scheduled and blanket.

Coverage is written on an open peril or named peril basis and a coinsurance provision generally applies.

Electronic Data Processing Policies

These are the three areas of coverage commonly found in EDP policies:

1. Equipment - coverage for “loss” to hardware.

2. Data and Media - coverage for “loss” to software.

3. Time Element - Extra Expenses and/or Business Income.

Losses include electrical and magnetic damage, mechanical breakdown, computer virus and accidental discharge of fire suppression systems. A coinsurance provision generally applies.

49



NOTES Installation Floater

This form is designed to protect an insured who is contractually responsible to cover machinery, equipment, fixtures, carpeting, furnishings, and like property during and prior to installation. It is normally purchased by a subcontractor (heating and air conditioning contractor) who is installing an expensive piece of equipment (like an air conditioning compressor).

Property covered is the insured’s materials and supplies for installation. The property of others may be covered in the following situations: (1) during installation, (2) in transit, (3) at a job site, and (4) in storage - awaiting installation.

The Installation Floater is written on an Open Perils basis.

Transportation Coverages

Transportation Coverage is used to insure the goods (personal property being transported). There are three types of carriers who transport goods.

1. Private – A business who hires their own drivers to drive their own trucks.

2. Contract – Only hires out services to a limited number of customers. They are only liable when they are negligent.

3. Common – Transports property of others for a fee and is in effect a bailee. Common carriers issue a Bill of Lading which is a receipt from the carrier to the shipper for goods being transported. A Bill of Lading serves as a contract between the shipper and the carrier, outlining the responsibilities of each party. A released Bill of Lading limits the carrier’s liability to a specific amount.

Common Carrier Cargo Liability

The common law liability states that the carrier is responsible for the safe delivery of property. This is similar to the responsibility we looked at earlier in this chapter under bailment. Because of the high degree of responsibility, the owner of goods or personal property being transported has a good chance of recovering for damages from the carrier.

The carrier is not responsible for damage from the following:

1. Acts of God or Nature

2. Exercise of Public Authority

3. Acts of Public Enemy

4. Negligence of the Shipper

5. Inherent Vice or Nature of the Property

50



NOTES Motor Truck Cargo Forms

There are two basic types of cargo forms that are used to insure the carrier’s legal liability to the property owner. The first is the Trucker’s or Carriers Form and the second form is the Owner’s Form.

Motor Truck Cargo – Trucker’s Form

Liability coverage to cover cargo of others being transported by trucker. Covers trucker’s liability for negligent transporting of goods.

Motor Truck Cargo – Shipper’s Form

Property coverage to cover owner’s good on others’ trucks (common carrier or contract carrier). The shippers goods are covered while being transported by a common or contract carrier.

Motor Truck Cargo – Owner’s Form

Property coverage to cover owner’s goods on owner’s trucks.

Two (2) Transportation Policies

Transportation Policy – Annual Form

Property coverage for business that is shipping incoming & outgoing goods on annual basis.

Transportation Policy – Trip Transit Form

Property coverage for one specific trip.

These policies are usually written on an open perils basis, although, some forms provide coverage on a named perils basis.

51



NOTES

EQUIPMENT BREAKDOWN (’13)

For many years this coverage had been known as the Boiler & Machinery policy. It was difficult to persuade a business owner who didn’t have a boiler to purchase a policy that had the name “boiler” displayed in its title. So the name of the coverage has been changed to Equipment Breakdown. It is important to note that the commercial property policy provides coverage for many external perils that can damage mechanical, electrical or boiler equipment. However, this coverage part provides protection against the internal perils of or breakdown to mechanical, electrical or steam boiler equipment. Many businesses face these more common exposures of mechanical breakdown of equipment and artificially generated electrical current that can damage the equipment. As you can see, the equipment breakdown coverage part fills an important gap in the commercial property policy.

The structure of the Equipment Breakdown Policy is shown below.

Structure of the Equipment Breakdown Policy


+


+

Equipment Breakdown Declarations Page

+

Equipment Breakdown Protection Coverage Form

+

Endorsements

EQUIPMENT BREAKDOWN PROTECTION COVERAGE FORM – EB 00 20

Direct Damage Coverage

Equipment Breakdown coverage form pays for direct damage to Covered Property caused by a Covered Cause of Loss.

52



NOTES Covered Property

The Equipment Breakdown Protection Coverage Form defines “Covered Property” as any property:

1. The insured owns; or

2. Is in the insured’s care, custody or control and for which the insured is legally liable.

Covered Cause of Loss

A “Covered Cause of Loss” in the Equipment Breakdown Protection Coverage Form is a “Breakdown” to “Covered Equipment”.

Definition of “Breakdown”

“Breakdown” means the following direct physical loss, that causes damage to “Covered Equipment” and necessitates its repair or replacement:

1. Failure of pressure or vacuum equipment;

2. Mechanical failure including rupture or bursting caused by centrifugal force; or

3. Electrical failure including arcing;

Note: Explosion, other than combustion explosions of steam equipment, is covered.

“Breakdown” does not include:

Malfunction including but not limited to adjustment, alignment, calibration, cleaning or modification;

Defects, erasures, errors, limitations or viruses in computer equipment and programs;

Leakage at any valve, fitting, shaft seal, gland packing, joint or connection;

Damage to any vacuum tube, gas tube or brush;

Damage to any structure or foundation supporting the “Covered Equipment”;

The functioning of any safety or protective device; or

The cracking of any part on an internal combustion gas turbine exposed to the products of combustion.

53



NOTES “Covered Equipment”

”Covered Equipment” includes:

1. Equipment built to operate under internal pressure or vacuum other than weight or contents;

2. Electrical or mechanical equipment that is used in the generation, transmission or utilization of energy;

3. Communication equipment and “Computer Equipment”; and

4. Equipment owned by a Utility and used solely to supply utility services to the insured’s premises.

5. Examples of covered equipment include: steam boilers and similar pressure vessels, electrical generating and transmitting equipment, pumps, compressors, turbines and engines, air conditioning and refrigeration systems and equipment, production machinery used in manufacturing, etc.

Except for 4, the “Covered Equipment” must be located at a premises described in the Declarations and be owned, leased, or operated under the insured’s control.

The following are examples of losses under the Equipment Breakdown Protection Coverage Form to help you better understand “Covered Cause of Loss” and “Covered Equipment”.

• A condominium building sustained over $55,000 damage when a large boiler overheated, because it did not have enough water in it.

• A church suffered a loss of approximately $35,000 to its organ, public address system and choir robes when a cast iron boiler cracked and a fitting to a steam pipe split resulting in steam release.

• A transformer and switch gear sustained over $50,000 damage when a squirrel got into the switch gear and caused a short circuit.

Equipment Breakdown Coverages

The following coverages are provided in the Equipment Breakdown Protection Coverage Form if either a limit or the word “INCLUDED” is shown for that coverage in the Declarations.

1. Property Damage

Covers direct damage to “Covered Property”, which includes loss of property in the insured’s care, custody or control. The property must be located at the premises shown in the Declarations.

2. Expediting Expenses

These are the extra costs to make temporary repairs or expedite permanent repairs.

54



NOTES 3. Business Income And Extra Expense or Extra Expense Only

This coverage pays for the loss of income or the extra expenses incurred as a result of a “Breakdown” to “Covered Equipment”.

Unless a higher limit is shown in the Declarations, payment will be limited to the lesser of the actual loss of Business Income and/or Extra Expense up to 30 days or $25,000.

Extended Period of Restoration Coverage is provided for five days following the “Period of Restoration”, unless replaced by a number of days shown in the Declarations.

If the insured has coverage for Ordinance or Law, the Period of Restoration is extended to include the additional time required for demolition, removal, repair, remodeling or reconstruction.

There is no Business Income or Extra Expense coverage for media or data that cannot be replaced or restored.

4. Spoilage Damage

Coverage for goods damaged by or due to lack or excess of power, light, heat, steam or refrigeration.

5. Utility Interruption

Extends Business Income, Extra Expense and Spoilage damage if the cause of the loss is due to the breakdown of equipment owned by the insured’s utility.

6. Newly Acquired Premises

The newly acquired premises will be covered for the broadest coverage and highest limits and deductible applicable to existing premises. Coverage is limited to the number of days shown in the Declarations for Newly Acquired Premises.

7. Ordinance or Law Coverage

Covers the loss in value of the undamaged portion of the building, the cost to demolish a damaged building, and the increased costs expended to repair or reconstruct.

8. Errors and Omissions

Pays for any loss or damage that would not be covered because of an error or omission committed unintentionally by the insured in the description or location of the property);

55



NOTES 9. Brands & Labels

Covers the costs to stamp damaged merchandise “SALVAGE” or remove the labels and re-label in order to comply with any law.

10. Contingent Business Income and Extra Expense Only Coverage

The Business Income And Extra Expense Coverage is extended to cover a “Breakdown” of “Covered Equipment” at a premises not owned or operated by the insured which prevents the delivery of services or materials or results in the loss of sales).

Selected Exclusions

Many of the Equipment Breakdown exclusions are the same as you encountered in earlier policies such as:

1. Ordinance Or Law:

2. Earth Movement;

3. Water (flood, surface water, etc.);

4. Nuclear Hazard; and

5. War Or Military Action.

The Equipment Breakdown form also excludes:

1. Explosions that occur outside “Covered Equipment.”

2. Fire that results in a “Breakdown,” occurs at the same time as a “Breakdown” or ensues from a “Breakdown.”

3. Fungus, Wet Rot and Dry Rot, except for loss or damage resulting from a breakdown.

4. Virus, bacterium or other microorganism, except for loss or damage resulting from a breakdown.

5. Explosion from within the furnace or passage of the furnace of a chemical recovery type boiler.

6. Damage to “Covered Equipment” undergoing a pressure or electrical test.

7. Water or other means to extinguish a fire if the attempt is unsuccessful.

8. Depletion, deterioration, corrosion, erosion, or wear and tear, unless a “Breakdown” occurs resulting in loss or damage.

9. Caused by any of the following if coverage provided by another policy, whether collectable or not:

a. Aircraft or vehicles;

56



NOTES b. Freezing;

c. Lightning;

d. Sinkhole collapse;

e. Smoke;

f. Riot, civil commotion or vandalism; or

g. Weight of snow, ice or sleet.

10. Windstorm or hail.

11. Delay or interruption of business, except under Business Income, Extra Expense or Utility Interruption coverages.

12. For Business Income, Extra Expense or Utility Interruption coverages:

a. Business that could not be carried on if the breakdown had not occurred;

b. Failure to use due diligence to operate business; or

c. Loss of a contract extending beyond the time business could have resumed.

13. Lack or excess of power, light, heat, steam or refrigeration, except under Business Income, Extra Expense, Spoilage Damage, or Utility Interruption coverages.

14. For Utility Interruption coverage:

a. Acts of sabotage;

b. Collapse;

c. Deliberate acts of load-shedding by the supplying utility;

d. Freezing;

e. Aircraft, missile or vehicle;

f. Falling objects from an aircraft or missile;

g. Lightning

h. Riot, civil commotion or vandalism;

i. Sinkhole collapse;

j. Smoke; or

k. Weight of snow, ice or sleet.

15. Any indirect loss, except under Business Income, Extra Expense, Spoilage Damage or Utility Interruption coverages.

16. Neglect of the insured.

57



NOTES The following coverages are automatically included in the Equipment Breakdown Protection Coverage Form. Unless a higher limit or “INCLUDED” is shown in the Declarations, the most that will be paid for any loss is $25,000 for each coverage.

1. Ammonia Contamination

2. Consequential Loss

3. Data and Media

4. Hazardous Substance

5. Water Damage

Policy also includes:

6. Limited Coverage for Fungus, Wet Rot and Dry Rot

o Property damage is limited to $15,000.

o Business Income or Extra Expense are limited to 30 days, unless changed in the Declarations.

7. Increased Cost of Loss and Related Expenses for Green Upgrades

o Unless a different limit is shown in the Declarations, “Green” upgrades are limited to 25% of the total property damage, subject to a maximum of $100,000.

o Business Income or Extra Expense are limited to 30 days, unless changed in the Declarations.

Valuation

All property is insured on a replacement cost basis, However, if the damaged property is not repaired or replaced within 24 months of the breakdown, settlement will be at the smaller of ACV or the cost to repair or replace.

If the insured or the insurance company repairs damaged equipment, enhancing safety while maintaining existing function, the policy will pay up to an additional 25% of the property damage amount.

Deductibles

There are four deductible options under the Equipment Breakdown Protection Coverage Form. One or more of these deductibles can be applied under the same form. For example, a dollar deductible could be used for Property Damage and a time deductible could apply to any Business Income And Extra Expense loss.

58



NOTES The four deductible options are:

1. Dollar Deductible

2. Time Deductible

3. Multiple Of Daily Value Deductible

4. Percentage Of Loss Deductible

Suspension Condition

Whenever “Covered Equipment” is found to be in, or exposed to, a dangerous condition, any representative of the insurance company may immediately suspend the insurance for that “Covered Equipment”. This can be done by delivering or mailing a written notice of suspension to the insured’s last known address or the address where the “Covered Equipment” is located.

Once suspended, the insurance can be reinstated only by endorsement. If the insurance is suspended, the insured will receive a pro rata refund of premium.

SELECTED ENDORSEMENT

Actual Cash Value (EB 99 59)

If this endorsement is attached, our payment will be the lesser of:

1. The cost to repair or replace the damaged property; or

2. Actual Cash Value.

59



NOTES

COMMERCIAL GENERAL LIABILITY (‘07)

INTRODUCTION

The insurance policy used to provide Liability Protection for individuals, businesses and other organizations is the Commercial General Liability (CGL) Policy. It is designed to cover the insured’s legal liability that arises out of injuries or damages suffered by it’s customers, tenants or the public. The name of the policy contains the word “General” because it insures most liability areas other than Automobile and Employers Liability.

COMPONENTS OF A COMMERCIAL GENERAL LIABILITY POLICY

We have illustrated the structure below:


+


+

Commercial General Liability Declarations

+

Commercial General Liability Coverage Form

+

Endorsements

60



NOTES Types of Forms

There are two Commercial General Liability Coverage forms available: the Occurrence Form and the Claims Made Form. These two coverage forms contain the exact same coverage, the only difference being how a claim is triggered or activated.

1. Occurrence - CG 00 01

This form is the one used most often to provide CGL coverage. Under this form coverage applies for injury or damage that occurs during the policy period, regardless of when the claim is reported to the insurer.

2. Claims-Made - CG 00 02

This form provides coverage for claims occurring on or after the retroactive date that are made during the policy period or the extended reporting period, even if the injury or damage occurred years before the current policy term. We will discuss the specific features of the retroactive dates and the extended reporting periods later in this section.

Section I - Coverages

Bodily Injury and Property Damage Liability (Coverage A)

This coverage promises to pay the insured’s legal obligations for damages for bodily injury or property damage to which this insurance applies. In addition, the insurer promises to defend any lawsuits.

Premises and Operations

Provides coverage for exposures at the insured’s business location (on premises and off premises due to your operations):

1. Customer slips and falls on a wet floor in your restroom.

2. Your employee carpenter drops a hammer from a roof you are replacing (away from your business location) and injures someone walking by.

These are negligent acts occurring both at the premises and off the premises but arising from the business operations of the insured.

Products and Completed Operations

Provides coverage for exposures away from the insured’s business location. Products liability begins when the customer takes possession of the product and the product is removed from the insured’s premises. Completed Operations begins when the insured’s work has been completed and has been put to its intended use.

1. A customer buys a steamer from a retail store (insured). When the customer gets home and uses the steamer it malfunctions, causing steam to blow back in the customer’s face. (Products Claim)

61



NOTES 2. The roof you have finished replacing leaks six weeks later and causes $4,000

damage to the interior of the building. (Completed Operations Claim)

Section I Exclusions

The following are important exclusions that apply to Coverage A – Bodily Injury and Property Damage. This insurance does not apply to:

Expected or intended acts (intentional),

Contractual liability, EXCEPT the six insured contracts:

L ease of premises;

E asement or license agreement;

A greement to indemnify a municipality;

S idetrack agreement;

E levator maintenance agreement.

T ort Liability of a Third Party

Liquor liability for those in the liquor business, however, coverage is provided for host liquor liability;

Employee injuries (Workers’ Compensation, Employer’s Liability and similar laws);

Pollution, except pollution caused by a hostile fire and fluids that escape from mobile equipment and some other incidental exceptions;

Aircraft, auto or watercraft, EXCEPT:

o watercraft ashore on the insured’s premises;

o non-owned watercraft less than 26 feet;

o parking customers’ autos on or next to premises;

o insured contract for aircraft and watercraft;

o operation of machinery or equipment that is mobile equipment (cherry pickers, compressor pumps and cleaning equipment); and

o mobile equipment transported by an auto.

War risks;

Damage to property the insured owns, rents or occupies or property in the insured’s care, custody or control EXCEPT damage by fire to premises.

Property damage to the insured’s product;

62



NOTES Property damage to the insured’s work;

Property damage to impaired property;

Products recall;

Damage to or loss of use to electronic data;

Damage due to distribution of material that violates statutes (CAN SPAM Act or TCPA Act); and

Employment related practices.

Personal and Advertising Injury Liability (Coverage B)

This coverage promises to pay those sums for which the insured becomes legally obligated for personal injury or advertising injury caused during the policy period. For this coverage, personal injury means libel, slander, invasion of privacy, false arrest or detention, malicious prosecution and wrongful entry or eviction. Advertising injury means libel, slander violation of privacy, copyright infringement or misappropriation of advertising ideas. The limits for Coverage B losses are expressed as dollars ($$$) per person or organization rather than the normal per occurrence limits.

Exclusions

Acts committed by an insured knowing the act would violate the rights of another;

Publishing any material the insured knows is false;

Material published before the policy period;

Criminal acts committed by or at the direction of the insured;

Contractual liability;

Breach of contract;

Failure of goods, products or services to perform;

Wrong description of prices;

Infringement of copyright, patent, trademark or trade secret;

Insured’s whose business is advertising, broadcasting, publishing or an internet provider (chat rooms, bulletin boards).

Medical Payments (Coverage C)

This will pay for medical expenses for bodily injury caused by an accident on the premises the named insured owns or rents or uses, and for accidents because of their operations. Medical expenses are paid regardless of fault or negligence and must be incurred within one year from the date of the accident. Medical payments are considered part of the occurrence limit.

63



NOTES Exclusions

To any insured except volunteer workers;

To your tenants injured on their rental premises;

To a person hired to work or covered under Workers’ Compensation;

For any products or completed operations;

To a person injured in any physical exercise of games, sports or athletic contests;

If excluded under Coverage A.

Supplementary Payments - Coverages A and B

The CGL Coverage Form contains a section that pays resulting expenses from the insurer’s defense of any claim or “suit” in addition to the limits in the policy. Supplementary Payments covered under Coverage A - Bodily Injury and Property Damage Liability and Coverage B - Personal and Advertising Injury Liability include:

1. All expenses the insurer incurs.

2. Up to $250 for the cost of bail bonds because of an accident or traffic law violation(s).

3. Premiums on appeal bonds, and bonds to release attachments.

4. Interest on any judgment (both pre-judgment and post-judgment interest).

5. Other reasonable expenses incurred by the insured at the insurance company’s request. This could include travel expenses to attend a trial or the insured sending a copy of a police report, etc. This includes the actual loss of earnings up to $250 a day because of time off work.

6. All costs taxed against the insured in the “suit.”

These Supplementary Payments are in addition to the policy limits.

Section II – Who is an Insured (who is covered under the policy)

There are three categories of insureds found in the CGL:

1. Named Insureds - those persons or organizations who are specifically named on the CGL Declarations.

2. Automatic Insureds - those persons or organizations who qualify automatically as insureds, because they qualify as a member of a category like employees.

3. Additional Insureds - those persons or organizations who qualify, because they either are specifically named or qualify as a member of a listed category. These insureds are added by endorsement.

64



NOTES Commercial General Liability Policy

Who Is An Insured

Note: The categories of Named Insureds represent the various legal types of businesses.

1. NAMED INSUREDS LIMITATIONS

a. Individual. Includes spouse. Conduct of any business of which you are the whole owner.

b. Partnership or Joint Venture. Includes partners, members and their spouses.

Conduct of your business.

c. Limited Liability Company. Includes members and managers.

Members: Conduct of your business. Managers: Respect to their duties as trustees.

d. Corporations. Includes “executive officers,” directors and stockholders.

“Executive officers” and directors: Respect to their duties. Stockholders: Respect to their liability as stockholders.

e. Trust. Includes trustees. Respect to their duties as trustees.

2. OTHERS LIMITATIONS

a. “Employees” and “volunteer workers”, other than “executive officers” of corporation and managers of limited liability company.

Acting within the scope of their employment.

b. Persons other than “employees” and “volunteer workers”.

While acting as your real estate manager.

c. Any person with temporary custody of your property if you die.

Liability arising out of the maintenance or use of that property.

d. Your legal representative if you die. Respect to their duties.

3. Newly acquired or formed organization if majority interest

Not partnership, joint venture or limited liability company. Covered for 90 days after acquisition or formation

Applies ONLY to CGL (Not covered in BOP)

65



NOTES Section III - Limits of Insurance

There are six limits for the CGL, which may apply differently to different coverages.

1. General Aggregate

The General Aggregate is the most that will be paid during the policy period for Coverages A & B for all covered claims other than the products and completed operations claims.

2. Products and Completed Operations Aggregate

The Products and Completed Operations Aggregate is the most that will be paid under Coverage A during the policy period for all covered products and/or completed operations claims.

3. Personal and Advertising Injury (Per Person or Organization)

Coverage B - Personal and Advertising Injury Liability contains a limit separate from the occurrence limit, but is subject to the general aggregate limit.

4. Per Occurrence

The Occurrence Limit is the most the insurer will pay for damages under Coverages A & C regardless of the number of insureds, claims made or suits brought resulting from any one occurrence. This limit is subject to the General Aggregate or Products and Completed Operations Aggregate, whichever applies.

5. Medical Expense

Coverage C - Medical Payments contains the Medical Expense Limit per person for medical expenses. As is the case in the Damage to Premises Rented to You Limit, this is a sublimit, since a payment under this Coverage reduces the amount payable under the occurrence limit. Likewise this will reduce the General Aggregate Limit.

6. Damage to Premises Rented to You

The Damage to Premises Rented to You Limit is the most that will be paid under Coverage A for any one premises, while rented to the named insured. This limit may be referred to as sublimit, since payment here reduces the amount payable under both the Occurrence Limit and the General Aggregate Limit.

66



NOTES

Section IV - Conditions

1. In the event of a claim, occurrence or lawsuit, the insured must make prompt notice to and cooperate with the insurer.

2. Other insurance – in most circumstances the CGL coverage form is primary.

3. Separation of insureds – the CGL policy applies as though each insured has its own separate policy. If one insured brings a covered claim against another insured under the same policy, the policy will pay the claim.

4. Premium audit – under the CGL the insured pays what is described as a “deposit premium”. At the end of the year, the company will conduct an audit to determine the amount of the actual earned premium. If the insured’s business increased over the policy year, they will owe additional premium. If the insured’s business decreased over the year they will receive a refund.

5. Transfer of rights of recovery – addresses how subrogation will work.

GENERAL AGGREGATE LIMIT COVERAGES A & B

PRODUCTS COMPLETE OPERATIONS AGGREGATE LIMIT

OCCURRENCE LIMIT COVERAGES A & C

PER ENTITY LIMIT

BI & PD FROM COVERED

PREMISES/ OPERATIONS COVERAGE A

MEDICAL EXPENSES

COVERAGE C

COVERAGE FOR DAMAGE TO

PREMISES RENTED TO YOU

COVERAGE A

OCCURRENCE LIMIT COVERAGE A

BI & PD FROM PRODUCTS/ COMPLETED OPERATIONS COVERAGE A

PERSONAL & ADVERTISING

INJURY COVERAGE B

COMMERCIAL GENERAL LIABILITY – LIMITS OF INSURANCE

67



NOTES Section V - Definitions

Advertisement

A notice that is broadcast or published to the general public or specific market segments about your goods, products or services for the purpose of attracting customers. This includes electronic media (internet, facebook, etc.)

Auto

A land motor vehicle or trailer designed for use on public roads including any equipment attached to said vehicle.

Bodily Injury

Bodily injury means bodily injury, sickness or disease sustained by a person, including death.

Coverage Territory

1. The United States of America, its territories and possessions, Puerto Rico and Canada.

2. Coverage is worldwide for injuries or damages if the goods or products are made or sold by the named insured in the coverage territory and for activities of a person temporarily outside the coverage territory.

Employee

Includes a leased worker but not a temporary worker.

Executive Officer

A person holding an officer’s position created by the insured’s charter, constitution, bylaws or similar documents.

Impaired Property

Tangible property but not the insured’s property that cannot be used or is less useful because it includes the insured’s product or work that is known to be or thought to be defective, inadequate or dangerous.

Insured Contract (six)

L ease of premises

E asement or license agreement

A greement to indemnify a municipality

S idetrack agreement

E levator maintenance agreement

T ort liability of a Third Party

68



NOTES Loading or Unloading

The handling of property

Mobile Equipment

Includes the following types of land vehicles and the attached equipment;

1. Bulldozers, farm machinery, forklifts and other vehicles designed for use off public roads.

2. Vehicles maintained for use solely on or next to the named insured’s premises.

3. Vehicles on crawler treads.

4. Vehicles maintained to provide mobility to permanently mounted power cranes, shovels, loaders, diggers, etc.

Occurrence

An accident including continuous or repeated exposure to substantially the same conditions.

Walden Pool Company uses a small bulldozer to dig a pool in a customer’s backyard. While backing the bulldozer, Walden’s employee strikes the neighbor’s fence. There is no apparent damage after the first time, but soon after being struck for the third time a section of the fence collapses. This would qualify as an “occurrence.”

Personal and Advertising Injury

“Personal and advertising injury” means injury from the following offenses:

1. False arrest, detention or imprisonment.

2. Malicious prosecution.

3. Wrongful eviction, wrongful entry or invasion of privacy.

4. Oral or written publication of material that slanders or libels or violates a person’s right of privacy.

5. The use of another’s advertising ideas in the insured’s advertisement.

6. Infringement of copyright, trade dress or slogan in the insured’s advertisement.

Products and Completed Operations Hazard

Bodily injury or property damage that arises out of the insured’s product.

69



NOTES Property Damage

Property damage means:

1. Physical injury to tangible property, including its loss of use, and

2. Loss of use of tangible property not physically injured.

Electronic data is not tangible property.

Temporary Worker

A person who is furnished to the insured to substitute for a permanent employee on leave or someone used to meet a seasonal or short-term workload condition.

Volunteer Worker

A person who is not an employee of the insured and donates his/her own time (without payment) under the insured’s direction.

Your Product

“Your product” means any goods or products manufactured, sold, handled, distributed or disposed of by the named insured. It includes warranties and representations.

Your Work

“Your work” means work or operations performed by the named insured or on behalf of the named insured as well as materials and parts furnished in connection with the work. It also includes warranties and representations.

Occurrence versus claims-made

The Occurrence Form is the one used most often to provide CGL coverage. Under this form coverage applies for injury or damage that occurs during the policy period, regardless of when the claim is reported to the insurer.

The Claims-Made Form provides coverage for claims occurring on or after the retroactive date that are made during the policy period or the extended reporting period, even if the injury or damage occurred years before the current policy term.

Claims-Made Features

Trigger

The trigger is simply how coverage for a claim is activated. Under the Claims-Made Coverage Form the event that triggers coverage is a demand for damages by a third-party.

Retroactive Date

The retroactive date determines when coverage starts. In order for coverage to apply, the occurrence that gives rise to a claim must take place after the retroactive date. There are three things you need to know in order to handle a claim under a Claims-Made Form with a retroactive date:

70



NOTES 1. When was the occurrence?

2. What is the retroactive date?

3. When was the claim made?

If the occurrence was before the retroactive date, there is no coverage under the current policy. If the occurrence was after the retroactive date and the claim was made during the policy period, coverage applies. This is true even if another Claims-Made Policy was in effect when the actual loss occurred.

The retroactive date is usually the effective date of the first Claims-Made Policy and normally stays the same (does not move forward) each year as successive Claims-Made Policies are renewed.

Extended Reporting Periods (also known as “tail” coverage)

Extended reporting periods are used to provide coverage for claims that are reported after a Claims-Made Policy ends. Remember, in a Claims-Made Policy once the policy ends there is no continued coverage for claims that are made. These periods provide additional time for claims to be reported but do not extend coverage beyond the policy period.

Basic Extended Reporting Period (BERP)

This “tail” is provided automatically at no additional cost and consists of:

a. Mini-tail which gives an additional 60 days after policy termination to make any claims that occurred during the policy period.

b. Midi-tail which gives up to five (5) years after policy termination to make a claim, provided the occurrence is reported within 60 days of policy termination and the loss occurred during the policy period.

Supplemental Extended Reporting Period (SERP)

This “tail” extends the reporting period forever. This is an endorsement that must be purchased and it must be requested in writing by the insured within 60 days of policy termination. The one-time premium charge for this endorsement cannot exceed 200% of the last annual CGL premium. Coverage still only applies to claims that occurred during the policy period the supplemental tail reacts like an occurrence policy.

71



NOTES Claim Information

Any insurer who cancels or nonrenews a Claims-Made CGL must provide claim and occurrence information to the first named insured pertaining to any policy issued over the previous 3 years. This information must be sent within:

1. 30 days of termination if the insurer canceled or nonrenewed the policy, or

2. within 60 days of the expiration of the policy period if the insured makes a written request.

72



NOTES

QUIZ

1. The Commercial Package Policy is made up of the following components except:

a. Common Policy Declarations

b. Common Policy Conditions

c. Common Policy Exclusions

d. Coverage Parts

2. If a Commercial Package Policy has been in effect for more than 60 days, the insurer may cancel for either failure to pay the premium or material misrepresentation at the time the policy is issued by giving _____-days notice.

a. 10

b. 15

c. 30

d. 60

3. In the Building and Personal Property Coverage Form, Business Personal Property includes all of the following except:

a. Property of others in the insured’s care, custody or control.

b. A tenant’s use interest in improvements and betterments.

c. Stock.

d. Machinery and equipment.

4. All of the following are considered Building as described in the Building and Personal Property Coverage Form except:

a. Stock.

b. Permanently installed machinery and equipment.

c. Floor covering.

d. Outdoor furniture.

5. The Building and Personal Property Coverage Form lists which one of the following as “property not covered?”

a. Machinery and equipment

b. Animals owned by others boarded by the insured

c. Bridges, roadways and walks

d. Outdoor furniture

73



NOTES

6. Which statement is correct about the Additional Coverage – Debris Removal found in the Building and Personal Property Coverage Form?

a. The Debris Removal is found in the Extensions of Coverage.

b. Debris Removal is only covered when the loss results from fire and the extended covered perils.

c. Debris Removal pays for pollution cleanup from land or water.

d. If a total loss is paid on the building and/or personal property and there is still debris to be removed, the policy will provide an additional $10,000.

7. Which statement about the Coverage Extension – Property Off-Premises in the Building and Personal Property Coverage Form is not true?

a. This extension of coverage protects Covered Property including stock while it is located temporarily at a place the insured does not own.

b. It does not provide coverage for property in the custody of a salesperson while making sales calls.

c. This extension of coverage provides coverage for property in or on a motor vehicle.

d. This extension covers property at a fair, trade show or exhibition.

8. If the insured has a building that has been vacant for over 60 days when a fire loss of $100,000 occurs to the building, how much will be paid under the Building and Personal Property Coverage Form with a Special Causes of Loss attached? (Disregard deductibles and assume the insured has an adequate amount of coverage.)

a. The policy pays nothing due to the vacancy.

b. The policy pays the entire $100,000.

c. The policy pays 75% of the $100,000.

d. The policy pays 85% of $100,000.

9. The insured has purchased a Building and Personal property Coverage Form with a Special Causes of Loss attached to provide $300,000 protection for the building with a value of $500,000. The policy is written with 80% coinsurance. The insured suffers a windstorm loss of $120,000. How much will the policy pay (disregard any deductibles)?

a. $90,000

b. $80,000

c. $120,000

d. $96,000

74



NOTES 10. Which of the following statements about Business Income coverage is not true?

a. The purpose of Business Income coverage is to provide for the lost income expenses to reduce loss when a covered loss causes damage to the insured’s covered property.

b. “Business Income” includes net income and continuing normal operating expenses.

c. An example of expenses to reduce loss would be the moving expense to another location and advertisement of such move so the insured’s business could remain open.

d. The Business Income limit is based on a stated percentage of the building value.

11. An attorney’s office is more likely to need which of the following Time Element coverages?

a. Extra Expense Coverage

b. Business Income Coverage

c. Valuable Papers and Records Coverage

d. Ordinance and Law Coverage

12. The BNR Corporation had a Value Reporting Form with a $500,000 limit of liability written on January 1. BNR makes all of their required reports of values on time. Their April report showed an inventory of $100,000 which understated an actual inventory of $200,000. On May 1, BNR had a fire loss of $200,000. Disregarding any deductible, how much would BNR’s insurer pay?

a. $200,000 (the entire amount)

b. $100,000 (50% of the loss)

c. $150,000 (75% of the loss)

d. $180,000 (90% of the loss)

13. The Todd Toy Store makes almost 50% of their sales in October, November and December; therefore, it significantly increases its inventory by almost 40%. Which of the following is the best method of providing insurance coverage for the three months seasonal fluctuation of their inventory?

a. Value Reporting Form

b. Inflation Guard Option

c. Peak Season Endorsement

d. Higher policy limits at the inception date of the policy

75



NOTES 14. There are two Commercial General Liability Coverage Forms available. Which of the

following statements is not true about those coverage forms?

a. The most commonly written coverage form is the claims-made form.

b. The claims-made form is activated when a covered loss occurs after a date specified in the Declarations Page and before the end of the policy period.

c. The occurrence form CGL is activated when a covered loss occurs during the policy period.

d. In the occurrence form it makes no difference when the claim is made.

15. “Property Damage” does not include:

a. Physical injury to tangible property.

b. Loss of use of tangible property that has sustained physical injury.

c. Loss of use of tangible property that is not physically injured.

d. Extra expense.

16. Mr. Weber, who works for American Technology, goes to Germany to negotiate a contract with a customer. While walking through the Hamburg train station, he knocks a man down. The man brings a suit in federal court in New York against Mr. Weber an American Technology. Which statement correctly describes the coverage under the CGL?

a. There is no coverage outside the U.S., its territories and possessions, Puerto Rico and Canada.

b. There is only coverage worldwide for products and not liability arising out of an insured’s activities.

c. American Technology is covered for the suit, but the CGL does not extend coverage to employees.

d. Both Weber and American Technology are covered for this loss, because the policy extends coverage for the acts of employees whose home is the U.S., its territories and possessions, (i.e., Puerto Rico), and Canada, and the suit is brought in the territory just described.

76



NOTES 17. Which of the following areas of exposure are covered under Coverage A, Bodily

Injury and Property Damage Liability in the CGL?

I. Premises

II. Personal Injury

III. Operations

IV. Products/Completed Operations

a. Premises and Personal Injury Only (I and II)

b. Premises and Operations Only (I and III)

c. Premises, Operations and Products/Completed Operations (I, III, IV)

d. Premises, Personal Injury, Operations and Products/Completed Operations (I, II, III, IV)

18. Your insured is RDS, Inc. Which of the following statements best represents the “insureds” under RDS’s unendorsed Commercial General Liability Coverage?

a. RDS, Inc. only.

b. RDS, Inc. and its officers, directors, stockholders and employees.

c. RDS, Inc., its officers directors, stockholders and employees, plus ABC, Inc., a company in which RDS has 25% ownership.

d. RDS, Inc., its officers, directors, stockholders and employees, and their family members.

19. Your insured owns a shopping center that is leased to others. The insured’s CGL Coverage Form:

a. Covers claims arising out of the building premises and insured’s operations.

b. Covers claims made by the general public, but does not cover any claims brought by the tenants of the building.

c. Covers claims arising out of the described building premises only.

d. Does not provide coverage since the insured doesn’t occupy space at the shopping center.

77



NOTES

20. Jack is a computer salesman. He hosts a cocktail party for his customers. One of the customers leaves the party in an intoxicated state and has an auto accident. How would the CGL respond if the customer sues Jack?

a. Jack’s CGL will not respond to this suit because of the liquor exclusion.

b. The CGL insurer will deny coverage because Jack is not legally liable.

c. Since Jack is not in the liquor business, this is considered a “host liquor” exposure and is covered by Jack’s CGL.

d. Jack will be covered only if his CGL has been endorsed to cover this exposure.

21. Clint is a general contractor. One of Clint’s employees accidentally dropped a pallet of bricks from the third floor of a building under construction. Which of the following will not be covered by Clint’s CGL?

a. Damage to a subcontractor’s truck.

b. Injury to a subcontractor’s employee.

c. Damage to Clint’s forklift.

d. All of the above.

22. Your insured, Pete’s Plumbing, installed a hot water heater in a house which later malfunctioned and caused fire and water damage. Which of the following is not covered by Pete’s CGL Coverage Form?

a. Damage to the house.

b. Damage to the contents of the house.

c. Damage to the hot water heater.

d. Injury to the occupant of the house.

23. All of the following are true of pollution liability under the CGL Policy except:

a. There is coverage for fluids that escape from mobile equipment.

b. Pollution caused by a hostile fire is covered.

c. Pollution coverage can be endorsed onto the CGL.

d. The CGL policy excludes all pollution.

78



NOTES

24. Becky, a sales clerk at Wilkins Department Store, notices a suspicious activity of a “customer.” She calls security and detains the customer. Upon a search by Becky and security, no store property is found. The customer brings suit against Becky and Wilkins for unlawful detention and false arrest. Which of the following best describes the coverage contained within the CGL?

a. There is no coverage since it was an intentional act.

b. This is Personal Injury Liability loss and there is no coverage for this type of loss under the CGL.

c. Even though the CGL provides coverage for Coverage B – Personal Injury and Advertising Injury Liability, detention and false arrest are not covered offenses.

d. This is a Personal Injury Liability loss and there is coverage under Coverage B – Personal and Advertising Injury Liability.

25. Bob and Ray have a Commercial General Liability Coverage Form with limits of $500,000 per occurrence and $1,000,000 general aggregate. The effective date of the policy is January 1. On April 1, two persons were injured by the same occurrence on Bob and Ray’s premises. One of the injured personal collected $300,000 on June 1. On July 1, the second person filed claim for $550,000. What limits are available for this second claim?

a. $700000

b. $500,000

c. $200,000

d. None of the above.

26. Your insured has a Commercial General Liability Coverage Form with limits of $300,000 per occurrence, $500,000 aggregate, and $50,000 Damage to Premises Rented to You. Which of the following statements is incorrect?

a. A payment under Damage to Premises Rented to You will reduce the per occurrence limit.

b. Damage to Premises Rented to You will pay damages to rented premises if the loss is caused by fire.

c. A payment under Damage to Premises Rented to You will not reduce the general aggregate limit.

d. Damage to Premises Rented to You will also pay for a fire loss to premises temporarily occupied by the named insured.

79



NOTES

27. Robertson Manufacturing has a Commercial General Liability Policy with limits of $300,000 per occurrence and $600,000 aggregate. Robertson was sued for $300,000 for bodily injury arising out of a faulty product, and the claimant was awarded this amount by the court. The cost of defense was $50,000. What is the total amount that will be paid by the CGL?

a. $300,000; defense costs are excluded.

b. $300,000; defense costs are included in the occurrence limit.

c. $300,000; unless the policy is endorsed to cover defense costs.

d. $350,000; defense costs are paid in addition to the occurrence limit.

28. Which of the following is not a type of property group described in the Nationwide Marine Definition?

a. Imports

b. Buildings

c. Domestic Shipments

d. Bridges, Tunnels and Other Instrumentalities of Transportation and Communication.

29. Which of the following is true about Commercial Inland Marine forms?

a. Filed forms means that the coverage form and/or rates must be filed with state regulatory authorities.

b. Most of the coverages written under Inland Marine are filed.

c. Unfiled lines of Inland Marine include Accounts Receivable and Sign Coverage.

d. Filed lines of Inland Marine Coverage tend to have a greater variance of exposure.

30. The Commercial Articles Floater is designed to provide protection for:

a. Loss of any type of business personal property whether it is on or off the described premises.

b. Loss to musical instruments and cameras that are owned by the insured and sold to the business’ customers.

c. Loss to musical instruments or cameras used in the insured’s business, but not held for sale.

d. Loss to articles that are published within the insured’s newspaper or periodical (magazine) business.

80



NOTES

31. Which of the following are exclusions that are common to Commercial Inland Marine policies?

a. Government Action

b. War and Military Action

c. Earthquake

d. All of the above are common exclusions.

32. Which of the following items would not be considered covered property within a Jewelers Block Coverage Form?

a. A diamond necklace on display at a local art exhibit.

b. A customer’s watch that is left at the insured’s premises to be repaired.

c. A ruby ring that has been sold, but was left with the insured for sizing.

d. Loose stones, both precious and semiprecious, used to put in jewelry.

33. Which of the following statements is not true about the Equipment Dealers Coverage Form?

a. Covers a Dealer’s stock in trade.

b. Covered property automatically includes furniture, furnishings and office supplies.

c. Covers mobile agricultural equipment and construction equipment.

d. Covers mobile agricultural and construction equipment of others while in the care custody or control of the insured.

34. Despite the fact that a common carrier has a high degree of duty for the safe transportation of property and persons, there are certain defenses for a common carrier. Which of the following is not a defense?

a. Act of God or Nature

b. Exercise of Public Authority

c. Negligence of the Shipper

d. Fellow-worker Rule

35. The Commercial Property Policy excludes the following except:

a. Mechanical breakdown.

b. Fire that ensues from an explosion.

c. Artificially generated electric current that damages an electrical device, appliance or wires.

d. Any damage caused by the explosion of steam boilers, steam pipes or steam turbines.

81



NOTES

36. The Trebor Manufacturing Company uses boilers in their manufacturing process. There is some concern that a boiler is not working properly, so they hire Cazer Company to come to the plant to test the vessels. During the gas pressure test the increase in pressure causes the boiler to explode destroying the boiler and other equipment. How would the Equipment Breakdown policy respond to this loss?

a. Pay the loss since it was a “breakdown” of “covered equipment.”

b. It will not pay anything since the policy excludes losses arising from testing.

c. It will pay for the boiler, but not the other equipment.

d. It will pay for the loss to the boiler, but the insurer will subrogate against the Cazer Company.

37. All of the following are Additional Coverages in the Equipment Breakdown policy except:

a. Ammonia Contamination

b. Supplementary Payments

c. Hazardous Substance

d. Water Damage

38. The limit on the Declarations Page of the Equipment Breakdown policy applies per loss. Which of the following is not subject to a sublimit of $25,000 unless an additional limit is shown?

a. Consequential Loss

b. Property Damage

c. Ammonia Contamination

d. Data and Media

39. “A loss due to the lack of power, light, steam or refrigeration to “Covered Property” at the premises shown on the Declarations” best describes which coverage?

a. Business Income and Extra Expense

b. Spoilage Damage

c. Ordinance or Law Coverage

d. Expediting Expenses

82



NOTES

40. Burglary is:

a. The unlawful taking of property from a person by actual violence or threat of violence.

b. The unlawful taking of property from within a premises by entering into or leaving a premises where there are visible signs of forcible entry or exit.

c. The unlawful taking of property from a person or premises.

d. The act of stealing.

41. Robbery is:

a. The unlawful taking of property from a person by actual violence or threat of violence.

b. The unlawful taking of property from within a premises by entering into or leaving a premises where there are visible signs of entry or exit.

c. The unlawful taking of property from a person or premises.

d. The act of stealing.

42. The territory, as shown in the Crime Policy General Conditions, is:

a. Anywhere in the world.

b. United States of America only.

c. United States of America and Canada only.

d. United States, its territories and possessions, Puerto Rico and Canada.

43. Employee Theft Coverage applies to the following types of property:

a. “money” only.

b. “money” and “securities” only.

c. “property other than money and securities.”

d. “money”, “securities” and “other property.”

44. The coverage territory for Forgery or Alteration Coverage is:

a. Anywhere in the world.

b. United States of America only.

c. United States of America and Canada only.

d. United States of America, U.S. Virgin Islands, Puerto Rico, Canal Zone or Canada only.

83



NOTES

45. Which of the following is not excluded under the Inside the Premises – Theft of Money and Securities Coverage?

a. Loss resulting from accounting or arithmetical errors.

b. Voluntary parting.

c. Acts of “employees”, members, directors, trustees or representatives.

d. Disappearance or destruction of “money” or “securities.”

46. The Inside the Premises – Robbery or Safe Burglary of Other Property Coverage and the Inside The Premises – Robbery or Safe Burglary of Money and Securities endorsements provide coverage for robbery. Under these coverages the robbery must be of:

a. A “custodian.”

b. A “messenger.”

c. An armored motor vehicle company.

d. A janitor.

47. Which of the following statements about Computer Fraud Coverage is correct?

a. “Computer fraud” is the theft of property arising out of the use of a computer to fraudulently transfer property from inside the premises to a person or place outside the premises.

b. “Computer fraud” does not include theft of property arising from the use of a computer.

c. Covered property only covers “money” and “securities.”

d. “Computer fraud” includes the acts of employees, directors, trustees or representatives so long as the loss arises from the use of a computer to fraudulently transfer property.

48. Which statement best describes the coverage which can be provided in the Farm Property Coverage Form?

a. Provides protection for dwelling and household personal property from Covered Causes of Loss.

b. Provides protection for not only residential property exposures, but may cover incidental business pursuits.

c. Provides protection for not only residential property exposures, but also includes coverage for commercial exposures arising out of farming or ranching.

d. Provides protection for commercial exposures arising out of farming and ranching, but does not include residential property coverage.

84



NOTES 49. Under Coverage A – Dwelling in the Farm Property Coverage Form, which of the

following is not included under covered property?

a. “Dwelling”

b. Shelter used for protection or housing of livestock.

c. Manufactured or Mobile Home.

d. Material or supplies located on the insured’s location used for construction, alteration or repair of the “dwelling.”

50. In Coverage E – Schedule Farm Personal Property in the Farm Property Coverage Form there are many types of property covered. Which of the following is not a covered property?

a. Growing crops

b. Grain

c. Computers and related software used principally in farm operations

d. Bees and worms

51. There are numerous coverage extensions under Coverage E – Scheduled Farm Property Coverage Form. Which of the following is a correct statement about the coverage extension?

a. Farm Personal Property in the custody of a common or contract carrier is granted up to $10,000 for a loss resulting from a covered cause of loss.

b. Under the coverage extension “Replacement Machinery, Vehicles, and Equipment Newly Purchased," new equipment is provided coverage for an amount up to the value of old equipment plus $75,000 for 30 days.

c. The extension of coverage away from the insured property will provide protection up to a limit of 10% for Miscellaneous Equipment.

d. Newly acquired livestock is covered up to 10% of Coverage E.

52. In Coverage G – Other Farm Structures there are 7 kinds of property that can be insured under this coverage. Which of the following may not be insured under Coverage G?

a. Outdoor radio and TV equipment, antennas, masts and towers

b. Insured’s in-ground pool

c. Barns and Silos

d. Portable buildings and portable structures

85



NOTES

53. Avery purchases a Farm Property Coverage Form with the Special Causes of Loss provision selected on the Declarations. Tractors and accessories (plows, etc.) and harvesting equipment (corn picker/combines) are specifically described on the Declarations. While picking corn, a scrap of metal is taken into Avery’s corn picker. What will the coverage form pay related to this claim?

a. The $400 loss will be paid.

b. It will pay $400 less the deductible.

c. It will pay nothing since the corn pickers and other harvesting equipment are not covered property.

d. It will pay nothing since damage to farm equipment as a result of foreign objects taken into any farm machinery is excluded.

54. Which of the following statements about farm liability is not correct?

a. Farm Liability is usually provided by endorsing the Homeowners Policy.

b. The Farm Liability Coverage Form can be combined with a Farm Liability Coverage Form Declarations, Common Policy Conditions (IL 00 17) and any appropriate endorsements to form a Farm Liability Policy.

c. The Farm Liability Coverage From can be combine with farm property coverage forms to provide a multi-line policy?

d. The Farm Liability Coverage Form has some of the characteristics of the CGL Coverage From and some of the characteristics of Section II – Liability of the Homeowners Policy.

55. “Custom farming means performance of specific planting, cultivating, harvesting or other specific “farming” operations by an “insured.” It does not include:

a. A farm that is an “insured location.”

b. Operations for which no compensation in money or goods is received.

c. A neighborly exchange of services.

d. All of the above.

86



NOTES

56. Rod owns a computer store. He hosts a reception for his customers. One of the customers leaves the party in an intoxicated state and has an accident. How would the unendorsed Commercial General Liability Coverage Form respond if the injured party sues Rod and his company?

a. Rod’s CGL will not respond to this suit because of the liquor liability exclusion.

b. Rod will be covered only if the CGL has been endorsed to cover this exposure.

c. Since Rod is not in the business of manufacturing, selling or furnishing alcohol, this is considered a “host liquor” exposure and is covered by Rod’s CGL.

d. None of the above describe the coverage provided by Rod’s CGL.

Answers 1c, 2b, 3a, 4a, 5c, 6d, 7c, 8d, 9a, 10d, 11a, 12b, 13c, 14a, 15d, 16d, 17c, 18b, 19a, 20c, 21c, 22c, 23d, 24d, 25c, 26c, 27d, 28b, 29a, 30c, 31d, 32a, 33a, 34d, 35b, 36b, 37b, 38b, 39b, 40b, 41a, 42d, 43d, 44a, 45d, 46a, 47a, 48c, 49b, 50a, 51b, 52b, 53d, 54a, 55d, 56c

87

88

Chapter One Section 2

Businessowners (’10) Policy

Originally Submitted in 2014 by: Jason F. Ernest, Esq. Insurance Agents & Brokers Mechanicsburg Updated in 2016 by: Neil Robertson, Esq. Robertson Insurance & Risk Management Lititz

© 2013. Insurance Agents & Brokers. Reprinted with permission.

89

90



BUSINESSOWNERS (’10) POLICY

CHARACTERISTICS AND PURPOSE

The Businessowners Policy (BOP) is a package policy designed to provide property & liability coverage for small to medium sized business. Designed like the Homeowners Policy, the BOP allows the small to medium sized business the option of buying coverage that is designed to satisfy most of their commercial insurance needs (property, business income and liability) with a single, simple, affordable policy. There are few decisions to make and few options to consider. This policy is an alternative to the more complex Commercial Package Policy (CPP). In fact, many of the coverages found in the CPP are identical to those in the BOP.

Since it’s meant to be a complete package, the BOP automatically provides Business Income & Extra Expense Coverage for up to 12 months, some business income from dependent properties, built-in inflation guard, peak season coverage (up to 25% of business personal property), glass expense and fire extinguisher system recharge expense. The policy is written on a Special Form and it is on a replacement cost basis. Instead of a coinsurance requirement the policy has an insurance to value requirement which requires a limit of insurance equal to 80% or more of the full replacement cost of the property immediately before the loss. This is similar to processes found in Homeowners and Dwelling Forms. The policy has the following optional coverages available:

1. Outdoor signs

2. Money and securities

3. Employee dishonesty

4. Equipment Breakdown

ELIGIBILITY

The main distinction between the CPP + CGL and the BOP is not coverage, but eligibility. Literally, almost any business can purchase a commercial package and choose their coverages as needed (a-la-carte). The size or complexity of the business does not matter, anyone can buy a CPP. However, the BOP is meant for smaller to medium sized, low-risk businesses.

Those eligible risks would include:

Apartment buildings and residential condominiums;

Office buildings including office condominiums not exceeding six stories or a total of 100,000 square feet;

91



Mercantile occupancies if the total floor area does not exceed 35,000 square feet and whose sales do not exceed $6 million;

Personal property in an office with less than 35,000 square feet per building;

Service and processing risks as long as no more than 25% of gross sales come from off-premises operations including:

o Bakeries

o Barber and beauty shops

o Dental laboratories

o Dry cleaning and laundry stores

o Engraving and photoengraving

o Funeral homes

o Mailing or addressing

o Photocopying, printing, and lithographing

o Photography

o Shoe repair shops

o Tailoring

o Taxidermy

o Television and appliance installation and service

o Watch, clock, and jewelry repair

Contractors such as carpentry, residential construction, drywall installation, landscape gardening, etc. as long as annual payroll does not exceed $300,000

Restaurants

o Limited Cooking Restaurants (cafés, coffee shops, pizzarias)

No more than 7,500 square feet and a seating capacity of no more than 75 people. Alcohol can be beer or wine only and those sales cannot be more than 25% of total gross sales.

o Fast Food Restaurant (McDonalds, Wendy’s, etc.)

No more than 7,500 square feet and a seating capacity of no more than 150 people. Alcohol can be beer or wine only and those sales cannot be more than 25% of total gross sales.

o Casual Dining Restaurants

No more than 7,500 square feet and a seating capacity of no more than 150 people. Alcohol can be beer, wine and liquor but those sales cannot be more than 50% of total gross sales.

o Fine Dining Restaurants

No more than 7,500 square feet and a seating capacity of no more than 150 people. Alcohol can be beer, wine and liquor but those sales cannot be more than 75% of total gross sales.

92



o Convenience Store with Gasoline Pumps

Gasoline sales may not exceed 75% of total convenience store sales. There can be no automotive service or repair, carwash, propane or kerosene tank filling or restaurant operations.

o Wholesalers

No more than 25% of gross sales can come from retail sales and no more than 25% of the total square footage can be open to the public.

Ineligible Risks

The type of exposure here usually takes it out of the low risk category. Ineligible business includes:

1. Manufacturers

2. Banks, credit unions, stockbrokers, and other financial institutions

3. Wholesalers not specified

4. Places of amusement (carnivals, bowling alleys, amusement parks)

5. Processing and service not specifically identified as eligible

6. Auto dealers, repair or service stations, parking lots and garages

7. Household personal property

Eligible Risks Summary

Apartment Buildings

Office Buildings – including office condominiums not exceeding 6 stories or a total of 100,000

square feet.

Mercantile, Processing or Service Risks (Bakeries, Barber Shops, Dry Cleaners, Funeral Homes,

Printers, Shoe Repair, Tailoring, Repair Shops, etc.), if the total floor area of the building does not

exceed 35,000 square feet and whose sales do not exceed $6,000,000.

Contractors whose annual payroll does not exceed $300,000 and no work done over 3 stories.

Convenience Stores – with a minimum of 3,000 square feet; if gas sales - no auto repair or service,

no car wash, and no propane or kerosene tank filling.

Motels – not exceeding 3 stories, no bar or lounge and not seasonal.

Restaurants – all restaurants limited to 7,500 square feet. Fast food, casual and fine dining

restaurants maximum seating capacity of 150 (limited cooking 75). Fast food and limited cooking

– beer and wine only 25% of sales; casual and fine dining – alcohol only 50% of sales.

Self-Storage Facilities – no more than 2 stories and no storage of industrial materials, chemicals or

cold storage.

Wholesale Risks – with no more than 25% retail sales and 25% of area open to public.

93



8. Full cooking Restaurants, Bars and Pubs (too much alcohol)

9. Businesses located in buildings which contain ineligible processing or manufacturing operations

10. Contractors not specified (heavy construction, demolition, larger general contractors)

BUSINESSOWNERS SECTION I – PROPERTY

Many of the property coverage provisions in the BOP are similar to those found in the Commercial Property forms reviewed in the preceding chapter. The Commercial Property forms most applicable to the Section I of the BOP are:

COVERAGE

Covered Property

Buildings

Building means the building or structure described on the Declarations Page, including:

• Completed additions;

• Fixtures (including outdoor fixtures);

• Permanently installed machinery and equipment;

Section I

Building & Personal Property Coverage Form

Causes of Loss – Special Form

Business Income Form

Peak Season Endorsement

Automatic Increase in Insurance

Endorsements

Protective Safeguards

Utility Services – Direct Damage

Utility Services – Time Element

94



• Your personal property in apartments or rooms furnished by you as landlord (not included in the CPP);

• Personal property used to service or maintain the building (like outdoor furniture, floor covering and appliances used for maintaining the building).

Also included in the meaning of building are additions and repairs in progress and material, equipment, supplies, and temporary structures within 100 feet of the described premises which are used for making additions or repairs, if no other insurance is available for such property.

Business Personal Property

Business Personal Property is the insured’s personal property located in or on the building described on the Declarations Page, or in the open (or in a vehicle) within 100 feet of the described premises. This property may include the following items:

1. Property the insured owns and uses in his/her business.

2. Property of others in the insured’s care, custody or control, but only for the amount the insured may be legally liable for, plus the cost of labor, material or services furnished or arranged by the named insured on personal property of others (not included in the CPP).

3. Use interest in tenants’ improvements. The coverage may include the value of improvements and betterments made by the insured, at his or her expense, which a lease agreement states are a part of the building and cannot be legally removed.

4. Any leased personal property that the insured has a contractual obligation to insure.

5. Exterior building glass if insured is a tenant and no limit of insurance for the building is shown in the declarations. The glass must be owned by or in the care, custody or control of the insured (not included in the CPP).

Property Not Covered

A shorter list of property not covered is contained in the BOP forms than we found in the Commercial Property Policy. These excluded items of property are:

1. Aircraft, automobiles, trucks and other vehicles subject to motor vehicle registration.

2. Money or securities, except as provided in the:

(a) Money and Securities Optional Coverage; or

(b) Employee Dishonesty Optional Coverage.

3. Contraband.

95



4. Land, water, growing crops or lawns.

5. Outdoor fences, radio or television antennas (including satellite dishes), signs (other than those attached to the buildings), trees, shrubs or plants, except as provided in the:

(a) Outdoor Property Coverage Extension; or

(b) Outdoor Signs Optional Coverage.

6. Watercraft (including motors and equipment) while afloat.

7. Accounts, bills, food stamps, other evidences of debt, accounts receivable or valuable papers and records, except as otherwise provided in the policy.

8. Computers permanently installed or designed to be permanently installed in any aircraft, watercraft, truck or the vehicle subject to motor vehicle registration, unless held as stock.

9. Electronic data, except as provided under Additional Coverages – Electronic Data. Does not apply to prepackaged software held as stock.

10. Animals, except animals owned by others and boarded by the insured, or if owned by the insured, as stock while inside a building.

In ISO’s version of the BOP the following limitations apply:

1. Loss or damage to the following property is excluded.

a. Steam boilers, steam pipes, steam engines, steam turbines, or hot water heaters if caused by a condition inside the equipment, except explosion within the furnace or flues.

b. Hot water heaters if caused by a condition inside the equipment except explosion.

c. Inventory shortage.

d. Property transferred to others on the basis of unauthorized instructions.

e. Interior building damage caused by rain, snow, sleet, ice, sand or dust unless:

(1) The building first sustains damage by a Covered Cause of Loss to its roof or walls; or

(2) The loss is caused by the thawing of snow, sleet or ice on the building.

f. Lawns, trees, shrubs or plants which are part of a vegetated roof caused by:

(1) Dampness or dryness of the atmosphere or soil;

(2) Changes in temperature;

(3) Disease;

96



(4) Frost or hail; or

(5) Rain, snow, ice or sleet.

2. Loss or damage to the following types of property are excluded unless caused by a “specified cause of loss” or glass breakage:

a. Animals, unless killed or their destruction is made necessary.

b. Fragile articles. Does not apply to:

(1) Glass that is part of the exterior or interior of the building.

(2) Containers of property held for sale.

(3) Photographic or scientific instrument lenses.

3. Loss or damage caused by theft is limited to $2,500 for the following types of property:

a. Furs or any garments lined with fur.

b. Jewelry, watches, jewels, pearls, precious and semi-precious stones, bullion, gold, silver, platinum and other precious metals, except jewelry and watches worth less than $100 per item.

c. Patterns, dies, molds and forms.

97



Additional Coverages

Additional Coverages found in the BOP are similar to those in the Commercial Property Policy.

ADDITIONAL COVERAGE

WHAT IS COVERED? WHAT IS NOT COVERED?

DEBRIS REMOVAL * 1. Reported within 180 days of the loss.

2. 25% of paid loss plus the deductible.

3. If:

a. Loss plus debris removal exceeds policy limit; or

b. Debris removal exceeds the 25% limitation;

Will pay additional $25,000. (CPP will only give $10,000)

4. If no covered property is damaged, will pay up to $5,000 per location for the removal of other property.

1. Cost to extract pollutants from land or water.

2. Cost to remove, restore or replace polluted land or water.

PRESERVATION OF PROPERTY *

If moved to protect from a Covered Cause of Loss, then covered for any cause of loss up to 30 days.

Personal Property Off Premises Coverage Extension will apply if moved to protect from a cause of loss that is not covered.

FIRE DEPARTMENT SERVICE CHARGE *

Up to $2,500 if assumed by contract or required by local ordinance

Only $1,000 in the CPP *

COLLAPSE 1. Buildings, if caused by:

a. Hidden decay, hidden insect or vermin damage or defective materials or methods during construction.

b. Use of defective material or methods after construction if caused by hidden decay, insect or vermin damage, “specified cause of loss”, breakage of building glass, weight of people or personal property, or weight of rain on the roof.

2. Antennas (including satellite dishes), awnings, gutters, down-spouts, yard fixtures, swimming pools, piers, wharves, docks, diving platforms, retaining walls, walks roadways and other paved surfaces, if direct result of the collapse of a building.

3. Personal property and damage not caused by collapse of a building:

a. Must be caused by a cause of loss in 1. above;

b. Must be within a building; and

c. The property is not of a kind listed in 2. above.

Settling, cracking, shrinkage, bulging or expansion.

*The CPP automatically provides coverage.

98




ADDITIONAL COVERAGE


WATER DAMAGE, OTHER LIQUIDS, POWDER OR MOLTEN MATERIAL

Cost to tear out and replace any part of the building necessary to repair the system or appliance.

Cost to repair the defect that caused the damage.

BUSINESS INCOME 1. Business Income:

a. Actual loss sustained.

b. 72 hour waiting period, unless changed to begin immediately following the loss by adding BP 04 41.

c. Up to 12 months.

2. Extended Business Income limited to 60 days, unless period is increased.

3. Additional limit of insurance.

1. Ordinary payroll is excluded after 60 days, unless period is increased.

2. Delay in rebuilding or resuming operations due to strikers.

3. Loss of contract, except during period restoration.

EXTRA EXPENSE 1. Necessary expenses to:

a. Continue operations; or

b. Minimize suspension of operations.

2. Expediting expenses to extent they reduce loss.

3. Up to 12 months.


1. Delay in rebuilding or resuming operations due to strikers.

2. Loss of contract, except during period of restoration.

POLLUTANT CLEAN UP AND REMOVAL *

1. At the described premises.

2. Reported within 180 days of the loss.

3. $10,000 per location for the policy period.

Costs to test for, monitor or assess the existence of pollutants.

CIVIL AUTHORITY 1. Access denied to premises due to Covered Cause of Loss to other premises within one mile.

2. Business Income and Extra Expense.

3. 72 hour waiting period, unless changed to begin immediately following the loss by adding BP 04 41.

4. Limited to four weeks.

MONEY ORDERS AND COUNTERFEIT MONEY

1. Good faith acceptance of invalid money orders or counterfeit money.

2. Up to $1,000.

FORGERY OR ALTERATION

1. Outgoing checks, drafts or similar written promise of payment.

2. Up to $2,500 unless higher limit is shown on Dec Page.

99



ADDITIONAL COVERAGE


INCREASED COST OF CONSTRUCTION *

1. If buildings insured on a replacement cost basis.

2. Due to ordinance or law regulating construction.

3. Up to $10,000 per building.


5% of building limit or $10,000 whichever is less *

1. If required to comply before the loss, and failed to comply.

2. Ordinance or law requiring testing for, removal of, etc. of pollutants.

3. Repairs made more than two years after the loss.

BUSINESS INCOME FROM DEPENDENT PROPERTIES

1. 72 hour waiting period.

2. Up to $5,000, unless higher limit shown in Declarations.

If due to the loss or damage to dependent property’s electronic data.

GLASS EXPENSES 1. Temporary plates or board up openings.

2. Removal of obstructions.

FIRE EXTINGUISHER SYSTEMS RECHARGE EXPENSE

Up to $5,000. If discharged during installation or testing.

ELECTRONIC DATA *

$2,500 *

1. Damage to, destruction of or corruption of electronic data.

2. Covered Causes of Loss include virus, harmful code or similar instruction.

3. Up to $10,000 for all loss sustained in any one policy year, unless a higher Limit of Insurance is shown in the Declarations.

1. Acts of an employee or an entity hired to inspect, install, maintain or repair the system.

2. Electronic Data which operates a building’s elevator, lighting, heating, ventilation, air conditioning or security system.

INTERRUPTION OF COMPUTER OPERATIONS

1. Business Income and Extra Expense.

2. Damage to, destruction of or corruption of electronic data.

3. Covered Causes of Loss include virus, harmful code or similar instruction.

4. Up to $10,000 for all loss sustained in any one policy year, unless a higher Limit of Insurance is shown in the Declarations.

5. No Extended Business Income.

1. Acts of an employee or an entity hired to inspect, install, maintain or repair the system.

2. Electronic Data which operates a building’s elevator, lighting, heating, ventilation, air conditioning or security system.

LIMITED COVERAGE FOR FUNGI, WET ROT, DRY ROT AND BACTERIA

1. Direct physical loss.

2. Cost to tear out and replace.

3. Cost of testing.

4. Up to $15,000 per policy period.

5. Business Income and Extra Expenses loss limited to 30 days.


100



Coverage Extensions

There are six Coverage Extensions provided under the BOP. You should keep in mind that each extension is additional insurance.

COVERAGE EXTENSION WHAT IS COVERED? WHAT IS NOT COVERED?

NEWLY ACQUIRED OR CONSTRUCTED PROPERTY

1. Buildings;

a. New buildings being constructed on same premises.

b. Newly-acquired at other premises if similar use or warehouse.

c. Up to $250,000.

d. 30 days.

2. Personal property:

a. Up to $100,000.

b. 30 days.

PERSONAL PROPERTY OFF PREMISES

1. In transit.

2. At premises not owned, leased or operated.

3. Up to $10,000.

1. At premises owned, leased or operated by the insured.

2. Money and securities.

3. Valuable papers and records.

4. Accounts receivable.

OUTDOOR PROPERTY * 1. Fences, radio and TV antennas (including satellite dishes), signs, (other than signs attached to building), trees, shrubs and plants.

2. Includes debris removal for a covered loss.

3. Fire, lightening, explosion, riot or civil commotion, or aircraft.

4. Up to $2,500, but no more than $1,000 for any one tree, shrub or plant.

*$1,000 and $250 for any tree, shrub or plant. *

All causes of loss except those listed under the Coverage Extension.

PERSONAL EFFECTS * 1. Owned by the insured, officers, partners or employees.

2. Up to $2,500.

1. Tools or equipment used in the insured’s business.

2. theft.

VALUABLE PAPERS AND RECORDS *

1. Cost to research, replace or restore.

2. Up to $10,000 at described premises.

3. Up to $5,000 off premises.

$2,500 *

1. Property held as samples or for delivery after sale.

2. In storage off premises.

3. Programming errors or faulty data processing equipment.

4. Errors in processing or copying.

ACCOUNTS RECEIVABLE 1. Amounts unable to collect due to a covered cause of loss.

2. Interest on loans.

3. Collection expenses.

4. Up to $10,000 at described premises.

5. Up to $5,000 off premises.

1. Programming errors or faulty data processing equipment.

2. Errors in processing or copying.

3. Alternation of records.

4. Accounting errors.

5. Loss can only be proved by audit or inventory.

BUSINESS PERSONAL PROPERTY TEMPORARILY IN PORTABLE STORAGE UNITS

1. Includes a detached trailer.

2. Within 100 feet of the described buildings.

3. Up to $10,000

1. If property stored more than 90 days.

2. If storage unit has been in use more than 90 days.


101



CAUSES OF LOSS

Under Section I of the BOP buildings and business personal property are insured for risks of direct physical damage unless otherwise excluded or limited. Therefore, the BOP Covered Causes of Loss are similar to the Commercial Property Causes Of Loss - Special Form.

The BOP can be endorsed with the Named Perils endorsement, which limits the Covered Causes of Loss to:

• Fire

• Lightning

• Explosion

• Windstorm and Hail

• Smoke

• Aircraft and Vehicles

• Riot and Civil Commotion

• Vandalism

• Sprinkler Leakage

• Sinkhole Collapse

• Volcanic Action

• Transportation

EXCLUSIONS

The exclusions that apply to Section I of the BOP include:

1. Ordinance or Law

2. Earth Movement

3. Governmental Action (seizure or destruction of property)

4. Nuclear Hazard

5. Failure of utility services if failure originates away from the described premises

6. War and Military Action

7. Flood, surface water, mudslide, waterborne material, etc.

8. Certain Computer-Related Losses (failure or malfunction)

9. Fungi, Wet Rot, or Dry Rot

The exclusion does not apply:

a. As a result of fire or lightning; or

b. To the coverage provided under Additional Coverage – Limited Coverage For Fungi, Wet Rot, Dry Rot and Bacteria.

10. Virus or Bacteria (capable of inducing illness or disease)

102



11. Electrical Apparatus - Artificially generated electrical current which damages an electrical device, appliance or wires is not covered, unless fire follows.

12. Consequential Losses (for delay or loss of market)

13. Smoke, Vapor, Gas (from agricultural smudging or industrial operations)

14. Steam Apparatus (no coverage for damage caused by the explosion of steam boilers, pipes, engines or turbines unless fire follows, and then only damage caused by the fire will be paid.

15. Frozen Plumbing (only if the insured fails to maintain heat or drain and shutoff water supply)

16. Dishonesty (by insureds or employees)

17. False Pretense (no coverage for theft by trickery)

18. Exposed Property (no coverage for personal property left in the open and damaged by rain, snow or ice)

19. Collapse (except as described in additional coverage)

20. Pollution

21. Neglect of an insured.

22. Other Types of Loss

There are several types of losses not covered by the BOP Property Special Form which are commonly excluded under many commercial and personal lines property forms. Some specific Causes of Loss this policy coverage form excludes are: wear and tear, rust, corrosion, decay, settling and cracking, mechanical breakdown, and loss to personal property due to dampness or dryness or other extreme temperature changes.

23. Errors or omissions in programming, processing or storing data or processing or copying valuable papers.

24. Errors in design, installation, testing, maintenance or repair of computer system or electronic data.

25. Electrical disturbance of electronic data except as provided under Coverage Extensions.

26. Continuous or repeated seepage or leakage of water that occurs over a period of 14 days or more.

103



THE FOLLOWING ARE ALL CONCURRENT CAUSATION EXCLUSIONS

27. Weather Conditions - The BOP Property Special Form will not pay if weather conditions contribute to an excluded event. As an example, excess snowfall causes a landslide, which is excluded under earth movement.

28. Acts or Decisions - This exclusion eliminates coverage for a loss in which the damage claims are a result of the actions or decisions of any person, group, organization or governmental body. This exclusion also applies to the failure to act or make a decision.

29. Negligent Work - The exclusion is related to loss from alleged faulty, inadequate or defective planning, zoning, development, design, workmanship, construction, or improper material use or maintenance.

LIMITS OF INSURANCE

1. Outdoor Signs

The only specified limit detailed in the Limits section is the $1,000 limit on outdoor signs attached to the building.

2. Automatic Increase in Building Limit

The Limits Section also explains how the policy provides an automatic increase in the building limit. The amount of increase is raised by the annual percentage shown on the Declarations Page.

Your insured has a BOP Property Policy with a limit for her building of $100,000. The annual increase she has elected is 6%. The policy increases on a daily basis so that at the end of the policy period the building limit has increased to $106,000

3. Seasonal Increase Limit

The business personal property limit is automatically increased by 25% to reflect seasonal increases of business personal property. However, this provision applies only if the limit of insurance is 100% of the average monthly values during the 12 months prior to the loss.

104



BUSINESSOWNERS SECTION II – LIABILITY

COVERAGES

Businessowners Liability

The Businessowners Liability is similar to the Commercial General Liability Coverage Form in terms of content, but it differs in format. You will not find Coverage A - Bodily Injury and Property Damage, Coverage B - Personal and Advertising Injury Liability, and Coverage C - Medical Payments as we saw in the CGL. In the Businessowners Policy, Coverages A and B are combined under the heading of Business Liability. Coverage C - Medical Payments is labeled as Medical Expenses in the Businessowners Liability Coverage Form.

All the liability exposure areas we examined in Commercial General Liability are contained within this coverage. You will recall that the CGL promises to pay for the legal obligations for damages for “Bodily injury”, “Property damage”, “Personal injury”, or “Advertising injury” to which this insurance applies. This insurance applies to “bodily injury” and “property damage” that arises from an “occurrence” that takes place in the “coverage territory.” The “coverage territory” is the same as in the CGL.

One difference between the CGL and the BOP is that the BOP is ONLY written on an occurrence basis.

Additionally, the insuring agreement promises that the insurer will defend any “suit” seeking damages related to “bodily injury,” “property damage,” “personal injury,” or “advertising injury.”

Included in the policy premium are basic limits: Liability of $300,000 per occurrence and $600,000 aggregate, Medical Payments of $5,000 and Damage to Premises Rented To You of $50,000. The BOP provides coverage for:

• premises and operations

• products/completed operations

• personal injury liability

• advertising injury liability

Coverage Extension - Supplementary Payments

The Supplementary Payments Coverage Extension is the same as the CGL. It includes:

• All expenses the insurer incurs to defend the insured.

• Up to $250 for the cost of bail bonds because of an accident or traffic law violation arising out of the use of a covered vehicle (mobile equipment).

• Premiums on appeal bonds, and bonds to release attachments.

105



• Other reasonable expenses incurred at the insurance company’s request.

• All costs taxed against the insured in the “suit.”

• Pre-judgment interest and post-judgment interest.

Now, in order to better analyze the liability coverage of the Businessowners Form, we need to move on to exclusions.

EXCLUSIONS

The numerous exclusions found in the Businessowners Policy are identical to those we examined in Commercial General Liability with two additional exceptions.

The Aircraft, Auto Or Watercraft exclusion in the CGL has an exception for

non-owned watercraft less than 26 feet in length. The exception in the same

exclusion in the Businessowners Policy applies to non-owned watercraft less

than 51 feet in length.

The Businessowners Policy contains a specific exclusion for professional

services. The Professional Services Exclusion states that this insurance does

not apply to “bodily injury,” “property damage,” “personal injury,” or

“advertising injury” due to rendering or failure to render any professional

services. This coverage form states that this includes, but is not limited to:

1. Legal, accounting or advertising services.

2. Preparing, approving or failing to prepare or approve maps, drawings, opinions, reports, surveys, change orders, designs or specifications.

3. Supervisory, inspection or engineering services.

4. Medical, surgical, dental, x-ray or nursing services treatment, advice or instruction.

5. Any health or therapeutic service treatment, advice or instruction.

6. Any service, treatment, advice or instruction for the purpose of appearance or skin enhancement, hair removal or replacement or personal grooming.

7. Optometry or optical or hearing aid services.

8. Body piercing services.

9. Services in the practice of pharmacy, but this does not apply to an insured whose operations include those of a retail druggist or drugstore.

The CGL does not have a specific professional services exclusion.

106



Medical Expenses

Medical Expenses is a coverage similar to that discussed in earlier chapters. One obvious change is the title of Medical Expenses instead of Medical Payments. Unlike Business Liability, this coverage is not subject to Legal Liability. The coverage will pay medical expenses for “bodily injury” caused by accident in the “coverage territory” and during the policy period. The expenses must be incurred and reported to the company within one year of the date of the accident.

The coverage is intended for premises and operations only, and not for products and completed operations.

Selected Exclusions

This insurance will not pay expenses for “bodily injury:”

1) to any insured;

2) to a person hired to do work for the insured or a tenant of an insured;

3) to a person injured on a part of the premises you own or rent that the person normally occupies;

4) to someone who is covered under a workers compensation or similar law;

5) to a person injured while practicing, instructing or participating in any physical exercises or games, sports or athletic contests;

6) included within the products completed operations hazard; and

7) those areas excluded under Business Liability Coverage.

Medical Expenses coverage contains its own limit of insurance.

107



WHO IS AN INSURED

The Who is an Insured Section in the Businessowners Policy is the same as the CGL except in regard to newly acquired or newly formed organizations. You may remember that in the CGL, there is coverage for newly acquired or newly formed organizations, unless the organization is a partnership, joint venture, or limited liability company. This automatic coverage is for a period up to 90 days. The unendorsed BOP has no automatic coverage.

You may wish to refresh your memory in this area by referring to the Who is an Insured chart below that was provided in the CGL section.

1. NAMED INSUREDS LIMITATIONS

a. Individual. Includes spouse Conduct of any business of which you are the

whole owner.

b. Partnership or Joint Venture.

Includes partners, members and their spouses.

Conduct of your business.

c. Limited Liability Company. Includes

members and managers.

Members: Conduct of your business.

Managers: Respect to their duties as trustees.

d. Corporations. Includes “executive officers,” directors

and stockholders.

“Executive officers” and directors: Respect to

their duties.

Stockholders: Respect to their liability as

stockholders.

e. Trust. Includes trustees. Respect to their duties as trustees.

2. OTHERS LIMITATIONS

a. “Employees” and “volunteer workers”, other than

“executive officers” of corporation and managers of

limited liability company.

Acting within the scope of their employment.

b. Persons other than “employees” and

“volunteer workers”. While acting as your real estate manager.

c. Any person with temporary custody of your property

if you die. Liability arising out of the maintenance or use of

that property.

d. Your legal representative if you die. Respect to their duties

3. Newly acquired or formed organization if named

insured has a majority interest

Not partnership, joint venture or limited liability

company.

Covered for 90 days after acquisition or

formation

108



LIMITS OF INSURANCE

As you might expect, the Businessowners Liability Limits Section is very similar to the CGL, but it is not exactly the same. The Businessowners has a single limit for liability and medical expense, which covers personal and advertising injury liability as well as “bodily injury” and “property damage.”

For the five limits within the Businessowners Liability Coverage Form, the limits represent the most the coverage form will pay for the following:

Liability and Medical Expense Limit

This is the most that will be paid on any one “occurrence” for those losses covered under Business Liability and Medical Expense coverages.

Medical Expenses Limit

In addition to being subject to the “occurrence” limit discussed above, medical expenses are first subject to a per person limit that is shown in the Declarations. This will reduce the General Aggregate Limit.

Damage to Premises Rented to You

“Damage to Premises Rented to You” coverage, as we saw in the CGL has a per fire limit, however, in the Businessowners Liability Coverage Form the General Aggregate does not apply to “Damage to Premises Rented to You.”

Products / Completed Operations Aggregate Limit

This is the most that will be paid during the policy period for this type of claims. This limit applies regardless of the number of claims during the policy period.

General Aggregate Limit

This is the most that will be paid for all other injury or damage, including medical expenses, arising from all “occurrences” during the policy period. The General Aggregate limit is twice the Liability and Medical Expenses limit shown on the declarations.

LIABILITY AND MEDICAL EXPENSE CONDITIONS

Bankruptcy of the insured does not relieve the insurance company of its

obligations.

Duties in the event of occurrence offense, claim or suit requires notification &

cooperation.

Financial Responsibility Law condition states that if the Businessowners

Liability Coverage Form is certified as required evidence of motor vehicle

financial responsibility (which only would apply to mobile equipment in this

coverage form), the policy will comply with the provisions of the law to the

109



extent of the coverage and limits of insurance required by that law. The CGL

has no corresponding condition.

Legal action against us means the insured must comply with conditions prior to

starting a legal action against the insurer.

Separation of Insureds means the limits apply separately to each insured.

DEFINITIONS

“Advertisement” means a notice that is broadcast or published to the general public or specialized market about your goods products or services for the purpose of attracting customers.

“Auto” means a land motor vehicle designed for travel on public roads including any attached equipment trailer, semi-trailer or any other land vehicle subject to compulsory financial responsibility law.

“Bodily injury” means bodily injury, sickness or disease including death.

“Coverage territory” means the United States of America, its territories and possessions, Puerto Rico and Canada. Coverage is worldwide for injury or damages arising out of the insureds goods or products or, while temporarily outside the coverage territory.

“Employee” includes a leased worker but not a temporary worker.

“Hostile fire” means one which becomes uncontrollable or breaks out from where it was intended to be.

“Impaired property” is tangible property that is not your product or work, but cannot be used, or is less useful because it incorporates your product or work that is known or thought to be defective, deficient, inadequate or dangerous.

“Insured contract” - See definition from CGL (LEASE-T)

“Leased worker” means a person leased to the insured by a labor leasing firm.

“Loading or unloading” means the handling of property

“Mobile equipment” means vehicles other than “autos” not licensed for road use. These would include bulldozers, farm machinery, forklifts, vehicles on crawler treads, etc.

“Occurrence” means an accident, including continuous or repeated exposure to substantially the same general harmful conditions.

110



“Personal and advertising injury” means injury arising out of false arrest, detention, imprisonment, malicious prosecution, wrongful entry or eviction, invasion of privacy, oral or written publication that libels or slanders a person or organization, the use of another’s advertising idea in your “advertisement”, infringing upon another's copyright, trade dress or slogan in your “advertisement.” “Personal injury” does not apply to the business of advertising, publishing, broadcasting or telecasting done by or for the named insured.

“Products and completed operations hazard” means bodily injury or property damage occurring away from your premises & arising out of your product. However, the definition is broadened to include liability coverage for the consumption of the insured’s products on the insured’s premises, as would be the case with a delicatessen, fast food restaurant or other eligible business.

“Property damage” means:

a. Physical injury to tangible property, including loss of use of that property;

b. Loss of use of tangible property that is not physically injured.

Electronic data is not tangible property.

“Your product” means any goods or products manufactured, sold, handled, or disposed of by the insured.

“Your work” means work or operations performed by the insured or on the insured's behalf, and materials and parts or equipment furnished in connection with such work.

DEDUCTIBLES

The deductibles shown on the Declarations Page of the Businessowners Policy will apply to any covered loss. However, a $500 deductible applies to all of the following optional coverages, and any deductible here is not in addition to the policy deductible:

1. Money & Securities

2. Employee Dishonesty

3. Outdoor Signs

4. Forgery and alteration

No $ deductible applies to the following:

1. Fire department service charge

2. Business income or extra expense (subject to 72 hour waiting period)

3. Civil authority

4. Fire Extinguisher systems recharge expense

111



PROPERTY LOSS CONDITIONS

Abandonment

Appraisal

Duties in the Event of Loss or Damage

These are similar to those found in other property policies. They include providing timely notice, protecting the property from further damage, providing an inventory of damaged property, and sending a signed proof of loss within 60 days after the insurance company’s request. Also included is the requirement to notify the police if a law may have been broken.

Legal Action Against Us

Action cannot be taken unless the insured has complied fully with all terms of the policy and action must be brought within 2 years of the loss.

Recovered Property

Either party must give prompt notice to the other. The insured has the option to keep recovered property or retain the insurance payment already made.

Resumption of Operations

The company will reduce payments under Business Income and/or Extra Expense to the extent the insured can resume operations

Valuation

In the BOP Property Standard and Special forms, Replacement Cost is the basis of value for all covered property. In order to receive full replacement cost coverage, the insured must carry a limit of insurance equal to at least 80% of the replacement cost of the property and must actually repair or replace the damaged or lost property. The following types of property, however, are valued on an Actual Cash Value basis:

1. Used merchandise,

2. Property of others, unless insured is liable under a written contract. If liable under a written contract, valuation based upon the contract amount, subject to the lesser of the replacement cost or the Limit of Insurance.,

3. Household contents, except personal property in apartments or rooms furnished by the insured as landlord,

4. Manuscripts,

5. Fine arts (all of which are valued on an ACV basis),

6. Tenant’s Improvements & Betterments are valued at replacement cost if repairs are promptly made,

7. Valuable Papers and Records valued at the cost of blank media,

112



8. Money valued at face value, and

9. Securities valued at their value at the close of business on the day the loss is discovered.

Vacancy

If the insured’s property is vacant for a period of more than 60 consecutive days, the policy will pay nothing for losses arising from the following Causes of Loss (definitions of vacancy are the same as CPP):

1. Vandalism,

2. Sprinkler leakage, unless you have protected the system against freezing,

3. Building glass breakage,

4. Water Damage, and

5. Theft or attempted theft.

If loss results from any other covered Causes of Loss then the payment is reduced by 15%.

Loss Payment - Pennsylvania Changes

In Pennsylvania, the BOP forms are required to be modified by the Pennsylvania Changes endorsement (BP 01 42). The primary difference found in this form is that the insurance company is required to respond within 15 days after receiving the completed proof of loss from the insured. The company must advise that they accept, reject or need more time to analyze the loss. If they advise they need more time, they must respond again within 30 days. Thereafter they must advise the insured every 45 days of their progress. In addition to this requirement, the endorsement includes provisions regarding transfer of rights following death of the insured, as well as cancellation, non-renewal and increase of premium provisions as discussed earlier.

The Loss Payment Provision of the BOP is very similar to the Loss Settlement Provision of the Homeowners Policy.

PROPERTY GENERAL CONDITIONS

1. Control of Property Any act or neglect of any person, other than the insured, and not at the insureds direction or control will not affect this insurance.

2. Mortgage Holders This provision requires the insurance company to pay the mortgage holder as their interests appear. The mortgage holder can pay premiums and file proofs of loss. They are also protected & guaranteed to collect the outstanding

113



balance on a mortgage, even if the insured violates a policy condition and does not get paid.

3. No Benefit to Bailee No person or organization, other than the insured, who has custody of covered property will benefit from this insurance.

4. Policy Period Coverage Territory Losses are only covered if they take place during the policy period.

The coverage territory is the United States, its territories and possessions, Puerto Rico and Canada.

OPTIONAL COVERAGES

The BOP may be broadened by adding any or all of the following optional coverages by indicating a limit of insurance on the Declarations Page. Optional Coverages are written into the body of the BOP and activated by the entry on the Declarations Page. Coverage does not apply unless the insured has paid the appropriate additional premium. These optional coverages are:

Outdoor Signs

This optional coverage extends coverage to all outdoor signs (whether they are attached to buildings or not) at the insured premises. A limit of liability is shown on the Declarations Page. The coverage is on an open perils basis with few exclusions (only wear and tear for example) and subject to the deductible shown in the Declarations. This coverage is similar to the Commercial Inland Marine Sign Form.

Money And Securities

The Money And Securities Optional Coverage covers theft, disappearance or destruction of the insured’s money and securities while on the described premises, in transit, at a bank, or within the living quarters of the insured or an employee who has custody of the property. A limit is purchased for Inside The Premises and a separate limit is purchased for Outside The Premises. This coverage is similar to the Commercial Crime Coverage Inside the Premises – Theft of Money & Securities and Outside the Premises Coverage.

Employee Dishonesty

This optional will pay for loss of business, loss to personal property, including both money and securities caused by a dishonest employee and discovered within 1 year from policy expiration. This coverage is similar to the Commercial Crime Coverage – Employee Theft.. Typical limits would be $10,000 on premises and $5,000 off premises.

114



Equipment Breakdown

This option is a limited type of Equipment Breakdown Coverage. The coverage pays for the sudden breakdown of pressure, mechanical or electrical machinery or equipment that necessitates repair or replacement. The covered objects must be owned or in the care of the insured at the described premises. This coverage is similar to the Commercial Equipment Breakdown Coverage Form.

PROPERTY DEFINITIONS

“Computer” means programmable electronic equipment used to store and process data.

“Counterfeit money” means an imitation of money intended to deceive and to be taken as genuine.

“Electronic data” means information, facts or computer programs stored on computer software , on floppy disk , CD-ROMs, etc.

“Fungi” means any type or form of fungus including mold or mildew and any mycotoxins Spores scents or byproducts produced or released by fungi.

“Money” means currency coins banknotes travelers checks registered checks and money orders held for sale.

“Period Of Restoration” means the period of time that begins 72 hours after the time of direct physical loss or damage for Business Income loss or immediately after the time of direct physical loss or damage for extra expense coverage, caused by or resulting from a covered cause of loss at the described premises; and ends on the earlier of: the date when the property at the described premises should be repaired, replaced or rebuilt with reasonable speed and similar quality, Or the date when business is resumed at a new permanent location.

“Securities” means negotiable and nonnegotiable instruments or contracts representing either money or other property and includes tokens, tickets, and evidences of debt issued in connection with credit or charge cards.

115



BUSINESSOWNERS SECTION III – COMMON POLICY CONDITIONS

Cancellation

Cancellation conditions in a BOP are similar to those on the Commercial Property Policy. It will also include the Pennsylvania Changes - Cancellation and Nonrenewal (IL 02 46 09 00).

Changes

Changes are the same as in Common Policy Conditions for the Commercial Property Policy. Remember that only the First Named Insured is authorized to request changes to the policy with the insurance company’s consent.

Concealment, Misrepresentation or Fraud

Similar to the same condition in the Commercial Property form, the policy will be void if the named insured conceals, misrepresents a material fact regarding the coverage, the property or a claim made.

Examination of Books

Permits the insurance company to examine the insured’s records and books up to 3 years from the policy expiration date.

Inspections and Surveys

Gives the insurance company the right to inspect and survey for underwriting purposes but not the obligation to inspect.

Insurance Under Two or More Coverages

If two or more coverages apply in the BOP, only the actual amount of the loss will be paid.

Liberalization

Under this BOP condition, a revision in the BOP which broadens coverage (without an additional premium) within 45 days prior to the inception date or during the policy period will apply immediately to the BOP which is in effect.

Other Insurance

The BOP is excess over any other insurance.

Premiums

The Premiums Condition states the First Named Insured is responsible for payment of premium, and may receive any appropriate refund (such as a refund after policy cancellation). This condition states that the insurance company is entitled to an additional premium if a change in the insured’s operations and exposures occurs during the policy period.

116



Premium Audit

When the BOP Declarations shows a premium as an “advance premium” it means that the premium shown is subject to a final audit by the insurance company. After policy expiration the company will review the insured’s financial records and recalculate the annual premium based upon the insured’s records.

Transfer of Rights of Recovery Against Others to Us (Subrogation)

With regard to a property loss, the insured may waive the right of recovery to anyone in writing prior to a loss and even after a loss to an insured, a parent or subsidiary company or a tenant. With regard to a liability loss, the insured may waive rights in writing prior to a loss, but may not waive rights to anyone after a loss.

Transfer of Your Rights and Duties Under This Policy (Assignment)

This provision in the BOP Common Policy Conditions is modified in Pennsylvania by the endorsement Pennsylvania Changes (BP 01 42). Under the modified condition, the insured’s rights and duties may not be transferred without the insurer’s written consent except in the case of death of an individual named insured. If the insured dies during the BOP policy period, the company will insure the legal representative of the insured for a period of 180 days or until end of policy whichever is longer (unless the property is sold).

SELECTED ENDORSEMENTS

Although there are many endorsements available in the Businessowners program, the number is small in comparison with the Commercial General Liability Coverage Form. Many of the Businessowners endorsements correspond with the CGL endorsements. There is one endorsement that does not correspond, and which is commonly added to a Businessowners Policy.

HIRED AND NON-OWNED AUTO LIABILITY - BP 04 04

This endorsement provides liability coverage for Business Auto exposures. Hired Autos mean any auto hired, rented, leased or borrowed by the business. An example of a hired auto is a car rented by an employer on company business.

“Non-owned” auto means an auto not owned, leased, or borrowed by the named insured that is used in connection with the named insured’s business.

117



Examples would be:

1. An employee using their personal car to go pick up the mail or office supplies

on behalf of the named insured’s business, or

2. The insured rents a truck to haul some business property.

This endorsement is used for an insured entity that does not own any auto, and does not have a Commercial Auto Policy. For example, the insured may be an owner of a retail store that provides no delivery, or the owner or business entity may have no reason to own an auto for business purposes.

Unless the named insured has only incidental auto exposures, then it is preferable to provide coverage for commercial auto exposure through the use of commercial auto forms.

PROTECTIVE SAFEGUARDS (BP 04 30) This endorsement applies only to the peril of fire.

The objective of this endorsement is to identify protective devices the insured has on his or her insured property, and to assure that the insured who has received a premium discount for protective devices does in fact maintain the devices. An insured who does not notify the insurer that the device (or devices) is not in working order is subject to coverage suspension. If the system is shut off due to breakage, leakage, freezing or opening of sprinkler heads, the insured has 48 hours to restore the system before they must notify the insurer.

UTILITY SERVICES – DIRECT DAMAGE (BP 04 56)

This endorsement is designed to pay for loss to the insured’s property resulting from an interruption of utility services listed in the Schedule of this endorsement. The three main categories of utility services are:

• Water supply services

• Communication supply services (including telephone, radio, microwave or television).

• Power supply services (property supplying electricity, steam or gas)

The interruption of utility services must arise from direct damage to the utility company from a covered cause of loss. For example, a fire would be a covered cause of loss, but an equipment malfunction would not.

The endorsement only applies to direct physical loss to covered property.

118



UTILITY SERVICES – TIME ELEMENT (BP 04 57)

This time element endorsement will provide coverage for a loss of income or extra expenses arising from a loss of the utility services that is shown on the schedule of this endorsement. The loss to the property of utility service must arise from a Covered Cause of Loss, such as a fire at a switching station.

In the case of both of these utility services endorsements, the coverage is very similar to endorsements by the same name in the Commercial Property endorsements.

119



QUIZ

1. Which one of the following businesses is not eligible for a Businessowners Policy?

a. Clock Shop

b. Manufacturer

c. Funeral Home

d. Accountant’s Office

2. Which of the following buildings is eligible for the Businessowners Policy under the property category of buildings?

a. Eight-story office building.

b. Four story apartment building that contains 50 units.

c. Single-story building that contains 15,000 square feet and is owned and occupied by a bank.

d. Single-story office building and equipment building of 10,000 square feet used by a manufacturer.

3. Which of the following reasons is a permitted reason for the insurer to cancel the BOP as provided in the Pennsylvania Changes after the policy has been in effect for 60 days?

a. The risk has significantly changed

b. Non-payment of premium

c. A material failure of the insured to comply with policy provisions

d. All of the above are valid reasons

4. Which of the following items is included in the meaning of building under the BOP?

a. Permanently installed machinery and equipment

b. Stock

c. Warehouse located away from described location


5. BOP personal property coverage includes all the following items EXCEPT:

a. Furniture

b. Machinery and equipment (not permanently installed)

c. Personal property in apartments or rooms furnished by the insured as landlord

d. Stock

120



6. The BOP lists which one of the following as “property not covered?”

a. Bridges and walkways

b. Animals owned by the insured for sale

c. Outdoor fences, except as provided in the Outdoor Property Coverage Extension

d. Stock

7. Which of the following is a true statement about Debris Removal Coverage in the BOP?

a. Debris removal is only covered when the loss results from fire and extended coverage perils.

b. If a total loss is paid on the building and/or personal property and there is still debris to be removed, the policy will provide an additional $25,000 of coverage.

c. This provision pays for pollution cleanup from land or water.

d. The debris removal coverage is 25% of the amount paid for damage to covered property and is additional insurance.

8. If the insured’s building has been vacant for more than 60 days and sustains a $10,000 vandalism loss, disregarding any deductible, the BOP provides which of the following as the amount of loss to be paid?

a. $8,500

b. $10,000

c. $5,000

d. There is no coverage

9. The Amron Company has a building with replacement value of $100,000. The building is covered under the BOP for a limit of $60,000. Amron suffers a $40,000 replacement cost fire loss to the building and the loss is calculated at $28,000 on an actual cash basis. What will this form pay for the described loss situation? Disregard any deductible.

a. $40,000

b. $30,000

c. $32,000

d. $10,000

121



10. The replacement cost option in the BOP may not be applied to:

a. Stock owned by the insured.

b. Business personal property of others in the insured’s care, custody or control if insured is not contractually liable.

c. Business personal property owned by the insured.

d. Buildings.

11. An insurance agency is more likely to need which of the following Time Element coverages?

a. Business Income

b. Extra Expense

c. Homeowners Policy with the Permitted Incidental Occupancy Endorsement

d. Valuable Papers and Records Coverage

12. In the BOP, the term “Business Income” can best be described by which statement?

a. “Business Income” includes net income (net profit or loss before income tax) that would be earned.

b. “Business Income” includes continuing normal operations expenses.

c. “Business Income” includes income (profit) that would be earned.

d. “Business Income” includes net income that would be earned and continuing normal operating expenses.

13. David makes an error in entry into the company’s books causing a loss related to accounts receivable of $2,000. His company has a BOP with a limit of $100,000 on the Building and $50,000 on Business Personal Property. How much will the BOP pay for this loss?

a. $0, the BOP does not include accounts receivable coverage.

b. $0, the BOP excludes bookkeeping, accounting or billing errors.

c. $2,000.

d. $2,000 less the standard $500 deductible.

122



14. The Silva Floral Company has a large sign worth $1,500 located twenty feet from its building. Silva has purchased a BOP. What would they need to do to provide coverage related to this sign?

a. Nothing, since the BOP provides automatic sign coverage.

b. Add the BOP Sign endorsement.

c. Select the Outdoor Sign Optional Coverage with appropriate limits since the BOP only gives limited coverage for outdoor signs.

d. Purchase another form of property insurance since there is no method of providing coverage under a BOP for signs.

15. Julie owns a retail store, Julie’s Cool Junk, which is insured under a BOP and is endorsed with the Utility Services – Direct Damage (BP 04 56) with Power supply services selected. Thunderstorms cause the river to rise and flooding of the local power company. Which of the following losses would be covered?

a. Damage to power station

b. Damage to Julia’s perishable foods

c. Loss of income from closing the shop

d. None of the above since the loss arose from a noncovered cause of loss

16. The Businessowners Form is very similar to the CGL in many ways. In the Businessowners Common Policy Conditions, one difference in the BOP from the CGL is found in the Other Insurance Provision. Which statement correctly expresses the difference?

a. The BOP is excess over any other applicable coverage, whereas the CGL is primary with a few stated exceptions.

b. The BOP is primary, whereas the CGL is excess over any other applicable coverage with a few stated exceptions.

c. The BOP is excess over any other applicable coverage, whereas the CGL is always primary.

d. The BOP is excess, whereas the CGL does not permit other insurance.

17. The Businessowners Liability Coverage is composed of the following format:

a. Coverage A – Bodily Injury and Property Damage and Coverage B – Personal and Advertising Injury.

b. Coverage A – Bodily Injury and Property Damage, Coverage B – Personal and Advertising Injury and Coverage C – Medical Payments.

c. Business Liability and Medical Expenses.

d. Business Liability and Personal and Advertising Injury.

123



18. Which statement best describes the exclusions in the Businessowners Form?

a. All the exclusions in the Businessowners Liability are the same as those found in the CGL.

b. All the exclusions in the Businessowners Liability contain the same contents as those found in the CGL, except the Personal and Advertising Injury.

c. All the exclusions in the Businessowners Liability contain the same contents as those found in the CGL, except the Businessowners does not contain a professional services exclusion.

d. All the exclusions in the Businessowners Liability contain the same contents as those found in the CGL, except the Businessowners does contain a professional services exclusion.

19. Medical Expenses will pay medical expenses for bodily injury caused by an accident on premises the named insured owns or rents or because of the named insured’s operations. Which of these statements is not correct?

a. The expenses must be incurred within three years from the date of the accident.

b. The purposes of this coverage are goodwill and the reduction of lawsuits.

c. This coverage does not pay expenses for “bodily injury” to an insured.

d. This coverage does not pay expenses for “bodily injury” to any person hired to do work for an insured or a tenant of an insured.

20. The “Who is an Insured” section in the Businessowners Liability Coverage is very important. Which statement best describes coverage for newly acquired or newly formed organizations?

a. The Businessowners Liability Coverage Form is the same as the CGL.

b. The Businessowners Liability Coverage Form provides automatic coverage for 180 days.

c. The Businessowners Liability Coverage Form does not provide automatic coverage for newly acquired or newly formed organizations.

d. The Businessowners Liability Coverage From provides automatic coverage not only to newly acquired or newly formed corporations, but also partnerships.

124



21. Which of the following statements is not correct with respect to the Limits of Businessowners Liability?

a. There are six limits under the Businessowners Liability Coverage Form.

b. There is no separate limit for Personal and Advertising Injury Liability.

c. The General Aggregate does not apply to Fire Legal Liability as it does in the CGL.

d. Medical expenses are subject to a per person limit and any payment will reduce the General Aggregate Limit.

22. The Hired Auto and Nonowned Auto Liability (BP 04 04) endorsement is frequently attached to a BOP. To which of the following types of autos may this coverage be extended?

a. “Hired autos” (any auto leased, hired or borrowed by the insured) only.

b. “Nonowned auto” only.

c. Both “hired autos” and “nonowned auto.”


Answers 1b, 2b, 3d, 4a, 5c, 6c, 7b, 8d, 9b, 10b, 11b, 12d, 13b, 14c, 15d, 16a, 17c, 18d, 19a, 20c, 21a, 22c

Chapter 8 Answers

1b, 2b, 3d, 4a, 5c, 6c, 7b, 8d, 9b, 10b, 11b, 12d, 13b, 14c, 15d, 16a, 17c, 18d, 19a, 20c,

21a, 22c

125

126

Chapter One

Appendices

Appendix A: Property and Casualty Insurance Companies and Producers Issuing Certificates of Insurance in Pennsylvania; Notice No. 2009-02 ............................... 129

Appendix B: Kvaerner Metals v. Commercial Union Ins. ............................................................. 131

Appendix C: Millers Cap. Ins. Co. v. Gambone Bros. Dev. ......................................................... 141

Appendix D: Idalex Inc. v. Nat'l Union Fire Ins. Co. of Pittsburgh ................................................ 151

127

128

NOTICESProperty and Casualty Insurance Companies and Producers Issuing Certificates of

Insurance in Pennsylvania; Notice No. 2009-02

[39 Pa.B. 918][Saturday, February 14, 2009]

''Certificates of Insurance'' regarding Property and Casualty coverage are typically used to provide proofof liability insurance to and summarize the terms of a policy for a third party in lieu of providing the thirdparty with a complete copy of the policy. This notice clarifies the acceptable use of certificates ofinsurance with respect to Property and Casualty insurance policies in Pennsylvania.

Certificates of insurance that clearly and accurately state the insurance coverage provided to an insuredor third party are not forms subject to filing with the Insurance Department (Department) because thesecertificates do not in any context amend, extend or alter coverage of the insurance policy. They simplysummarize the coverages provided by that policy.

Where an insurer or insurance producer uses a certificate of insurance or other evidence of coverage thatgoes beyond or does not accurately summarize the policy, the insurer or producer may be misrepresentingthe policy language, terms, conditions or coverage limits as issued by the insurer. Similarly, languageincluded in a certificate that amends or extends coverage of the underlying policy or states that coverage isactually in force when it is not constitutes a misrepresentation of the coverage provided by the policy; assuch, any insurer or producer issuing such a certificate would be in violation of Pennsylvania insurancestatues and regulations. Additionally, when a certificate of insurance is used in such a manner that itattempts to modify the terms and conditions of coverage this may subject the certificate to the filingrequirements of 31 Pa. Code Chapter 89b (relating to approval for life insurance, accident and healthinsurance and property and casualty insurance filing and form). Violations of Pennsylvania statutes andregulations may be subject the person issuing or providing the certificate to administrative penaltiesincluding possible license suspension or revocation and civil monetary penalty.

Questions regarding this notice may be directed to Jack Yanosky, Director of Licensing andEnforcement for the Department at (717) 783-2627.

JOEL SCOTT ARIO,Insurance Commissioner

[Pa.B. Doc. No. 09-281. Filed for public inspection February 13, 2009, 9:00 a.m.]

No part of the information on this site may be reproduced for profit or sold for profit.

This material has been drawn directly from the official Pennsylvania Bulletin full text database. Due to thelimitations of HTML or differences in display capabilities of different browsers, this version may differslightly from the official printed version.

Appendix A: Property and Casualty Insurance Companies and Producers Issuing Certificates of Insurance in Pennsylvania; Notice No. 2009-02

129

130

908 A.2d 888 (2006)

KVAERNER METALS DIVISION OF KVAERNER U.S., INC. f/k/a Kvaerner Davy Divisionof Kvaerner U.S. Inc. f/k/a Davy International, A Division of Trafalgar House, Inc. and

Kvaerner Songer, Inc., f/k/a Kvaerner Davy Songer, Inc. f/k/a Davy Songer, Inc.,Together A Joint Venture; Kvaerner Metals Division of Kvaerner U.S., Inc. f/k/a

Kvaerner Davy Division of Kvaerner U.S. Inc f/k/a Davy International, A Division ofTrafalgar House, Inc., Kvaerner Songer, Inc., f/k/a Kvaerner Davy Songer, Inc. f/k/aDavy Songer, Inc.; Kvaerner Public Liability Company f/k/a Trafalgar House Public

Liability Company; and Kvaerner ASAv.

COMMERCIAL UNION INSURANCE COMPANY, Lexington Insurance Company,National Union Fire Insurance Company of Pittsburgh, PA, Bethlehem Steel

Corporation, Thyssen Still Otto Anlagentechnick GMBH, Successor-in-interest to StillOtto, GMBH.

Appeal of National Union Fire Insurance Company Of Pittsburgh, PA.

Nos. 47 & 48 MAP 2004.

Argued October 19, 2004.Decided October 25, 2006.

Supreme Court of Pennsylvania.

*890 Michael J. Cawley, Deborah Malamut Minkoff, Gaele M. Barthold, Philadelphia, Jay M. Levin, Paoli,Leanne Alsen Waldie, for Nat. Union Fire Ins. Co. of Pittsburgh, PA, appellant.

890

Michael Scott Olsan, Philadelphia, for Complex Ins. Claims Litigation Ass'n, appellant amicus curiae.

Joseph Leonard Luciana, III, Kenneth John Lund; Robert L. Byer, Philadelphia; John R. Dingess; PhilipMarsh Hof, Eason, for Kvaerner Metals Div. of Kvaerner et al., appellees.

John Norig Ellison, Philadelphia, for United Policyholders, appellee amicus curiae.

James G. McLean, Pittsburgh, for Mechanical Contractors Ass'n of Western PA, Inc., appellee amicuscuriae.

Before: CAPPY, C.J., CASTILLE, NIGRO, NEWMAN, SAYLOR, EAKIN and BAER, JJ.

OPINION

Chief Justice CAPPY.

In this insurance coverage dispute, Appellant National Union Fire Insurance Company of Pittsburgh,Pennsylvania ("National Union") appeals from the Superior Court's April 16, 2003 order, which reversedthe trial court's order granting National Union's motion for summary judgment and remanded the case foradditional proceedings to determine whether National Union was responsible for defending andindemnifying Appellee Kvaerner Metals Division of U.S., Inc., and other related companies (collectively,"Kvaerner") in an action brought by Bethlehem Steel Corporation ("Bethlehem"). Because we find thatNational Union has no duty under its policies to defend or indemnify *891 Kvaerner in this case, the orderof the Superior Court is reversed.

891

Appendix B: Kvaerner Metals v. Commercial Union Ins.

131

In June 1997, Bethlehem brought an action against Kvaerner asserting claims of breach of contract andbreach of warranty. In its complaint, Bethlehem alleged that it entered into a contract with Kvaerner (the"Contract") pursuant to which Kvaerner agreed to design and construct a coke oven battery (the "Battery")for Bethlehem. According to Bethlehem, under the contract Kvaerner (1) agreed to build the Batteryaccording to certain "plans and specifications that were made a part of the [Contract]," (2) warranted thatits materials, equipment, and work would be free from defect, and (3) agreed to repair or replace anydefective work or materials.

Bethlehem then contended that based on these facts, Kvaerner breached the above Contract termsbecause the Battery built by Kvaerner was "damaged" and "did not meet the contract specifications andwarranties, or the applicable industry standards for construction ..." Bethlehem further alleged that althoughit sent Kvaerner a "non-performance list" detailing the Battery's "damages and breaches," Kvaerner hadfailed to remedy the Battery's problems. Moreover, Bethlehem incorporated by reference the "damages andbreaches" listed in the non-performance list, which enumerated numerous problems with the Battery,including the following:

(1) "100% of the ovens have cracked paver bricks"; (2) "[s]hifting brickwork has causedmaximum deviation of centerlines of flue inspection ports"; (3) "[t]he larry car rails areintroducing eccentric loads on the oven walls"; (4) "[d]ue to displacement of oven top brickand appurtenances (e.g. larry car rail chairs) the chairs are not directly above the centerlineof the heating walls"; (5) "[t]he non-uniform shifting of brickwork in the oven roof resulted ina tilted configuration of the flue inspection ports"; (6) "[s]heared/open joints are present inthe horizontal plane of roof brick and there are open joints in the vertical plane of roof brick,"causing the migration of gas; (7) "[s]ections of seven lintel blocks [have subsided] and theouter blocks of two ovens are completely broken or shattered"; (8) the centerlines of theBattery's ovens are displaced, causing multiple door jams; (9) there are sheared/open jointsbetween the silica and fireclay in the Battery; (10) the oven walls are not plumb and aredistorted, causing them to experience compressive stress orders of a magnitude greaterthan design; (11) the oven walls are spalling; (12) certain braces deviate from the Contractdesign specifications; (13) the spring adjustments are inadequate; (14) the tie rod housingsare bowed; (15) the buckstays do not comply with the erection tolerances; and (16) water ispenetrating the coke side bench.

Bethlehem's Non-Performance List, attached to May 15, 1997 Letter of Final Notification of ContractNon-Performance ("Non-Performance List"), Exh. 3 to Kvaerner's Motion for Reconsideration, at 1-14(incorporated by reference in Bethlehem Complaint, Exh. A to Kvaerner Complaint, at 8-9). As a result ofthese damages to the Battery, Bethlehem asserted that Kvaerner was liable to it for either "the amountthat it will cost to replace the Coke Oven Battery, or the difference in value between the defective CokeOven Battery that it received and the Coke Oven Battery that [Kvaerner] warranted that it would deliver."Id. at 10.

After being served with Bethlehem's complaint, Kvaerner notified its insurer, National Union, of the suit,seeking defense and indemnity pursuant to two *892 commercial general liability ("CGL") policies(collectively, the "Policies"). The first policy was a "claims made" policy for the period of September 30,1995 to September 30, 1996 (the "1996 Policy") whereas the second policy was an "occurrence" policy forthe period of April 1, 1997 to December 31, 1997 (the "1997 Policy").[1] National Union subsequentlynotified Kvaerner that it was disclaiming "coverage, defense, and indemnity for all allegations contained in[the] complaint" based on its conclusion that Bethlehem's claims did not fall within the coverage provisionsof the Policies. August 29, 1997 Letter from AIG Claim Services, Inc. to National Union, Exh. H of Index ofExhibits in Support of National Union's Motion for Summary Judgment, at 6.

892

Due to National Union's refusal to provide coverage, Kvaerner commenced the instant action in the Courtof Common Pleas of Northampton County against National Union, seeking, inter alia, a declaratoryjudgment that National Union has a duty to defend and indemnify it pursuant to the Policies. National

132

Union responded by filing an answer and a new matter, raising numerous affirmative defenses.[2] Theparties engaged in discovery and in September 2000 National Union filed a motion for summary judgment,arguing that judgment must be entered in its favor because (1) the Policies only permitted coverage forallegations of "property damage" caused by an "occurrence," which was defined by the Policies as anaccident, and Bethlehem had not alleged that the Battery was damaged by such an occurrence, and (2)even if Bethlehem alleged property damage caused by an occurrence, such damages were excluded undervarious "business risk/work product" exclusions in the Policies.

Kvaerner filed a brief in opposition to National Union's motion for summary judgment as well as a cross-motion for summary judgment, asserting that National Union was responsible for defending andindemnifying it under the Policies because the Battery's damages were caused by an occurrence, which itdeemed to be an unintended and unexpected event. According to Kvaerner, the Battery was damagedbecause of "longitudinal movement of the roof," which was caused because the bricks in the Battery's roofwere "grouted" *893 too early and because of heavy rains that occurred on October 31, 1994. Kvaerner'sBf. in Opposition to National Union's Motion for Summary Judgment, at 6, 24. In support of this claim,Kvaerner submitted a report from two experts in which they collectively opined that the damages to theBattery were caused from displacement and movement of the Battery's roof, which occurred becauseKvaerner grouted the bricks earlier than had been scheduled. See Expert Report of Mr. Chuck Beechanand Dr. Clayton Liu, Exh. 8 to Appendix to Kvaerner's Responses in Opposition to the Motions forSummary Judgment of Commercial Union and National Union and in Support of its Cross-Motion forSummary Judgment. The experts further opined, however, that "the heavy `monsoon-type' rain whichoccurred on October 31 could have damaged the joints in the roof." Id. at 3. Kvaerner then explained thatbecause it did not intend or expect the early grouting of the Battery's bricks or the October 31 rains tocause the movement in the Battery's roof and thereby damage the Battery, the Battery's damages werecaused by an "accident" for purposes of the Policies. See Kvaerner's Bf. in Opposition to NationalUnion's Motion for Summary Judgment, at 23-24.

893

Kvaerner further asserted that the Policies included "Completed Operations Coverage," which, accordingto Kvaerner, meant that National Union would provide coverage for damages to Kvaerner's completedwork product in certain circumstances, such as where the damages were the result of improper workperformed by its subcontractor, Thyssen Still Otto Anlagentecnick ("Thyssen"). According to Kvaerner, itwas entitled to coverage under the above provisions because the damages to the Battery occurred after itwas completed by Kvaerner and were the result of Thyssen's decision to permit Kvaerner to grout thebricks on the Battery's roof earlier than scheduled. Finally, Kvaerner claimed that National Union was notentitled to summary judgment based on the exclusions relied upon by National Union because they wereinapplicable.

On February 9, 2001, the trial court entered an opinion and order granting National Union's motion forsummary judgment and denying Kvaerner's cross-motion.[3] The trial court initially reviewed the Policiesand agreed with National Union that it was only required to provide coverage for property damage causedby an occurrence or accident. The trial court then found, relying largely on the Superior Court's en bancdecision in Redevelopment Auth. of Cambria County v. International Ins. Co., 454 Pa.Super. 374, 685A.2d 581 (1996), that because the Policies were only meant to cover "accidental" damages National Unionwas not required to defend or indemnify an insured for breach of contract claims, presumably becausedamages resulting from a party's breach of contract could never be classified as "accidental."[4] *894 Withthat premise in mind, the trial court examined Bethlehem's complaint to determine whether it was coveredby the Policies.

894

After finding that Bethlehem was solely seeking damages for Kvaerner's breach of the Contract, ratherthan damages caused by an accident, the trial court concluded that Bethlehem's Complaint did not triggercoverage under the Policies. See Kvaerner Metals Division of Kvaerner U.S., Inc., et al. v. CommercialUnion Ins. Co., et al., Pa. C. Northampton, No. 1998-C-9531, at 11 (Feb. 9, 2001) ("The designspecifications are duties imposed on Insured, not by public policy, but by the Contract; therefore,

133

[Bethlehem's] allegations lie in breach of contract."). In spite of this conclusion, the trial court went on toconsider Kvaerner's claim that it was entitled to coverage under the "Completed Operations Coverage"provisions in the Policies. While the trial court agreed with Kvaerner that these provisions providedcoverage for property damage to an insured's completed work product when such damage was caused bythe insured's subcontractor, it found that these provisions did not "obviate the [Policies'] requirement... thatthe property damage [be caused by an accident]." Id. at 14. Thus, as it had already found that Bethlehemwas not seeking accidental damages, the trial court concluded that National Union did not have to defendor indemnify Kvaerner pursuant to the "Completed Operations Coverage" provisions.[5]

Kvaerner appealed to the Superior Court, which entered an opinion and order on April 16, 2003, reversingthe trial court's order and remanding the case back to that court for further proceedings. See KvaernerMetals Division of Kvaerner U.S., Inc., et al. v. Commercial Union Ins. Co., et al., 825 A.2d 641(Pa.Super.2003). The Superior Court first found that it was unable to agree with the trial court's conclusionthat National Union did not have a duty to defend or indemnify Kvaerner because Bethlehem had notalleged that the Battery's damages were caused by an accident. While the Superior Court acknowledgedthat case law from this Court indicated that an insurer's duty to defend and indemnify was dependant on"whether the third-party's complaint triggers coverage," Kvaerner, 825 A.2d at 650 (emphasis in original)(quoting Mutual Benefit Ins. Co. v. Haver, 555 Pa. 534, 725 A.2d 743, 745 (1999)), the court found that itcould look outside of Bethlehem's Complaint in the instant case because there was "no requirement in the[Policies] that a civil complaint be filed to trigger coverage...." Id. at 652 (emphasis in original). Therefore,looking beyond the allegations in Bethlehem's Complaint to the expert report submitted by Kvaerner withits cross-motion for summary judgment, see, supra p. ____, 908 A.2d at pp. 892-93, the Superior Courtobserved that the Battery's damages may have been caused by various events, including the "torrentialrains" on October 31, which would have clearly constituted an occurrence under the Policy. Kvaerner, 825A.2d at 654. In light of this uncertainty, the Superior Court found that there was a genuine issue of materialfact regarding the causes of the Battery's damages and therefore concluded that "summary judgment wasimproperly entered against Kvaerner on the basis that there had been no òccurrence' as required by theterms of the policy." Id. at 654-55.

*895 The Superior Court next considered whether National Union was entitled to summary judgmentbased on the Policies' "business risk/work product" exclusions, which National Union also relied upon in itssummary judgment motion. The Superior Court found that these exclusions may have precluded coveragefor the Bethlehem lawsuit if an endorsement had not been added to the 1997 Policy, changing the effect ofthe exclusions. The court explained that while the "business risk/ work product exclusions" generally barredcoverage for damages caused by work performed by the insured or the insured's subcontractor,endorsement 16, which was added to the 1997 Policy in March 1997, altered the exclusions by permittingcoverage for property damage caused by the insured's subcontractor. Given this endorsement, theSuperior Court found that it could not conclude as a matter of law that the "business risk/work product"exclusions precluded coverage in the instant case until findings of fact were made regarding the amount ofwork performed by Kvaerner's subcontractors and whether any of that work caused the Battery'sdamages. Thus, the Superior Court remanded the case to the trial court to make the necessary findings offact to determine whether any of the Battery's damages were covered because they were caused by thework of Kvaerner's subcontractors.

895

National Union subsequently filed a petition for allowance of appeal with this Court and we grantedallocatur to consider whether the Superior Court erred by, inter alia, (1) looking beyond Bethlehem'sComplaint to find that National Union may have a duty to defend Kvaerner, (2) finding that the Batterymay have been damaged by an "occurrence," and (3) finding that the "business risk/work product"exclusions did not exclude coverage for Bethlehem's claims.[6] We now conclude that the Superior Courtdid in fact err in looking beyond the allegations raised in Bethlehem's complaint to determine whetherNational Union had a duty to defend Kvaerner and in finding that the Battery's damages may have beenthe result of an "occurrence."

134

In analyzing the order of the trial court that granted summary judgment to National Union, our scope ofreview is plenary. Mountain Village v. Board of Supervisors, 582 Pa. 605, 874 A.2d 1, 5 (2005). Thestandard of review is clear; we will reverse the order of the trial court only when the court committed anerror of law or abused its discretion. Mountain Village, 874 A.2d at 5. Summary judgment is appropriateonly when the record clearly shows that there is no genuine issue of material fact and that the moving partyis entitled to judgment as a matter of law. Id. The reviewing court must view the record in the light mostfavorable to the *896 nonmoving party and resolve all doubts as to the existence of a genuine issue ofmaterial fact against the moving party. Id. at 5-6. Only when the facts are so clear that reasonable mindscould not differ can a trial court properly enter summary judgment. Id. at 6.

896

It is well established that an insurer's duties under an insurance policy are triggered by the language of thecomplaint against the insured.[7] In Mutual Benefit Insurance Co. v. Haver, 555 Pa. 534, 725 A.2d 743, 745(1999), we stated;

A carrier's duty to defend and indemnify an insured in a suit brought by a third partydepends upon a determination of whether the third party's complaint triggers coverage.

Id., citing General Accident Insurance Co. v. Allen, 547 Pa. 693, 692 A.2d 1089, 1095 (1997). Thisprinciple has been long held in this Commonwealth as well as in other jurisdictions. In Wilson v. MarylandCasualty Co., 377 Pa. 588, 105 A.2d 304, 307 (1954), we explained:

[T]he rule everywhere is that the obligation of a casualty insurance company to defend anaction brought against the insured is to be determined solely by the allegations of thecomplaint in the action...

Id. (Emphasis supplied).

In this case, the Superior Court looked to information not contained in the underlying complaint in itsdetermination that coverage might exist under the National Union policies. It claimed that it could do sobecause the Policies do not require that a Complaint be filed in order to trigger coverage. The SuperiorCourt premised its coverage determination on reports submitted by two experts on behalf of Kvaernerstating that torrential rains may have caused the damages complained of by Bethlehem. The court held thatthese reports create uncertainty as to the cause of the damage and perhaps set forth an "occurrence" asrequired by the policies to trigger coverage, thus making summary judgment improper.

The Superior Court erred in looking beyond the allegations raised in Bethlehem's Complaint to determinewhether National Union had a duty to defend Kvaerner and in finding that the Battery's damages mayhave been the result of an "occurrence." In doing so, it departed from the well-established precedent of thisCourt requiring that an insurer's duty to defend and indemnify be determined solely from the language ofthe complaint against the insured. Haver, 725 A.2d at 745; Allen, 692 A.2d at 1095; Wilson, 105 A.2d at307. We find no reason to expand upon the well-reasoned and long-standing rule that an insurer's duty todefend is triggered, if at all, by the factual averments contained in the complaint itself.

Thus, we hold that the Superior Court's approach in looking beyond the Bethlehem complaint was in error.Instead, we will look to the language of the policies themselves *897 to determine in which instances theywill provide coverage, and then examine Bethlehem's complaint to determine whether the allegations setforth therein constitute the type of instances that will trigger coverage.

897

The interpretation of an insurance policy is a question of law that we will review de novo. See 401 FourthStreet v. Investors Insurance Co., 583 Pa. 445, 879 A.2d 166, 170 (2005). Our primary goal in interpretinga policy, as with interpreting any contract, is to ascertain the parties' intentions as manifested by thepolicy's terms. 401 Fourth Street, 879 A.2d at 170. "When the language of the policy is clear andunambiguous, [we must] give effect to that language." Id. Alternatively, when a provision in the policy isambiguous, "the policy is to be construed in favor of the insured to further the contract's prime purpose ofindemnification and against the insurer, as the insurer drafts the policy, and controls coverage." Id. With

135

these principles in mind, we shall review the terms of the Policies to determine when they required NationalUnion to defend Kvaerner.

The pertinent portions of the National Union CGL policies under which Kvaerner claims coverage state;

COVERAGE A. BODILY INJURY AND PROPERTY DAMAGE LIABILITY

1. Insuring Agreement

a. We will pay those sums that the insured becomes legally obligated to pay as damagesbecause of "bodily injury" or "property damage" to which this insurance applies. We willhave the right and duty to defend any "suit" seeking those damages....

. . . .

b. This insurance applies to "bodily injury" or "property damage" only if:

(1) The "bodily injury" or "property damage" is caused by an "occurrence" that takes place inthe "coverage territory;"

1996 Policy, National Union's Bf., at E2; 1997 Policy, id. at F2 (emphasis added). The Policies defined"property damage" as "[p]hysical injury to tangible property, including all resulting loss of use of thatproperty." 1996 Policy, id. at E9-E10; 1997 Policy, id. at F9. An "occurrence" was defined as "an accident,including continuous or repeated exposure to substantially the same or general harmful conditions." 1996Policy, id. at E9; 1997 Policy, id. at F8. The Policies also defined a "suit" as "a civil proceeding in whichdamages because of `bodily injury', `property damage,' `personal injury,' or àdvertising injury' to which thisinsurance applies are alleged." 1996 Policy, id. at E10; 1997 Policy, id. at F9 (emphasis added).

Thus, National Union contracted to defend Kvaerner only when a "suit" or "proceeding" was broughtagainst Kvaerner seeking or alleging damages for inter alia, property damage which is a result of an"occurrence." An "occurrence," in turn, is an accident. It is necessary, then, to examine whether the damagethat is the impetus of this suit was caused by an accident, so as to constitute an occurrence under thepolicy. We must, then, examine what constitutes an accident under the policy.

The National Union CGL policies do not provide a definition for "accident." Words of common usage in aninsurance policy are construed according to their natural, plain, and ordinary sense. Madison ConstructionCo. v. Harleysville Mutual Insurance Co., 557 Pa. 595, 735 A.2d 100, 108 (1999). We may consult thedictionary definition of a word to determine its ordinary usage. Id. Webster's II New College Dictionary 6(2001) defines *898 "accident" as "[a]n unexpected and undesirable event," or "something that occursunexpectedly or unintentionally." The key term in the ordinary definition of "accident" is "unexpected." Thisimplies a degree of fortuity that is not present in a claim for faulty workmanship.

898

Other courts have reached similar conclusions in the construction of the word àccident' for purposes ofinsurance coverage. In Snyder Heating v. Pennsylvania Manufacturers' Association Insurance Co., 715A.2d 483 (Pa.Super.1998), the insured sought a declaratory judgment that insurer's CGL policy coveredalleged liability for a breach of its agreement to maintain burners and boilers at a school's physical plant.The relevant language of the policy was the same as that in this case. Snyder, 715 A.2d at 485-86. Theschool allegedly suffered damage to its boilers due to insured's failure to maintain them properly.[8] Thecourt held that there was no coverage under the language of the CGL policy because the complaint setforth solely claims for breach of contract. Id. at 487. The court explained, "[p]rovisions of a general liabilitypolicy provide coverage ... if the insured work or product actively malfunctions, causing injury to anindividual or damage to another's property." Id. (Emphasis original). Contractual claims of poorworkmanship did not constitute the active malfunction needed to establish coverage under the policy.

In McAllister v. Peerless Ins. Co., 124 N.H. 676, 474 A.2d 1033 (1984), the New Hampshire SupremeCourt held that claims for poor workmanship were not covered by the insured landscaper's CGL policy. It

136

stated, "[t]he fortuity implied by reference to accident or exposure is not what is commonly meant by afailure of workmanship." McAllister, 474 A.2d at 1036. emphasis added. Thus, the Court found thatbecause the only damage alleged was caused by faulty workmanship to the work product itself, there wasnot an "accident" as required to trigger coverage. Id. at 1035.

The recent decision of the Supreme Court of South Carolina, L-J, Inc. v. Bituminous Fire and Marine Ins.Co., 366 S.C. 117, 621 S.E.2d 33 (2005), is instructive in our analysis. L-J Inc. contracted to build roads fora real estate developer. Within four years of completion the roads had deteriorated and the developerbrought an action against L-J Inc. asserting breach of contract, breach of warranty, and negligence. L-J Inc.brought a declaratory judgment action against Bituminous, seeking coverage under its CGL policy. The trialcourt and intermediate appellate court found that coverage existed under the policy.

On appeal, the Supreme Court of South Carolina reversed. It held that the deterioration of the road couldnot constitute an "occurrence" under the terms of the policy. The Court explained that all of the allegationsraised in the complaint against L-J Inc., including the negligence claims, were based on faultyworkmanship. L-J, Inc., 621 S.E.2d at 36. Faulty workmanship, the Court held, does not constitute an"accident" as required to establish an "occurrence" under the policies. Thus, coverage was denied.

The Court stated that a CGL policy may provide coverage where faulty workmanship *899 caused bodilyinjury or damage to another property, but not in cases where faulty workmanship damages the workproduct alone. Id. at 36 n. 4. To permit coverage in such instances would convert CGL policies intoperformance bonds, which guarantee the work, rather than like an insurance policy, which is intended toinsure against accidents. Id. at 36-37. See also Hotel Roanoke Conference Center Commission v.Cincinnati Insurance Co., 303 F.Supp.2d. 784, 788 (W.D.Va.2004), ("[T]he word àccident' as used in thedefinition of occurrence involves a degree of fortuity not present when the insured's defective performanceof a contract causes injury to the insured's own work or product."); Norwalk Ready Mixed Concrete v.Travelers Insurance Companies, 246 F.3d 1132, 1137 (8th Cir.2001),(holding that defective workmanshipcannot be characterized as an accident under Iowa law), Auto-Owners Insurance Co. v. Home PrideCompanies, Inc., 268 Neb. 528, 684 N.W.2d 571, 578 (2004) (A CGL policy does not provide coverage forfaulty workmanship that damages only the resulting work product.)[9]

899

We hold that the definition of "accident" required to establish an "occurrence" under the policies cannot besatisfied by claims based upon faulty workmanship.[10] Such claims simply do not present the degree offortuity contemplated by the ordinary definition of "accident" or its common judicial construction in thiscontext. To hold otherwise would be to convert a policy for insurance into a performance bond. We areunwilling to do so, especially since such protections are already readily available for the protection ofcontractors.[11]

*900 The underlying suit in this case avers only property damage from poor workmanship to the workproduct itself. In its complaint, Bethlehem alleged that the construction of the coke battery "did not meet thecontract specifications and warranties, or the applicable industry standards for construction, andaccordingly was in breach of the Contract and its warranties." Bethlehem Complaint at 8. Bethlehemincorporated by reference into its complaint a non-performance list, specifying the damages and breachesthat it alleged. See Page ____, 908 A.2d at 891, supra. The list details construction defects and a series ofworkmanship related irregularities. As faulty workmanship does not constitute an "accident" as required toset forth an occurrence under the CGL policies, we hold that National Union had no duty to defend orindemnify Kvaerner in the action brought by Bethlehem. Given this conclusion, it is not necessary for us toconsider whether the business risk/work product exclusions also preclude coverage here. The SuperiorCourt erred, therefore, in vacating the trial court's grant of summary judgment to National Union. As such,the Superior Court's order is reversed.

900

Justices CASTILLE, SAYLOR, EAKIN and BAER join this opinion.

Former Justice NIGRO and Justice NEWMAN did not participate in the decision of this case.

137

[1] "An òccurrence' policy protects the policyholder from liability for any act done while the policy is in effect, whereas a`claims made' policy protects the holder only against claims made during the life of the policy." See Consulting EngineersInc., v. Ins. Co. of North America, 710 A.2d 82, 85 (Pa.Super.1998), citing St. Paul Fire & Marine Ins. Co. v. Barry, 438U.S. 531, 535, 98 S.Ct. 2923, 57 L.Ed.2d 932 (1978). Thus, even though the Policies contained the same general termsand conditions, they differed in the sense that the 1996 Policy only covered claims made between September 30, 1995 andSeptember 30, 1996, and the 1997 Policy only covered acts that took place between April 1, 1997 and December 31,1997. See 1996 Policy, National Union's Bf., at E2; 1997 Policy, id. at F2. In all other respects, the policies were identical;thus, for purposes of this appeal only a single analysis is necessary.

[2] National Union claimed that it did not have a duty to defend or indemnify Kvaerner under the Policies for numerousreasons, including the following: (1) Bethlehem's claims against Kvaerner did not involve "property damage" arising froman "occurrence" as required by the Policies; (2) the Battery's damages did not take place during the effective time periodsof the Policies; (3) the Battery's damages were a loss in progress or known loss when the Policies were issued; (4) theBattery's damages were excluded under different "business risk/work product" exclusions in the Policies; and (5) theBattery's damages were based on the rendering of or failure to render professional services and the Policies excludedcoverage for such harm. See Answer of National Union with New Matter and New Matter Under Pa.R.C.P. 2252.

[3] Shortly after the trial court entered its decision, the Bethlehem lawsuit was settled and consequently, discontinued withprejudice.

[4] The Superior Court in Redevelopment Auth. concluded that a CGL insurer was not responsible for defending theRedevelopment Authority of Cambria County for a breach of contract action filed against it by Barr Township because theCGL policy did not cover such actions. 685 A.2d at 589-90. The court explained:

Erie correctly asserts that it has no duty to defend or indemnify the Authority since the underlying suit arises out of a breachof contract which is not an accident or occurrence contemplated or covered by the provisions of the general liabilityinsurance policy.

Id. at 589.

[5] As the trial court concluded that National Union was entitled to summary judgment because Bethlehem had not allegedthat the Battery's damages were the result of an accident, it did not consider whether coverage was precluded based on thePolicies' exclusions also relied on by National Union in its summary judgment motion.

[6] In our order granting allocatur, we also directed the parties to "address the appropriate test or inquiry in ascertainingwhether an underlying claim sounds in contract or tort for purposes of insurance coverage." Kvaerner Metals Div. ofKvaerner U.S., Inc., et al. v. Commercial Union Ins. Co., et al., 577 Pa. 667, 848 A.2d 925 (2004). We furtherconsolidated the case with Freestone v. New England Log Homes, Inc., 77 WAL 2003, in which the Superior Court directlyconsidered this issue. See Kvaerner Metals Div., 577 Pa. 667, 848 A.2d 925 (2003); Freestone v. New England LogHomes, Inc., 577 Pa. 735, 848 A.2d 929 (2004); Freestone v. New England Log Homes, Inc., 819 A.2d 550, 553-54(Pa.Super.Ct.2003). The Freestone case, however, was dismissed prior to oral argument. Given these circumstances, wesee no need to address this issue and shall therefore leave it for another day. See Gulnac by Gulnac v. South ButlerCounty School Dist., 526 Pa. 483, 587 A.2d 699, 701 (1991) (opining that this Court should only consider issues overwhich there "is a real controversy").

[7] Kvaerner claims that National Union owed it a duty to defend as well as a duty to indemnify. As this Court hasexplained, a duty to defend is broader than the duty to indemnify. General Accident Insurance Co. v. Allen, 547 Pa. 693,692 A.2d 1089, 1095 (1997). Further, the Superior Court has explained that because the duty to defend is broader, a findingthat it is not present will also preclude a duty to indemnify. Scopel v. Donegal Mutual Insurance Co., 698 A.2d 602, 605(Pa.Super.1997). Although, however, the duty to defend is separate from and broader than the duty to indemnify, both dutiesflow from a determination that the complaint triggers coverage. Allen, 692 A.2d at 1095. Thus, if National Union does nothave a duty to defend Kvaerner in this suit, neither does it have the duty to indemnify.

[8] The school's complaint specified the following alleged causes for its damages; (1) Failure to seal and close the boilers;(2) failure to properly test and inspect the boilers; (3) failure to timely inspect the boilers and report noted deficiencies; (4)failure to install new hardware as needed in the boilers; (5) failure to start the boilers in accordance with specifications; (6)failure to properly clean the boilers; (7) failure to properly secure the boiler doors; (8) failure to otherwise perform itsobligations. Snyder, 715 A.2d at 486.

[9] While the majority of Courts have held that coverage under a CGL policy is not triggered by poor workmanship whichcauses injury to the work product itself, a minority of jurisdictions have held that faulty or negligent workmanship constitutes

138

an accident so long as the insured did not intend for the damage to occur. American Family Mutual Insurance Co. v.American Girl, Inc., 268 Wis.2d 16, 673 N.W.2d 65 (2004), Fidelity & Deposit of Maryland v. Hartford Cas., 189 F.Supp.2d1212 (D.Kan.2002), Joe Banks Drywall v. Transcontinental Ins. Co., 753 So.2d 980 (La.App. 2000), Erie InsuranceExchange v. Colony Development Corp., 136 Ohio App.3d 406, 736 N.E.2d 941 (1999). We believe that this is an overlybroad interpretation of accident, as the situation is rare indeed in which a contractor intends that the work product sufferinjury. Because we believe that CGL policies are not the proper means to protect against such risks, we concur with themajority of Courts and decline to apply coverage in such cases.

[10] The application and limitations of CGL policies were aptly explained in a seminal law review article by Roger C.Henderson;

The risk intended to be insured is the possibility that the goods, products or work of the insured, once relinquished andcompleted, will cause bodily injury or damage to property other than to the completed work itself and for which the insured bybe found liable. The insured, as a source of goods or services, may be liable as a matter of contract law to make good onproducts or work which is defective or otherwise unsuitable because it is lacking in some capacity. This may even extend toan obligation to completely replace or rebuild the deficient work or product. This liability, however, is not what the coveragesin question are designed to protect against. The coverage is for tort liability for physical damages to others and not forcontractual liability of the insured for economic loss because the product or completed work is not that for which thedamaged person bargained.

Insurance Protection for Products Liability and Completed Operations; What Every Lawyer Should Know, 50 Neb. L.Rev.415, 441 (1971).

[11] In this case Kvaerner was covered by a Builder's Risk Policy, providing coverage for property constructed by Kvaernerunder the Contract, and a Professional Liability Policy, covering alleged negligent acts, errors, or omissions by Kvaerner orits subcontractors. Kvaerner has recovered monies under both policies.

139

140

941 A.2d 706 (2007)

MILLERS CAPITAL INSURANCE COMPANY, Appelleev.

GAMBONE BROTHERS DEVELOMENT CO., INC., Continental Realty Co., WhitpainAssociates, L.P., Margery and Thomas Caputo

Appeal of Gambone Brothers Development Co., Inc., and Whitpain Associates.Millers Capital Insurance Company, Appellee

v.Gambone Brothers Development Company, Gambone Brothers Construction

Company, Gambone Brothers Organization, Inc., Gambone Brothers Enterprises,Inc., Gambone Development Company, Gambone Construction, Continental RealtyCompany, Christopher and Amy Coloian, Scott and Laura Dillman, Mark Levy and

Maureen Fitzgerald and George and Elizabeth SeesAppeal of Gambone Brothers Development Co., Inc., and Whitpain Associates.

Submitted October 29, 2007.Filed December 28, 2007.

Reargument Denied March 5, 2008.

Superior Court of Pennsylvania.

*707 Lee M. Epstein, Philadelphia, Frank R. Bartle, Lansdale, and Timothy P. Law, Philadelphia, forappellants.

707

Stuart D. Lurie, Philadelphia, for appellee.

Charles D. Mandracchia, Skippack, fro Continental, appellee.

Jacob C. Cohn, Philadelphia, for Millers, appellee.

BEFORE: BENDER, McCAFFERY and TAMILIA, JJ.

OPINION BY TAMILIA, J.:

¶ 1 Gambone Brothers Development Co., Inc. (Gambone) and Whitpain Associates[1] appeal from the May1, 2007, Orders of the trial court denying Gambone's cross-motion for partial summary judgment and,conversely, granting a motion for partial summary judgment and a cross-motion for partial summaryjudgment filed by appellee, *708 Millers Capital Insurance Company (Millers).708

¶ 2 Gambone is a real estate firm headquartered in Montgomery County. The firm plans, develops, andbuilds housing developments, retail properties, office properties and industrial sites, and also operates anumber of residential rental properties throughout the Delaware Valley and the suburban countiescontiguous to Philadelphia. During the late 1990's and the earlier part of the current decade, Gamboneplanned, developed, and built, among other projects, two housing developments. The first came to beknown as Normandy at Blue Bell (Normandy); the second as The Reserve at Spring Meadow (TheReserve).

¶ 3 To cover the unforeseen risks and hazards inherent in projects of such scale, Gambone purchasedextensive insurance coverage from Millers. Gambone and Millers executed three insurance policies. Thefirst policy, numbered 616739, was a primary package policy (PL policy) that provided both property andliability coverage to Gambone with a coverage period running from June 30, 2002, through June 30, 2003.

Appendix C: Millers Cap. Ins. Co. v. Gambone Bros. Dev.

141

Record, No. 2, Millers Preliminary Objections to Defendants' Second and Fourth Counterclaims, at B, Exb.C.[2] The second policy, numbered 628468, was an umbrella excess policy Gambone purchased to protectitself from exposure in an amount exceeding the policy limits of any other Miller policy Gambone had, orwould, purchase; the coverage period for the excess policy was identical to that of the PL policy-June 30,2002, through June 30, 2003. Id. at Exb. D. The third and final policy, numbered 648507, was a commercialgeneral liability policy (CGL) with coverage effective from August 8, 2002, through August 8, 2003. Id. atExb. B.

¶ 4 The matter sub judice is an insurance coverage dispute between Millers and Gambone. The salientissue underlying this appeal is whether Millers owes a duty to indemnify and/or defend Gambone againstclaims brought by two groups of plaintiffs. Each individual plaintiff previously had purchased a home ateither The Reserve or the Normandy development and had suffered damage in their respective homesattributable to faulty workmanship. The damage was discovered during the period in which Gambone wasinsured under the three policies issued by Millers. The relevant procedural history of this case is intricategiven that it involves two underlying sets of claims. We will set forth the relevant factual and proceduralhistory of each set of claims separately before outlining the conjoined factual and procedural history ofthese cases.

I. The Coloian Claims

¶ 5 From what we can discern the first group of plaintiffs—Christopher "and Amy Coloian, Scott and LauraDillman, Mark and Maureen Fitzgerald, and George and Elizabeth Sees (collectively referred to hereinafteras the "Coloian plaintiffs")—all of whom owned homes in The Reserve— initiated proceedings in theChester County Court of Common Pleas by writ of summons dated November 21, 2003. See Gambonebrief at 6 n. I. On December 21, 2004, the Coloian plaintiffs filed an amended complaint in the ChesterCounty Court of Common Pleas averring that in 2001 the *709 Coloians, Dillmans, Fitzgeralds, and Seeshad each entered into an agreement of sale with Gambone for the purchase of separate residences in TheReserve. Record Part 10 of 17, Action for Declaratory Judgment, Exb. A, at 13-15. The complaint averredthat each family began to notice water leaks in their respective homes during the course of 2002. Thecomplaint further averred these leaks were the result of "construction defects and product failures" in, interalia, the homes' vapor barriers, windows, roofs, and stucco exteriors. The complaint raised claims forbreach of contract, breach of warranty, negligence, strict liability, fraud and misrepresentation, andviolations of the Unfair Trade Practice and Consumer Protection Law (UTPCPL)[3] against Gambone.[4]

709

¶ 6 By Order dated March 18, 2005, the Chester County Court of Common Pleas sustained, in part,preliminary objections filed by Gambone and dismissed the Coloian plaintiffs' negligence claims. RecordPart 10 of 17, Action for Declaratory Judgment, Exb. B. On February 16, 2006, Millers filed a declaratoryjudgment action in Chester County asking the trial court, inter alia, to issue an order declaring Millers hadno duty to defend or indemnify Gambone against the surviving claims brought by the Coloian plaintiffs. Id.

¶ 7 Shortly thereafter, the parties proceeded to arbitration pursuant to a provision set forth in the underlyingagreements of sale; as a result, further judicial proceedings were stayed. See Record Part 10 of 17, MillersMotion for Partial Summary Judgment, Exb. D, Preliminary Interim Arbitral Award, at 3, ¶ 5. On April 14,2006, the arbitrator entered an interim award in favor of the Coloian plaintiffs. Id. On that same day,Gambone sent a notice of claim to Millers. Id. at Exb. E. By letter dated April 25, 2006, Millers deniedcoverage. Id. On July 13, 2006, the arbitrator entered a final arbitration award in favor of the Coloianplaintiffs in the aggregate amount of $1,146,494.60. Id. at Exb. F.

II. The Caputo Claims

¶ 8 On August 18, 2005, Thomas and Margery Caputo, the second set of plaintiffs, filed a written complaintin the Montgomery County Court of Common Pleas averring that the Caputos had executed an agreementof sale with Gambone in May of 2002 for a residence in the Normandy development. Record, No. 2, supraat B, Exb. A. The complaint averred that in late September of 2002, the Caputos discovered Gambone had

710

142

used defective stucco known as "drivit" in building the exterior of the Caputos' home.[5] The Caputosalleged the defective drivit resulted in "delamination, peeling, disfigurement, compromise of structuralintegrity, infiltration by the elements, mold, cracking of the exterior cladding, and moisture penetration andentrapment in and through said system." The Caputos further averred that "the defects are the result ofpoor workmanship during the initial construction of the Home, including, without limitation, the improper orfaulty design, implementation, workmanship, and supervision *710 of the application of the exterior finish ofthe Home by the Builder." The complaint raised claims for breach of implied warranty, fraudulentnondisclosure, negligent misrepresentation, and violations of the UTPCPL.

¶ 9 On November 3, 2005, Millers filed a complaint seeking, in relevant part, a judgment against Gambonedeclaring that Millers had no duty to defend or indemnify Gambone against the Caputos' claims. RecordPart 8 of 17, Amended Motion to Coordinate Actions, Exb. A.

¶ 10 By Order dated July 26, 2006, the Montgomery County Court of Common Pleas sustained Gambone'spreviously filed preliminary objections, in part, and dismissed the Caputos' fraudulent nondisclosure,negligent misrepresentation, and UTPCPL claims. Record Part 13 of 17, Gambone Defendants' Motion forPartial Summary Judgment Regarding Insurance Policy Interpretation, Exb. F. As a result, only the Caputos'breach of implied warranty claim survived. Id.

III. Coordination and Summary Judgment

¶ 11 On June 20, 2006, Gambone filed a motion to coordinate the Millers declaratory judgment actions inthe Montgomery County Court of Common Pleas by transferring the Coloian declaratory judgment actionfrom Chester County to Montgomery County. See generally, Pa:R.C.P. 213.1(d)(2), Coordination of Actionsin Different Counties. On July 24, 2006, Gambone filed an amended motion to coordinate.

¶ 12 While the amended motion was pending, Millers filed a motion for partial summary judgment in theColoian proceedings on September 11, 2006, seeking a declaration that Millers was not required toindemnify Gambone for the July 13, 2006, arbitration award pursuant to the three previously issuedinsurance policies. By Order dated September 29, 2006, the Montgomery County Court of Common Pleascoordinated the Coloian declaratory judgment action with the. Caputo declaratory judgment action bydirecting the transfer of the former action to Montgomery County.

¶ 13 On November 17, 2006, Gambone filed a cross-motion for partial summary judgment in both theColoian and Caputo declaratory judgment actions. On December 18, 2006, Millers filed a brief in oppositionto Gambone's cross-motion and in support of its pending motion for partial summary judgment in theColoian declaratory judgment action; the brief also purported to raise a cross-motion for partial summaryjudgment in the Caputo action.

¶ 14 On March 12, 2007, the trial court held oral argument on all of the outstanding motions and cross-motions for summary judgment. Shortly thereafter, the trial court issued the two Orders subject to appealdeclaring Millers has no duty to defend or indemnify Gambone for the Coloian arbitration award, anddeclaring Millers has no duty to defend or indemnify Gambone against the Caputo action.

¶ 15 Gambone promptly filed a notice of appeal, which subsequently was amended, and complied with thetrial court's ensuing Rule 1925(b) Order by filing a timely statement of matters complained of on appeal.See generally, Pa.R.A.P.1925, Opinion in Support of Order. On June 27, 2007, the trial court issued anOpinion discussing the rationale it relied on in concluding Millers had neither the duty to indemnifyGambone for the arbitration award in Coloian proceedings nor the duty to defend or indemnify Gamboneagainst the Caputos' breach of implied warranty claim. The trial court noted that the insuring agreements*711 for both the PL policy and the CGL policy contained the following language:

711

1. Insuring Agreement

a. We will pay those sums that the insured becomes legally obligated to pay as damages

143

because of "bodily injury" or "property damage" to which this insurance applies.

b. This insurance applies to "bodily injury" and "property damage" only if:

(1) The "bodily injury" or "property damage" is caused by an "occurrence" that takes place inthe "coverage territory;"

Record, No. 2, supra at B, Exb. B, Commercial General Liability Coverage Form, accord Exb. C, PL policy.

¶ 16 The trial court further noted the CGL and PL policies define an "occurrence" as "an accident, includingcontinuous or repeated exposure to substantially the same general harmful conditions." See e.g., Record,No. 2, supra at B, Exb. B, Sec. V, Definitions, at 22. Relying on this language, the trial court found that ourSupreme Court's recent decision in Kvaerner Metals Division of Kvaerner of United States, Inc. v.Commercial Union Insurance Co., et al., 589 Pa. 317, 908 A.2d 888 (2006), was controlling. Trial CourtOpinion, Moore, J., at 6. In Kvaerner, our Supreme Court held that language in a commercial generalliability policy identical to the language in the CGL and PL policies set forth above was unambiguous anddid not provide coverage for claims against the insured which were premised on allegations of faultyworkmanship in constructing a coke oven battery. Id. at 899.[6]

¶ 17 Gambone raises the following issues for our review:

1. Did the trial court err in decreeing that the allegations in the Underlying Caputo Actionand the Underlying Coloian Action did not actually or potentially constitute an "occurrence"as defined in the relevant insurance policies, especially in light of the obligation to resolveany ambiguities in policy language in favor of coverage?

2. Does the continuous or repeated presence of water that has intruded through the stuccoexterior of a home causing property damage to non-defective property constitute an"occurrence," which is defined as "an accident, including continuous or repeated exposureto substantially the same general harmful conditions"?

3. Did the trial court err in entering summary judgment when there were factual disputesabout the reasonable expectations of the policyholder and the nature and circumstances ofthe insurance transaction, which included the purchase of insurance at a high premiumspecifically to insure construction liabilities?

*712 Did the trial court err in denying summary judgment to the Gambone Defendants intheir Motion for Partial Summary Judgment on Policy Interpretation?

712

Gambone brief at 5.[7]

¶ 18 We begin by delineating our standard and scope of review:

An appellate court may reverse the grant of a motion for summary judgment if there hasbeen an error of law or an abuse of discretion. Since the issue as to whether there are nogenuine issues as to any material fact presents a question of law, our standard of review isde novo; thus, we need not defer to the determinations made by the lower tribunals. Ourscope of review, to the extent necessary to resolve the legal question before us, is plenary.We must view the record in the light most favorable to the non-moving party, and all doubtsas to the existence of a genuine issue of material fact must be resolved against the movingparty.

Chanceford Aviation Properties., LLP. v. Chanceford Twp. Bd. of Supervisors, 592 Pa. 100, 107, 923 A.2d1099, 1103 (2007) (internal citations omitted).

¶ 19 The interpretation of an insurance policy is a question of law subject to de novo analysis. Kvaerner,

144

supra at 897, citing 401 Fourth St. v. Investors Insurance Group, 583 Pa. 445, 452-53, 879 A.2d 166, 170(2005). The primary goal of insurance policy interpretation is to ascertain the intent of the parties asmanifested in the words of the policy itself. Id. When policy language is unambiguous, we give effect to thatlanguage. Id. When, on the other hand, policy language is ambiguous, we will construe the language infavor of the insured given that the insurer drafts the policy and controls the scope of coverage. Id. It isaxiomatic that an insurance provider's duty to indemnify and/or defend a policy holder against a suitbrought by a third party is based on a determination as to whether the third party's complaint triggerscoverage. Id. at 896, citing Mutual Benefit Insurance Co. v. Haver, 555 Pa. 534, 537-38, 725 A.2d 743,745 (1999).

¶ 20 While Gambone raises a number of issues for our consideration, we must also account for thearguments raised by amicus curiae United Policyholders (United). Accordingly, we have characterized thevarious arguments raised for case of disposition as opposed to analyzing the various arguments using atedious and disjointed issue by issue approach.

IV. Latent Ambiguity

¶ 21 As an initial matter, Gambone argues the facts of this case are distinguishable from the facts ofKvaerner. Gambone contends this discrepancy creates latent ambiguity in the underlying policies thatshould be construed against Millers as a matter of law. See e.g., Steuart v. McChesney, 498 Pa. 45, 53,444 A.2d 659, 663 (1982) ("A patent ambiguity is that which appears "on the face of the instrument, andarises from the defective, obscure, or insensible language used. Black's Law Dictionary 105 (rev. 4th ed.1968). In contrast, a latent ambiguity arises from extraneous or collateral facts which make the meaning ofa written agreement uncertain although the language thereof, on its face, appears clear andunambiguous."), citing Easton v. *713 Washington County Insurance Co., 391 Pa. 28, 137 A.2d 332(1957); see also Black's Law Dictionary 88 (8th ed. 2004).

713

¶ 22 Specifically, Gambone contends the nature of the damage at issue in this case varies from the natureof the damage at issue to the coke oven battery in Kvaerner.[8] Gambone concedes Kvaerner stands forthe broad principle that an insurance claim under an occurrence based CGL policy that defines the term"occurrence" as an accident cannot be premised on a claim of faulty workmanship. Gambone argues theColoian and Caputo actions do not merely involve claims for faulty workmanship that led to the failure ofthe stucco exteriors but also involve claims for ancillary and accidental damage caused by the resultingwater leaks to non-defective work inside the home interiors. Gambone brief at 26. Gambone argues theresulting water damage constitutes an "occurrence" even though the damage to the faulty stucco exteriorsdoes not. Id. We do not see any merit in the distinction Gambone attempts to create.

¶ 23 In Kvaerner, the plaintiff's complaint alleged Kvaerner had built and warranted a defective cokebattery. Id. at 891. Kvaerner contended the damage complained of had occurred after one of itssubcontractors had allowed the roof of the battery to be grouted too early. Id. at 892-893. Kvaerner furthercontended the defective grouting was unable to stand up to unexpected "monsoon rains," which lead to the"longitudinal movement of the roof" and resulted in internal damage to the coke oven battery. Id. Kvaernercontended these monsoon rains, and the resulting internal damage to the battery, constituted an"occurrence" for purpose of the underlying CGL policy. Id. The Court rejected Kvaerner's rationale.

¶ 24 In the instant matter, the factual sequences underlying the Coloian and Caputo actions are identical.Both complaints aver Gambone and/or its subcontractors built homes with defective stucco exteriors,windows, and other artificial seals intended to protect the home interiors from the elements. Bothcomplaints are based on claims for faulty workmanship. Both complaints allege that when the defectsmanifested themselves, water damage resulted to the interior of the larger product—in this case, the homeinteriors.

¶ 25 Furthermore, the weight of common sense collapses the distinction Gambone attempts to create. TheKvaerner Court held the terms "occurrence" and "accident" in the CGL policy at issue contemplated a

714

145

degree of fortuity that does not accompany faulty workmanship. Id. at 899 ("We hold that the definition ofàccident' required to establish an òccurrence' under the policies cannot be satisfied by claims based uponfaulty workmanship. Such claims simply do not present the degree of fortuity contemplated by the ordinarydefinition of àccident' or its common judicial construction in this context."). In reaching this holding, theCourt suggested that natural and foreseeable acts, such as rainfall, which tend to exacerbate the damage,effect, or consequences caused ab initio by faulty workmanship also cannot be considered sufficientlyfortuitous to constitute an "occurrence" or "accident" for the purposes of an occurrence based CGL policy.This suggestion is consistent with this Commonwealth's longstanding notion of legal and proximatecausation in tort law. See generally, Powell v. Drumheller, 539 Pa. 484, 493, 653 A.2d 619, 623 (1995) ("Indetermining whether an intervening force is a superseding cause, the test is whether the *714 interveningconduct was so extraordinary as not to have been reasonably foreseeable.") (citations omitted).

¶ 26 Gambone's next argument is merely a re-characterization of its initial argument. Gambone points outthat the definition of occurrence in the CGL and PL policies includes the phrase "continuous or repeatedexposure to substantially the same general harmful conditions." See e.g., Record, No. 2, supra at 13, Exb.B, Sec. V, Definitions, at 22. Gambone maintains "the continued and repeated presence of water within" thehome interiors fits within the literal language of this phrase and, as such, constitutes an "occurrence" forpurposes of coverage. Gambone brief at 34.

¶ 27 Gambone's re-characterized analysis fails to account for the fact that the phrase "continuous orrepeated exposure to substantially the same general harmful conditions" is directly preceded by the words"accident, including" in both the CGL and PL policy definitions of "occurrence." See e.g., Record, No. 2,supra at B, Exb. B, Sec. V, Definitions, at 22. The premise of the definition when read in the entirety,therefore, is that coverage is triggered for an "occurrence," which is an "accident" that can include a seriesof fortuitous exposures to harmful conditions. See Kvaerner, supra at 899. To reiterate, damage caused byrainfall that seeps through faulty home exterior work to damage the interior of a home is not a fortuitousevent that would trigger coverage. Id.

¶ 28 Gambone also attempts to demonstrate latent ambiguity by arguing the trial court erred by refusing toconsider the amount of premium it paid for products-completed operations hazard coverage. Gambonereply brief at 15-16, citing Rhone-Poulenc, Inc. v. International Insurance Co., 71 F.3d 1299 (7th Cir.1995).Gambone points out that during 2002-2003 it paid approximately $253,296 for completed operationscoverage while paying only $446,704 in premiums for all other coverages combined. Id. at 16.

¶ 29 Gambone's argument holds little persuasive value. Gambone invites this Court to comb through thevarious insurance policies, calculate what premiums were paid for specific grants of coverage, and thencompare these calculations to discern whether it paid an amount which could lead us to believe it intendedto purchase coverage for damages caused by the faulty workmanship of subcontractors.

¶ 30 The problem with Gambone's request is apparent; it has given us no framework within which toconduct such an inquiry. This Court will not step outside the certified record to embark on a sua sponteinquiry to determine what various insurers charge for such coverage; such an inquiry would prejudiceMillers, who would not have the opportunity to provide rebuttal data. We have no idea what the prevailingmarket rates are for completed operations coverage riders which do not insure against faulty workmanship.Even if evidence in the certified record demonstrated Millers charges a high premium for such coverage,we have no idea whether Millers offers services that other insurers do not, such that the higher premium'charged would be justified. Thus, we must decline Gambone's invitation.

V. Surplusage

¶ 31 Gambone's next set of arguments proceeds from a different premise. Gambone argues that if it can beassumed arguendo Millers' interpretation of the definition of what constitutes an "occurrence" in the CGLand PL policies is correct, the exceptions to various exclusions *715 contained within those policies wouldbe rendered mere surplusage. Gambone brief at 37.

715

146

¶ 32 In support of this argument, Gambone points to the following policy exclusion, its attendant exception,and the definition of the relevant phrase "your work" contained within the policy:

I. Damage to Your Work

"Property damage" to "your work" arising out of it or any part of it and included in the"products-completed operations hazard."

This exclusion does not apply if the damaged work or the work out of which the damagearises was performed on your behalf by a subcontractor.

See e.g., Record, No. 2, supra at B, Exb. B, Sec. I, Exclusions, at 7.

22. "Your work":

a. Means:

(1) Work or operations performed by you or on your behalf; and

(2) Materials, parts or equipment furnished in connection with such work or operations.

See e.g., Record, No. 2, supra at B, Exb. B, Sec. V, Definitions, at 24.

¶ 33 Gambone contends this language indicates the "drafters of the form insurance policy . . . intended toexclude damage to the policyholder's own completed work for which the policyholder is being held liable,unless the damaged work or the work out of which the damage arises was performed on the policyholder'sbehalf by a subcontractor." Gambone brief at 39.

¶ 34 The governing rule of construction is well-settled. In construing an insurance policy, we are notpermitted to treat words in the policy as mere surplusage and we must construe the policy in a manner thatgives effect to all the policy's language if at all possible. Tenos v. State Farm. Insurance Co., 716 A.2d 626,631 (Pa.Super.1998), citing General Mills, Inc. v. Snavely, 203 Pa.Super. 162, 199 A.2d 540, 544 (1964).

¶ 35 The fatal flaw in Gambone's argument is that if we were to accept its interpretation of the CGL and PLpolicies in toto we would be forced to render the definition of "occurrence" mere surplusage in everyinstance where a plaintiff sues a contractor for faulty work performed by a subcontractor on the contractor'sbehalf. Tenos, supra at 631 (citation omitted). The grant of coverage states that "property damage" will onlybe covered if caused by an "occurrence," which is, in turn, defined as an "accident." Inasmuch as both theColoian and Caputo claims are premised on allegations of faulty workmanship, Gambone argues that theexception to the "your work" exclusion allows coverage to lie for claims based on faulty workmanship by asubcontractor.[9] Yet, claims predicated on faulty workmanship cannot be considered "occurrences" forpurposes of an occurrence based CGL policy as a matter of plain language and judicial construction.Kvaerner, supra at 899. Gambone does not offer us any manner in which to rectify this seeminglyinsurmountable contradiction.

¶ 36 Conversely, the trial court's disposition of these cases allows for the term "occurrence" to be read inpari materia *716 with the exception to the "your work" exclusion in situations where a plaintiff sues acontractor for faulty work performed by a subcontractor. For example, a scenario could arise where asubcontractor confuses job orders and works on a part of a project on which it was not contracted to work;such a scenario would, in all likelihood, be considered an "occurrence" which would not be defined asfaulty workmanship and would fit within the exception to the "your work" exclusion. We can also conjure upadditional examples. A subcontractor could use materials on a job not contemplated by the contractualarrangement between the contractor and subcontractor. An error such as this could also be considered an"occurrence" and could fit within the exception to the "your work" exclusion.

716

¶ 37 Echoing Gambone, United raises a similar argument in its amicus curiae brief. United contends the

147

definition of "your work" contained within the CGL and PL policies includes "Warranties or representationsmade at any time with respect to the fitness, quality, durability, performance or use of `your work.'" Record,No. 2, supra at Exb. B., Sec. V, at 24. It contends the underlying claims in the Coloian and Caputo actionsare, at least in part, based on allegations that Gambone breached warranties and representations theymade concerning its subcontractors' work and, as such, these claims fit within the exception to the "yourwork" exclusion because these warranties attach to work performed on behalf of Gambone bysubcontractors. We disagree.

¶ 38 Again, our goal is to read the language in the Millers policies in pari materia whenever possible.Tenos, supra at 631. And, as with the preceding argument, if we follow the interpretation for which Unitedadvocates, we would be violating the governing rule of construction.

¶ 39 United's argument requires us to allow coverage for claims predicated on warranties against instancesof faulty workmanship performed by subcontractors, which are not "occurrences" as a matter of plainlanguage and judicial construction. Kvaerner, supra at 899. United has offered us no way in which to rectifythis contradiction. Accordingly, if there is anyway we can construe the definition of "occurrence," thedefinition of "your work," and the exception to the "your work" exclusion in pari materia we must adopt thisconstruction.

¶ 40 We can think of situations where a contractor could warrant subcontractor work that can be defined asan "occurrence" and not faulty workmanship. For example, a contractor could warrant a subcontractor'swork on a portion of a project on which the subcontractor was not contracted to work. This warranty wouldpertain to what would be, in all likelihood, defined as an "occurrence," that being an erroneously renderedperformance. The warranty, therefore, would be considered "your work," yet would also fit into theexception to the "your work" exclusion because it would be deemed performance erroneously tendered bya subcontractor.

¶ 41 In sum, when we are forced to choose between two competing interpretations of an insurance policy,we are bound, as a matter of law, to choose the interpretation which allows us to give effect to all of thepolicy's language. Tenos, supra at 631. The interpretations offered by Gambone and United do not allow usto account for the definition of "occurrence" contained in the Millers policies; indeed, neither Gambone norUnited offer any suggestion as to how we could read their respective interpretations in pari materia withthe definition of "occurrence." Conversely, the trial court's disposition conceivably allows for claims basedon a subcontractor's *717 erroneously tendered performance to fit within the exception to the "your work"exclusion.

717

VI. The Reasonable Expectations Doctrine

¶ 42 Gambone next argues the trial court's interpretation of the CGL and PL policies defies the "reasonableexpectations" Gambone had in purchasing these policies. Gambone brief at 44, citing Tonkovic v. StateFarm Mutual Auto. Insurance Co., 513 Pa. 445, 456, 521 A.2d 920, 926 (1987).[10] The problem withGambone's argument is that it ignores the applicable rules of insurance policy interpretation.

¶ 43 It is well-settled that when policy language is unambiguous, we give effect to that language. Kvaerner,supra at 897. It is also well-settled that the focus of any inquiry regarding issues of coverage under aninsurance policy is the reasonable expectations of the insured. Bubis v. Prudential Property & CasualtyInsurance Co., 718 A.2d 1270, 1272 (Pa.Super.1998). An insured, however, may not complain that itsreasonable expectations have been frustrated when the applicable policy limitations are clear andunambiguous. Id., citing Bateman v. Motorists Mutual Insurance Co., 527 Pa. 241, 244-46, 590 A.2d 281,283 (1991); Neil v. Allstate Insurance Co., 379 Pa.Super. 299, 549 A.2d 1304 (1988); St. Paul MercuryInsurance Co. v. Corbett, 428 Pa.Super. 54, 630 A.2d 28 (1993) (en banc).

¶ 44 The policy limitation at issue—namely, the definition of occurrence—is unambiguous as a matter ofplain language and judicial construction. As Gambone has failed in its attempts to demonstrate latent

148

ambiguity, the reasonable expectations doctrine is inapplicable.

¶ 45 United also invokes the reasonable expectations doctrine by asserting that when a consumerpurchases a general liability policy the consumer expects to be protected from all liability, whether thisliability arises from a breach of contract or a tort action. United's amicus brief at 23, citing Vandenberg v.Superior Court, 21 Cal.4th 815, 88 Cal.Rptr.2d 366, 982 P.2d 229, 245 (1999).

¶ 46 This argument, however, also ignores the applicable rules of construction. The occurrence limitationcontained within the CGL and PL policies is unambiguous. United cannot circumvent this limitation withoutdemonstrating ambiguity; it cannot do so.

¶ 47 In concluding with our analysis of the reasonable expectations doctrine, we note that applying thedoctrine in the way for which Gambone and United advocate would undermine the fundamental principlesof insurance contract law and impair the Commonwealth insurance industry. If we were to allow an insuredto override the plain language of a policy limitation anytime he or she was dissatisfied with the limitation bysimply invoking the reasonable expectations doctrine, the language of insurance policies would cease tohave meaning and, as a consequence, insurers would be unable to project risk. The inability to project riskwould dissuade insurers from doing business in the Commonwealth and the net result would be anincrease in premiums for consumers. We *718 refuse to set such a deleterious sequence of events intomotion.

718

VII. Conclusion

¶ 48 Gambone raises additional arguments attacking the application of various exclusions in the policy.These arguments, however, are irrelevant in light of the fact that we have concluded the Coloian andCaputo claims do not arise out of "occurrences" within the meaning of the CGL and PL policies and, hence,are not within the affirmative grant of coverage of these policies.

¶ 49 In construing the language of an insurance policy, we are bound by the plain language of the policy.The term "occurrence," as defined in the Millers CGL and PL policy, is defined in a manner that isunambiguous as a matter of plain language and common judicial construction. "Occurrence" refers to"accidental" phenomena—not claims predicated on allegations of faulty workmanship. No one disputes thatthe Coloian and Caputo claims are predicated on allegations of faulty workmanship. Neither Gambone noramicus United was able to demonstrate latent ambiguity or offer any scenario in which we could look pastthe plain language of the term "occurrence" without either rendering the term mere surplusage orundermining general principles of insurance contract law. Accordingly, we conclude the trial court did notabuse its discretion or commit reversible error in granting Millers' motion and cross-motion for partialsummary judgment while conversely denying Gambone's cross-motion for partial summary judgment.Chanceford Aviation Props., LLP., 923 A.2d at 1103.

¶ 50 Orders affirmed.

[DOCNUM 08010475]]

[1] From what we can discern from the certified record, Whitpain Associates is a business entity which is either ownedand/or operated and/or controlled by Gambone.

[2] Very few documents in the certified record are numbered and the docket sheets forwarded to this Court do not containcorresponding entries for various documents contained within the record. In cases with voluminous records, such as thisone, it is imperative the prothonotary comply with Pa.R.A.P.1931, Transmission of Record, (c) Duty of clerk to transmit therecord. We refer the Montgomery County Prothonotary to Rule 1931(c) for future reference.

[3] 73 P.S. § 201-1 et. seq.

[4] The complaint included similar claims against additional defendants who have no interest in this appeal. Record Part 10of 17, Action for Declaratory. Judgment, Exb. A, at 13-15. Whitpain Associates was not one of the additional defendantsnamed. Id.

149

[5] The complaint included similar claims against additional defendants who have no interest in this appeal. Record, No. 2,Millers Preliminary Objections to Defendants' Second and Fourth Counterclaims, at B, Exb. A. Whitpain Associates is anamed defendant in the Caputo complaint. Id.

[6] In Kvaerner Metals Division of Kvaerner of United States, Inc. v. Commercial Union Insurance Co., et al., 589 Pa. 317,908 A.2d 888 (2006), the Court noted that the majority of courts which have considered the question of whether claimspremised on allegations of faulty workmanship are covered under occurrence based CGL policies have concluded suchclaims are not covered. See e.g., Snyder Heating v. Pa. Manufacturers' Association Insurance Co., 715 A.2d 483, 487(Pa.Super.1998); Norwalk Ready Mixed Concrete v. Travelers Insurance Cos., 246 F.3d 1132, 1137 (8th Cir.2001); HotelRoanoke Conference Center Commission v. Cincinnati Insurance Co., 303 F.Supp.2d 784, 788 (W.D.Va.2004);Auto-Owners Insurance. Co. v. Home Pride Cos., 268 Neb. 528, 684 N.W.2d 571, 578 (2004); McAllister v. PeerlessInsurance Co., 124 N.H. 676, 474 A.2d 1033, 1036 (1984); L-J Inc. v. Bituminous Fire & Marine Insurance Co., 366 S.C.117, 621 S.E.2d 33, 36 (2005).

[7] United Policyholders (United) filed a brief as amicus curiae adopting and incorporating by reference Gambone'sstatement of the questions involved. United Policyholders amicus curiae brief at 3. United is a non-profit organizationfounded in 1991 "dedicated to educating the public on insurance issues and consumer rights." Id. at 1.

[8] United raises a similar argument. United Policyholders amicus curiae brief at 25-28.

[9] The claims in both the Coloian and Caputo actions are all characterized as being premised on faulty workmanship. SeeRecord Part 10 of 17, Action for Declaratory Judgment, Exb. A, accord Record, No. 2, Millers Preliminary Objections, atExb. A. We are bound by these characterizations as a matter of law. Kvaerner, supra at 896. Neither Gambone norUniversal challenges these characterizations.

[10] The parties disagree as to whether the "reasonable expectations" doctrine can be invoked by a "sophisticated"commercial enterprise. See e.g., Pressley v. Travelers Property Casualty Corp., 817 A.2d 1131, 1140 n. 3(Pa.Super.2003) (concluding that because the underlying dispute pertained to the reasonable expectation of anon-commercial insured the doctrine was applicable), citing Madison Construction Co. v. Harleysville Mutual InsuranceCo., 557 Pa. 595, 611, n. 8, 735 A.2d 100, 109 n. 8 (1999). The parties further disagree as to how to define what constitutesa "sophisticated" commercial enterprise. Due to our disposition of this appeal, we leave these questions for another day.

150

2013 PA Super 311 INDALEX INC. f/k/a, and successor by merger to, INDALEX AMERICA INC. f/k/a CARADON AMERICA INC.; INDALEX LIMITED f/k/a CARADON LIMITED; HARLAND CLARKE HOLDINGS CORP. f/k/a CLARKE AMERICAN CORP. f/k/a, and successor by merger to, NOVAR USA INC. f/k/a CARADON USA INC. f/k/a CARADON INC., Appellants v. NATIONAL UNION FIRE INSURANCE COMPANY OF PITTSBURGH, PA, Appellee APPEAL OF: INDALEX INC. AND HARLAND CLARKE HOLDINGS CORP.

: IN THE SUPERIOR COURT OF : PENNSYLVANIA : : : : : : : : : : : : : : : : : : : : No. 612 WDA 2012

Appeal from the Order Entered March 7, 2012, In the Court of Common Pleas of Allegheny County,

Civil Division, at No. G.D. 06-21147. BEFORE: DONOHUE, SHOGAN and WECHT, JJ. OPINION BY SHOGAN, J.: FILED DECEMBER 03, 2013

Indalex Inc. (formerly known as, and successor by merger to, Indalex

America Inc. formerly known as Caradon America Inc.) and Harland Clarke

Holdings Corp. (formerly known as Clarke American Corp., formerly known

as, and successor by merger to, Novar USA Inc. formerly known as Caradon

USA Inc. formerly known as Caradon Inc.) (collectively “Appellants”) appeal

Appendix D: Idalex Inc. v. Nat'l Union Fire Ins. Co. of Pittsburgh

151

from the order entered on March 7, 2012, in the Allegheny County Court of

Common Pleas that granted summary judgment in favor of National Union

Fire Insurance Company of Pittsburgh, Pennsylvania, (“Appellee”) in this

insurance coverage dispute. After careful review, we reverse and remand

for further proceedings consistent with this opinion.

In their First Amended Complaint filed on July 13, 2007, Appellants

alleged they were entitled to coverage from Appellee under a commercial

umbrella policy. Appellants’ claims stem from multiple out-of-state lawsuits

filed by homeowners and property owners. OneBeacon Insurance Group,

pursuant to a primary policy of insurance with Appellants, had provided a

defense and indemnity in the underlying lawsuits until November of 2005,

when the limits of that policy were exhausted. Appellees’ Motion for

Summary Judgment, 1/14/11, Exhibit W. The underlying lawsuits claimed

that Appellants’ windows and doors were defectively designed or

manufactured and resulted in water leakage that caused physical damage,

such as mold and cracked walls, in addition to personal injury.1 Appellees’

Motion for Summary Judgment, 1/14/11, Exhibit C at ¶ 36, 38, Exhibit F at

¶ 24, and Exhibit R at ¶¶ 24, 76, 79, and 84. The out-of-state claims

against Appellants were based on strict liability, negligence, breach of

1 There were two types of underlying complaints: (1) where contractors or product supplier defendants brought third or fourth party complaints against an affiliate of Appellants; and (2) where the homeowners or property owners sued an affiliate of Appellants directly.

152

warranty, and breach of contract. Appellee countered that it was not

required to provide coverage because under Pennsylvania law there was no

occurrence triggering coverage. On January 14, 2011, Appellee filed a

motion for summary judgment that the trial court granted in an order filed

on March 7, 2012. The trial court concluded that Kvaerner Metals

Division of Kvaerner U.S., Inc. v. Commercial Union Ins. Co., 908 A.2d

888 (Pa. 2006), barred coverage. Trial Court Opinion, 3/8/12, at 22. On

April 5, 2012, Appellants timely appealed.

On appeal, Appellants raise the following issues:

1. Did the trial court err in ruling that [Appellee] has no obligation to defend or indemnify [Appellants] under the terms and conditions of the commercial umbrella policy issued by [Appellee] for the period from October 1, 1998 to October 1, 1999 [(“the policy”)]?

a. Did the trial court err in characterizing the Underlying Lawsuits as involving solely “faulty workmanship” and therefore as not constituting an “Occurrence,” as defined in [the policy]?

b. Did the trial court err by failing to recognize that the Underlying Lawsuits pleaded tort-based products liability claims involving damage to property other than the doors and windows themselves and therefore are clearly covered under [the policy], when read as a whole?

c. Did the trial court fail to engage in a proper duty to defend analysis, relying improperly on Pennsylvania’s gist of the action doctrine to ignore legally viable tort claims against product manufacturers pleaded under the law of foreign states, which trigger a duty to defend?

153

Appellants’ Brief at 4. As Appellants’ issue and sub-issues are interrelated,

we will address them concurrently.

Our scope and standard of review of an order granting summary

judgment are well settled.

We view the record in the light most favorable to the nonmoving party, and all doubts as to the existence of a genuine issue of material fact must be resolved against the moving party. Only where there is no genuine issue as to any material fact and it is clear that the moving party is entitled to a judgment as a matter of law will summary judgment be entered. Our scope of review of a trial court’s order granting or denying summary judgment is plenary, and our standard of review is clear: the trial court’s order will be reversed only where it is established that the court committed an error of law or abused its discretion.

NASDAQ OMX PHLX, Inc. v. PennMont Securities, 52 A.3d 296, 303

(Pa. Super. 2012).

When interpreting an insurance policy, we first look to the terms of the

policy. “When the language of the policy is clear and unambiguous, we must

give effect to that language.” Donegal Mut. Ins. Co. v. Baumhammers,

938 A.2d 286, 290 (Pa. 2007) (quoting Kvaerner, 908 A.2d at 897).

“However, ‘when a provision in the policy is ambiguous, the policy is to be

construed in favor of the insured….’” Id. Also, we do not treat the words in

the policy as mere surplusage and, if at all possible, we construe the policy

in a manner that gives effect to all of the policy’s language. Teno v. State

Farm Ins. Co., 716 A.2d 626, 631 (Pa. Super. 1998) (citing General Mills,

Inc. v. Snavely, 199 A.2d 540, 544 (Pa. Super. 1964)).

154

We then compare the terms of the policy to the allegations in the

underlying complaint. “It is well established that an insurer’s duties under

an insurance policy are triggered by the language of the complaint against

the insured.” Kvaerner, 908 A.2d at 896. In determining whether an

insurer’s duties are triggered, the factual allegations in the underlying

complaint are taken as true and liberally construed in favor of the insured.

“It does not matter if in reality the facts are completely groundless, false or

fraudulent. It is the face of the complaint and not the truth of the facts

alleged therein….” D’Auria v. Zurich Ins. Co., 507 A.2d 857, 859 (Pa.

Super. 1986).

Although the case sub judice involves both the duty to defend and the

duty to indemnify, we focus primarily on the duty to defend because it is

broader than the duty to indemnify. Kvaerner, 908 A.2d. at 896, n.7. If an

insurer does not have a duty to defend, it does not have a duty to

indemnify. Id. However, “both duties flow from a determination that the

complaint triggers coverage.” General Accident Ins. Co. of America v.

Allen, 692 A.2d 1089, 1095 (Pa. 1997). Furthermore, if a single claim in a

multi-claim lawsuit is potentially covered, an insurer must defend against all

claims until it is clear that the underlying plaintiff cannot recover on any

claim. American States v. Maryland Cas., 628 A.2d 880, 887 (Pa. Super.

1993).

155

The policy at issue states that Appellee is obligated to provide

coverage for “liability imposed by law or assumed by the Insured under an

Insured Contract because of Bodily Injury, Property Damage, Personal Injury

or Advertising Injury that takes place during [the] Policy Period and is

caused by an occurrence happening anywhere in the world.” Commercial

Umbrella Policy, Section I (emphasis omitted). Furthermore, the policy

provides for a separate $25 million aggregate limit of liability for a

“Products-Completed Operations Hazard,” which includes “all Bodily Injury

and Property Damage occurring away from premises you own or rent and

arising out of Your Product or Work Scope.” Id. at Section IV., ¶ J.1

(emphasis added). “Property damage in your product” is excluded. Id. at

Section V., ¶ F (emphasis added). Also, the definition of “Your Product”

includes all of the insured’s “goods or products” and related “[w]arranties

or representations . . . with respect to the fitness, quality, durability,

performance or use.” Id. at Section IV., ¶ M. In addition, covered property

damage includes “[p]hysical injury to tangible property, including all

resulting loss of use” and “[l]oss of use of tangible property that is not

physically injured.” Id. at Section IV., ¶ K.

Although these provisions are relevant to our analysis, the major point

of contention between the parties relates to the meaning of “occurrence” in

the policy. The policy states:

156

H. Occurrence means:

1. As respects Bodily Injury or Property Damage, an accident, including continuous or repeated exposure to conditions, which results in Bodily Injury or Property Damage neither expected nor intended from the standpoint of the Insured. All such exposure to substantially the same general conditions shall be considered as arising out of one Occurrence;

2. As respects Personal Injury, an offense arising out of your business that results in Personal Injury. All damages that arise from the same or related injurious material or act shall be considered as arising out of one Occurrence, regardless of the frequency or repetition thereof, the number and kind of media used and the number of claimants[.]

Commercial Umbrella Policy, Section IV. at ¶ H(1) and (2).

Here, the trial court concluded that the insurance policy did not afford

coverage due to the absence of an “occurrence” as that word is defined in

the policy and based on the Pennsylvania Supreme Court’s decision in

Kvaerner. Trial Court Opinion, 3/8/12, at 22. After careful review of the

record, the relevant law, and the arguments of the parties, we are

constrained to disagree.

In Kvaerner, Bethlehem Steel Corporation contracted with Kvaerner

for the construction of a coke oven battery. Kvaerner, 908 A.2d at 891.

Bethlehem Steel subsequently brought an action against Kvaerner claiming

breach of contract and breach of warranty due to the coke oven battery

failing to meet construction specifications and being in a damaged condition.

Id. Kvaerner sought coverage from its insurer, National Union Fire

Insurance Company of Pittsburgh, Pennsylvania (“National Union”), for

157

defense in the underlying suit and indemnification. Id. National Union

denied coverage claiming that the damage to the faulty coke oven battery

was not an occurrence and, even if it was damaged by rain as Kvaerner

complained, it was not an “accident” as defined in the insurance policy. Id.

The Pennsylvania Supreme Court agreed with National Union, as

follows:

We hold that the definition of “accident” required to establish an “occurrence” under the policies cannot be satisfied by claims based upon faulty workmanship. Such claims simply do not present the degree of fortuity contemplated by the ordinary definition of “accident” or its common judicial construction in this context. To hold otherwise would be to convert a policy for insurance into a performance bond. We are unwilling to do so, especially since such protections are already readily available for the protection of contractors.

Id. at 899 (footnote omitted). In summary, because the underlying

complaint alleged only property damage from faulty workmanship to the

work product itself, the Supreme Court concluded that no coverage was due.

Id.

The Court further supported its holding, however, by quoting from a

law review article by Roger C. Henderson, as follows:

The risk intended to be insured [by commercial general liability policies] is the possibility that the goods, products or work of the insured, once relinquished and completed, will cause bodily injury or damage to property other than to the completed work itself and for which the insured by [sic] be found liable. The insured, as a source of goods or services, may be liable as a matter of contract law to make good on products or work which is defective or otherwise unsuitable because it is lacking in some capacity. This may even extend to an obligation to completely

158

replace or rebuild the deficient work or product. This liability, however, is not what the coverages in question are designed to protect against. The coverage is for tort liability for physical damages to others and not for contractual liability of the insured for economic loss because the product or completed work is not that for which the damaged person bargained.

Insurance Protection for Products Liability and Completed Operations; What Every Lawyer Should Know, 50 Neb.L.Rev. 415, 441 (1971).

Kvaerner, 908 A.2d at 899, n.10 (emphasis added). Thus, the Kvaerner

Court’s decision was also based on the fact that the underlying complaint

contained only claims for breach of contract and breach of warranty.

Kvaerner was subsequently relied upon by this Court in Millers

Capital Ins. Co. v. Gambone Bros. Development Co., Inc., 941 A.2d

706 (Pa. Super. 2007). Gambone Brothers Development Company

Incorporated (“Gambone”) planned and built housing developments.

Homeowners in two of Gambone’s housing developments filed lawsuits

stating that their homes had suffered damage attributable to faulty

workmanship. As described by a prior panel of this Court,

Both complaints aver Gambone and/or its subcontractors built homes with defective stucco exteriors, windows, and other artificial seals intended to protect the home interiors from the elements. Both complaints are based on claims for faulty workmanship. Both complaints allege that when the defects manifested themselves, water damage resulted to the interior of the larger product – in this case, the home interiors.

Id. at 713.

159

The homeowners from one of the housing developments raised claims

for breach of contract, breach of warranty, negligence, strict liability, fraud,

misrepresentation, and violations of the Unfair Trade Practice and Consumer

Protection Law (“UTPCPL”). Through preliminary objections, the negligence

claims were dismissed. The homeowners from the other housing

development raised claims for breach of implied warranty, fraudulent

nondisclosure, negligent misrepresentation, and violation of the UTPCPL.

However, only the breach of implied warranty claim survived preliminary

objections. During the relevant period, Gambone was insured by a

commercial general liability policy issued by Millers Capital Insurance

Company (“Millers Capital”). Relying on Kvaerner, Millers Capital denied

coverage to Gambone due to the allegations of faulty workmanship. The

trial court subsequently granted summary judgment in favor of Millers

Capital on this issue, and this Court affirmed. In doing so, however, the

panel in Gambone focused on the allegations of faulty workmanship in what

they had characterized as the product itself, the home.

In Erie Insurance Exchange v. Abbott Furnace Co., 972 A.2d 1232

(Pa. Super. 2009), this Court further extended the Kvaerner holding to a

suit involving a negligence claim, as well as breach of contract claims.

Innovative Magnetics, Inc. (“IMI”) sued Abbott Furnace Company (“Abbott”)

based on a faulty annealing furnace, which Abbott designed and installed, for

160

the manufacture of ground fault magnets. Id. at 1234. The defect in the

annealing furnace was due to faulty welding. Id. at 1235. Abbott sought

coverage under an insurance policy it had with Erie Insurance (“Erie”), and

Erie denied coverage. The trial court granted summary judgment in favor of

Erie. Id. at 1236. Abbott appealed.

This Court summarized Abbott’s argument on appeal as follows:

The trial court relied upon Kvaerner Metals Div. of Kvaerner United States, Inc. v. Commercial Union Ins. Co., 589 Pa. 317, 908 A.2d 888 (2006), for the proposition that a third party’s complaint alleging only faulty workmanship and damage to the insured’s work product does not trigger coverage under a standard commercial general liability policy. However, Appellant argues that in addition to the claims for faulty workmanship and damage to the insured’s work product, IMI’s second amended complaint included allegations that the furnace actively malfunctioned and caused damage to other IMI property, thereby triggering coverage under the provisions of a general liability policy. Accordingly, Appellant argues that the trial court erred in entering summary judgment in favor of Appellee.

Abbott, 972 A.2d at 1237.

Thus, this Court looked to the complaint to determine if IMI actually

“pleaded a negligence claim that alleged the furnace actively malfunctioned,

directly and proximately causing destruction of and damage to IMI’s

laminations.” Abbott, 972 A.2d at 1238.2 In determining whether a

negligence claim was pled in that instance, the Court was guided by the

2 In its analysis, the Court reiterated that general liability policies are intended to provide coverage if the insured’s product actively malfunctions, causing personal injury or damages to another’s property. See Ryan Homes v. Home Indem. Co., 647 A.2d 939, 942 (1994).

161

following principles. “When a plaintiff alleges that the defendant committed

a tort in the course of carrying out a contractual agreement, Pennsylvania

courts examine the claim and determine whether the ‘gist’ or gravamen of it

sounds in contract or tort.” Id. “The test is not limited to discrete instances

of conduct; rather, the test is, by its own terms, concerned with the nature

of the action as a whole.” Id. (citation omitted). Ultimately, this Court

concluded that a negligence claim was not adequately pled and, therefore,

the gist of the action was a breach of contract that was not an occurrence.

Id. at 1239.

Upon review of the record in the instant matter, we are constrained to

conclude that neither Kvaerner, Gambone, nor Abbott, bar coverage. As

acknowledged by the trial court in this case, the Kvaerner holding was

limited to situations “where the underlying claims were for breach of

contract and breach of warranty, and the only damages were to the

[insured’s] work product.” Trial Court Opinion, 3/8/12, at 12. Gambone

was a suit against a property developer and builder of homes, not a typical

product manufacturer, with the “product” being the home itself. In the

instant case, we have an off-the-shelf product that failed and allegedly

caused property damage and personal injury. Also, the court in Gambone

framed the issue as faulty workmanship in the application of the stucco and

other items. Here, there are issues framed in terms of a bad product, which

162

can be construed as an “active malfunction,” and not merely bad

workmanship. The decision in Abbott was based on a contract between a

magnetic equipment manufacturer and annealing furnace maker. Although

a negligence claim was pled in Abbott, the Court found that it was not

adequately pled. Therefore, it applied the gist of the action doctrine to

conclude that the lawsuit was basically a breach of contract action between

the contracting parties.

We must also disagree with the trial court’s conclusion that the

language in the umbrella policy in the instant case is “almost identical” to

the policy language in Kvaerner. Trial Court Opinion, 3/8/12, at 8. As

noted above, the policy at issue here includes in the definition of occurrence

the subjective language “[a]s respects Bodily Injury or Property Damage, an

accident, including continuous or repeated exposure to conditions, which

results in Bodily Injury or Property Damage neither expected nor intended

from the standpoint of the Insured.” Commercial Umbrella Policy, at

¶ H(1) (emphasis added). However, the policy at issue in Kvaerner

contained no such subjective definition. See Kvaerner, 908 A.2d at 897

(stating that the policy defined occurrence as “an accident, including

continuous or repeated exposure to substantially the same or general

harmful conditions.”). Moreover, Appellee points out in its brief that the trial

court stated “the key term in the ordinary definition of ‘accident’ is

163

‘unexpected.’” Appellee’s Brief at 12. The policy at issue provides that it is

the insured’s subjective viewpoint, and damages such as mold related health

issues were arguably not expected, see Appellee’s Motion for Summary

Judgment, 1/14/11, Exhibits C and J.

In summary, an insurance company is obligated to defend its insured

whenever the complaint filed by the injured party may potentially come

within the policy’s coverage. American States Ins. Co. v. Maryland

Casualty Company, 628 A.2d 880, 887 (Pa. Super. 1993). Our review of

the complaints in this case reveals that the claims against Appellant, which

were brought under the laws of five different states, involved product-

liability-based tort claims. Construing the policy in a manner that gives effect

to all of its language, we conclude that Appellee is obligated to defend

Appellants. Simply stated, because Appellants set forth tort claims based on

damages to persons or property, other than the insured’s product, we

cannot conclude that the claims are outside the scope of the coverage.

In so holding, we specifically reject preclusion based on a gist of the

action theory. This doctrine has been described as follows:

Under Pennsylvania law, a cause of action framed as a tort but reliant upon contractual obligations will be analyzed to determine whether the cause of action properly lies in tort or contract. “In general, courts are cautious about permitting tort recovery based on contractual breaches. In keeping with this principle, this Court has recognized the ‘gist of the action’ doctrine, which operates to preclude a plaintiff from re-casting ordinary breach of contract claims into tort claims.” Hart v.

164

Arnold, 884 A.2d 316, 339 (Pa.Super.2005), appeal denied, 587 Pa. 695, 897 A.2d 458 (2006).

Autochoice Unlimited, Inc. v. Avangard Auto Finance, Inc., 9 A.3d

1207, 1212 (Pa. Super. 2010).

The gist of the action doctrine forecloses tort claims “(1) arising solely

from the contractual relationship between the parties; (2) when the alleged

duties breached were grounded in the contract itself; (3) where any liability

stems from the contract; and (4) when the tort claim essentially duplicates

the breach of contract claim or where the success of the tort claim is

dependent on the success of the breach of contract claim.” Reardon v.

Allegheny College, 926 A.2d 477, 486 (Pa. Super. 2007) (citations

omitted).

As an initial matter, we note that the gist of the action doctrine has

not been adopted by our Supreme Court in an insurance coverage context.

Indeed, the application of the doctrine in this context would be inconsistent

with the duty to defend, which is broader than the duty to indemnify and

applicable when a claim is potentially covered.3 While not binding, we find

the analysis of the relationship between gist of the action and duty to defend

3 We acknowledge that this Court applied the gist of the action doctrine in Abbott. However, as noted by Appellants, this was not inconsistent with New Jersey law, which governed the underlying claim. Appellant’s Brief at 32-33, n.15; Abbott, 972 A.2d at 1234. Most significantly, we agree with Appellants that the duties allegedly breached arose from an express contractual agreement in Abbott, not from tort duties imposed as a matter of public policy.

165

actions by the United States District Court for the Western District of

Pennsylvania to be instructive in this regard:

If the underlying complaint contains more than one cause of action, and one of them would constitute a claim within the scope of the policy’s coverage, the insurer must defend the complaint until it can confine the claim to a recovery excluded from the scope of the policy. American States v. Maryland Cas., 427 Pa.Super. 170, 628 A.2d 880, 887 (Pa.Super.Ct.1993).2

2 This principle would be inconsistent with the “gist of the action” doctrine, to which Plaintiff refers, when analyzing a duty to defend. That doctrine “precludes plaintiffs from re-casting ordinary breach of contract claims into tort claims.” eToll, Inc. v. Elias/Savion Adver., Inc., 811 A.2d 10, 14 (Pa.Super.Ct.2002). Thus, it makes sense that the doctrine does not govern an analysis of duty to defend coverage. Berg Chilling Sys. v. Hull Corp., 70 Fed. Appx. 620, 624 (3d Cir.2003). Of course, I am not asked here to preclude the underlying plaintiff from asserting its negligent design claim. That is a question for the court presiding over the underlying action; for present purposes, the negligent design claim is present and I must consider it.

National Fire Ins. Co. of Hartford v. Robinson Fans Holdings, Inc., Not

Reported in F.Supp.2d, 2011 WL 1327435 (W.D. Pa. 2011). Likewise, tort

claims are present in the underlying suits, and we must consider them.4

Whether the laws under which the complaints are brought will bar those tort

claims because of the application of the gist of the action or a similar

4 We note that the Pennsylvania Supreme Court has found even a breach of warranty claim can sound in tort. Williams v. West Penn Power Co., 467 A.2d 811, 816 (Pa. 1983).

166

doctrine will be decided by the courts presiding over those lawsuits.

Ultimately, because the gist of the action doctrine has never been adopted

by our Supreme Court in an insurance coverage context, we are convinced

that, at this juncture of a duty to defend claim, applying the gist of the

action doctrine is inappropriate. See Berg Chilling Sys., 70 Fed. Appx.

At 624 (stating that a court undertaking a duty to defend analysis should not

rely entirely upon whether the plaintiff characterizes its claim as one arising

in tort or contract).

For the reasons set forth above, we conclude that the trial court erred

in granting summary judgment. Because the underlying complaints alleged

defective products resulting in property loss, to property other than

Appellants’ products, and personal injury, we conclude there was an

“occurrence” and reverse the order granting summary judgment.

Order reversed. Case remanded for further proceedings consistent

with this opinion. Jurisdiction relinquished.

Judgment Entered.

Joseph D. Seletyn, Esq. Prothonotary Date: 12/3/2013

167

168

Chapter Two

Commonwealth of Pennsylvania Office of Attorney General Insurance Fraud Section: Agent Fraud

Kara L. Cotter, Deputy Attorney General Robert Gift, Supervisory Special Agent Dennis A. Kistler, Senior Deputy Attorney General Insurance Fraud Section Pennsylvania Office of the Attorney General Pittsburgh M. Eric Schoenberg, Senior Deputy Attorney General Insurance Fraud Section Pennsylvania Office of the Attorney General Norristown

169

170

_____________________________________________________________________________________

171

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwiku46HmvPNAhVHXh4KHRPnAgUQjRwIBw&url=https://commons.wikimedia.org/wiki/File:Seal_of_the_Attorney_General_of_Pennsylvania.svg&psig=AFQjCNHeO0rwQ0EWFNMJ5j5A3ld-mfwznw&ust=1468594225057880

_____________________________________________________________________________________

The Pennsylvania Office of Attorney General’s Insurance Fraud Section is

the largest law enforcement entity in Pennsylvania vested with specific authority to

investigate and prosecute Insurance Fraud.

The Insurance Fraud Section was officially launched in March of 1996.

Since its inception, the Section has continued to aggressively investigate and

prosecute all types of Insurance Fraud in Pennsylvania, including frauds arising

from all lines of insurance, such as Auto, Disability Compensation, Homeowner’s,

Health, Life, and Workers’ Compensation.

A person charged with a crime is presumed innocent until proven guilty.

172

COMMONWEALTH OF PENNSYLVANIA

OFFICE OF ATTORNEY GENERAL

INSURANCE FRAUD SECTION _____________________________________________________________________________________

Part I

The Statutes

173




Altered, Forged, or Counterfeit Documents and Plates, 75 Pa.C.S.A. §7122

A person is guilty of a misdemeanor of the first degree if the person, with fraudulent

intent:

(1) alters, forges or counterfeits a certificate of title, registration card or plate,

inspection certificate or proof of financial responsibility;

(2) alters or forges an assignment of a certificate of title, or an assignment or

release of a security interest on a certificate of title or any other document issued

or prepared for issue by the department;

(3) has possession of, sells or attempts to sell, uses or displays a certificate of

title, registration card or plate, driver’s license, inspection certificate proof of

financial responsibility or any other document issued by the department, knowing

it to have been altered, forged or counterfeited;

(4) obtains or attempts to obtain a certificate of inspection without valid proof of

financial responsibility; or

(5) provides a certificate of inspection where there is no valid proof of financial

responsibility.

Corrupt Organizations, 18 Pa.C.S.A. §911(b)

(b) Prohibited activities.

(1) It shall be unlawful for any person who has received any income derived,

directly or indirectly, from a pattern of racketeering activity in which such person

participated as a principal, to use or invest, directly or indirectly, any part of such

income, or the proceeds of such income, in the acquisition of any interest in, or

the establishment or operation of, any enterprise: Provided, however, That a

purchase of securities on the open market for purposes of investment, and without

the intention of controlling or participating in the control of the issuer, or of

assisting another to do so, shall not be unlawful under this subsection if the

securities of the issue held by the purchaser, the members of his immediate

family, and his or their accomplices in any pattern of racketeering activity after

such purchase, do not amount in the aggregate to 1% of the outstanding securities

of any one class, and do not confer, either in law or in fact, the power to elect one

or more directors of the issuer: Provided, further, That if, in any proceeding

involving an alleged investment in violation of this subsection, it is established

that over half of the defendant’s aggregate income for a period of two or more

174




years immediately preceding such investment was derived from a pattern of

racketeering activity, a rebuttable presumption shall arise that such investment

included income derived from such pattern of racketeering activity.

(2) It shall be unlawful for any person through a pattern of racketeering activity

to acquire or maintain, directly or indirectly, any interest in or control of any

enterprise.

(3) It shall be unlawful for any person employed by or associated with any

enterprise to conduct or participate, directly or indirectly, in the conduct of such

enterprise’s affairs through a pattern of racketeering activity.

(4) It shall be unlawful for any person to conspire to violate any of the provisions

of paragraphs (1), (2) or (3) of this subsection.

Criminal Conspiracy, 18 Pa.C.S.A. §903(a)

Definition of conspiracy. — A person is guilty of conspiracy with another person or

persons to commit a crime if with the intent of promoting or facilitating its commission

he:

(1) agrees with such other person or persons that they or one or more of them will

engage in conduct which constitutes such crime or an attempt or solicitation to

commit such crime; or

(2) agrees to aid such other person or persons in the planning or commission of

such crime or of an attempt or solicitation to commit such crime.

Criminal Solicitation, 18 Pa.C.S.A. §902(a)

(a) Definition of solicitation. — A person is guilty of solicitation to commit a crime if

with the intent of promoting or facilitating its commission he commands, encourages or

requests another person to engage in specific conduct which would constitute such crime

or an attempt to commit such crime or which would establish his complicity in its

commission or attempted commission.

175




Criminal Use of Communications Facility, 18 Pa.C.S.A. §7512(a)

(a) Offense defined. — A person commits a felony of the third degree if that person uses

a communication facility to commit, cause or facilitate the commission or the attempt

thereof of any crime which constitutes a felony under this title or under the act of April

14, 1972 (P.L.233, No.64), known as The Controlled Substance, Drug, Device and

Cosmetic Act. Every instance where the communication facility is utilized constitutes a

separate offense under this section.

Dealing in Proceeds of Unlawful Activity, 18 Pa.C.S.A. §5111(a)(1),(2)

(a) Offense defined. — A person commits a felony of the first degree if the person

conducts a financial transaction under any of the following circumstances:

(1) With knowledge that the property involved, including stolen or illegally

obtained property, represents the proceeds of unlawful activity, the person acts

with the intent to promote the carrying on of the unlawful activity.

(2) With knowledge that the property involved, including stolen or illegally

obtained property, represents the proceeds of unlawful activity and that the

transaction is designed in whole or in part to conceal or disguise the nature,

location, source, ownership or control of the proceeds of unlawful activity.

Deceptive or Fraudulent Business Practices, 18 Pa.C.S.A. §4107(a)(5),(6)

Offense defined. — A person commits an offense if, in the course of business, the person:

(5) makes a false or misleading statement in any advertisement addressed to the

public or to a substantial segment thereof for the purpose of promoting the purchase

or sale of property or services;

(6) makes or induces others to rely on a false or misleading written statement for the

purpose of obtaining property or credit;

176




Doing Business with Unlicensed Persons, 40 P.S. §310.41(a)

Violation.--Any insurance entity or licensee accepting applications or orders for

insurance from any person or securing any insurance business that was sold, solicited or

negotiated by any person acting without an insurance producer license shall be subject to

civil penalty of no more than $5,000 per violation in accordance with this act. This

section shall not prohibit an insurer from accepting an insurance application directly from

a consumer or prohibit the payment or receipt of referral fees in accordance with this act.

False Application for Certificate of Title or Registration, 75 Pa.C.S.A. §7121

A person is guilty of a misdemeanor of the first degree if the person uses a false or

fictitious name or address or makes a material false statement, or fails to disclose a

security interest, or conceals any other material fact in an application for a certificate of

title or for registration.

False Swearing, 18 Pa.C.S.A. §4903(a)

(a) False swearing in official matters. — A person who makes a false statement under

oath or equivalent affirmation, or swears or affirms the truth of such a statement

previously made, when he does not believe the statement to be true is guilty of a

misdemeanor of the second degree if:

(1) the falsification occurs in an official proceeding; or

(2) the falsification is intended to mislead a public servant in performing his

official function.

177




Forgery, 18 Pa.C.S.A. §4101(a)(1)(2),(3)

(a) Offense defined. — A person is guilty of forgery if, with intent to defraud or injure

anyone, or with knowledge that he is facilitating a fraud or injury to be perpetrated by

anyone, the actor:

(1) alters any writing of another without his authority;

(2) makes, completes, executes, authenticates, issues or transfers any writing so

that it purports to be the act of another who did not authorize that act, or to have

been executed at a time or place or in a numbered sequence other than was in fact

the case, or to be a copy of an original when no such original existed; or

(3) utters any writing which he knows to be forged in a manner specified in

paragraphs (1) or (2) of this subsection.

Identity Theft, 18 Pa.C.S.A. §4120(a)

(a) Offense defined. — A person commits the offense of identity theft of another person

if he possesses or uses, through any means, identifying information of another person

without the consent of that other person to further any unlawful purpose.

Insurance Fraud, 18 Pa.C.S.A. §4117(a)(1),(2),(4); §4117(b)(4)

(a) Offense defined. — A person commits an offense if the person does any of the

following:

(1) Knowingly and with the intent to defraud a State or local government agency

files, presents or causes to be filed with or presented to the government agency a

document that contains false, incomplete or misleading information concerning

any fact or thing material to the agency’s determination in approving or

disapproving a motor vehicle insurance rate filing, a motor vehicle insurance

transaction or other motor vehicle insurance action which is required or filed in

response to an agency’s request.

(2) Knowingly and with the intent to defraud any insurer or self-insured, presents

or causes to be presented to any insurer or self-insured any statement forming a

part of, or in support of, a claim that contains any false, incomplete or misleading

information concerning any fact or thing material to the claim.

178




(4) Engages in unlicensed agent, broker or unauthorized insurer activity as

defined by the act of May 17, 1921 (P.L.789, No.285), known as The Insurance

Department Act of one thousand nine hundred and twenty-one, knowingly and

with the intent to defraud an insurer, a self-insured or the public.

(b) Additional offenses defined.

(4) A person may not knowingly and with intent to defraud any insurance

company, self-insured or other person file an application for insurance containing

any false information or conceal for the purpose of misleading information

concerning any fact material thereto.

Misapplication of Entrusted Property, 18 Pa.C.S.A. §4113(a)

(a) Offense defined. — A person commits an offense if he applies or disposes of property

that has been entrusted to him as a fiduciary, or property of the government or of a

financial institution, in a manner which he knows is unlawful and involves substantial

risk of loss or detriment to the owner of the property or to a person for whose benefit the

property was entrusted.

Possession of a Controlled Substance, 35 P.S. 780-113(a)(16),(30)

(a) The following acts and the causing thereof within the Commonwealth are hereby

prohibited:

(16) Knowingly or intentionally possessing a controlled or counterfeit substance

by a person not registered under this act, or a practitioner not registered or

licensed by the appropriate State board, unless the substance was obtained directly

from, or pursuant to, a valid prescription order or order of a practitioner, or except

as otherwise authorized by this act.

(30) Except as authorized by this act, the manufacture, delivery, or possession

with intent to manufacture or deliver, a controlled substance by a person not

registered under this act, or a practitioner not registered or licensed by the

appropriate State board, or knowingly creating, delivering or possessing with

intent to deliver, a counterfeit controlled substance.

179




Tampering with Public Records or Information, 18 Pa.C.S.A. §4911(a)

(a) Offense defined. — A person commits an offense if he:

(1) knowingly makes a false entry in, or false alteration of, any record, document

or thing belonging to, or received or kept by, the government for information or

record, or required by law to be kept by others for information of the government;

(2) makes, presents or uses any record, document or thing knowing it to be false,

and with intent that it be taken as a genuine part of information or records referred

to in paragraph (1) of this subsection; or

(3) intentionally and unlawfully destroys, conceals, removes or otherwise impairs

the verity or availability of any such record, document or thing.

Theft by Deception, 18 Pa.C.S.A. §3922(a)(1)

(a) Offense defined. — A person is guilty of theft if he intentionally obtains or

withholds property of another by deception. A person deceives if he intentionally:

(1) creates or reinforces a false impression, including false impressions as to law,

value, intention or other state of mind; but deception as to a person’s intention to

perform a promise shall not be inferred from the fact alone that he did not

subsequently perform the promise;

(2) prevents another from acquiring information which would affect his judgment

of a transaction; or

(3) fails to correct a false impression which the deceiver previously created or

reinforced, or which the deceiver knows to be influencing another to whom he

stands in a fiduciary or confidential relationship.

(b) Exception. — The term “deceive” does not, however, include falsity as to matters

having no pecuniary significance, or puffing by statements unlikely to deceive ordinary

persons in the group addressed.

180




Theft by Failure to Make Required Disposition of Funds, 18 Pa.C.S.A. §3927(a)

(a) Offense defined. — A person who obtains property upon agreement, or subject to a

known legal obligation, to make specified payments or other disposition, whether from

such property or its proceeds or from his own property to be reserved in equivalent

amount, is guilty of theft if he intentionally deals with the property obtained as his own

and fails to make the required payment or disposition. The foregoing applies

notwithstanding that it may be impossible to identify particular property as belonging to

the victim at the time of the failure of the actor to make the required payment or

disposition.

Unfair Business Practices, 18 Pa.C.S.A. §4107(a)(2)(5)(6)

(a) Offense defined. — A person commits an offense if, in the course of business, the person:

(2) sells, offers or exposes for sale, or delivers less than the represented quantity of any

commodity or service;

(5) makes a false or misleading statement in any advertisement addressed to the public or

to a substantial segment thereof for the purpose of promoting the purchase or sale of

property or services;

(6) makes or induces others to rely on a false or misleading written statement for the

purpose of obtaining property or credit;

Unlawful Use of Computer, 18 Pa.C.S.A. §7611(a)(1)

(a) Offense defined. — A person commits the offense of unlawful use of a computer if

he:

(1) accesses or exceeds authorization to access, alters, damages or destroys any

computer, computer system, computer network, computer software, computer

program, computer database, World Wide Web site or telecommunication device

or any part thereof with the intent to interrupt the normal functioning of a person

or to devise or execute any scheme or artifice to defraud or deceive or control

property or services by means of false or fraudulent pretenses, representations or

promises;

181




Unlicensed [Insurance] Activity, 40 P.S. §310.41

(a) PROHIBITION.— No person shall act as or perform the duties of an insurance

producer in this Commonwealth without being licensed in accordance with this act. An

insurer shall be responsible for a violation of this section by its employees; however,

other than against directors and officers, the department may not seek to impose penalties

against the individual employees in addition to the insurer for the same activity.

Unsworn Falsification to Authorities, 18 Pa.C.S.A. §4904(a)(1)(2)

(a) In general. — A person commits a misdemeanor of the second degree if, with intent

to mislead a public servant in performing his official function, he:

(1) makes any written false statement which he does not believe to be true;

(2) submits or invites reliance on any writing which he knows to be forged,

altered or otherwise lacking in authenticity;

Workers’ Compensation Fraud, 77 P.S. §1039.2(3)

A person, including, but not limited to, the employer, the employe, the health care

provider, the attorney, the insurer, the State Workmen's Insurance Fund and self-insureds,

commits an offense if the person does any of the following:

(3) Knowingly and with the intent to defraud any insurer assists, abets, solicits or

conspires with another to prepare or make any statement that is intended to be

presented to any insurer in connection with or in support of a workers' compensation

insurance claim that contains any false, incomplete or misleading information

concerning any fact or thing material to the workers' compensation insurance claim.

182




Part II

The Cases

183




Kevin Pickell and Robert Pickell

Charges

Corrupt Organizations, 18 Pa.C.S.A. §911(b)(3),(4)

Insurance Fraud, 18 Pa.C.S.A §4117(a)(4)

Theft by Failure to Make Required Disposition of Funds Received, 18 Pa.C.S.A. §3927(a)

Conspiracy, 18 Pa.C.S.A. §903

Possession of a Controlled Substance, 35 P.S. 780-113(a)(16)

Possession with Intent to Deliver a Controlled Substance, 35 P.S. 780-113(a)(30)

Facts

Kevin J. Pickell and Robert F. Pickell were insurance agents and partners in the Berks

County Insurance Brokerage firm KDN Lanchester Corporation (KDN). From 2008-2009, the

Pickells failed to remit to the School Board Insurance Company (SBIC) $840,000.00 in premium

payments KDN received from six Berks County public school districts.

Under the terms of a brokerage agreement between KDN and SBIC, KDN sold liability

and workers’ compensation insurance policies to Pennsylvania school districts. The agreement

allowed KDN to collect premium payments from the school districts, but, after deducting its

commissions from the premium payments, KDN was required to promptly forward the balance

to SBIC.

In early 2009, SBIC discovered that KDN had failed to forward balances of

$839,166.86. Investigation by Insurance Fraud Section confirmed that school districts’ 2008-09

premium payments were deposited into the KDN account, but KDN’s bank records showed no

corresponding payments to SBIC. Bank records also revealed that Kevin and Robert Pickell

made numerous withdrawals from the account and wrote large checks to themselves, one

another, and their wives. While executing a search warrant at KDN in October, IFS agents

discovered and seized several vials containing illegal anabolic steroids and a quantity of unused

syringes from Robert Pickell’s office.

Disposition

Robert Pickell was sentenced to a term of imprisonment of 10 months to 2 years, 1 year of house

arrest, and 20 years of probation.

Kevin Pickell was sentenced to a term of imprisonment of 1 - 2 years, 1 year of house arrest, and

20 years of probation.

Both defendants were also ordered to pay restitution of $874,594.55

184




Richard Piccinini, Jr.

Charges

Corrupt Organization, 18 Pa.C.S.A. §911(b)(3)

Theft by Deception, 18 Pa.C.S.A. §3922(a)

Forgery, 18 Pa.C.S.A. §4101(a)(2), (3)

Insurance Fraud, 18 Pa.C.S.A. §4117(a)(2),(4)

Insurance Fraud, 18 Pa.C.S.A. §4117(b)(4)

Dealing in Proceeds of Unlawful Activity, 18 Pa.C.S.A. §5111(a)

Criminal Use of Communications Facility, 18 Pa.C.S.A. §7512(a)

Facts

From 2007-2011, insurance agent Richard Piccinini, Jr., sold numerous annuities to two

elderly sisters as part of a fraudulent “churning” scheme.

Under the policy terms of most annuities, the owner of the annuity must pay a substantial

penalty if he withdraws funds or surrenders the entire annuity during the first few years after

purchase.

Typically, when an annuity is sold, the insurance agent immediately earns a commission,

but must refund all or part of that commission if the purchaser withdraws funds or surrenders the

entire annuity during the first year after purchase. After one year, however, the agent is “in the

clear” and retains his entire commission, even if there is a subsequent surrender or withdrawal.

Through a process known as “churning” an unscrupulous agent can manipulate this

situation for his own benefit, but to the detriment of both the policy holder and the insurer. In

order to churn, an agent only needs to:

1. Convince the client to buy an annuity;

2. Misrepresent to the insurer the client’s supposed intention to hold the annuity

for a long period and, if need be, the client’s financial circumstances;

3. Convince, manipulate, or deceive the client into surrendering the policy or

withdrawing funds as soon as one year has passed;

4. Recycle the net returned funds (i.e. what is left after the premature withdrawal

/ surrender penalty has been deducted) to have the client buy yet another

annuity, thereby earning the agent another commission;

5. Repeat.

185




Piccinini defrauded the elderly sisters by churning annuities to an extreme degree. From

an available pool of approximately $500,000 in cash, which was the bulk of the sisters’ life

savings, Piccinini sold 52 annuities to them, from 8 companies, with premiums paid of over $2.6

million. As a result his scheme, he received commissions of $194,430.39, but the sisters lost

$204,208.32 in premature surrender / withdrawal penalties. In addition, Piccinini’s scheme also

defrauded several insurance companies, which paid more in commissions to Piccinini than they

received as penalties from the sisters’ funds.

Piccinini was able to churn to this extent because he did not disclose to the sisters the

nature of annuities and, most importantly, the existence of the premature withdrawal / surrender

penalties. The sisters blindly followed Piccinini’s advice because they trusted him and he took

advantage of that by routinely instructing them to sign applications, suitability forms, and

withdrawal / surrender forms in blank.

After obtaining the sisters’ signatures on these forms, Piccinini filled them out with false

information, routinely denying that the annuities were being purchases as replacements for

previously owned ones and greatly exaggerating the sisters’ income and assets. Piccinini

submitted these documents to insurance companies, which, relying on his misrepresentations,

agreed to issue the annuities.

Disposition

Piccinini was sentenced to serve 11 ½ - 23 months imprisonment to be served on house

arrest, followed by 10 years of probation. Piccinini paid $204,208.32 in restitution to his elderly

victims sisters at the time of his sentencing and was ordered to pay an additional $17,227.44 in

restitution to various insurance companies and an additional $30,000 in fines and penalties.

Piccinini is also prohibited from acting in a fiduciary capacity for any person during the entire

term of his sentence.

186




Katherine M. Webb

Charges

Insurance Fraud, 18 Pa.C.S.A. §4117(a)(4)


Facts

Katherine Webb owned a retail insurance agency which sold and managed insurance

policies for transportation companies. Webb entered into an agreement with two wholesale

insurance producers who assisted Webb in placing her transportation customers with insurance

carriers and/or underwriter companies.

In the course of doing business in 2008 and 2009, Webb failed to forward the premium

payments made by her customers. This caused a cancellation of several customers’ insurance

policies. Upon receiving cancellation notices, many of Webb’s customers had to provide

documentation (cancelled checks) to prove that they had in fact paid their premiums.

The wholesale producer companies that Webb did business with were responsible for

reinstating the policies that were cancelled and for paying the transportation company

policyholders’ annual premiums. Webb failed to remit approximately $168,000 in premium

payments.

Webb admitted to having difficulty managing the premium payments made by customers

and acknowledged that she did not have sufficient premiums in her account to remit to insurers.

She indicated that the premiums were used for payroll, family, household and agency expenses.

Disposition

Webb was sentenced to 6 months of incarceration followed by 18 months electronic

monitoring and then 5 years of probation. She was also ordered to perform 100 hours community

service and pay $167,305.46 in restitution.

187




David Vahey

Charges

Criminal Solicitation, 18 Pa.C.S.A. §902(a)

Theft, Failure to Make Required Disposition, 18 Pa.C.S.A. §3927(a)

Forgery, 18 Pa.C.S.A. §4101(a)

Workers’ Compensation Fraud 77 P.S. §1039.2(3)

Facts

As a result of an injury to an employee of FTS Flooring Contractors on December 16,

2009, it was discovered that FTS did not have Workers’ Compensation insurance from October

25, 2008, through July 15, 2010, as required by law.

Investigation by the Insurance Fraud Section determined that FTS’s lack of insurance was

not because of any failing by FTS, but because of criminal conduct by its insurance agent, David

Vahey. Specifically, from September of 2008 through March of 2010, FTS wrote and turned

over to Vahey nine checks that were intended as payments for workers compensation insurance

coverage. Vahey deposited these checks, totaling $27,344.67, into his own account but did not

forward these funds to an insurer or otherwise obtain the required coverage for FTS. Even

though he did not obtain coverage for FTS, Vahey provided that company with certificates

indicating that it was insured.

A few days after the injury to the FTS’s employee, Vahey submitted an application for

coverage in FTS’s name. That application included the forged signatures of FTS’s principals.

While that application was pending, Vahey contacted the injured employee and asked

him to report that his injury occurred after the coverage obtained by submission of the forged

application was to take effect. The employee refused to do so.

Because FTS did not have workers’ compensation coverage, the Pennsylvania

Department of Labor & Industry, Uninsured Employer Guaranty Fund had to pay the injured

worker at least $57,490.71.

Disposition

Vahey was sentenced to serve 5 years of probation and to pay restitution of $78,105.65.

188




Norma Sommers

Charges



Facts

Norma Sommers, along with her husband, operated an insurance agency in Meadville,

Pennsylvania, known as Sommers Insurance. Sommers was primarily responsible for the

finances of the business.

Between March 2009 and September 2009, Sommers Insurance received premium

payments from approximately 150 Progressive Insurance policyholders. Payments were made

by checks made out to Progressive Insurance, which were supposed to be deposited into the

Sommers’ escrow account and then electronically uploaded to Progressive. However, at some

point, the Sommers bank account began carrying a negative balance and the bank assessed

numerous non-sufficient fund fees. As a result, premium payment uploads totaling $66,942.46

could not be completed because there were insufficient funds to cover them. Progressive

Insurance then applied $34,731.69 in commissions owed to Sommers Insurance to cover these

shortfalls, leaving a balance of $32,210.77 owed to Progressive for premiums that Sommers

Insurance received.

Disposition

Sommers was sentenced to 7 years of probation and ordered to pay restitution of

$32,210.77.

189




Charles Eckardt, Jr., Barton Sacks, & Fred Milbert

Charges

Unlicensed [Insurance] Activity, 40 P.S. §310.41

Doing Business with Unlicensed Persons, 40 P.S. §310.41(a)

Facts

As a result of Eckardt’s 2004 convictions on Insurance Fraud and Conspiracy charges,

the Department of Insurance suspended his license to do business as an agent on March 14, 2005.

In December of 2004, Eckardt became an “outside producer” for Union One Insurance

Group. Notwithstanding the subsequent suspension of his license, Eckardt continued in that

capacity, soliciting, negotiating, and selling insurance until December of 2007. In that period,

Eckardt received at least $73,000 in commissions. Fred Milbert was the managing partner of

Union One during this time.

In late 2007, Eckardt, who still did not have a valid license, also began placing new

insurance business with the Sidney Sacks Insurance Agency. Over a period of approximately 6

months, he generated approximately $200,000 worth of business with that agency and was paid

approximately $26,500 in commissions. Barton Sacks was the owner of that agency during this

time.

Disposition

Eckardt was sentenced to serve 3 years of probation, perform 200 hours of community service,

and pay a fine of $10,000, plus the costs of supervision.

Sacks and Milbert were admitted into a diversionary program.

190




Linda Escobedo, George Bradford, and Richard Weaver

Charges


Conspiracy, 18 Pa.C.S.A. §903

Theft By Deception, 18 Pa.C.S.A. §3922(a)


Deceptive or Fraudulent Business Practices, 18 Pa.C.S.A. §4107(a)(5)

Insurance Fraud, 18 Pa.C.S.A. §4117(a)(1)(4)



False Swearing, 18 Pa.C.S.A. §4903(a)

Unsworn Falsification to Authorities, 18 Pa.C.S.A. §4904(a)(1)(2)

Tampering with Public Records or Information, 18 Pa.C.S.A. §4911(a)

Unlawful Use of Computer, 18 Pa.C.S.A. §7611(a)(1)

False Application for Certificate of Title or Registration, 75 Pa.C.S.A. §7121

Altered, Forged, or Counterfeit Documents and Plates, 75 Pa.C.S.A. §7122

Facts

Linda Escobedo and George Bradford were licensed insurance agents and the principals

of A-Affordable Insurance Agency, located in Thorndale, Chester County. Through A-

Affordable, Escobedo and Bradford engaged in two criminal schemes involving multiple

violations of both the Crimes Code and the Motor Vehicle Code.

Scheme 1: A-Affordable let it be known that, through a “leasing program,” it would

provide people who did not have driver’s licenses or any other appropriate identifying

documentation with vehicle registrations, insurance, and tags enabling those persons to drive cars

in Pennsylvania. This “leasing program” was directed at illegal aliens, who could not legally

obtain these items and who therefore paid A-Affordable substantial fees for its illegal services.

A-Affordable’s “leasing program” had three components:

1) In Pennsylvania, individuals without driver’s licenses or other official state

identification cannot get a car titled and registered. To circumvent this

191




limitation on behalf of illegal aliens who had purchased cars, A-Affordable

submitted title and registration paperwork to PennDOT falsely identifying

itself as the owner of the car, accompanied by Linda Escobedo’s driver’s

license. A-Affordable then “leased” the illegal alien’s car back to him for a

nominal fee. The illegal aliens did not know that their cars were being titled

and registered in A-Affordable’s name.

A-Affordable was assisted in this portion of the scheme by Richard Weaver,

who was a car dealer and notary in Coatesville, PA. Although he was not an

authorized issuing agent, Weaver obtained license plates and other PennDOT

materials and, in some instance, completed PennDOT paperwork and issued

license plates to drivers on A-Affordable’ s behalf. He also provided these

items to A-Affordable so that it could complete the paperwork and issue the

tags itself. Defendants deceived PennDOT about the identity of the person

filling out these forms by falsely stating on them that they were completed by

an actual authorized issuing agent and forging the signature of that person.

2) A-Affordable required the illegal aliens to buy documents called “international

driver’s licenses.” These documents provided no driving privileges, yet A-

Affordable led its customers to believe otherwise.

3) A-Affordable also required its customers to buy auto insurance and then

provided them with proof of insurance cards. However, in selling these

policies, A-Affordable illegally charged undisclosed fees in excess of the

actual premiums and submitted to insurance companies false and

undocumented information about the identity, residence, and license status of

the insured drivers and about the ownership of the cars.

Hundreds of persons without driver’s licenses were provided license plates and

registrations, bogus driver’s licenses, and proof of insurance cards to drive cars in

Pennsylvania.

Scheme 2: A-Affordable’s second scheme involved the creation of Globe Life

insurance policies in the names of people who did not ask for such a policy or, in many

instances, did not even know that such a policy was being created in their name.

The Globe Life policies required policyholders to make monthly premium

payments. Globe Life’s standard procedure with agents selling these policies was to pay

the commission for a full year’s worth of premium payments as soon as it received the

payments for the first two months. Significantly, Globe Life did not require repayment of

commissions even if no premium payments were received after the first two months.

A-Affordable took advantage of this procedure to defraud Globe by using the

names of its legitimate auto insurance customers, the illegal alien customers involved in

Scheme 1, its own employees, persons unconnected to A-Affordable, and fictional

names, to produce over 2600 Globe Life insurance policies. After creating these policies,

192




A-Affordable paid the premiums on them for a short period, typically 2 or 3 months, for a

total of $15 to $40. Once Globe Life received these payments, it paid a commission of,

in most instances $200, of which A-Affordable received $135 (after sharing the

remainder with an online policy sales website).

Of over 2600 policies produced and paid for by A-Affordable, over 2100 lapsed

for non-payment of premiums after a very brief period. A-Affordable paid approximately

$33,000 in premiums on the Globe Life policies, resulting in Globe Life paying

approximately $450,000 in commissions, of which A-Affordable received approximately

$300,000.

Disposition

Bradford was sentenced to 52 – 104 months imprisonment, followed by 5 years of

probation. He was also ordered to pay restitution of $300,000 and a fine of $100,000.

Escobedo was sentenced to 36 - 72 months imprisonment, followed by 3 years of

probation. She was also ordered to pay restitution of $300,000 and a fine of $100,000.

Weaver died before the charges against him were resolved.

193




Thomas Serfass

Charges


Insurance Fraud, 18 PA.C.S.A §4117(a)(4)


Theft by Failure to Make Required Disposition of Funds Received, 18 PA.C.S.A. §3927(a)

Facts

Thomas Serfass owned an insurance business, Thomas Serfass and Associates. From

December 1998, through the end of 2007, Serfass solicited elderly persons to purchase what he

described as “Private Annuities,” promising them a large guaranteed interest rate as a return on

their investment. However, instead of investing the funds in an annuity, Serfass deposited the

funds in a business bank account and used the funds personally.

On a number of other occasions, Serfass also used funds, given to him by clients as

premium payments for insurance policies, to pay for personal expenses instead of procuring the

policies.

Over the course of eight years, stole over $ 676,000 from 25 victims ranging in age from

60 to 85 years old. Serfass’ crimes spanned seven different counties (Pike, Lehigh,

Northampton, Berks, Lackawanna, Lancaster and York).

Disposition

Serfass was sentenced to 10 to 20 years of imprisonment and ordered to pay restitution of

$675,535.

194




Barbra Ternak

Charges


Theft by Deception Insurance Fraud, 18 Pa.C.S.A. §3922(a)


Facts

Barbara Ternak, a licensed insurance agent, stole in excess of $200,000 in connection

with long-term medical care policies taken out on behalf of, or which were supposed to have

been taken out on behalf of, over 20 persons, ranging in age from 50 to 93. These policies were

intended to pay for long-term care for the victims; several of the victims were already in long-

term care facilities or anticipated the need for such care.

Ternak obtained and deposited over one hundred checks into her own account and then

spent the money for personal purposes, primarily gambling. Specifically, she deposited:

(a) Personal checks written by her clients (or clients’ family members) and made

payable to various insurance companies which the clients (or the clients' family

members) believed were for premium payments or other amounts supposedly

owed to insurance companies. In some instances, these funds were actually owed

to the insurance companies and others, Ternak deceived the clients into believing

that the money was owed, even though it was not. In both situations, however,

Ternak’s clients gave her the checks with the expectation that the check or

corresponding funds would be turned over to the insurance company.

(b) Checks made out by insurance companies and payable to insured parties who

were Ternak’s clients.

(c) personal checks written by Ternak’s clients (or the client’s family members)

and made payable to Ternak or her business, which Ternak obtained by falsely

telling clients that they owed her money because she had paid money to an

insurance company on their behalf.

Disposition

Having already been arrested by a different agency on similar charges related to one

victim and probably aware of her impending arrest by the Pennsylvania Office of Attorney

195




General, Insurance Fraud Section on the above-referenced charges, Ternak fled from the United

States. Foreign extradition has been refused. The charges remain open.

196




Charles Eckardt, Jr. & Mark Eckardt

Charges


Criminal Conspiracy, 18 Pa.C.S.A. §903(a)(2)

Facts

Insurance agent Charles Eckardt, Jr., submitted an individual income protection policy

application to UnumProvident Corporation. The application sought coverage for his brother

Mark Eckardt.

Both Charles Eckardt and Mark Eckardt signed the application. In a section of the

application to be filled out by the agent, Charles Eckardt indicated that the entire application was

filled out in the presence of Mark Eckardt.

In their answers to various questions on the application, the Eckardts indicated that Mark

Eckardt had never been convicted of a crime, had never used drugs or been treated for drug use,

had never had a back injury, and had never been denied for disability insurance.

In fact, Mark Eckardt has several convictions, including ones for burglary as a first

degree felony, for which he was sentenced to terms of imprisonment. In connection with one of

his sentences, the Court mandated that Mark Eckardt receive in-patient drug treatment. In

addition, Mark Eckardt had previously been in a car accident and, as a result, suffered a back

injury, for which he received significant medical treatment and a cash settlement. Shortly after

that injury, Mark Eckardt filed a disability insurance application on which he disclosed his back

injury. As a result of that disclosure, the application was denied. Charles Eckardt was the agent

who submitted that application.

Disposition

Both defendants were sentenced to serve 5 years of probation and to serve 100 hours of

community service. There were also each ordered to pay a $5000 fine and $1514 as the costs of

prosecution.

197




Ross Rabelow, Bruce Cherry, Tom Muldoon, & Robert Lerner

Charges

Criminal Conspiracy, 18 Pa .C.S.A. §903(a)

Theft by Deception, 18 Pa. C.S.A §3922(a)

Corrupt Conspiracy, 18 Pa.C.S.A. §911(b)

Theft, Failure to Make Required Disposition, 18 Pa.C.S.A. §3927(a)

Unfair Business Practices, 18 Pa.C.S.A. §4107(a)(2)(5)(6)


Dealing in Proceeds of Unlawful Activity, 18 Pa.C.S.A. §5111(a)(1)(2)

Facts

Agent Ross Rabelow, Agent Bruce Cherry and former Agent Tom Muldoon operated

schemes to defraud elderly victims throughout Pennsylvania, but primarily in the southeast and

south-central regions of the Commonwealth. Co-defendant Robert Lerner briefly joined in some

of these schemes as to a limited number of victims. The defendants operated two independent

criminal schemes: one operating under the guise of Rabelow’s company (American Comfort

Home Care Services) and the other operating under the guise of Muldoon’s company (Global

Services for the Home).

American Comfort Home Care Services

Rabelow, with Cherry as his primary salesman, held out American Comfort as a business

selling non-medical home-care service contracts to the elderly. All sales were made by way of

in-home contacts directly with the victims. Despite the façade of a legitimate business,

American Comfort had no purpose other than to defraud elderly victims.

American Comfort contracts purported to provide purchasers a fixed number of hours of

services in return for a fixed price. Significantly, the contracts explicitly promised purchasers

that they could obtain all of the purchased hours of services upon demand and without condition

during the term of each contract.

Under Pennsylvania law, these American Comfort contracts constituted unauthorized

insurance contracts and Rabelow and Cherry urged their victims to purchase these contracts for

non-medical services as a substitute for long-term health-care insurance. More fundamentally,

they sold the American Comfort contracts with the established intent that they would not provide

the services as promised. This intent was revealed in many ways, including:

1. The price structure of the contracts, which typically promised to provide services for

$1.59 per hour;

198




2. The finances of the company, which show that Rabelow was never able to provide

services as promised, never sought to reserve funds to do so, and only paid for

services on rare occasions; and

3. The deliberate efforts by Rabelow and Cherry to discourage and deter victims from

obtaining services.

Not content to sell a single bogus contract to each victim, Rabelow and / or Cherry

repeatedly returned to many victims’ homes to make additional sales to these victims, typically

under the guise of adding hours to, or renewing, existing contracts.

In all, 245 victims (counting spouses as one) purchased at least one contract. The

average age of these victims was in the 80’s.

In February of 2010, Robert Lerner was briefly enlisted to sell American Comfort

contracts with Cherry. Lerner accompanied Cherry to the homes of American Comfort victims

to do so, but once there, he and Cherry had those victims write out checks made payable to

Lerner based on his representation that these funds would be forwarded to legitimate insurance

companies as premium payments on existing policies. Lerner cashed these checks, but did not

forward the funds to any insurance company and did not share these funds with Rabelow.

Lerner ceased his association with American Comfort and Cherry shortly thereafter.

Because of disagreements that he had with Rabelow regarding the distribution of the

proceeds of the contracts that he sold, Cherry started making sales calls with Muldoon,

introducing him to many of the same victims and, instead of selling Rabelow’s American

Comfort contracts, helping Muldoon sell his Global Services contracts.

Global Services for the Home

Muldoon and Cherry represented Muldoon’s company, Global Services, to their victims

as specialists in providing services and equipment to the elderly, including home safety

inspections, the sale of home safety equipment, and representation of the elderly as their “health

advocate” in dealing with insurance companies. That supposed expertise was the basis for

charging victims thousands, and sometimes tens of thousands of dollars, in return for which

those victims received, if anything, token equipment, such as a rudimentary smoke detector,

alarm, or emergency medical monitor. Like American Comfort, Global Services had no

legitimate purpose and served only to provide a façade for a criminal scheme.

In addition, Muldoon promised some of his victims that, in his role as their “health

advocate,” he would forward insurance premium payments to the appropriate companies.

Relying on these representations, victims wrote checks out directly to Muldoon, but he kept them

for himself.

199




Disposition

Rabelow was sentenced to a term of imprisonment of 4 to 44 years with concurrent

probation of 14 years. He was also ordered to pay restitution of $650,000.

Cherry was sentenced to a term of imprisonment of 23 to 46 months followed by 8 years

of probation. He was also ordered to serve 100 hours community service and pay restitution of

$858,266.

Muldoon was sentenced to a term of imprisonment of 23 to 46 months followed by 8

years of probation. He was also ordered to serve 100 hours community service and pay

restitution of $169,501.

Lerner was sentenced to a term of imprisonment of 11 ½ to 23 months followed by 10

years of probation. He was also ordered to serve 100 hours community service and pay


200




Thomas Hurd

Charges




Facts

Thomas Hurd owned and operated a business called the Thomas Hurd Agency (Hurd

Insurance Associates), a business that sold transportation lines of insurance. Hurd acted as a

broker for limousine, bus, ambulance, and taxi companies to place their insurance with various

insurance companies. Hurd was a licensed agent and utilized his position as an agent/broker to

steal more than $1 million dollars. Several methods were used to carry out his thefts.

Often, Hurd’s clients did not have sufficient funds to pay the entire premium for their

policies up front. In those instances, the client was required to pay an initial deposit of 25% of

the premium and Hurd would secure premium financing for the balance. Once the financing was

in place and the policy paid for in full, the insured was required to make finance payments. If,

however, the insureds defaulted on its finance payments, the premium finance company notified

the insurance company, which cancelled the policy. Because, however, the policy was paid for

in full, the insurance company held “unused premium money.” Those funds were sent back to

Hurd, who had an obligation to remit the unused portion of the premium money to the finance

company. Hurd failed to do so on numerous occasions.

On other occasions, Hurd failed to forward premium finance payments from the insured

to premium finance companies, causing premature cancellation of policies paid by the insured.

Again, unused portions of the premium were returned to Hurd by the insurance company, but he

failed to remit the money to the premium finance company.

In other instances, Hurd simply failed to forward the initial deposit money to the

insurance company

During 2002-2003, numerous employees of Hurd received salaries from his agency at the

same time that they were receiving Unemployment Compensation benefits. Hurd requested that

these employees be placed on Unemployment and they received unemployment benefits even as

they continued to work for him. and Hurd reduced their salaries and had the difference made up

for in unemployment compensation. Through this scheme, Hurd was able to maintain a full

time staff at a fraction of the true cost.

201




Disposition

Hurd was sentenced to 11 ½ to 23 months of imprisonment and ordered to pay restitution

of over $1 million.

202




John Doe

Charges

Corrupt Organizations, 18 Pa.C.S.A. §911(b)(3)


Theft by Failure to Make Required Disposition, 18 Pa.C.S.A. §3927(a)


Deceptive or Fraudulent Business Practice, 18 Pa.C.S.A. §4107(6)



Dealing in Proceeds of Unlawful Activity, 18 Pa.C.S.A. §5111(a)

Facts

John Doe, a licensed insurance agent, was employed as a salesperson with Lechner &

Stauffer, an insurance agency located in Pennsburg, Montgomery County. Pursuant to both his

employment contract with Lechner & Stauffer and to agency policy applicable to all

salespersons, all clients, even clients that Doe had before he started his employment, were

considered Lechner & Stauffer’s clients. Accordingly, Doe was required to turn over any and all

premium payments received from any client to Lechner & Stauffer, which would then forward

the premium to the insurance company.

Under these arrangements, insurance companies paid all commissions directly to Lechner

& Stauffer, which, in turn, paid Doe his contractually agreed-upon share of commissions by way

of a monthly payroll check. This monthly payroll check was the only compensation that Doe

was entitled to receive for any work performed in connection with his employment. Thus, there

was never any legitimate reason for Doe to collect any amount from a client in excess of

whatever premium payments that the client owed and, similarly, there was no legitimate reason

for Doe to deposit any funds from a client into his own account or otherwise fail to turn them

over to Lechner & Stauffer. In fact, pursuant to his employment contract, Doe was specifically

required to turn over all client premium payments to Lechner & Stauffer within one day after his

receipt of them.

Investigation by the Insurance Fraud Section established that Doe systematically violated

these legal obligations and procedures in order to cheat Lechner & Stauffer, its clients, and

insurance companies:

1) On 7 occasions, Doe obtained a premium payment from a client, deposited it into his

own account, and simply kept the funds for himself, without forwarding the funds to

203




Lechner & Stauffer or an insurer. In these instances, the client, Lechner & Stauffer,

and the insurance company were cheated.

2) On 20 occasions Doe obtained a premium payment from a client that was larger than

what was actually owed, deposited the payment into his own account, and then sent a

bank check to Lechner & Stauffer for the correct amount owed by the client. In these

instances, Doe cheated the client out of the excess payment. On at least one of these

occasions, Doe presented the client with a declaration page on which the premium

amount had been altered to show the inflated premium that Doe later collected from

the client.

Through these misappropriations, Doe netted over $55,000.00 for himself.

Disposition

Arrest of this defendant is pending.

204




Percy E. Law, III

Charges

Forgery, 18 Pa.C.S.A. §4101(a)(2)




Facts

In 2014, Percy Law was an insurance agent licensed to sell life insurance policies for

Monumental Life Insurance Company, a division of Transamerica Life. In May and June of

2014, Law submitted fraudulent life insurance policy applications to Monumental Life for

numerous individuals for the purpose of collecting commission payments to which he was not

entitled.

The investigation revealed that Law used identifying information, including Social

Security numbers, of individuals for which he had written valid policies in the past, and

submitted applications on their behalf without their authorization. Through the submission of

these sixteen (16) fraudulent policies, Law obtained approximately $20,000.00 in commissions

from Monumental Life to which he was not entitled.

Law realized that he would receive a full year’s commission on the policies after only

paying a few months of premiums. Once he received the commission, he stopped paying the

premium and was able to turn his investment in the false premiums into a profit from the

commission.

Disposition

Law is currently awaiting trial.

205




Patricia L. McNear

Charges

Forgery, 18 Pa.C.S.A. §4101(a)(2)

Insurance Fraud, 18 Pa.C.S.A. §4117(a)(2),(3)


Facts

In February of 2015, a client contacted insurance agent Patricia McNear and asked her to

submit an accident claim for damages sustained to his truck. McNear realized that the client did

not have a valid auto policy because, even though the client had previously provided McNear

with his banking information so that monthly premium payments would be deducted

automatically, McNear had failed to submit any such premiums to start the policy.

To cover up her mistake, McNear created a new policy for the client, without his

knowledge, by backdating when the policy was created. McNear then filed the client’s accident

claim by changing the date of the loss so that it fell within the coverage period on the policy that

she created. McNear then instructed the client to change the date and time of the accident, but he

refused.

McNear admitted that she backdated coverage on her client’s policy and provided false

information during the application and claim process. Nationwide elected to pay the client’s

claim.

Disposition

McNear is currently awaiting trial.

206




Timothy M. Baranik

Charges




Facts

Timothy Baranik was the owner and operator of Baranik Insurance Agency located in

Altoona, Pennsylvania. Baranik had a contract to sell Harleysville Insurance products. In

February of 2013, Harleysville began to receive complaints from customers who were receiving

non-payment and late payment notices regarding their policies. The customers told Harleysville

that they did not understand why they had received such notices because they had paid their

annual premiums in full to Baranik.

Investigation of these complaints established that, between January of 2012 and August of

2012, Baranik collected annual premium payments from several Harleysville policyholders,

totaling $4,709, but failed to remit these payments to Harleysville.

Baranik told investigators that he began to experience financial problems in 2012. He

admitted that, in an effort to pay his business and personal expenses, he had accepted customers’

annual premium payments, but failed to forward those payments to Harleysville. Instead, he

deposited his customers’ money into his checking account switched, without the customers’

knowledge or authorization, the payment plans to allow for periodic payments, and tried to make

payments toward the customers’ policies when necessary.

Disposition

Charges against Baranik are still pending.

207




Martin Coyne

Charges



Facts

In August of 2010, Coyne, while employed as a Prudential agent, received a $12,074.80

check from a 71 year-old client to be invested in a Prudential annuity account. Instead of doing

so, Coyne deposited the money into his personal account and later used the funds for personal

purposes.

Coyne later admitted that he was not honest with the client as to what he did with her

investment money.

Disposition

Coyne paid full restitution to the victim before sentencing. At sentencing, he was ordered

to serve 18 months of probation and to perform 200 hours of community service.

208




William M. Elensky, Jr.

Charges



Facts

From 2004 through 2006, Elensky was an insurance agent, doing business in Clearfield

County. During that time, he stole approximately $91,000 that he had received from 11 clients

for the purpose of obtaining various types of annuity or insurance policies, including workers’

compensation and commercial liability policies.

Investigation established that Elensky did not use these funds for the intended purposes,

and by his own admission, that he used the funds for his own purposes, which included paying

bills arising out of his insurance agency.

To cover up his thefts, Elensky prepared fraudulent documents, such as a dividend check,

an annual statement, and bogus policies, which he used to convince his victims that the funds

that they had given to him were actually used for the intended purposes.

Disposition

Before sentencing, Elensky returned approximately $20,000 to some of his victims.

Elensky was then sentenced to 1 ½ to 7 years imprisonment and ordered to pay additional

restitution of $70,993.05.

209




Ronald Enders, Jr.

Charges

Deceptive or Fraudulent Business Practices, 18 Pa.C.S.A. §4107(a)(6)



Facts

From 2008 through 2014, Ronald Enders, Jr. operated an insurance agency known as

Enders & Sons, Inc. in Jersey Shore, PA. Investigation by the Insurance Fraud Section revealed

that, for numerous policies written for Selective Insurance and Safeco Insurance during that

period, Enders devised a scheme which unlawfully lowered the insured’s premium rates, thereby

depriving Selective and Safeco of thousands of dollars.

Specifically, between 2008 and 2012, Enders linked numerous insureds’ homeowner’s /

auto policies with the automobile / homeowner’s policies of unrelated individuals, thereby

unlawfully reducing and withholding premiums that were owed to Selective. Through this

conduct, Enders unlawfully deprived Selective of over $200,000.00 in premiums.

During 2013 and 2014, Enders falsely listed numerous insureds’ personal auto policies as

being for farm use in order to obtain a reduced rate, thereby unlawfully reducing and withholding

premiums that were due Safeco Insurance. Through this conduct, Enders unlawfully withheld

approximately $15,000.00 from Safeco Insurance.

Disposition

Before sentencing, Enders paid full restitution to Selective. He was then sentenced to a

term of imprisonment of 11 months to 24 months less 1 day to be served on house arrest,

followed by 2 years of probation. He was also ordered to pay court costs and $15,000 in

restitution to Safeco.

210




Chad Goodwin

Charges

Identity Theft ,18 Pa.C.S.A. §4120(a)

Theft by Deception,18 Pa.C.S.A. §3922(a)(1)

Forgery, 18 Pa.C.S.A. §4101(a)(3)

Facts

Between January 28, 2012, and June 10, 2012, and various other dates, Goodwin was an

agent selling insurance policies for Bankers Conseco. Two clients, Colleen Huff and Paul

Kriner, forwarded checks to Goodwin to be deposited into their accounts with Bankers Conseco.

On three separate occasions, Goodwin misappropriated the check and, instead of following his

clients’ instructions, deposited the check into his own account.

Specifically, Colleen Huff forwarded a check to Goodwin in the amount of $1,951.80

which she had signed and endorsed “to the care of Bankers.” Goodwin removed that

endorsement, forged Huff’s signature, and endorsed “pay to the order of Chad Goodwin.”

Goodwin also altered a $910.30 check forwarded to him by Huff in similar fashion.

Paul Kriner received a check from Bankers Life in the amount of $3,943.35. Not

knowing what the check was for, he contacted Goodwin, who instructed Kriner to forward the

check to him. Kriner signed the check. Goodwin wrote “pay to the order of Chad Goodwin” on

the reverse side and deposited it into his personal account

Disposition

Goodwin was sentenced to a term of imprisonment of 2 to 4 years and ordered to pay

restitution of $6,805.45 and a $1,000 fine.

211




Gregory Spitz

Charges



Facts

Gregory Spitz was an insurance agent with an active individual resident producer’s

license.

Over the course of several years, Spitz collected premiums on active policies, but did not

remit them to the appropriate carrier, Columbian Life Insurance Company. Spitz failed to remit

a total of $138,579.

Disposition

Spitz was sentenced to serve 6 - 23 months on house arrest, followed by seven years of

probation. He was also ordered to complete 120 hours of community service and to pay


212




Carol Hughes

Charges

Corrupt Organization, 18 Pa.C.S.A. §911(b)(3)


Theft by Deception, 18 Pa.C.S.A. §3922(a)(1), Theft by Deception


Misapplication of Entrusted Property, 18 Pa.C.S.A. §4113(a),

Forgery, 18 Pa.C.S.A. §4101(a)(3)

Facts

The Morry Hoffman Agency (MHA) was an insurance agency located in Plum,

Allegheny County, Pennsylvania. MHA specialized in obtaining liquor and liability insurance

for bars and restaurants.

From 2007 through 2011, MHA was operated by Carol Hughes, who identified herself as

President. Other relatives worked at MHA, including Hughes’ sister and niece. Hughes handled

all of the bookkeeping of the business. Her responsibilities included receiving premium money

and remitting premiums to the appropriate insurer to secure insurance for the policyholders.

MHA’s license to operate was terminated by the Insurance Department in February, 2011.

Investigation established that Hughes took premium money from numerous insureds, or

from other entities that paid on the insureds’ behalf, such as retail agencies or premium finance

companies, allowed the premium money to be comingled into one large operating account, and

failed to make required the dispositions of those funds to secure insurance with the appropriate

insurance company.

Investigation also revealed that on numerous occasions Hughes applied to premium

finance companies, without the authorization of the insureds, to obtain funds purportedly to be

used to pay premiums. In some instances, Hughes did this even though the insured had already

paid the full premium. Based on these applications, the premium finance company forwarded

the premium amount to MHA, which was supposed to forward all of those funds to the

appropriate insurance company, but Hughes did not do so, keeping all or part of these payments.

Investigation identified at least thirty individual insureds whose premium money was

misappropriated or unlawfully obtained. Further, retail agencies and brokers, insurers, and

premium finance companies identified many other instances where they wrote policies, but did

not receive the premiums.

For the time period of August 2007 through early 2011, the various companies associated

with this investigation claimed losses of nearly $500,000 as a result of writing policies and not

213




receiving all premiums due. Investigation verified that between $150,000 and $200,000 was

received by MHA.

Disposition

Hughes was sentenced to a term of imprisonment of 1 year less one day to 2 years less 2

days, followed by 20 years of probation. She was also ordered to pay court costs and restitution

of $227,906.02.

214




Robert Klein

Charges




Facts

Robert Klein was an insurance agent who had been arrested for misappropriating

$167,000 in life insurance premium payments made by an elderly client. Three additional

victims came forward after that first arrest.

Klein advised the victims to purchase life insurance with the Degree of Honor Protective

Association (D.H.P.A.) and the Hartford Insurance Company. After the victims did so, Klein

directed them to make their premium payment checks payable to him and assured them that he

would forward the payments to D.H.P.A. and Hartford. However, he did not do so and the

respective policies were cancelled for non-payment.

Additionally, Klein accepted premium payment checks from the victims, even though his

producer's license expired with Hartford Insurance Company.

Disposition

Klein was sentenced to 11 ½ to 23 months imprisonment and ordered to pay restitution of

$65,612.00.

215




Heather Kozuchowsky

Charges

Forgery, 18 Pa.C.S.A. §4101(a)(3)

Theft by Deception, 18 Pa.C.S.A. §3922 (a)(1)


Facts

Heather Kozuchowsky, was a licensed AFLAC insurance agent in 2008, when she

submitted over fifty (50) health policy applications on behalf of family, friends, and others

without their knowledge or authorization. In doing so, Kozuchowsky filled out the applications

and signed the name of the insured as if it had actually been completed by the named applicant.

As a result of this scheme, AFLAC paid Kozuchowsky approximately $16,000 in unwarranted

commissions.

Disposition

Kozuchowsky was sentenced to 3 years of probation and ordered to pay $15,813 in

restitution.

216




Barry Landsperger

Charges



Facts

In January 2008, Barry Landsperger was an insurance agent with the American Family

Life Assurance Company of Columbus (AFLAC). His employment with AFLAC was

terminated in 2010.

Between January 2008 and the date of his termination, Landsperger submitted 136

applications for insurance for AFLAC for fictitious individuals, using fictitious names, social

security numbers, and dates of birth. Landsperger listed his own current or prior addresses on

the fictitious applications so that he would receive any hard-copy applications sent by AFLAC to

the insureds for their signature. Landsperger signed the fictitious applications and returned them

to AFLAC. As a result of this scheme, AFLAC paid Landsperger $38,183.54 in commissions.

Disposition

Landsperger was sentenced to serve 5 years of probation and ordered to pay costs plus

restitution of $27,842.16. He was also ordered to perform 100 hours of community service.

217

218

Chapter Three

Cyber Risk Management and Liability Issues

Christopher J. Day, Esq. Clark Hill PLC Wilmington, DE David G. Ries, Esq. Clark Hill PLC Pittsburgh

219

220

Chapter Three Section 1

Information Security Overview: A Risk-Based Process

David G. Ries, Esq. Clark Hill PLC Pittsburgh

© David G. Ries 2016. All rights reserved. Reprinted with permission.

221

222

INFORMATION SECURITY OVERVIEW

A Risk-Based Process

David G. Ries Clark Hill PLC

Pittsburgh, PA [email protected]

June 2016

This paper provides a brief overview of the information security process, including the role of risk management in the process. More details are provided in Safeguarding Confidential Information: Attorneys’ Ethical and Legal Obligations, which is included in the course materials. While the Safeguarding paper focuses on security for attorneys and law firms, its contents apply to businesses and enterprises of all kinds, except for the ethics and professional responsibility considerations for attorneys.

Information security1 is a process to protect the confidentiality, integrity, and availability of information. Comprehensive security must address people, policies and procedures, and technology. While technology is a critical component of effective security, the other aspects must also be addressed. As explained by Bruce Schneier, a highly respected security professional, "[i]f you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology."2 The best technical security is likely to fail without adequate attention to people and policies and procedures. Many people incorrectly think that security is just for the Information Technology department or consultants. While IT has a critical role, everyone in an enterprise, including management and all personnel, must be involved for effective security.

An equally important concept is that security requires training and ongoing attention. It must go beyond a onetime “set it and forget it” approach. A critical component of a security program is constant vigilance and security awareness by all users of technology – every time they are using technology.

1 The term du jour is now “cybersecurity” – focusing on cyberspace and connectivity. But cybersecurity is actually a subset of information security because individual computers, servers and mobile devices need to be protected from threats like loss, theft and unauthorized physical access – distinct from connected cyberspace.

2 Bruce Schneier, Secrets and Lies - Digital Security in a Networked World (John Wiley & Sons, Inc. 2000) at p. xii.

The best technical security is likely to fail without adequate attention to people and policies and procedures.

223

mailto:[email protected]

Security starts with an inventory of information assets to determine what needs to be protected and then a risk assessment to identify anticipated threats to the information assets. The next step is development, implementation, and maintenance of a comprehensive information security program to employ reasonable physical, administrative, and technical safeguards to protect against identified risks. This is generally the most difficult part of the process. It must address people, policies and procedures, and technology and include policies, assignment of responsibility, training, ongoing security awareness, monitoring for compliance, and periodic review and updating. In addition to measures to safeguard data, security also requires measures to detect security incidents and breaches, to respond to them, and to recover from them. This is a risk-based approach that is now standard in information security.

Security involves thorough analysis and often requires balancing and trade-offs to determine what risks and safeguards are reasonable under the circumstances. There is frequently a trade-off between security and usability. Strong security often makes technology very difficult to use, while easy to use technology is frequently insecure. The challenge is striking the correct balance among all of these often competing factors.

There are numerous security frameworks, standards and guidance documents that can be used for implementing information security programs. It is important to select and use one or more that fit the size of the enterprise and the sensitivity of the information to use as an overall approach. This can be a daunting task with the alphabet soup of available resources: NIST, ISO, FTC, SANS, US-CERT, ILTA and more. They are discussed in the Safeguarding paper.

The National Institute of Standards and Technology (NIST), part of the U.S. Department of Commerce, has published the NIST Framework for Improving Critical Infrastructure, Version 1.0 (February 12, 2014).3 While the Framework is aimed at security of critical infrastructure, it is based on generally accepted security principles that can apply to all kinds of businesses and enterprises. The core security Functions in the Framework are “identify, protect, detect, respond and recover.” Under these core Functions, the Framework includes details through Categories, Subcategories, and Information Sources. These core Functions should shape any enterprise’s cybersecurity program. The Framework follows an evolving approach to security, which recognizes the increasing importance of detection and response. For years, the major emphasis was on

protection. While detection and incident response have long been necessary parts of comprehensive information security, they have too often taken a back seat to protection. Their increasing importance is now being recognized. Gartner, a leading technology consulting firm,

3 www.nist.gov/itl/csd. The Framework is available at www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf.

224

http://www.nist.gov/itl/csd

http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf

has predicted that by 2020, 60% of enterprises' information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2014.4 Some technology attorneys and security professionals have expressed the view that the Framework will become a or the de facto standard for an overall approach to reasonable security.

US- CERT, a part of the U.S. Department of Homeland Security, has published a number of cybersecurity resources5 for businesses, control systems, government agencies, and consumers, including ones for small and midsize businesses.6 They include resources like a “Toolkit for Small and Midsize Businesses” and “Why Every Small Business Should Use the NIST Cybersecurity Framework.”

The first step in developing and implementing an information security program is an inventory. It should include all information assets: data, software, hardware, appliances and infrastructure. You can’t protect it if you don’t know that you have it. Next is a risk assessment: a structured process to identify, evaluate and prioritize threats to a law firm’s information assets and operations and measures to mitigate the risks. The results are used to develop an information security program.

For the risk assessment function, it is best to use a framework standard, or outline to make sure that everything is covered. The security standards and frameworks discussed in the Safeguarding paper include risk assessment. Many IT consultants and security professionals have their own risk assessment frameworks and checklists.

The NIST Framework for Improving Critical Infrastructure includes risk assessment as part of the Identify Core Function.

A separate, formal risk assessment framework is CERT’s OCTAVE (Operationally Critical Threat, Asset and Vulnerability EvaluationSM).7 It is a good framework for large companies and enterprises. OCTAVE-S is a version of OCTAVE that is tailored for smaller organizations with 100 or fewer people. For very small organizations, the OCTAVE-S framework can be scaled down. The latest version of OCTAVE is OCTAVE Allegro. It is a streamlined version that supplements, rather than replaces the other versions.

The identified risks have to be addressed in the information security program. There are four options for addressing each risk or area of risk.

1. Apply security controls to manage the risk.

2. Transfer the risk (e.g., through a security policy or contract).

3. Eliminate the risk (by stopping the activity or doing it in a different way).

4. Accept the risk.

4 http://blogs.gartner.com/anton-chuvakin/2014/02/24/new-research-on-dealing-with-advanced-threats.

5 www.us-cert.gov/security-publications.

6 www.us-cert.gov/ccubedvp/getting-started-business.

7 www.cert.org/resilience/products-services/octave.

225

http://blogs.gartner.com/anton-chuvakin/2014/02/24/new-research-on-dealing-with-advanced-threats


http://www.us-cert.gov/security-publications

http://www.us-cert.gov/ccubedvp/getting-started-business

http://www.cert.org/resilience/products-services/octave

A distinction is frequently made between risk assessment and risk management. Risk assessment or risk analysis is used to describe a single step in the security process (often repeated periodically) in which risks are identified, the likelihood of occurrence and impact are analyzed, and mitigation measures are evaluated. Risk management is a broader, ongoing process in which risks and mitigation measures are continuously reviewed, evaluated, and addressed. Risk assessment is the evaluation phase; risk management includes evaluation, as well as implementation, maintenance, review, and updating.

After the inventory and risk assessment have been completed, appropriate controls and measures should be developed, implemented, and maintained to address identified risks. It is then necessary to continually or periodically review and update the controls and security measures as technology, threats, and available security change over time.

226

Chapter Three Section 2

Safeguarding Confidential Information: Attorneys’ Ethical and Legal Obligations

David G. Ries, Esq. Clark Hill PLC Pittsburgh

© David G. Ries 2016. All rights reserved. Reprinted with permission.

227

228

© David G. Ries 2016. All rights reserved.

SAFEGUARDING CONFIDENTIAL INFORMATION

Attorneys’ Ethical and Legal Obligations

David G. Ries Clark Hill PLC

Pittsburgh, PA [email protected]

June 2016

Introduction 1

Confidential data in computers and information systems, including those used by attorneys and law firms, faces greater security threats today than ever before. And they continue to grow! They take a variety of forms, ranging from e-mail phishing scams and social engineering attacks to sophisticated technical exploits resulting in long term intrusions into law firm networks. They also include lost or stolen laptops, tablets, smartphones, and USB drives, as well as inside threats - malicious, untrained, inattentive, and even bored personnel.

These threats are a particular concern to attorneys because of their duty of confidentiality. Attorneys have ethical and common law duties to take competent and reasonable measures to safeguard information relating to clients. They also often have contractual and regulatory duties to protect client information and other types of confidential information.

Effective information security2 requires an ongoing, comprehensive process that addresses people, policies and procedures, and technology, including training. It also requires an

1 Parts of this paper are adapted from prior materials prepared by the author, including David G. Ries, “Safeguarding Confidential Data: Your Ethical and Legal Obligations,” Law Practice (July/August 2010) and David G. Ries, “Cybersecurity for Attorneys: Understanding the Ethical Obligations,” Law Practice TODAY (March 2012). This paper is an overview. For more detailed information, see Sharon D. Nelson, David G. Ries and John W. Simek, Locked Down: Practical Information Security for Attorneys, Second Edition (American Bar Association 2016) and the other materials listed in the Additional Information section.

2 The term du jour is now “cybersecurity” – focusing on cyberspace and connectivity. But cybersecurity is actually a subset of information security because individual computers, servers and mobile devices need to be protected from threats like loss, theft and unauthorized physical access – distinct from connected cyberspace.

229

mailto:[email protected]

understanding that security is everyone’s responsibility and constant security awareness by all users of technology.

I. The Threats For years, technology attorneys and information security professionals warned lawyers that it was not a question of whether law firms would become victims of successful hacking attacks - it was a matter of when. They pointed to numerous law firm incidents of dishonest insiders and lost or stolen laptops and portable media, but there were not disclosed incidents of successful hacking attacks. It has now reached the “when” – over the last several years, there have been increasing reports in the popular, legal, and security media of successful attacks on attorneys and law firms. They have occurred and are occurring - and attorneys and law firms need to comprehensively address security.

Breaches are becoming so prevalent that there is a new mantra in cybersecurity today – it’s “when not if” a law firm or other entity will suffer a breach. Robert Mueller, then the FBI Director, put it this way in an address at a major information security conference in 2012:

I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they are converging into one category: companies that have been hacked and will be hacked again.

This observation is true for attorneys and law firms as well as companies.

A. Outside Attacks

Law firms are considered by attackers to be “one stop shops” for attacks because they have high value information that is well organized, often with weaker security than clients. Hackers target money, personally identifiable information that can be converted to money, client business strategy, intellectual property and technology, and information about deals and litigation. Threat actors include cybercriminals, hackers, governments, hactivists (with political agendas), and insiders.

As a recent article explained it:3

Ask hackers why they attack law firms, and their reply - to riff on bank robber Willie Sutton's famous quip - would no doubt be: "Because that's where the secrets are."

A December 2009 FBI alert warned that law firms and public relations firms were being targeted with spear phishing e-mails4 containing malicious payloads.5 In January 2010, the

3 Matthew J. Schwartz, “Cyberattacks: Why Law Firms Are Under Fire,” infoRisk Today (April 7, 2016).

4 “Spear phishing” is fraudulent e-mail that falsely appears to be from a trusted source and targets a specific organization or individual, seeking unauthorized access to confidential data, often log on credentials.

5 FBI Release, “Spear Phishing E-mails Target U.S. Law Firms and Public Relations Firms” (November 17, 2009).

230

FBI issued another alert, this time warning law firms about counterfeit check schemes that used e-mails to lure them into relationships with fraudulent overseas “clients.”6

The news reports of law firm breaches started with a February, 2010, Wired Magazine article that reported on advanced persistent threats (APTs), a particularly nasty form of sophisticated and extended hacking attack. It discussed an example of a 2008 APT attack on a law firm that was representing a client in Chinese litigation:7

The attackers were in the firm’s network for a year before the firm learned from law enforcement that it had been hacked. By then, the intruders harvested thousands of e-mails and attachments from mail servers. They also had access to every other server, desktop workstation and laptop on the firm’s network.

This attack was investigated by Mandiant, a leading information security firm that specializes in investigation of data breaches.8 Mandiant discovered that the network had been breached for more than a year before the law firm was tipped off to the breach by law enforcement. They could not determine the initial attack vector because the law firm did not have system logs available. The intruders at the law firm were able to obtain more than 30 sets of user credentials, compromise approximately three dozen workstations, and gain full access to all servers and computers on the network for an extended time.

A National Law Journal article in March, 2010, reported that Mandiant assisted over 50 law firms after security breaches.9 A Mandiant forensics specialist stated in an interview that Mandiant spent approximately 10% of its time in 2010 investigating data breaches at law firms.10

The same month, an article in the San Francisco Chronicle, “Law Firms Are Lucrative Targets of Cyberscams,” discussed recent attacks on attorneys, ranging from phishing scams to deep intrusions into law firm networks to steal lawsuit-related information.11 It reported:

Security experts said criminals gain access into law firms’ networks using highly tailored schemes to trick attorneys into downloading customized malware into their computers. It is not uncommon for them to remain

6 FBI Release, “New Twist on Counterfeit Check Schemes Targeting U.S. Law Firms” (January 21, 2010)

7 Kim Zetter, “Report Details Hacks Targeting Google, Others,” Wired Magazine (February 3, 2010).

8 See Mandiant’s M-Trends 2010 The Advanced Persistent Threat), www.fireeye.com/current-threats/annual-threat-report.html.

9 Karen Sloan, “Firms Slow to Awaken to Cybersecurity Threat,” The National Law Journal (March 8, 2010) www.nationallawjournal.com/id=1202445679728?slreturn=20140103163537.

10 Kelly Jackson, “Law Firms under Siege,” Dark Reading (April 6, 2011) www.darkreading.com/attacks-breaches/law-firms-under-siege/229401089.

11 Alejandro Martínez-Cabrera, “Law Firms Are Lucrative Targets of Cyberscams,” San Francisco Chronicle (March 20, 2010).

231

http://www.fireeye.com/current-threats/annual-threat-report.html

http://www.nationallawjournal.com/id=1202445679728?slreturn=20140103163537

http://www.darkreading.com/attacks-breaches/law-firms-under-siege/229401089

undetected for long periods of time and come and go as they please, they said.

In November, 2011, the FBI held a meeting for the 200 largest law firms in New York to advise them about the increasing number of attacks. Bloomberg News reported: 12

Over snacks in a large meeting room, the FBI issued a warning to the lawyers: Hackers see attorneys as a back door to the valuable data of their corporate clients.

“We told them they need a diagram of their network; they need to know how computer logs are kept,” Galligan [the head of the FBI cyber division in New York City] said of the meeting. “Some were really well prepared; others didn’t know what we were talking about.”

Successful attacks on law firms have continued. Bloomberg News published “China-Based Hackers Target Law Firms to Get Secret Deal Data” in January, 2012.13 It described a group of major hacking incidents in which attackers successfully targeted 7 Canadian law firms and 2

Canadian government agencies to get information about a transaction involving the sale of potash mines in Western Canada.

The SANS Institute, a highly regarded information security research, education, and certification organization, has published an interview with the managing partner and IT partner of a New York law firm that had been hacked.14 The attorneys said that the FBI told the law firm that “our files had been found on a server in another country. The

server was used as a way station for sending data to a large Asian country.” It was “all our files.”

Effective information security is now a requirement for attorneys. In June, 2012, the Wall Street Journal published “Client Secrets at Risk as Hackers Target Law Firms.”15 It started with:

Think knowing how to draft a contract, file a motion on time and keep your mouth shut fulfills your lawyerly obligations of competence and confidentiality?

12 Michael A. Riley and Sophia Pearson, “China-Based Hackers Target Law Firms to Get Secret Deal Data” Bloomberg News (January 31, 2012). www.bloomberg.com/news/2012-01-31/china-based-hackers-target-law-firms.html

13 Id.

14 SANS Institute, “Conversations about Cybersecurity,” www.sans.org/security-resources/cybersecurity-conversations.

15 Jennifer Smith, “Client Secrets at Risk as Hackers Target Law Firms,” Wall Street Journal Law Blog (June 25, 2012).

232

http://www.bloomberg.com/news/2012-01-31/china-based-hackers-target-law-firms.html

http://www.sans.org/security-resources/cybersecurity-conversations

The attackers used the law firm’s e-mail system as a platform to infiltrate biotechnology and pharmaceutical clients.

Not these days. Cyberattacks against law firms are on the rise, and that means attorneys who want to protect their clients’ secrets are having to reboot their skills for the digital age.

Security threats to law firms continue to grow. In February, 2013, an FBI agent gave a keynote presentation on law firm security threats at LegalTech New York. In an article reporting on it, the special agent in charge of the FBI’s cyber operations in New York City is quoted as stating:16

“We have hundreds of law firms that we see increasingly being targeted by hackers. …We all understand that the cyberthreat is our next great challenge. Cyber intrusions are all over the place, they’re dangerous, and they’re much more sophisticated” than they were just a few years ago.

In August, 2013, ILTA (the International Legal Technology Association) presented "The FBI and Experts Present Security Updates and Strategies for Firms of All Sizes" at its Annual Education Conference. An FBI speaker called the cyberattacks “a paradigm shift” and noted that attackers are “already in the system.” Another speaker observed that several practice areas appear to be most vulnerable to attack, including oil and gas, technology, and technology patents.17

Shane McGee, the general counsel and vice president of legal affairs at Mandiant Corp., explained the sophistication of attacks on law firms in a September, 2013 ABA Journal article:18

Law firms need to understand that they’re being targeted by the best, most advanced attackers out there … These attackers will use every resource at their disposal to compromise law firms because they can, if successful, steal the intellectual property and corporate secrets of not just a single company but of the hundreds or thousands of companies that the targeted law firm represents. Law firms are, in that sense, ‘one-stop shops’ for attackers.

At a security conference in October, 2014, Mandiant reported on a law firm data breach that it investigated. The attackers used the law firm’s e-mail system as a platform to infiltrate biotechnology and pharmaceutical clients. The attackers first sent phishing e-mails to the law firm and used information stolen through them to take control of the e-mail system. They then sent e-mails with malicious attachments from the law firm e-mail system to individuals at

16 Evan Koblenz, “LegalTech Day Three: FBI Security Expert Urges Law Firm Caution,” Law Technology News (February 1, 2013), www.lawtechnologynews.com/id=1202586539710?slreturn=20140103164728.

17 Monica Bay, “Bring in the FBI: Your Paranoia is Justified,” Law Technology News (August 26, 2013).

18 Joe Dysart, “New hacker technology threatens lawyers’ mobile devices,” ABA Journal Law News Now (September 1, 2103). www.abajournal.com/magazine/article/new_hacker_technology_threatens_lawyers_mobile_devices.

233

http://www.lawtechnologynews.com/id=1202586539710?slreturn=20140103164728

http://www.abajournal.com/magazine/article/new_hacker_technology_threatens_lawyers_mobile_devices

clients who had received law firm e-mails with attachments in the past. When some of the client personnel opened the attachments, malware designed to steal information was installed on the clients’ systems.19

In May of 2014, five Chinese military officers were indicted in federal court in Pittsburgh, charged with hacking attacks on energy companies, suppliers to them, and a labor union.20 While the indictment does not include any charges for hacking a law firm, it does include targeting confidential attorney-client communications. While the hacking in the indictment was taking place, a law firm representing one of the energy companies was also hacked. The firm represented the solar energy company in an antidumping matter against China.21

Although reports of law firm data breaches have been limited, breaches have been widespread. A March, 2015 article reports that “Cybersecurity firm Mandiant says at least 80 of the 100 biggest firms in the country, by revenue, have been hacked since 2011.”22 Mandiant has reported that 7% of the intrusions that it investigated in 2014 were in the legal services industry.23

Law firm breaches continue to be in the headlines in early 2016. On March 4, 2016, the FBI issued a Private Industry Alert directed to the legal profession about hacking for insider trading. Its summary states:

A financially motivated cyber crime insider trading scheme targets international law firm information used to facilitate business ventures. The scheme involves a hacker compromising the law firm’s computer networks and monitoring them for material, non-public information (MNPI). This information, gained prior to a public announcement, is then used by a criminal with international stock market expertise to strategically place bids and generate a monetary profit.

19 BSides DC 2014, “Opening Acts: How Attackers Get Their Big Breaks” www.youtube.com/watch?v=j1JC59QjPQs.

20 U.S. Department of Justice Press Release, May 19, 2014, www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor.

21 Michael Riley and Dune Lawrence, “Hackers Linked to China’s Army Seen from EU to D.C.” Bloomberg Business (July 26, 2012) www.bloomberg.com/news/articles/2012-07-26/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor.

22 Susan Hansen, “Cyber Attacks Upend Attorney-Client Privilege,” Bloomberg Businessweek (March 19, 2015) www.bloomberg.com/news/articles/2015-03-19/cyber-attacks-force-law-firms-to-improve-data-security.

23 Mandiant, M-Trends 2015: From the Front Lines, www.fireeye.com/current-threats/annual-threat-report.html.

234

http://www.youtube.com/watch?v=j1JC59QjPQs

http://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor

http://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor

http://www.bloomberg.com/news/articles/2012-07-26/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor

http://www.bloomberg.com/news/articles/2012-07-26/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor

http://www.bloomberg.com/news/articles/2015-03-19/cyber-attacks-force-law-firms-to-improve-data-security



A few weeks later, Crain’s Chicago Business reported that the scheme targeted nearly 50 elite law firms, including 48 major U.S. firms and 2 members of the UK’s Magic Circle.24 The same day, the Wall Street Journal reported that the hackers had broken into law firms:25

Hackers broke into the computer networks at some of the country’s most prestigious law firms, and federal investigators are exploring whether they stole confidential information for the purpose of insider trading, according to people familiar with the matter.

The firms include Cravath Swaine & Moore LLP and Weil Gotshal & Manges LLP, which represent Wall Street banks and Fortune 500 companies in everything from lawsuits to multibillion-dollar merger negotiations.

Other law firms also were breached, the people said, and hackers, in postings on the Internet, are threatening to attack more.

Also in March of 2016, the IRS issued an alert about a targeted spearphishing scheme in which cybercriminals were sending e-mails that appeared to be from target companies’ CEOs to payroll and human resources staff asking for copies of W-2 tax forms. They then used the W-2s from those who responded to file fraudulent tax returns to obtain refunds.26 The numerous victims who sent W-2s included a major law firm.27

In April of 2016, another law firm data breach made the headlines – Mossack Fonesca in Panama.28 It has been called the largest volume data breach of all time (in millions of documents and terabytes of data and resulted in disclosure of the “Panama Papers.” The papers disclosed details of “offshore financial activities of dozens of global leaders, businessmen and celebrities.

A growing threat to law firms and others, over the last few years, has been ransomware, which is malware that encrypts data in victims’ computers and networks and requires the victim to pay ransom, usually by Bitcoin, to obtain the decryption key from the

24

Claire Bushey, “Russian cyber criminal targets elite Chicago law firm,” Crain’s Chicago Business (March 29, 2016). http://www.chicagobusiness.com/article/20160329/NEWS04/160329840/russian-cyber-criminal-targets-elite-chicago-law-firms.

25 Nicole Hong and Robin Didel, “Hackers Breach Law Firms, Including Cravath and Weil Gotshal,” Wall

Street Journal (March 29, 2016).

26 Internal Revenue Service Alert IR-2016-34 (March 1, 2016)

https://www.irs.gov/uac/Newsroom/IRS-Alerts-Payroll-and-HR-Professionals-to-Phishing-Scheme-Involving-W2s.

27 Steve Ragan, “Latest tax-related data breach could affect employees and their children,” CSO Online

(April 8, 2016) www.csoonline.com/article/3053658/security/latest-tax-related-data-breach-could-affect-employees-and-their-children.html.

28 Jacob Gershman, “Law Firm at the Center of “Panama Papers” Leak,” Wall Street Journal Blog (April

4, 2016) http://blogs.wsj.com/law/2016/04/04/law-firm-at-the-center-of-panama-papers-leak.

235

http://www.chicagobusiness.com/article/20160329/NEWS04/160329840/russian-cyber-criminal-targets-elite-chicago-law-firms

http://www.chicagobusiness.com/article/20160329/NEWS04/160329840/russian-cyber-criminal-targets-elite-chicago-law-firms

https://www.irs.gov/uac/Newsroom/IRS-Alerts-Payroll-and-HR-Professionals-to-Phishing-Scheme-Involving-W2s

https://www.irs.gov/uac/Newsroom/IRS-Alerts-Payroll-and-HR-Professionals-to-Phishing-Scheme-Involving-W2s

http://www.csoonline.com/article/3053658/security/latest-tax-related-data-breach-could-affect-employees-and-their-children.html

http://www.csoonline.com/article/3053658/security/latest-tax-related-data-breach-could-affect-employees-and-their-children.html

http://blogs.wsj.com/law/2016/04/04/law-firm-at-the-center-of-panama-papers-leak

cybercriminal.29 On April 21, 2016, the ABA sent a Cyber Alert about ransomware to members, including a link to an FBI alert on the subject.30 The ABA has started to send this kind of Cyber Alert to its members at the request of the FBI’s Cyber Division.

The information on these law firm data breaches is consistent with breaches generally - many are found by third-parties and many are discovered after an extended time. Mandiant has reported that in 2015, 53% of data breaches were discovered by an external party and 43% were discovered internally. The median time for discovery of a data breach in 2015 was 146 days – 320 days when discovered by an external party and 56 days when discovered internally.31

B. Lost and Stolen Devices

While the large scale hacking attacks can make attention-grabbing headlines, law firms also continue to face smaller scale, yet still serious, security incidents, like lost or stolen laptops, tablets, smartphones, and USB drives. For example, a Maryland law firm lost an unencrypted portable hard drive containing medical information when an employee left it on a light rail train.32 The idea was good – take it offsite for backup – but the execution was a security risk – it wasn’t encrypted.

It happened again in June, 2014. A Georgia-based criminal defense firm reported that a backup drive containing personal information, including Social Security numbers, was stolen from an employee’s locked trunk.33 It was not encrypted.

Once again in January of 2015. A San Francisco attorney reported theft of a laptop “that contained identifying client information including names, social security numbers and dates of birth.”34

And again in April, 2015. A laptop owned by an attorney from a California law firm was stolen on a San Diego trolley. The laptop reportedly contained names, addresses, telephone

29

E.g., Susan Hansen, “Cyber Attacks Upend Attorney-Client Privilege,” Bloomberg Businessweek (March 19, 2015) www.bloomberg.com/news/articles/2015-03-19/cyber-attacks-force-law-firms-to-improve-data-security and Ed Silverstein, “Law Firm Among the Latest Victims of Ransomware Attack,” Legaltech News (March 11, 2015).

30 www.americanbar.org/content/dam/aba/administrative/cyberalert/ransomware.pdf.

31 Mandiant, M-Trends 2015: From the Front Lines,

www.fireeye.com/current-threats/annual-threat-report.html

32 Tricia Bishop, “Law Firm Loses Hard Drive with Patient Records,” Baltimore Sun (October 10, 2010) http://articles.baltimoresun.com/2011-10-10/news/bs-md-stent-hard-drive-20111010_1_patient-records-law-firm-medical-records.

33 Adam Greenberg, “Backup hard drive stolen from law firm contained personal information,” SC Magazine (August 27, 2014) www.scmagazine.com/backup-hard-drive-stolen-from-law-firm-contained-personal-info/article/368427.

34 https://oag.ca.gov/system/files/Security%20Breach%20Notice_0.pdf

236



http://www.americanbar.org/content/dam/aba/administrative/cyberalert/ransomware.pdf


http://articles.baltimoresun.com/2011-10-10/news/bs-md-stent-hard-drive-20111010_1_patient-records-law-firm-medical-records

http://articles.baltimoresun.com/2011-10-10/news/bs-md-stent-hard-drive-20111010_1_patient-records-law-firm-medical-records

http://www.scmagazine.com/backup-hard-drive-stolen-from-law-firm-contained-personal-info/article/368427

http://www.scmagazine.com/backup-hard-drive-stolen-from-law-firm-contained-personal-info/article/368427

https://oag.ca.gov/system/files/Security%20Breach%20Notice_0.pdf

numbers, Social Security numbers, and possibly certain financial information or medical records. It does not appear to have been encrypted.35

C. Inside Threats

In addition to threats from criminals and hackers and loss and theft of laptops and mobile devices, law firms, like other businesses and enterprises, also face threats from the inside. The insider threat includes a spectrum of trusted employees and third-parties with access - ranging from criminal, to malicious, to disgruntled, to untrained, to careless, to bored, to honestly mistaken. It even includes dedicated employees who just want to use their own technology to do their jobs better. Unauthorized hardware, software, and services can be a threat from insiders in any of these groups. An international survey of IT security professionals reported that 41% of those surveyed viewed rogue employees as the biggest threats to their organizations.36

Another survey reported the following on the scope of the risk from employee use of their own technology:37

It's out there: lurking in cubicles, infiltrating boardrooms, pulsing through desktops and laptops and tablets. Viral. Relentless. Unstoppable.

Rogue IT is the name given to the informal, ad hoc software and devices brought by employees into the workplace. If you've ever taken your own iPad to work or used cloud-based software like Evernote or Dropbox in the office, you may well be an offender. And you're not alone. Some 43% of businesses report that their employees are using cloud services independently of the IT department, according to a recent survey of 500 IT decision makers.

A recognized security consultant has summarized the accidental insider threat this way:38

Much is misunderstood today about the evolving insider threat. …In particular, senior leaders need to realize that their greatest risks aren't from rogue employees looking to cause damage, but rather from inadvertent breaches caused by staffers who simply stumble into costly mistakes.

35 Adam Greenberg, “Personal data on laptop stolen from attorney from California law firm,” SC Magazine (July 23, 2015) www.scmagazine.com/personal-data-on-laptop-stolen-from-attorney-with-california-law-firm/article/428222.

36 Avetco Press Release (June 7, 2013) www.avecto.com/news-events/press-releases/80-of-it-security-professionals-say-their-greatest-threats-are-from-rogue-employees,-malware-exploits-or-unauthorized-software.

37 Ryan Holmes, "’Rogue IT’ is About to Wreak Havoc at Work,” Fortune (August 9, 2012) http://tech.fortune.cnn.com/2012/08/09/rogue-it.

38 Tom Field, “Insider Threat: 'You Can't Stop Stupid,'” BankInfoSecurity, Interview with Eric Cole (July 28, 2010) www.bankinfosecurity.com/insider-threat-you-cant-stop-stupid-a-2789/op-1.

237

http://www.scmagazine.com/personal-data-on-laptop-stolen-from-attorney-with-california-law-firm/article/428222


http://www.avecto.com/news-events/press-releases/80-of-it-security-professionals-say-their-greatest-threats-are-from-rogue-employees,-malware-exploits-or-unauthorized-software



http://tech.fortune.cnn.com/2012/08/09/rogue-it

http://www.bankinfosecurity.com/insider-threat-you-cant-stop-stupid-a-2789/op-1

The FBI’s Chief Information Security Officer expressed the same concern in a presentation on 1 Adam

Greenberg, “Personal data on laptop stolen from attorney from California law firm,” SC Magazine (July 23, 2015) www.scmagazine.com/personal-data-on-laptop-stolen-from-attorney-with-california-law-firm/article/428222.

the FBI’s insider threat program at the 2013 RSA Security Conference.39 The FBI’s program was created after the 2001 Robert Hanssen incident in which an FBI agent was caught stealing information and selling it to the Russians. The CISO noted that authorized users with a level of organizational

trust, who are doing legitimate activities with malicious intent, pose the biggest threat. But a quarter of the incidents that the FBI tracks in its systems on an annual basis are from "knucklehead" problems: unintentional acts in which employees compromise systems by not following procedures, losing equipment and sensitive data, clicking on spam, inappropriate emails or Web links, or mishandling passwords and accounts. He said the FBI IT staff spends about 35% of its response time on these types of incidents.

Insider security incidents are often not publicly disclosed unless they lead to criminal prosecution or required data breach notice laws. For this reason, the availability of statistics and examples is limited. There are several reported incidents of loss or theft of law firm laptops, smartphones and mobile devices. There likely have been many more.

There are also older examples of intentional insider threats in law firms that illustrate the risks. A former Manhattan paralegal was sentenced to prison after pleading guilty to downloading his firm’s 400 page electronic trial plan for an asbestos case and offering to sell it to opposing counsel.40 In another example, a college student who worked for a service provider at a law firm pled guilty to theft of intellectual property.41 The student was brought in to help by his uncle, an employee of the service provider, because they were behind on the job. The firm represented DirectTV in litigation with one of its security vendors. The student worked in a secure area in the law firm’s offices, where he copied paper and electronic data for production in the litigation. He found the technology that controlled access by customers to DirectTV, copied it to a CD, and posted it on a hacker bulletin board. In a third example, a former IT employee of a large law firm pled guilty to theft of 156 computers and monitors from the law firm that he sold on eBay for over $74,000.42 More

39 Ericka Chickowski, “5 Lessons from the FBI Insider Threat Program,” Dark Reading (March 1, 2013) www.darkreading.com/insider-threat/5-lessons-from-the-fbi-insider-threat-pr/240149745.

40 U.S. Department of Justice Press Release, “Manhattan Paralegal Sentenced for Theft of Litigation Trial Plan,” (January 30, 2002).

41 U.S. Department of Justice Press Release, “L.A. Man Pleads Guilty to Theft of Trade Secrets for Stealing Information to DirecTV ‘Smart Card,’” (April 28, 2003).

42 U.S. Department of Justice Press Release, “Second Former Law Firm Employee Sentenced in Connection with Theft of Computers from Law Firm,” (April 20, 2009).

238



http://www.darkreading.com/insider-threat/5-lessons-from-the-fbi-insider-threat-pr/240149745

recently, a Pennsylvania law firm sued a former attorney, alleging that he took thousands of client files using Dropbox.43

In April of 2016, a former law firm IT engineer at a major law firm was sentenced in federal court in Houston to 115 months in prison for an intrusion into the firm’s network. He was convicted in a jury trial of accessing the law firm’s systems on two occasions after he left the firm and “issued instructions and commands that caused significant damage to the network, including deleting or disabling hundreds of user accounts, desktop and laptop accounts, and user e-mail accounts.”44

D. Government Surveillance

In addition to these other growing threats, a current concern for security and confidentiality for attorneys, particularly those representing foreign clients or clients engaged in international transactions, is government surveillance – both by the U.S. government and foreign governments. In August of 2013, the ABA adopted a resolution, recommended by the ABA Cybersecurity Legal Task Force, condemning intrusions into attorneys’ systems and networks, including those by governments.45 It included the following:

RESOLVED, That the American Bar Association condemns unauthorized, illegal governmental, organizational and individual intrusions into the computer systems and networks utilized by lawyers and law firms.

In February of 2014, the New York Times reported that documents leaked by Edward Snowden showed that an American law firm had been monitored by the Australian Signals Directorate, an NSA ally, while the law firm was representing a foreign government in trade disputes with the U.S.46 Following this report, ABA President James Silkenat wrote to the Director and General Counsel of the NSA about this incident, including:47

I write to express our concerns over allegations raised in recent press reports concerning possible foreign government surveillance of American lawyers’

43 Debra Cassens Weiss, “Suit Claims Ex-Partner Installed Software Allowing Continued Access to Law Firm Files, ABA Journal Law News Now (February 13, 2012).

44 U.S. Department of Justice Press Release, “Former Law Firm IT Engineer Convicted in Computer

Intrusion Case is Sentenced to 115 Months in Federal Prison,” (April 15, 2016). www.justice.gov/usao-ndtx/pr/former-law-firm-it-engineer-convicted-computer-intrusion-case-sentenced-115-months.

45 Available at www.americanbar.org/content/dam/aba/administrative/law_national_security/resolution_118.authcheckdam.pdf.

46 James Risen and Laura Poitras, “Spying by N.S.A Ally Entangles U.S. Law Firm,” New York Times (February 15, 2014), www.nytimes.com/2014/02/16/us/eavesdropping-ensnared-american-law-firm.html?_r=0.

47 Letter dated February 20, 2014, www.americanbar.org/content/dam/aba/uncategorized/GAO/2014feb20_privilegedinformation_l.authcheckdam.pdf.

239

http://www.justice.gov/usao-ndtx/pr/former-law-firm-it-engineer-convicted-computer-intrusion-case-sentenced-115-months

http://www.justice.gov/usao-ndtx/pr/former-law-firm-it-engineer-convicted-computer-intrusion-case-sentenced-115-months

http://www.americanbar.org/content/dam/aba/administrative/law_national_security/resolution_118.authcheckdam.pdf

http://www.americanbar.org/content/dam/aba/administrative/law_national_security/resolution_118.authcheckdam.pdf

http://www.nytimes.com/2014/02/16/us/eavesdropping-ensnared-american-law-firm.html?_r=0

http://www.americanbar.org/content/dam/aba/uncategorized/GAO/2014feb20_privilegedinformation_l.authcheckdam.pdf

http://www.americanbar.org/content/dam/aba/uncategorized/GAO/2014feb20_privilegedinformation_l.authcheckdam.pdf

confidential communications with their overseas clients, the subsequent sharing of privileged information from those communications with the National Security Agency (“NSA”), and the possible use of that information by the U.S. Government or third parties.”

NSA Director, General Keith Alexander, responded, noting:48

NSA is firmly committed to the rule of law and the bedrock legal principle of attorney-client privilege, which as you noted, is one of the oldest recognized privileges for confidential communications.

*** Let me be absolutely clear: NSA has afforded, and will continue to afford, appropriate protection to privileged attorney-client communications acquired during its lawful foreign intelligence mission in accordance with privacy procedures required by Congress, approved by the Attorney General, and, as appropriate, reviewed by the Foreign Intelligence Surveillance Court.”

E. Summary of Threats

As these examples of security incidents of all kinds demonstrate, law firm data faces continuing and growing threats. The American Bar Association’s 2015 Technology Survey reports that 15.3% of all responding attorneys reported that their firm had suffered a security breach at some time in the past. This is up from 13.8% the year before. “Security breach” is defined broadly, “lost/stolen computer or smartphone, hacker, break-in, website exploit.” Data is broken down by size of firm, with the percentage reporting breaches increasing with firm size, reaching 23% for firms with 500 or more attorneys:

Solo 11.1%

2-9 16.0%

10-49 14.2%

50-99 15.7%

100-499 22.7%

500 or More

23.0%

All Firms 15.3%

A number of responding attorneys reported that they didn’t know whether their firm had suffered a security breach in the past – 22.9% of all firms, increasing from 4.7% for solos to 67.2% in the largest firms.

Security threats to lawyers and law firms continue to be substantial, real, and growing – data breaches and security incidents have occurred and are occurring. It is critical for attorneys

48 Letter dated March 10, 2014, www.americanbar.org/content/dam/aba/images/abanews/nsa_response_03102014.pdf.

240

http://www.americanbar.org/content/dam/aba/images/abanews/nsa_response_03102014.pdf

and law firms to recognize these threats and address them through comprehensive information security programs.

II. Duty to Safeguard

Attorneys’ use of technology presents special ethics challenges, particularly in the areas of competence and confidentiality. Attorneys also have common law duties to protect client information and may have contractual and regulatory duties. These duties to safeguard information relating to clients are minimum standards with which attorneys are required to comply. Attorneys should aim for even stronger safeguards as a matter of sound professional practice and client service.

A. Ethics Rules

The duty of competence (ABA Model Rule 1.1) requires attorneys to know what technology is necessary and how to use it. The duty of confidentiality (ABA Model Rule 1.6) is one of an attorney’s most fundamental ethical responsibilities. Together, these rules require attorneys using technology to take competent and reasonable measures to safeguard client data. This duty extends to all use of technology, including computers, mobile devices, networks, technology outsourcing, and cloud computing.

Model Rule 1.1 covers the general duty of competence. It provides that “A lawyer shall provide competent representation to a client.” This “requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.” It includes competence in selecting and using technology. It requires attorneys who lack the necessary technical competence for security to consult with qualified people who have the requisite expertise.

Model Rule 1.4, Communications, also applies to attorneys’ use of technology. It requires appropriate communications with clients “about the means by which the client's objectives are to be accomplished,” including the use of technology. It requires keeping the client informed and, depending on the circumstances, may require obtaining “informed consent.” It requires notice to a client of a compromise of confidential information relating to the client.

Model Rule 1.6 generally defines the duty of confidentiality. It begins as follows:

A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b). . . .

Rule 1.6 broadly requires protection of “information relating to the representation of a client;” it is not limited to confidential communications and privileged information.

Attorneys have ethical and common law duties to take competent and reasonable measures to safeguard information relating to clients. They also often have contractual and regulatory duties to protect client information and other types of confidential information.

241

Disclosure of covered information generally requires express or implied client consent (in the absence of special circumstances like misconduct by the client).

The ABA Commission on Ethics 20/20 conducted a review of the ABA Model Rules of Professional Conduct and the U.S. system of lawyer regulation in the context of advances in technology and global legal practice developments. One of its core areas of focus was technology and confidentiality. Its Revised Draft Resolutions in this area were adopted by the ABA at its Annual Meeting in August of 2012.49

The 2012 amendments include addition of the following highlighted language to the Comment to Model Rule 1.1 Competence:

[8] To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology…

As of December 23, 2015, 20 states have adopted the new comment to Model Rule 1.1, some with variations from the ABA language.50 Andrew Perlman, the Reporter of the Ethics 20/20 Commission, has described cybersecurity as one of the critical competencies in attorneys’ use of technology.51

The amendments also added the following new subsection (highlighted) to Model Rule 1.6 Confidentiality of Information:

(c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

This requirement covers two areas – inadvertent disclosure and unauthorized access. Inadvertent disclosure includes threats like leaving a briefcase, laptop, or smartphone in a taxi or restaurant, sending a confidential e-mail to the wrong recipient, producing privileged documents or data in litigation, or exposing confidential metadata. Unauthorized access includes threats like hackers, criminals, malware, and insider threats.

The amendments also include the following changes to Comment [18] to this rule:

Acting Competently to Preserve Confidentiality

[18] Paragraph (c) requires a A lawyer must to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure by the lawyer or other persons or entities who are participating in the

49www.americanbar.org/groups/professional_responsibility/aba_commission_on_ethics_20_20.html.

50 www.lawsitesblog.com/2015/03/11-states-have-adopted-ethical-duty-of-technology-competence.html.

51 Andrew Perlman, “The Twenty-First Lawyer’s Evolving Ethical Duty of Competence,” The Professional Lawyer (December 2014) http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2532995.

242

http://www.americanbar.org/groups/professional_responsibility/aba_commission_on_ethics_20_20.html

http://www.lawsitesblog.com/2015/03/11-states-have-adopted-ethical-duty-of-technology-competence.html

http://www.lawsitesblog.com/2015/03/11-states-have-adopted-ethical-duty-of-technology-competence.html

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2532995

representation of the client or who are subject to the lawyer’s supervision or monitoring. See Rules 1.1, 5.1 and 5.3. The unauthorized access to, or the inadvertent or unauthorized disclosure of, confidential information does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure. Factors to be considered in determining the reasonableness of the lawyer’s efforts include the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use). A client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to forego security measures that would otherwise be required by this Rule. Whether a lawyer may be required to take additional steps to safeguard a client’s information in order to comply with other law, such as state and federal laws that govern data privacy or that impose notification requirements upon the loss of, or unauthorized access to, electronic information, is beyond the scope of these Rules. For a lawyer’s duties when sharing information with nonlawyers outside the lawyer’s own firm, see Rule 5.3, Comments [3]-[4].

Significantly, these revisions make explicit what is already required rather than making substantive changes. They are consistent with the then existing rules and comments, ethics opinions, and generally accepted information security principles.52

Model Rule 5.3 (Responsibilities Regarding Nonlawyer Assistants) was amended to expand its scope. “Assistants” was expanded to “Assistance,” extending its coverage to all levels of staff and outsourced services ranging from copying services to outsourced legal services. This requires attorneys to employ reasonable safeguards, like due diligence, contractual requirements, supervision, and monitoring, to insure that nonlawyers, both inside and outside a law firm, provide services in compliance with an attorney’s duty of confidentiality.

52 ABA Commission on Ethics 20/20, Report to Resolution 105A Revised (2012): “The proposed amendment, which appears in a Comment, does not impose any new obligations on lawyers. Rather, the amendment is intended to serve as a reminder to lawyers that they should remain aware of technology, including the benefits and risks associated with it, as part of a lawyer’s general ethical duty to remain competent.” (Model Rule 1.1.) “This duty is already described in several existing Comments, but the Commission concluded that, in light of the pervasive use of technology to store and transmit confidential client information, this existing obligation should be stated explicitly in the black letter of Model Rule 1.6.”

243

B. Ethics Opinions

A number of state ethics opinions have addressed professional responsibility issues related to security in attorneys’ use of various technologies. Consistent with the Ethics 20/20 amendments, they generally require competent and reasonable safeguards. It is important for attorneys to consult the rules, comments, and ethics opinions in the relevant jurisdiction(s).

An early example is State Bar of Arizona, Opinion No. 05-04 (July 2005) (Formal Opinion of the Committee on the Rules of Professional Conduct). It requires “competent and reasonable steps to assure that the client’s confidences are not disclosed to third parties through theft or inadvertence” and “competent and reasonable measures to assure that the client’s electronic information is not lost or destroyed.” It further explains that “an attorney must either have the competence to evaluate the nature of the potential threat to the client’s electronic files and to evaluate and deploy appropriate computer hardware and software to accomplish that end, or if the attorney lacks or cannot reasonably obtain that competence, to retain an expert consultant who does have such competence.”

Additional examples include New Jersey Advisory Committee on Professional Ethics, Opinion 701, “Electronic Storage and Access of Client Files” (April, 2006), State Bar of Arizona, Opinion No. 09-04 (December, 2009): “Confidentiality; Maintaining Client Files; Electronic Storage; Internet” (Formal Opinion of the Committee on the Rules of Professional Conduct); State Bar of California, Standing Committee on Professional Responsibility and Conduct, Formal Opinion No. 2010-179; and New York State Bar Association Ethics Opinion 1019, “Confidentiality; Remote Access to Firm’s Electronic Files,” (August, 2014).

Significantly, California Formal Opinion No. 2010-179 advises attorneys that they must consider security before using a particular technology in the course of representing a client.

It notes that attorneys “must take appropriate steps to evaluate,” among other considerations, “the level of security attendant to the use of that technology, including whether reasonable precautions may be taken when using the technology to increase the level of security.” Depending on the circumstances, an attorney may be required to avoid using a particular technology or to advise a client of the risks and seek informed consent if appropriate safeguards cannot be

employed. The opinion covers use of a firm-issued laptop and use of public and home wireless networks.

New York Opinion 1019 cautions attorneys to analyze necessary precautions in the context of current risks:

Cyber-security issues have continued to be a major concern for lawyers, as cyber-criminals have begun to target lawyers to access client information, including trade secrets, business plans and personal data. Lawyers can no longer assume that their document systems are of no interest to cyber-crooks. That is particularly true where there is outside access to the internal

Before using a particular technology in the course of representing a client, an attorney must take appropriate steps to evaluate the security.

244

system by third parties, including law firm employees working at other firm offices, at home or when traveling, or clients who have been given access to the firm's document system.

The opinion leaves it up to attorneys and law firms to determine the specific precautions that are necessary:

Because of the fact-specific and evolving nature of both technology and cyber risks, we cannot recommend particular steps that would constitute reasonable precautions to prevent confidential information from coming into the hands of unintended recipients, including the degree of password protection to ensure that persons who access the system are authorized, the degree of security of the devices that firm lawyers use to gain access, whether encryption is required, and the security measures the firm must use to determine whether there has been any unauthorized access to client confidential information.

Like California Opinion 2010-179, it requires attorneys to either make a determination that the selected precautions provide reasonable protection, in light of the risks, or to obtain informed consent from clients after explaining the risks.

Attorneys need to stay up to date as technology changes and new threats are identified. For example, following news reports that confidential information had been found on digital copiers that were ready for resale,53 the Florida Bar issued Professional Ethics of the Florida Bar Opinion 10-2 (September, 2010) that addresses this risk. Its conclusion states:

In conclusion, when a lawyer chooses to use Devices that contain Storage Media, the lawyer must take reasonable steps to ensure that client confidentiality is maintained and that the Device is sanitized before disposition. These reasonable steps include: (1) identification of the potential threat to confidentiality along with the development and implementation of policies to address the potential threat to confidentiality; (2) inventory of the Devices that contain Hard Drives or other Storage Media; (3) supervision of nonlawyers to obtain adequate assurances that confidentiality will be maintained; and (4) responsibility for sanitization of the Device by requiring meaningful assurances from the vendor at the intake of the Device and confirmation or certification of the sanitization at the disposition of the Device.

There are now multiple ethics opinions on attorneys’ use of cloud computing services like online file storage and software as a service (SaaS).54 For example, New York Bar Association

53 E.g., Armen Keteyian, “Digital Copiers Loaded with Secrets,” CBS Evening News (April 19, 2010). www.cbsnews.com/news/digital-photocopiers-loaded-with-secrets.

54 The ABA Legal Technology Resource Center has published a summary with links, “Cloud Ethics Opinions around the U.S.,” available at

245

http://www.cbsnews.com/news/digital-photocopiers-loaded-with-secrets

Committee on Professional Ethics Opinion 842 “Using an outside online storage provider to store client confidential information” (September, 2010), consistent with the general requirements of the ethics opinions above, concludes:

A lawyer may use an online data storage system to store and back up client confidential information provided that the lawyer takes reasonable care to ensure that confidentiality is maintained in a manner consistent with the lawyer's obligations under Rule 1.6. A lawyer using an online storage provider should take reasonable care to protect confidential information, and should exercise reasonable care to prevent others whose services are utilized by the lawyer from disclosing or using confidential information of a client. In addition, the lawyer should stay abreast of technological advances to ensure that the storage system remains sufficiently advanced to protect the client's information, and the lawyer should monitor the changing law of privilege to ensure that storing information in the "cloud" will not waive or jeopardize any privilege protecting the information.

Additional examples of opinions covering cloud services are Pennsylvania Bar Association, Committee on Legal Ethics and Professional Responsibility, Formal Opinion 2011-200, “Ethical Obligations for Attorneys Using Cloud Computing/Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property” (November, 2011) and North Carolina State Bar 2011 Formal Ethics Opinion 6, “Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property” (January, 2012).

The North Carolina State Bar recently issued 2015 Formal Ethics Opinion 6, “Lawyer’s Professional Responsibility When Third Party Steals Funds from Trust Account” (October 2015) that applies the duty of reasonable measures to safeguard client funds. Interpreting the state equivalent of Model Rule 1.15, Safeguarding Property, to 7 different inquiries. Its headnote states:

Opinion rules that when funds are stolen from a lawyer’s trust account by a third party who is not employed or supervised by the lawyer, and the lawyer was managing the trust account in compliance with the Rules of Professional Conduct, the lawyer is not professionally responsible for replacing the funds stolen from the account.

Significantly, in one example, the opinion concludes that the lawyer would have an ethical obligation to reimburse a client for real estate closing funds that the lawyer wire transferred to a hacker’s bank account in response to a spoofed e-mail, where the lawyer did not verify the change in disbursement instructions.

The opinion is limited to a lawyer’s professional responsibility requirements and does not opine on a lawyer’s legal liability. www.americanbar.org/groups/departments_offices/legal_technology_resources/resources/charts_fyis/cloud-ethics-chart.html.

246

http://www.americanbar.org/groups/departments_offices/legal_technology_resources/resources/charts_fyis/cloud-ethics-chart.html

http://www.americanbar.org/groups/departments_offices/legal_technology_resources/resources/charts_fyis/cloud-ethics-chart.html

The key professional responsibility requirements from these various opinions on attorneys’ use of technology are competent and reasonable measures to safeguard client data, including an understanding of limitations in attorneys’ competence, obtaining appropriate assistance, continuing security awareness, appropriate supervision, and ongoing review as technology, threats, and available safeguards evolve. They also require obtaining clients’ informed consent in some circumstances.

C. Ethics Rules – Electronic Communications

E-mail and electronic communications have become everyday communications forms for attorneys and other professionals. They are fast, convenient, and inexpensive, but also present serious risks. It is important for attorneys to understand and address these risks.

In addition to adding the requirement of competent safeguards to protect confidentiality to the Comments to Rule 1.6, the Ethics 2000 revisions to the Model Rules, over 10 years ago, also added Comment 17 [now 19] to Rule 1.6. This comment requires reasonable precautions to safeguard and preserve confidential information during electronic transmission. This Comment, as amended in accordance with the Ethics 20/20 recommendations (highlighted), provides:

[19] When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions. Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement. A client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to the use of a means of communication that would otherwise be prohibited by this Rule. Whether a lawyer may be required to take additional steps in order to comply with other law, such as state and federal laws that govern data privacy, is beyond the scope of these Rules.

This Comment requires attorneys to take “reasonable precautions” to protect the confidentiality of electronic communications. Its language about “special security measures” has often been viewed by attorneys as providing that attorneys never need to use “special security measures” like encryption. 55 While it does state that “special security measures”

55 Encryption is a process that translates a message into a protected electronic code.

The recipient (or anyone intercepting the message) must have a key to decrypt it and make it readable. E-mail

247

are not generally required, it contains qualifications and notes that “special circumstances” may warrant “special precautions.” It includes the important qualification - “if the method of communication affords a reasonable expectation of privacy.” There are, however, questions about whether Internet e-mail affords a reasonable expectation of privacy.

Respected security professionals for years have compared unencrypted e-mail to postcards or postcards written in pencil.56

A June 2014 post by Google on the Google Official Blog57 and a July 2014 New York Times article58 use the same analogy – comparing unencrypted e-mails to postcards.

Reasonable expectation of privacy?

encryption has become easier to use over time. Transport layer security (TLS) encryption is available to automatically encrypt e-mail between two e-mail gateways. If a law firm and client each have their own e-mail gateways, TLS can be used to automatically encrypt all e-mails between them.

A virtual private network is an arrangement in which all communications between two networks or between a computer and a network are automatically protected with encryption. See, David G. Ries and John W. Simek, “Encryption Made Simple for Lawyers,” GPSolo Magazine (November/December 2012).

56 E.g., B. Schneier, E-Mail Security - How to Keep Your Electronic Messages Private, (John Wiley & Sons, Inc. 1995) p. 3, B. Schneier, Secrets & Lies: Digital Security in a Networked Work, (John Wiley & Sons, Inc. 2000) p. 200, and Larry Rogers, Email – A Postcard Written in Pencil, Special Report, (Software Engineering Institute, Carnegie Mellon University 2001).

57 “Transparency Report: Protecting Emails as They Travel Across the Web,” Google Official Blog (June 3, 2014) http://googleblog.blogspot.com/2014/06/transparency-report-protecting-emails.html.

58 Molly Wood, “Easier Ways to Protect Email From Unwanted Prying Eyes,” New York Times (July 16, 2014)

www.nytimes.com/2014/07/17/technology/personaltech/ways-to-protect-your-email-after-you-send-it.html?_r=0.

“Emails that are encrypted as they’re routed from sender to receiver are like sealed envelopes, and less vulnerable to snooping—whether by bad actors or through government surveillance—than postcards.” Google Official Blog June 2014

"The common metaphor for Internet e-mail is postcards: Anyone – letter carriers, mail sorters, nosy delivery truck drivers - who can touch the postcard can read what's on the back." Bruce Schneier 1995

Email – A Postcard Written in Pencil Larry Rogers 2001 SEI - Carnegie Mellon University

248

http://googleblog.blogspot.com/2014/06/transparency-report-protecting-emails.html

http://www.nytimes.com/2014/07/17/technology/personaltech/ways-to-protect-your-email-after-you-send-it.html?_r=0

http://www.nytimes.com/2014/07/17/technology/personaltech/ways-to-protect-your-email-after-you-send-it.html?_r=0

Encryption is being increasingly required in areas like banking and health care. Newer laws in Nevada59

and Massachusetts60 (which apply to attorneys as well as others) require defined

personal information to be encrypted when it is electronically transmitted. As the use of encryption grows in areas like these, it will become more difficult for attorneys to demonstrate that confidential client data that they transmit needs lesser protection.

Comment 19 to Rule 1.6 also lists “the extent to which the privacy of the communication is protected by law” as a factor to be considered. The federal Electronic Communications Privacy Act61 and similar state laws make unauthorized interception of electronic communications a crime. Some observers have expressed the view that this should be determinative and attorneys are not required to use encryption. The better view is to treat legal protection as only one of the factors to be considered. As discussed below, some of the newer ethics opinions conclude that encryption may be a reasonable measure that should be used, particularly for highly sensitive information.

D. Ethics Opinions – Electronic Communications

An ABA ethics opinion in 1999 and several state ethics opinions have concluded that special security measures, like encryption, are not generally required for confidential attorney e-mail.62

However, these opinions should be carefully reviewed because, like Comment 19, they contain qualifications that limit their general conclusions. In addition, more recent ethics opinions, discussed below, are increasingly recognizing that encryption may be a required safeguard in some circumstances.

59 Nev. Rev. Stat. 603A.010, et seq.

60 Mass. Gen. Laws Ch. 93H, regulations at 201 CMR 17.00.

61 18 U.S.C. §§ 2510 et seq.

62 E.g., ABA Formal Opinion No. 99-413, Protecting the Confidentiality of Unencrypted E-Mail (March 10, 1999) (“based upon current technology and law as we are informed of it …a lawyer sending confidential client information by unencrypted e-mail does not violate Model Rule 1.6(a)…” “…this opinion does not, however, diminish a lawyer's obligation to consider with her client the sensitivity of the communication, the costs of its disclosure, and the relative security of the contemplated medium of communication. Particularly strong protective measures are warranted to guard against the disclosure of highly sensitive matters.”) and District of Columbia Bar Opinion 281, “Transmission of Confidential Information by Electronic Mail,” (February, 1998), (“In most circumstances, transmission of confidential information by unencrypted electronic mail does not per se violate the confidentiality rules of the legal profession. However, individual circumstances may require greater means of security.”).

"Security experts say email is a lot more like a postcard than a letter inside an envelope, and almost anyone can read it while the note is in transit.” New York Times July 2014

249

As an example of the earlier approach, New York Bar Association Committee on Professional Ethics Opinion 709 “Use of Internet to advertise and to conduct law practice focusing on trademarks; use of Internet e-mail; use of trade names” (September, 1998) concludes:

We therefore conclude that lawyers may in ordinary circumstances utilize unencrypted Internet e-mail to transmit confidential information without breaching their duties of confidentiality … to their clients, as the technology is in use today. Despite this general conclusion, lawyers must always act reasonably in choosing to use e-mail for confidential communications, as with any other means of communication. Thus, in circumstances in which a lawyer is on notice for a specific reason that a particular e-mail transmission is at heightened risk of interception, or where the confidential information at issue is of such an extraordinarily sensitive nature that it is reasonable to use only a means of communication that is completely under the lawyer's control, the lawyer must select a more secure means of communication than unencrypted Internet e-mail.

A lawyer who uses Internet e-mail must also stay abreast of this evolving technology to assess any changes in the likelihood of interception as well as the availability of improved technologies that may reduce such risks at reasonable cost. It is also sensible for lawyers to discuss with clients the risks inherent in the use of Internet e-mail, and lawyers should abide by the clients’ wishes as to its use.

This opinion, like the Comment, concluded that attorneys may use unencrypted e-mail “in ordinary circumstances,” but added some qualifications, including available safeguards to reduce risk.

Consistent with the questions raised by security experts about the security of unencrypted e-mail, some ethics opinions express a stronger view that encryption may be required. For example, New Jersey Opinion 701 (April, 2006), discussed above, notes at the end: “where a document is transmitted to [the attorney]… by email over the Internet, the lawyer should password a confidential document (as is now possible in all common electronic formats, including PDF), since it is not possible to secure the Internet itself against third party access.”63 This was over nine years ago.

California Formal Opinion No. 2010-179, also discussed above, notes that “encrypting email may be a reasonable step for an attorney in an effort to ensure the confidentiality of such communications remain so when circumstances call for it, particularly if the information at issue is highly sensitive and the use of encryption is not onerous.”

63 File password protection in some software, like current versions of Microsoft Office, Adobe Acrobat, and WinZip uses encryption to protect security. It is generally easier to use than encryption of e-mail and attachments. However, the protection can be limited by use of weak passwords that are easy to break or “crack.”

250

An Iowa opinion on cloud computing suggests the following as one of a series of questions that attorneys should ask when determining appropriate protection: “Recognizing that some data will require a higher degree of protection than others, will I have the ability to encrypt certain data using higher level encryption tools of my choosing?” Iowa Ethics Opinion 11-01.

A Pennsylvania ethics opinion on cloud computing concludes that “attorneys may use email but must, under appropriate circumstances, take additional precautions to assure client confidentiality.” It discusses encryption as an additional precaution that may be required when using services like web mail. Pennsylvania Formal Opinion 2011-200.

Texas Ethics Opinion 648 (2015) takes the same approach:

In general, considering the present state of technology and email usage, a lawyer may communicate confidential information by email. In some circumstances, however, a lawyer should consider whether the confidentiality of the information will be protected if communicated by email and whether it is prudent to use encrypted email or another form of communication.

It includes examples of circumstances where encryption may be required.

Summarizing these more recent opinions, a July, 2015 ABA article notes:64

The potential for unauthorized receipt of electronic data has caused some experts to revisit the topic and issue [ethics] opinions suggesting that in some circumstances, encryption or other safeguards for certain email

communications may be required.

In addition to complying with any applicable ethics and legal requirements, the most prudent approach to the ethical duty of protecting confidentiality is to have an express understanding with clients (preferably in an engagement letter or other writing) about the nature of communications that will be (and will not be) sent electronically and whether or not encryption and other security measures will be utilized.

It has now reached the point (or at least is reaching it) where all attorneys should have encryption available for use in appropriate circumstances.

E. Common Law Duties

Along with these ethical duties, there are also parallel common law duties defined by case law in the various states. The Restatement (3rd) of the Law Governing Lawyers (2000) summarizes this area of the law. See, Section 16(2) on competence and diligence, Section

64 Peter Geraghty and Susan Michmerhuizen, “Encryption Conniption,” Eye on Ethics, Your ABA (July 2015) www.americanbar.org/publications/youraba/2015/july-2015/encryption-conniption.html.

“The potential for unauthorized receipt of electronic data has caused some experts to revisit the topic and issue [ethics] opinions suggesting that in some circumstances, encryption or other safeguards for certain email communications may be required.” ABA, Eye on Ethics (July 2015)

251

http://www.americanbar.org/publications/youraba/2015/july-2015/encryption-conniption.html

16(3) on complying with obligations concerning client’s confidences, and Chapter 5, “Confidential Client Information.” Breach of these duties can result in a malpractice action.

There are also instances when lawyers have contractual duties to protect client data. This is particularly the case for clients in regulated industries, such as health care and financial services, that have regulatory requirements to protect privacy and security. Clients are increasingly recognizing, sometimes after being pressed by regulators, that law firms may be the weak links in protecting their confidential information. They are increasingly requiring specified safeguards, providing questionnaires about a law firm’s security, and even requiring security audits.65

F. Laws and Regulations Covering Personal Information

In addition to the ethical and common law duties to protect client information, various state and federal statutes and regulations require protection of defined categories of personal information. Some of them are likely to apply to lawyers who possess any covered personal information about their employees, clients, clients’ employees or customers, opposing parties and their employees, or even witnesses.

At least 13 states now have general information security laws that require reasonable measures to protect defined categories of personal information (including Arkansas, California, Connecticut, Illinois, Maryland, Massachusetts, Nevada, New Jersey, New York, Oregon, Rhode Island, Texas, and Utah). While the scope of coverage, the specificity of the requirements and the definitions vary among these laws, “personal information” is usually defined to include general or specific facts about an identifiable individual. The exceptions tend to be information that is presumed public and does not have to be protected (e.g., a business address).

The most comprehensive law of this type to date is a Massachusetts law,66 which applies to

“persons who own, license, store or maintain personal information about a resident of the

Commonwealth of Massachusetts.” Covered “personal information” includes Social Security

numbers, driver’s license numbers, state-issued identification card numbers, financial

account numbers and credit card numbers. With its broad coverage of “persons,” this law is

likely to be applied to persons nationwide, including attorneys and law firms, when they

have sufficient contacts with Massachusetts to satisfy personal jurisdiction requirements. It

requires covered persons to “develop, implement, and maintain a comprehensive

65 Kenneth N. Rashbaum, Jason M. Tenenbaum and Liberty McAteer, “Cybersecurity: Business Imperative for Law Firms,” New York Law Journal (December 10, 2014) www.newyorklawjournal.com/id=1202678493487/Cybersecurity-Business-Imperative-for-Law-Firms?slreturn=20141127155939 and Sharon D. Nelson & John W. Simek, “Clients Demand Law Firm Cyber Audits,” Law Practice (November/December 2013) www.americanbar.org/publications/law_practice_magazine/2013/november-december/hot-buttons.html.

66 Mass. Gen. Laws Ch. 93H.

252

http://www.newyorklawjournal.com/id=1202678493487/Cybersecurity-Business-Imperative-for-Law-Firms?slreturn=20141127155939

http://www.newyorklawjournal.com/id=1202678493487/Cybersecurity-Business-Imperative-for-Law-Firms?slreturn=20141127155939

http://www.americanbar.org/publications/law_practice_magazine/2013/november-december/hot-buttons.html

http://www.americanbar.org/publications/law_practice_magazine/2013/november-december/hot-buttons.html

information security program that is written in one or more readily accessible parts and

contains administrative, technical, and physical safeguards.”

The implementing regulation67 for the Massachusetts law became effective in 2010. In

addition to requiring a comprehensive information security program, including a risk

assessment, the regulation contains detailed requirements for the information security

program and detailed computer system security requirements. The security requirements

include:

• Encryption of all transmitted records and files containing personal

information that will travel across public networks, and encryption of all

data containing personal information to be transmitted wirelessly; and

• Encryption of all personal information stored on laptops or other portable

devices.

Additional system security requirements in the Massachusetts regulation are secure user

authentication, secure access control, reasonable monitoring to detect unauthorized access,

reasonably up-to-date firewall protection, reasonably up-to-date security software (including

current patches and virus definitions), and education and training of employees.

Lawyers and law firms should think about and understand the consequences of the Massachusetts law, as some observers believe that it will become a model for comprehensive protection of personal information.

Nevada also has laws that require “reasonable security measures” and encryption68 although they are much less detailed than the Massachusetts law. Note too that encryption is already required for federal agencies that have information about individuals on laptops and portable media. As encryption becomes a legal requirement in areas like these, it is likely to become the standard of what is reasonable for lawyers.

The legal obligations don’t stop, however, at protecting the confidentiality of information. Forty-seven states and the District of Columbia and the Virgin Islands have laws that require notification concerning data breaches (all but Mississippi, New Mexico and South Dakota). While there are differences in their scope and requirements, they generally require entities that own, license or possess defined categories of personally identifiable information about individuals to notify affected individuals if there is a breach. Like the reasonable security laws, many of these laws apply to covered information “about” residents of the state. Some require notice to a state agency in addition to notice to consumers. Most of these laws have encryption safe harbors, which provide that notice is not required if the data is encrypted and the decryption key has not been compromised.

67 201 C.M.R. 17.00. 68 Nevada Revised Statutes 603A.210 and 597.970.

253

To add to the web of issues involved, at least 19 states also now have laws that require secure disposal of paper and electronic records that contain defined personal information. The Federal Trade Commission’s Disposal Rule69 has similar requirements for consumer credit reports and information derived from them.

At the federal level, an attorney who receives personally identifiable protected health information (PHI) from a covered entity under the Health Insurance Portability & Accountability Act (HIPAA) will generally be a “business associate” and be required to comply with the HIPAA security requirements. The 2009 Healthcare Information Technology and Clinical Health (HITECH) Act enhanced HIPAA security requirements, extended them directly to business associates, and added a new breach notification requirement. Encryption is included as an “addressable” requirement, which means that it or an alternative must be implemented or a written explanation provided to explain why it is not needed.70 In addition, the Federal Trade Commission has brought a number of enforcement actions against businesses based on allegations that they failed to take reasonable measures to safeguard the privacy and security of personal information about consumers. In over half of them, settlements required the businesses to employ additional safeguards, including encryption of personal information in transmission and storage.71

G. Summary of Duties

The ethics rules and common law duties require attorneys to take competent and reasonable measures to safeguard client data, including an understanding of limitations in attorneys’ competence, obtaining qualified assistance, continuing security awareness, appropriate supervision, and ongoing review as technology, threats, and available security evolve. These ethical and common law duties, as well as any applicable contractual and regulatory duties, are minimum standards of conduct. Attorneys should aim for even stronger safeguards as a matter of sound professional practice and client service. While the risks of disciplinary proceedings, malpractice claims, and regulatory actions arising from security breaches are real, the greatest risks are often dissatisfied clients (or former clients) and harm to professional reputation.

III. Information Security Basics

Information security is a process to protect the confidentiality, integrity, and availability of information. Comprehensive security must address people, policies and procedures, and technology. While technology is a critical component of effective security, the other aspects must also be addressed. As explained by Bruce Schneier, a highly respected security 69 16 C.F.R. Part 682.

70 See, 45 CFR Parts 160 and 164.

71 Patricia Bailin, “Study: What FTC Enforcement Actions Teach Us about Features of Reasonable Privacy and Data Security Practices,” The Privacy Advisor (Sept. 19, 2014), https://privacyassociation.org.

The best technical security is likely to fail without adequate attention to people and policies and procedures.

254

https://privacyassociation.org/

professional, "[i]f you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology."72 The best technical security is likely to fail without adequate attention to people and policies and procedures. Many attorneys incorrectly think that security is just for the IT department or consultants. While IT has a critical role, everyone, including management, all attorneys, and all support personnel, must be involved for effective security.

An equally important concept is that security requires training and ongoing attention. It must go beyond a onetime “set it and forget it” approach. A critical component of a law firm security program is constant vigilance and security awareness by all users of technology. As a recent ABA report aptly put it:73

Lawyers must commit to understanding the security threats that they face, they must educate themselves about the best practices to address those threats, and they must be diligent in implementing those practices every single day.

(Emphasis added.)

Security starts with an inventory of information assets to determine what needs to be protected and then a risk assessment to identify anticipated threats to the information assets. The next step is development, implementation, and maintenance of a comprehensive information security program to employ reasonable physical, administrative, and technical safeguards to protect against identified risks. This is generally the most difficult part of the process. It must address people, policies and procedures, and technology and include policies, assignment of responsibility, training, ongoing security awareness, monitoring for compliance, and periodic review and updating. In addition to measures to safeguard data, security also requires measures to detect security incidents and breaches, to respond to them, and to recover from them.

At the ABA Annual Meeting in August, 2014, the ABA adopted a resolution on cybersecurity that is consistent with this general approach:74

RESOLVED, That the American Bar Association encourages all private and public sector organizations to develop, implement, and maintain an appropriate cybersecurity program that complies with applicable ethical and legal obligations and is tailored to the nature and scope of the organization and the data and systems to be protected.

It recommends an appropriate cybersecurity program for all private and public sector organizations, which includes law firms.

72 Bruce Schneier, Secrets and Lies - Digital Security in a Networked World (John Wiley & Sons, Inc. 2000) at p. xii.

73 Joshua Poje, “Security Snapshot: Threats and Opportunities,” ABA TECHREPORT 2013 (ABA Legal Technology Resource Center 2013). 74 Available at www.americanbar.org/content/dam/aba/images/abanews/2014am_hodres/109.pdf.

255

http://www.americanbar.org/content/dam/aba/images/abanews/2014am_hodres/109.pdf

The requirement for lawyers is reasonable security, not absolute security. For example, New Jersey Ethics Opinion 701 states “’[r]easonable care,’ however, does not mean that the lawyer absolutely and strictly guarantees that the information will be utterly invulnerable against all unauthorized access. Such a guarantee is impossible…” Recognizing this concept, the Ethics 20/20 amendments to the Comment to Model Rule 1.6 include “…[t]he unauthorized access to, or the inadvertent or unauthorized disclosure of, confidential information does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure.”

Security involves thorough analysis and often requires balancing and trade-offs to determine what risks and safeguards are reasonable under the circumstances. There is frequently a trade-off between security and usability. Strong security often makes technology very difficult to use, while easy to use technology is frequently insecure. The challenge is striking the correct balance among all of these often competing factors.

The Ethics 20/20 amendments to Comment 18 to Rule 1.6 provide some high level guidance. As discussed above, the following factors are applied for determining reasonable and competent safeguards:

Factors to be considered in determining the reasonableness of the lawyer’s efforts include the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

This is a risk-based approach that is now standard in information security.

IV. Reasonable Safeguards

The greatest challenge for lawyers in establishing cybersecurity programs is generally deciding what security measures are necessary and then implementing and maintaining them. Determining what constitute “competent and reasonable measures” can be difficult.

The ethics requirements are the floor—anything less is a violation of attorneys’ professional responsibility obligations. Attorneys should aim for stronger safeguards to protect their clients and themselves. They must meet legal requirements for personally identifiable information and protected health information like HIPAA or the Massachusetts law, if they apply, and any requirements to which attorneys have agreed by contract. In determining what is reasonable, attorneys can look to guidance from bar groups, legal standards in other areas, government publications, and consensus security standards.

The American Bar Association regularly publishes materials and provides educational programs on information security. Examples include the Law Practice Division75 (with resources like books, webinars, the Legal Technology Resource Center (LTRC), ABA

75 www.lawpractice.org.

256

http://www.lawpractice.org/

TECHSHOW, and articles in Law Practice magazine and Law Practice Today webzine), the Cybersecurity Legal Taskforce, the Standing Committee on Law and National Security, the Section of Science and Technology’s Information Security Committee and the Business Law Section’s Cyberspace Law Committee. Many state bar associations provide similar materials and programs. This kind of information is particularly helpful to attorneys because it is tailored to the practice of law.

The International Legal Technology Association (ILTA),76 a professional organization devoted to technology for law firms and law departments, regularly provides security education and materials and has peer groups that regularly exchange information. ILTA has established the LegalSEC initiative that has been working for several years to provide the legal community with tailored guidelines for risk-based information security programs. It conducts an annual LegalSEC Summit and provides additional educational programs and resources.

A. Security Frameworks and Standards

There are numerous security frameworks, standards and guidance documents that can be used for implementing law firm information security programs. It is important to select and use one or more that fit the size of the firm and the sensitivity of the information to use as an overall approach. This can be a daunting task with the alphabet soup of available resources: NIST, ISO, FTC, SANS, US-CERT, ILTA and more.

The National Institute of Standards and Technology (NIST), part of the U.S. Department of Commerce, has published the NIST Framework for Improving Critical Infrastructure, Version 1.0 (February 12, 2014).77 While the Framework is aimed at security of critical infrastructure, it is based on generally accepted security principles that can apply to all kinds of businesses and enterprises, including law firms. The core security Functions in the Framework are “identify, protect, detect, respond and recover.” Under these core Functions, the Framework includes details through Categories, Subcategories, and Information Sources. These core Functions should shape any law firm’s cybersecurity program. It includes cross-references to other security standards, including the ones discussed below, in Table 2 in Appendix A.

76 www.iltanet.org.

77 www.nist.gov/itl/csd. The Framework is available at www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf.

257

http://www.iltanet.org/



The Framework follows an evolving approach to security, which recognizes the increasing importance of detection and response. For years, the major emphasis was on protection. While detection and incident response have long been necessary parts of comprehensive information security, they have too often taken a back seat to protection. Their increasing importance is now being recognized. Gartner, a leading technology consulting firm, has predicted that by 2020, 60% of enterprises' information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2014.78 Some technology attorneys and security professionals have expressed the view that the Framework will become a or the de facto standard for an overall approach to reasonable security in the United States.

The ISO 27000 series of standards, published by the International Organization for Standardization (ISO), are consensus international standards for a comprehensive Information Security Management System (ISMS), including its elements, processes, and controls.79 The systems are described in ISO/IEC 27000:2014 – Overview and Vocabulary. There are various additional standards in the series that provide additional details. Together, they provide the overall framework and details for establishing, implementing, monitoring, and continually improving an ISMS. The core standards include: ISO/IEC 27001:2013 - Information Security Management Systems— Requirements, ISO/IEC 27002:2013 - Code of Practice for Information Security Management Controls, and ISO/IEC 27005:2011 - Information Security Risk Management. There is a formal process under which an organization’s ISMS can be formally certified under ISO/IEC 27001 by a qualified third-party. While a limited, but slowly growing, number of law firms report having or seeking formal certification under the ISO 27000 standards, a greater number report using these standards, or parts of them, as guides. ILTA’s LegalSEC initiative has been focusing on aligning the legal community with the 27000 standards.

In addition to the Framework, NIST has published numerous security standards and guidance documents and periodically updates them. While compliance with many of them is required for government agencies and government contractors, they can be used as guidance by other enterprises, including law firms. Many of them are very technical and more appropriate for government agencies and large companies (and large law firms), but some are basic and tailored for small and midsize businesses.

NIST Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations (April 2013) and standards referenced in it provide a comprehensive catalog of controls and a process for selection and implementation of them through a risk management process. While designed for federal agencies, the NIST process and various NIST standards can be used by law firms or businesses as guides. There is no

78 http://blogs.gartner.com/anton-chuvakin/2014/02/24/new-research-on-dealing-with-advanced-threats.

79 www.iso.org.

258



http://www.iso.org/

formal process for certification under NIST like there is under ISO 27001. Some law firms have reported that they are aligning their security programs with NIST standards.

There are NIST standards and guidance documents that are tailored to small and mid-size businesses. NIST’s Small Business Information Security: The Fundamentals, Draft NISTR 7621, Revision 1 (December 2014) provides NIST’s recommendations for small businesses to establish reasonably effective cybersecurity programs. It defines typical small businesses as ones with up to 500 employees, but recognizes that it may vary with the type of business. It provides 3 classifications of security practices: absolutely necessary, highly recommended, and more advanced. Because of attorneys’ duty to protect confidential information, they should consider implementing the security practices in all 3 classifications.

US- CERT, a part of the U.S. Department of Homeland Security, has published a number of cybersecurity resources80 for businesses, control systems, government agencies, and consumers, including ones for small and midsize businesses.81 They include resources like a “Toolkit for Small and Midsize Businesses” and “Why Every Small Business Should Use the NIST Cybersecurity Framework.”

The Federal Trade Commission’s (FTC) Safeguards Rule under the Gramm-Leach-Bliley Act also provides a helpful framework for smaller firms, although it does not generally apply to lawyers as a legal requirement (unless they have agreed by contract to do so). The requirements in the rule, “Standards for Safeguarding Customer Information,” 16 CFR, Part 314, are general and cover fewer than two pages in the Federal Register. They provide an overall approach, but not all the details.

B. Consensus Security Controls

In addition to standards and frameworks for comprehensive security programs, there are consensus standards for sets of security controls that are parts of comprehensive programs, but not complete programs. For example, the SANS Top 20 Critical Security Controls, first published in 2008, were developed as “an approach to prioritizing a list of the controls that would have the greatest impact in improving risk posture against real-world threats.” They were originally coordinated by the SANS Institute, a leading information research and education provider, and were agreed upon by a consortium including the National Security Agency, U.S.-CERT, the Department of Defense, Joint Task Force Global Network Operations (JTF-GNO) Command, the Department of Energy Nuclear Laboratories, the Department of State, the Department of Defense Cyber Crime Center, the Federal Bureau of Investigation, leading commercial forensics consultants and pen testers, and others.

They are now managed by the Center for Internet Security and are now called the CIS Controls for Effective Cyber Defense Version 6.0.82 They include 20 critical controls. They have evolved over time and it is important to consult the Center or SANS websites for the

80 www.us-cert.gov/security-publications.

81 www.us-cert.gov/ccubedvp/getting-started-business.

82 www.cisecurity.org/critical-controls.cfm.

259

http://www.us-cert.gov/security-publications


http://www.cisecurity.org/critical-controls.cfm

current version. The Controls do not define the requirements for a comprehensive information security program, but instead, are “a recommended set of actions that provide specific and actionable ways to stop today's most pervasive and dangerous cyber attacks.” They remain current and relevant because “they are updated by cyber experts based on actual attack data pulled from a variety of public and private threat sources.” They “represent the most important cyber hygiene actions every organization should implement to protect their IT networks.”

For law firms starting information security programs, the Controls can be used for setting priorities and making sure that the key controls are covered. They state that “Controls CSC 1 through CSC 5 are essential to success and are among the very first things to be done.” They are necessary for a strong foundation for defense. They include:

CSC 1: Inventory of Authorized and Unauthorized Devices

CSC 2: Inventory of Authorized and Unauthorized Software

CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

CSC 4: Continuous Vulnerability Assessment and Remediation

CSC 5: Controlled Use of Administrative Privileges

The first step in comprehensive security (CSC 1 and CSC 2) is identifying what needs to be protected.

For those with established programs, the Controls can be used as part of the auditing and updating process.

The SANS Institute publishes a poster that demonstrates the Controls and some details relating to them. It also includes a map that coordinates the controls with other security standards and requirements like NIST, ISO and HIPAA. 83

The Australian Signals Directorate, an intelligence agency in the Australian Government Department of Defence, publishes a set of Strategies to Mitigate Targeted Cyber Intrusions.84 The current version (February 2014) lists 35 measures and provides details about them. The Strategies take an approach similar to the Critical Security Controls.

Significantly, the Signals Directorate reports that 4 of the measures, as a package, would have mitigated at least 85% of the incidents to which it responded. These Top 4 Mitigation Strategies are: 1) application whitelisting, 2) patching systems, 3) restricting administrative privileges, and 4) creating a defence in depth system.

Attorneys and law firms should select and use one or more of the standards and frameworks that fit the size of the firm and the sensitivity of the information. As noted above, the NIST Framework includes, in Table 2 in Appendix A, cross-references of its subcategories to other

83

www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf.

84 www.asd.gov.au/publications/Mitigation_Strategies_2014.pdf.

260

http://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf

http://www.asd.gov.au/publications/Mitigation_Strategies_2014.pdf

security standards and consensus controls, including the ISO 27000 series, NIST 800-53, the Critical Security Controls, and the Strategies to Mitigate.

Starting with the basics and then moving forward can have a prompt, strong impact on improving security - the Verizon 2013 Data Breach Investigation Report (covering 2012) reports that 78% of breaches were of low or very low difficulty for initial compromise.85 This suggests that basic and intermediate safeguards may have prevented many of them.

C. Inventory and Risk Assessment

The first step in developing and implementing an information security program is an inventory. It should include all information assets: data, software, hardware, appliances and infrastructure. You can’t protect it if you don’t know that you have it. Next is a risk assessment: a structured process to identify, evaluate and prioritize threats to a law firm’s information assets and operations and measures to mitigate the risks. The results are used to develop an information security program.

For the risk assessment function, it is best to use a framework standard or outline to make sure that everything is covered. The security standards and frameworks discussed above include risk assessment.

The NIST Framework for Improving Critical Infrastructure includes risk assessment as part of the Identify Core Function. ISO/IEC 27002:2013 includes basic risk assessment, with more complete details in ISO/IEC 27005:2011 - Information Security Risk Management. NIST Special Publication 800-53 also includes basic risk assessment, with more details in NIST Special Publication 800-30, Revision 1, Guide for Conducting Risk Assessments (September 2012).

A separate, formal risk assessment framework is CERT’s OCTAVE (Operationally Critical Threat, Asset and Vulnerability EvaluationSM).86 It is a good framework for large law firms and companies. OCTAVE-S is a version of OCTAVE that is tailored for smaller organizations with 100 or fewer people. For very small law firms, the OCTAVE-S framework can be scaled down. The latest version of OCTAVE is OCTAVE Allegro. It is a streamlined version that supplements, rather than replaces the other versions.

Many IT consultants and security professionals have their own risk assessment frameworks and checklists.

The identified risks have to be addressed in the information security program. There are four options for addressing each risk or area of risk.

1. Apply security controls to manage the risk.

2. Transfer the risk (e.g., through a security policy or contract).

3. Eliminate the risk (by stopping the activity or doing it in a different way).

4. Accept the risk. 85 www.verizonenterprise.com/DBIR/2013.

86 www.cert.org/resilience/products-services/octave.

261

http://www.verizonenterprise.com/DBIR/2013/

http://www.cert.org/resilience/products-services/octave

A distinction is frequently made between risk assessment and risk management. Risk assessment or risk analysis is used to describe a single step in the security process (often repeated periodically) in which risks are identified, the likelihood of occurrence and impact are analyzed, and mitigation measures are evaluated. Risk management is a broader, ongoing process in which risks and mitigation measures are continuously reviewed, evaluated, and addressed. Risk assessment is the evaluation phase; risk management includes evaluation, as well as implementation, maintenance, review, and updating.

D. Laptops and Portable Devices

Protection of laptops, smartphones, tablets, and other mobile devices presents a good example of application of the requirement of “reasonable efforts” to a specific category of technology. Mobile devices present a great security risk because they can be easily lost or stolen. The Verizon 2014 Data Breach Investigation Report (covering 2013) explains the risk and a solution to it – encryption – this way:87

PHYSICAL THEFT AND LOSS RECOMMENDED CONTROLS

The primary root cause of incidents in this pattern is carelessness of one degree or another. Accidents happen. People lose stuff. People steal stuff. And that’s never going to change. But there are a few things you can do to mitigate that risk.

Encrypt devices

Considering the high frequency of lost assets, encryption is as close to a no-brainer solution as it gets for this incident pattern. Sure, the asset is still missing, but at least it will save a lot of worry, embarrassment, and potential lawsuits by simply being able to say the information within it was protected.

(Emphasis added.)

While each attorney and law firm should determine what is reasonable in their circumstances, this raises the question, does failure to use encryption for mobile devices - a no-brainer solution – comply with the duty to employ reasonable safeguards?

Conclusion

Attorneys have ethical and common law obligations to take competent and reasonable measures to safeguard information relating to clients and often have contractual and regulatory requirements. Compliance with these duties requires developing, implementing, and maintaining a comprehensive information security program. Important considerations for attorneys include understanding limitations in their knowledge and experience, obtaining appropriate, qualified assistance, continuing security training, and ongoing review and

87 www.verizonenterprise.com/DBIR/2014.

Physical Theft and Loss of Laptops and Mobile Devices

“Considering the high frequency of lost assets, encryption is as close to a no-brainer solution as it gets for this incident pattern.” Verizon Enterprise

262

http://www.verizonenterprise.com/DBIR/2014

updating as technology, threats, and available security evolve over time. Particularly important is constant security awareness by all users of technology – every day, every time they’re using technology. ------------------------------------------------------------------------------------------------------------------------ Dave Ries is Of Counsel in the Pittsburgh, PA office of Clark Hill PLC, where he practices in the areas of environmental, technology, and data protection law and litigation. For over 15 years, he has increasingly focused on cybersecurity, privacy, and information governance. He has used computers in his practice since the early 1980s and since then has strongly encouraged attorneys to embrace technology - in appropriate and secure ways. He is a co-author of Locked Down: Practical Information Security for Lawyers, Second Edition (American Bar Association 2016) and Encryption Made Simple for Lawyers (American Bar Association 2015) and a contributing author to Information Security and Privacy: A Legal, Business and Technical Handbook, Second Edition (American Bar Association 2011).

263

Additional Information

American Bar Association, Business Law Section, Cyberspace Law Committee, http://apps.americanbar.org/dch/committee.cfm?com=CL320000.

American Bar Association, Cybersecurity Resources, www.americanbar.org/groups/leadership/office_of_the_president/cybersecurity/resources.html, provides links to cybersecurity materials and publications by various ABA sections, divisions and committees

American Bar Association, Cybersecurity Legal Task Force www.americanbar.org/groups/leadership/office_of_the_president/cybersecurity.html

American Bar Association, Law Practice Division, www.lawpractice.org, including the Legal Technology Resource Center www.americanbar.org/groups/departments_offices/legal_technology_resources.html

American Bar Association, A Playbook for Cyber Events, Second Edition (American Bar Association 2014)

American Bar Association, Section of Science and Technology Law, Information Security Committee http://apps.americanbar.org/dch/committee.cfm?com=ST230002

Center for Internet Security, a leading security organization that publishes consensus-based best security practices like the CIS Critical Security Controls and Secure Configuration Benchmarks https://www.cisecurity.org.

ILTA LegalSEC, http://connect.iltanet.org/resources/legalsec?ssopc=1 (International Legal Technology Association), provides the legal community with guidelines for risk-based information programs, including publications, the LegalSEC security initiative, peer group discussions, webinars, an annual LegalSEC Summit conference and other live programs; some materials are publicly available while others are available only to members

National Institute of Standards and Technology (NIST), www.nist.gov/itl/csd, numerous standards and publications, including the Framework for Improving Critical Infrastructure Cybersecurity (February 2014), www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf

SANS Institute, www.sans.org, a leading information research, education, and certification provider, includes resources like the SANS Reading Room, the Critical Security Controls, Securing the Human, and OUCH! (a monthly security newsletter for end users)

Sharon D. Nelson, David G. Ries and John W. Simek, Encryption Made Simple for Lawyers (American Bar Association 2015)

Sharon D. Nelson, David G. Ries and John W. Simek, Locked Down: Practical Information Security for Lawyers, Second Edition (American Bar Association 2016)

Jill D. Rhodes and Vincent I. Polley, The ABA Cybersecurity Handbook: A Resource for Attorneys, Law Firms, and Business Professionals (American Bar Association 2013)

264

http://apps.americanbar.org/dch/committee.cfm?com=CL320000

http://www.americanbar.org/groups/leadership/office_of_the_president/cybersecurity/resources.html

http://www.americanbar.org/groups/leadership/office_of_the_president/cybersecurity/resources.html

http://www.americanbar.org/groups/leadership/office_of_the_president/cybersecurity.html

http://www.lawpractice.org/

http://www.americanbar.org/groups/departments_offices/legal_technology_resources.html

http://apps.americanbar.org/dch/committee.cfm?com=ST230002

https://www.cisecurity.org/

http://connect.iltanet.org/resources/legalsec?ssopc=1




http://www.sans.org/

The Sedona Conference, Commentary on Privacy and Information Security: Principles and Guidelines for Lawyers, Law Firms, and Other Legal Service Providers (November 2015)

Thomas J. Shaw, Editor, Information Security and Privacy: A Practical Guide for Global Executives, Lawyers and Technologists (American Bar Association 2011)

US-CERT, part of the U.S. Department of Homeland Security, www.us-cert.gov, includes resources for implementing the NIST Framework (businesses www.us-cert.gov/ccubedvp/getting-started-business) and (small and midsize businesses https://www.us-cert.gov/ccubedvp/getting-started-smb)

265

https://thesedonaconference.org/publication/The%20Sedona%20Conference%20Commentary%20on%20Privacy%20and%20Information%20Security

https://thesedonaconference.org/publication/The%20Sedona%20Conference%20Commentary%20on%20Privacy%20and%20Information%20Security

http://www.us-cert.gov/



https://www.us-cert.gov/ccubedvp/getting-started-smb

266

Chapter Four

Data Security 101: A Lawyer’s Guide to Ethical Issues in the Digital Age

Christopher M. Brubaker, Esq. Clark Hill PLC Philadelphia David G. Ries, Esq. Clark Hill PLC Pittsburgh

267

268

Data Security 101: A Lawyer’s Guide to Ethical Issues in the Digital Age

Overview of Ethical Obligations Governing Data Security

Christopher M. Brubaker, Esquire

David G. Ries, Esquire

Clark Hill PLC

At this point everyone should be aware of the financial and reputational damage an organization

can incur from a successful cyber-attack. For attorneys the threats are even more significant. A

successful data breach of client files implicates a number of ethical obligations that attorneys

owe their clients in addition to any applicable common law, contractual or regulatory duties that

may apply. The ethical obligations are centered on the most well-known ethical duty of an

attorney, the duty to preserve and protect client information and property. Attorneys must also

be wary of a host of other potential threats beyond data-breach such as denial of service attacks,

power outages, and malfunctioning software lest they find themselves in a situation where they

are unable to access critical client information in a timely manner.

Summary of Pennsylvania Rules of Professional Conduct Involving Data Security

The Pennsylvania Rules of Professional Conduct (“Pa.RPC”) were amended effective November

2013 to clarify that they applied to cyber-issues and the use of technology in the practice of law.

However, even before the amendments, the Pa.RPC clearly governed an attorney’s use of

technology in the practice of law. See e.g., “Ethical Obligations for Attorneys Using Cloud

Computing/ Software as a Service While Fulfilling the Duties of Confidentiality and

Preservation of Client Property” Pennsylvania Bar Association Committee on Legal Ethics and

Professional Responsibility, Formal Opinion 2011-200 (“Opinion 2011-200”). This article will

focus on the ethical rules and obligations to protect client data and property in connection with

the use of computers and “smart devices” capable of connecting to or with other such devices or

the internet. When talking about safeguarding client information that is stored and used

electronically there are three main areas we are talking about, an attorney or law firm’s internal

network, the use of “cloud services” for data storage and management, and web-based

communications. When discussing an “internal network” we are referring to computers, servers,

routers and other hardware that is maintained by the attorney or law firm itself. In discussing

“cloud services” and web-based communications we will refer to these collectively as “cloud

computing.”

If an attorney uses a Smartphone or an iPhone, or uses web-based electronic mail

(e-mail) such as Gmail, Yahoo!, Hotmail or AOL Mail, or uses products such as

Google Docs, Microsoft Office 365 or Dropbox, the attorney is using “cloud

computing.” While there are many technical ways to describe cloud computing,

perhaps the best description is that cloud computing is merely “a fancy way of

saying stuff’s not on your computer.”

From a more technical perspective, “cloud computing” encompasses several

similar types of services under different names and brands, including: web-based

269

e-mail, online data storage, software-as-a-service (“SaaS”), platform-as-a-service

(“PaaS”), infrastructure-as-a-service (“IaaS”), Amazon Elastic Cloud Compute

(Amazon EC2”), and Google Docs.

Opinion 2011-200, pg. 1. While there are different areas of emphasis with each of these, they

are all subject to the same ethical obligations as standard document management practices.

Opinion 2011-200, pg. 4. Even though Opinion 2011-200 was issued prior to the formal

adoption of the amendments in 2013, the Opinion acknowledged that the amendments were

pending and is in no way inconsistent with them. Indeed, given that the amendments were meant

to clarify an attorney’s existing obligations and not expand them it is still a useful guide to

understanding what is required with respect to the use of technology.

The use of technology in the practice of law touches a number of obligations and implicates the

following Pa.RPC with respect to the duty to safeguard client information: Rule 1.0

(“Terminology”); Rule 1.1 (“Competence”); Rule 1.4 (“Communication”); Rule 1.6

(“Confidentiality of Information”); Rule 1.15 (“Safekeeping Property”); and Rule 5.3

(“Responsibilities Regarding Nonlawyer Assistants”).1 The following is a summary of the

relevant portions and commentary from these provisions.

First, we have Rule 1.15 (“Safekeeping Property”) which clearly and unequivocally requires a

lawyer to safeguard client property. “A lawyer shall hold all Rule 1.15 Funds and property

separate from the lawyer's own property. Such property shall be identified and appropriately

safeguarded.” Pa.RPC 1.115(b). While Rule 1.15’s primary focus is on client funds, client

property includes files, information and documents whether in paper or electronic format. See

Opinion 2011-200 at pg. 5.

Rule 1.1 (“Competence”) states, “A lawyer shall provide competent representation to a client.

Competent representation requires the legal knowledge, skill, thoroughness and preparation

reasonably necessary for the representation.” Pa.RPC 1.1. Explanatory Comment 5

(Thoroughness and Preparation) provides in relevant part, “[c]ompetent handling of particular

matter includes inquiry into and analysis of the factual and legal elements of the problem, and use

of methods and procedures meeting the standards of competent practitioners.” Pa.RPC

Explanatory Comment 5 (emphasis added). Comment 8 is even more direct, “… a lawyer should

keep abreast of changes in the law and its practice, including the benefits and risks associated with

relevant technology … .” Pa.RPC 1.1 Explanatory Comment 8. Thus, it is necessary to be aware

of advances in technology and how those advances can improve your practice. Think of the

evolution from type writers, to word processors, to personal computers and word processing

software, to tablets and smart phones. In other words a lawyer has an obligation to “keep up with

the Jones” when it comes to the practice of law. That is not to say that you need to adopt every

new bit of technology or be the first to try a new piece of software but you do need to be aware of

what is available and how it could improve your ability to serve clients as well as any potential

vulnerabilities or threats to maintaining client confidentiality.

1 Rule 5.1 (“Responsibility of Partners, Managers and Supervisory Lawyers”) is also implicated as it requires that

attorneys in management positions take steps to ensure that other attorneys follow the Pa.RPC, but with respect to

data security does not involve any ethical obligations beyond adherence to the enumerated Rules.

270

Rule 1.0(e) defines the term “informed consent” which is a central component of several other

rules that touch upon the use of computers and technology in the practice of law. “"Informed

consent" denotes the consent by a person to a proposed course of conduct after the lawyer has

communicated adequate information and explanation about the material risks of and reasonably

available alternatives to the proposed course of conduct.” Pa.RCP 1.0(e).

Rule 1.6 mandates that attorney’s take affirmative steps to safeguard and preserve the secrecy of

client documents and information and to guard against both inadvertent disclosure and

unauthorized disclosure or access and provides in relevant part:

(a) A lawyer shall not reveal information relating to representation of a client

unless the client gives informed consent, except for disclosures that are impliedly

authorized in order to carry out the representation, and except as stated in

paragraphs (b) and (c).

***

(d) A lawyer shall make reasonable efforts to prevent the inadvertent or

unauthorized disclosure of, or unauthorized access to, information relating to the

representation of a client.

Pa.RPC 1.6(a) and (d). What these provisions make imperative is the maintenance of an

informed dialogue with clients about the manner in which data is handled, stored,

accessed and transmitted. Ideally this will take place in connection with the retainer or

engagement letter at the outset of the representation. This can be accomplished in large

part by preparing a standard overview of the firm’s data security systems, processes and

procedures. While this will need to be kept current, it should be something that once

prepared can be used with all clients. There will also be situations where additional

discussion with the client is required depending on the nature and type of information and

whether or not “cloud computing” will be used. These responsibilities are spelled out in

the Explanatory Comments to Rule 1.6.

Explanatory Comment

25§ Paragraph (d) requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer's supervision. See Rules 1.1, 5.1 and 5.3. The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (d) if the lawyer has made reasonable efforts to prevent the access or disclosure. Factors to be considered in determining the reasonableness of the lawyer's efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer's ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use). A

271

client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to forgo security measures that would otherwise be required by this Rule. Whether a lawyer may be required to take additional steps to safeguard a client's information in order to comply with other law, such as state and federal laws that govern data privacy or that impose notification requirements upon the loss of, or unauthorized access to, electronic information, is beyond the scope of these Rules. For a lawyer's duties when sharing information with nonlawyers outside the lawyer's own firm, see Rule 5.3, Comments 3§- 4§.

26§ When transmitting a communication that includes information relating to the

representation of a client, the lawyer must take reasonable precautions to prevent

the information from coming into the hands of unintended recipients. This duty,

however, does not require that the lawyer use special security measures if the

method of communication affords a reasonable expectation of privacy. Special

circumstances, however, may warrant special precautions. Factors to be considered

in determining the reasonableness of the lawyer's expectation of confidentiality

include the sensitivity of the information and the extent to which the privacy of the

communication is protected by law or by a confidentiality agreement. A client may

require the lawyer to implement special security measures not required by this

Rule or may give informed consent to the use of a means of communication that

would otherwise be prohibited by this Rule. Whether a lawyer may be required to

take additional steps in order to comply with other law, such as state and federal

laws that govern data privacy, is beyond the scope of these Rules.

Pa.RPC 1.6, Explanatory Comments 25 and 26.

Attorney’s also have to maintain adequate lines of communication with clients. Rule 1.4

(“Communication”) provides in relevant part:

(a) A lawyer shall:

(1) promptly inform the client of any decision or circumstance with respect to which the client's informed consent, as defined in Rule 1.0(e), is required by these Rules;

(2) reasonably consult with the client about the means by which the client's objectives are to be accomplished;

(3) keep the client reasonably informed about the status of the matter;

(4) promptly comply with reasonable requests for information; …

Pa.RPC 1.4. Needless to say in today’s world this will often require electronic communications

including email. It also requires ready access to the client’s files and data.

Rule 5.3 (“Responsibilities Regarding Nonlawyer Assistance”) states:

With respect to a nonlawyer employed or retained by or associated with a lawyer:

(a) a partner and a lawyer who individually or together with other lawyers possesses comparable managerial authority in a law firm shall make reasonable efforts to

272

ensure that the firm has in effect measures giving reasonable assurance that the person's conduct is compatible with the professional obligations of the lawyer.

(b) a lawyer having direct supervisory authority over the nonlawyer shall make reasonable efforts to ensure that the person's conduct is compatible with the professional obligations of the lawyer; and

(c) a lawyer shall be responsible for conduct of such a person that would be a violation of the Rules of Professional Conduct if engaged in by a lawyer if:

(1) the lawyer orders or, with the knowledge of the specific conduct, ratifies the conduct involved; or (2) the lawyer is a partner or has comparable managerial authority in the law firm

in which the person is employed, or has direct supervisory authority over the

person, and in either case knows of the conduct at a time when its consequences

can be avoided or mitigated but fails to take reasonable remedial action.

Pa.RCP 5.3. Thus, attorneys must take steps to ensure that service providers are acting in a

manner that is consistent with their ethical obligations and consider a wide array of

circumstances that could impact on those obligations.

An attorney utilizing “cloud computing” will likely encounter circumstances that

require unique considerations to secure client confidentiality. For example,

because a server used by a “cloud computing” provider may physically be kept in

another country, an attorney must ensure that the data in the server is protected by

privacy laws that reasonably mirror those of the United States. Also, there may

be situations in which the provider’s ability to protect the information is

compromised, whether through hacking, internal impropriety, technical failures,

bankruptcy, or other circumstances.

Opinion 2011-200 at pg. 6. This generally involves ensuring that service providers are able to

limit access to client information to necessary personnel, information is backed-up, and the

information is reasonably available to the attorney while also being reasonably safe from

unauthorized access. Id. at 7.

Threat Overview

Now that we have an understanding of the obligations that are implicated it is time to look at

what we are safeguarding client information from. First and foremost is hacking. Hacking

encompasses a number of different techniques but is at its most basic the unauthorized access or

use of a computer or electronic file. Hacking often utilizes multiple methods of infiltrating

cyber-defenses such as spear phishing emails and malware. Hacking includes both internal and

external attacks and can range from mischievous, to financially motivated (Target/Home Depot),

to ideologically motivated (“Panama Papers” - Ashley Madison) and/or government sponsored

(Sony) attacks. Law firms are viewed as an extremely valuable target because of the types and

amounts of sensitive information that they often have; a one stop shop for cyber-criminals. Lost

and stolen devices and credentials, while not generating the same sensational headlines as

hacking events, still make up a significant amount of security incidents. By some accounts

however, the most serious threat to cybersecurity are “insiders.” The insider threat includes a

273

broad spectrum from trusted employees, to third-parties with access such as business partners

and service providers, to disgruntled, untrained, careless, and/or bored employees, to criminal or

malicious ones. It even includes dedicated employees who simply want to use their own

technology to try and do their jobs better. Moreover, unauthorized hardware, software, and

services can be a threat from any type of insider. The FBI’s Chief Information Security Officer

has stated that a quarter of the incidents the FBI tracks in its systems on an annual basis are from

“knucklehead” problems (i.e. unintentional acts in which employees compromise systems by:

not following procedures, losing equipment and sensitive data, clicking on spam, inappropriate

emails or Web links, or mishandling passwords and accounts).2 Another growing concern is

government surveillance, both by the U.S. and foreign governments. This is particularly true in

situations involving the representation of foreign parties or in connection with transactions

involving foreign parties. This is only a partial listing of the most common and recognized

threats. It is not intended to be a comprehensive listing of the threats that lawyers need to

consider when safeguarding client information. It is imperative to keep in mind that cyber-risk at

this time and for the foreseeable future is an evolving ever changing risk. Threats rise and fall

and permutate constantly. Thus threat trends need to be monitored and defenses adjusted

regularly.

Reasonable Steps

As should be apparent the operative standard for complying with the Pa.RPC is to take

“reasonable steps” to safeguard client data, information and communications. This will

necessarily vary depending on the nature of the data, information and communication as well as

the technology in question. There is no one right answer and Opinion 2011-200 stops short of

requiring any particular action.

While the measures necessary to protect confidential information will vary based

upon the technology and infrastructure of each office – and this Committee

acknowledges that the advances in technology make it difficult, if not impossible

to provide specific standards that will apply to every attorney – there are common

procedures and safeguards that attorneys should employ.

Opinion 2011-200, pg. 8. The Committee also stopped short of finding the use of unencrypted

electronic mail a per se violation of the Rules but did note that attorneys must take account of

any factors that would warrant a higher level of security for a particular communication. Id. at

12-13. Other factors to consider include whether such communications can be accessed by

devices using public wifi connections and the potential for lost or stolen devices. Storage of data

in the cloud raises additional potential concerns.

Because “cloud computing” refers to “offsite” storage of client data, much of the

control over that data and its security is left with the service provider. Further,

data may be stored in other jurisdictions that have different laws and procedures

concerning access to or destruction of electronic data. Lawyers using cloud

2 Ericka Chickowski, “5 Lessons from the FBI Insider Threat Program,” Dark Reading (March 1, 2013)

www.darkreading.com/insider-threat/5-lessons-from-the-fbi-insider-threat-pr/240149745.

274

http://www.darkreading.com/insider-threat/5-lessons-from-the-fbi-insider-threat-pr/240149745

services must therefore be aware of potential risks and take appropriate

precautions to prevent compromising client confidentiality, i.e., attorneys must

take great care to assure that any data stored offsite remains confidential and not

accessible to anyone other than those persons authorized by their firms. They

must also assure that the jurisdiction in which the data are physical (sic) stored do

not have laws or rules that would permit a breach of confidentiality in violation of

the Rules of Professional Conduct.

Opinion 2011-200 at pg. 3. Other factors to consider regarding use of “cloud computing include:

countries with unclear policies regarding data ownership, breach notification, and/or data

destruction; whether provider offers sufficient back-up and encryption; bankruptcy; hackers,

insider threats and technical capabilities; business interruption; and loss of data.

The Committee provided the following nonexclusive list of reasonable steps to consider in

connection with “cloud computing.”

Thus, the standard of reasonable care for “cloud computing” may include:

Backing up data to allow the firm to restore data that has been lost, corrupted,

or accidentally deleted;

Installing a firewall to limit access to the firm’s network;

Limiting information that is provided to others to what is required, needed, or

requested;

Avoiding inadvertent disclosure of information;

Verifying the identity of individuals to whom the attorney provides

confidential information;

Refusing to disclose confidential information to unauthorized individuals

(including family members and friends) without client permission;

Protecting electronic records containing confidential data, including backups,

by encrypting the confidential data;

Implementing electronic audit trail procedures to monitor who is accessing the

data;

Creating plans to address security breaches, including the identification of

persons to be notified about any known or suspected security breaches

involving confidential data;

Ensuring the provider:

o explicitly agrees that it has no ownership or security interest in the data;

o has an enforceable obligation to preserve security;

o will notify the lawyer if requested to produce data to a third party, and

provide the lawyer with the ability to respond to the request before the

provider produces the requested information;

o has technology built to withstand a reasonably foreseeable attempt to

infiltrate data, including penetration testing;

o includes in its “Terms of Service” or “Service Level Agreement” an

agreement about how confidential client information will be handled;

275

o provides the firm with right to audit the provider’s security procedures and

to obtain copies of any security audits performed;

o will host the firm’s data only within a specified geographic area. If by

agreement, the data are hosted outside of the United States, the law firm

must determine that the hosting jurisdiction has privacy laws, data security

laws, and protections against unlawful search and seizure that are as

rigorous as those of the United States and Pennsylvania;

o provides a method of retrieving data if the lawyer terminates use of the

SaaS product, the SaaS vendor goes out of business, or the service

otherwise has a break in continuity; and,

o provides the ability for the law firm to get data “off” of the vendor’s or

third party data hosting company’s servers for the firm’s own use or in-

house backup offline.

Investigating the provider’s:

o security measures, policies and recovery methods;

o system for backing up data;

o security of data centers and whether the storage is in multiple centers;

o safeguards against disasters, including different server locations;

o history, including how long the provider has been in business;

o funding and stability;

o policies for data retrieval upon termination of the relationship and any

related charges; and,

o process to comply with data that is subject to a litigation hold.

Determining whether:

o data is in non-proprietary format;

o the Service Level Agreement clearly states that the attorney owns the data;

o there is a 3rd party audit of security; and,

o there is an uptime guarantee and whether failure results in service credits.

Employee of the firm who uses the SaaS must receive training on and are

required to abide by all end-user security measures, including, but not limited

to, the creation of strong passwords and the regular replacement of passwords.

Protecting the ability to represent the client reliably by ensuring that a copy of

digital data is stored onsite.

Having an alternate way to connect to the internet, since cloud service is

accessed through the internet.

Opinion 2011-200, pg. 8-10. The attorney must also consider whether or not it is necessary to

inform the client of the outsourcing or use of a service provider, the identity of the provider, and

whether or not a written disclosure to the client outlining the nature of the services to be utilized

and the risks and benefits of using the service in connection with the matter is appropriate. As a

general rule the more sensitive the information at issue is, the higher the degree of care necessary

to satisfy the reasonable steps analysis.

In addition to these specific steps related to cloud computing listed above (many of which apply

to internal networks as well) it is important to consider the following security steps:

276

Development of a comprehensive cybersecurity program. This typically involves a risk

management style approach to inventorying cyber systems and data, looking at how those

systems and data are accessed, used and maintained, identifying risks and threats to those

systems and data, identifying existing security features, identifying additional available

security measures, selecting and implementing additional security features necessary to

comply with ethical and other obligations to safeguard data, preparing disaster recovery

and breach notification plans among other steps.

Evaluate and purchase cyber-insurance. While this may not be an absolute necessity

cyber-insurance is a valuable tool that should be considered. The underwriting for cyber-

insurance involves a risk management approach and can be a useful tool and additional

resource in preparing a cybersecurity program. Coverage can also help provide services

in the event of a breach or other event.

Encrypt all email communications. While not yet a “required” practice it is a valuable

tool that can go a long way to maintaining confidentiality and is close to becoming

standard.

Encrypt all client data that is being put on portable devices whether laptops, discs, flash

drive or other media. Many states breach notification laws include exceptions for

encrypted data.

Equip firm issued smartphones, tablet and laptops with remote lock and wipe capabilities.

Limit or ban the use of non-firm issued (personal) devices. There should be a clear

written policy covering this that is published to all employees and strictly enforced.

Maintain and enforce strong password policies that include the regular changing of

passwords. Again there should be a clear written policy covering this that is published to

all employees and strictly enforced.

Retention of security experts to review and test your systems.

Stay proactive and continue to monitor and tweak your program as appropriate.

Again there is no one answer or set of steps that is appropriate for all attorneys and law firms.

Much will depend on both the size of the firm and the nature of the practice areas. It is also

important to bear in mind and worth repeating that this is a rapidly evolving area that requires

constant monitoring to keep up with changes in both technology and threats and vulnerabilities

so that your security efforts continue to be reasonable under the circumstances.

Other Duties and Obligations

Keep in mind that there are also parallel common law duties that are defined by case law. The

Restatement (3rd) of the Law Governing Lawyers (2000) summarizes this area of the law. See,

Section 16(2) on competence and diligence, Section 16(3) on complying with obligations

concerning client’s confidences, and Chapter 5, “Confidential Client Information.” Breach of

these duties can result in a malpractice action. There are also instances when lawyers have

contractual duties to protect client data. This is particularly the case for clients in regulated

industries, such as health care and financial services, that have regulatory requirements to protect

privacy and security. Thus attorneys and law firms need to be cognizant of regulatory

environment in which their clients are operating and take affirmative steps to ensure that they are

meeting the standards set forth in the Graham-Leach Bliley Act when representing banks or other

financial institutions or HIPPA and Hi-Tech when representing clients in the health care field.

277

In addition to the ethical and common law duties to protect client information, various state and

federal statutes and regulations require protection of defined categories of personal information

that is affirmative action to safeguard particular types of data. Some of them are likely to apply

to lawyers who possess any covered personal information about their employees, clients, clients’

employees or customers, opposing parties and their employees, or even witnesses. While the

focus of this Article is the duties and obligations of Pennsylvania lawyers, it is necessary to be

aware of the requirements in other states as those laws apply to residents of their state. Thus,

Pennsylvania lawyer representing Pennsylvania Corporation that does business and has

customers in ten states is potentially subject to ten different breach notification and/or security

obligations if Pennsylvania lawyer obtains such information in the course of the representation.

At least 12 states now have general information security laws that require reasonable measures to

protect defined categories of personal information (including Arkansas, California, Connecticut,

Illinois, Maryland, Massachusetts, Nevada, New Jersey, Oregon, Rhode Island, Texas, and

Utah). While the scope of coverage, the specificity of the requirements and the definitions vary

among these laws, “personal information” is usually defined to include general or specific facts

about an identifiable individual. The exceptions tend to be information that is presumed public

and does not have to be protected (e.g., a business address).

Additional Resources

Ethics Opinions and Guidance Documents

ABA Commission on Ethics 20/20 Working Group on the Implications of New

Technologies, “Issues Paper Concerning Client Confidentiality and Lawyers’ Use of

Technology” (Sept. 20, 2010).

Alabama State Bar Office of General Council Disciplinary Commission, Ethics Opinion

2010-02.

State Bar of Arizona, Ethics Opinion 09-04 (Dec. 2009) and Ethics Opinion 05-04 (July

2005).

The California State Bar Standing Committee on Professional Responsibility and

Conduct, Formal Opinion 2010-179.

Illinois State Bar Association, Ethics Opinion 10-01 (July 2009).

The Maine Board of Overseers of the Bar Professional Ethics Commission, Opinion 194

(June 30, 2008).

Massachusetts Bar Association, Ethics Opinion 05-04 (March 3, 2005).

The State Bar of Nevada Standing Committee on Ethics and Professional Responsibility,

Formal Opinion No. 33 (Feb. 9, 2006).

New Jersey Advisory Committee on Professional Ethics, Opinion 701 (April 2006).

The New York State Bar Association Committee on Professional Ethics, Opinion 1019

(Aug. 6, 2014), Opinion 842 (Sept. 10, 2012) and Opinion 709 (Sept. 16, 1998).

The North Carolina State Bar Ethics Committee, 2011 Formal Ethics Opinion 6 (Jan. 27,

2012).

State Bar Association of North Dakota Ethics Committee, Opinion 99-03 (June 21,

1999).

Vermont Bar Association, Advisory Ethics Opinion 2003-03.

278

Virginia State Bar Ethics Counsel, Legal Ethics Opinion 1818 (Sept. 30, 2005).

Publications and Online Resources

David G. Ries, “Safeguarding Confidential Information: Attorneys’ Ethical and Legal

Obligations” (April, 2016).

National Institute of Standards and Technology, Framework for Improving Critical

Infrastructure Cybersecurity, Version 1.0 (February 12, 2014).

www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf

Sharon D. Nelson, David G. Ries, and John W. Simek, Encryption Made Simple for

Lawyers (American Bar Association, 2015).

279


280

PBI Urges You to Join PBA!

The Pennsylvania Bar Institute is the continuing legal education arm of the Pennsylvania Bar Association. Together, the two organizations work to serve you, the practicing Pennsylvania lawyer. By joining PBA, you’ll get great discounts on PBI publications and courses—not to mention other member benefits such as malpractice insurance and discounts on magazines, office equipment, and Casemaker.

You’ll want to also join one of PBA’s 18 Sections on nearly every area of the law to stay current on changing rules and to network with other attorneys who practice in the same area as you do. So don’t delay. Join PBA today and start receiving your benefits right away. For a complete packet of information on PBA, call 1-800-932-0311, or 717-238-6715.

To join, complete the following application (see the reverse for information on dues and Sections) and mail to:

PBA Member Records P.O. Box 186, Harrisburg, PA 17108

Full Name of Applicant______________________________________ Supreme Court I.D. #___________________

Firm or Office Address_______________________________________ State________ Zip__________________

Firm or Office Telephone_________________ FAX #_________________ E-mail__________________________

Home Address __________________________________________________ City ________________________

State_______ Zip____________ County_______________________________ Date of Birth______________

I am an attorney employed full time by a local, state, or federal government agency or a nonprofit legal services office, as opposed to an independent contractor. Your Signature___________________________________________

Type of Practice Private Government Corporate

Area(s) of Specialization _______________________________________________________________________

Date Admitted to Supreme Court of Pennsylvania ____________________________________________________

(or) Date Admitted _____________________________________ in County of ___________________________

Earliest Date Admitted in Any State _____________________________________________ State_______________

Have you ever been a member of this association? Yes No

Other State or Local Bar Memberships____________________________________________________________

__________________________________________________________________________________________

Please enroll me in the Association and any Sections checked on the reverse!Applicant’s signature________________________________________________________________________

Payment Enclosed (Make checks payable to the PA Bar Association)

Charge my: DISCOVERCARD

R

Card #___________________________________________________________ Exp. Date____________________

Billing Address_________________________ City______________________ State_______ Zip____________

Please send all PBA mailings to my: Home Office

Check here if you do NOT want your FAX number to appear in PBA publications. PBI Book—Rev. 12/15

For More Information Call PBA: 800-932-0311 or 717-238-6715

*Current as of Jan. 1, 2016; dues fees in effect until Dec. 31, 2016. Call PBA at 800-932-0311 or 717-238-6715 for current information.

Administrative Law.......................................$25.00 Aeronautical & Space Law ............................$20.00 Business Law .................................................$40.00 Civil Litigation ..............................................$45.00 Criminal Justice ............................................$35.00 Education Law .............................................. $15.00 Elder Law ......................................................$35.00 Environmental & Energy Law ......................$25.00 Family Law ....................................................$65.00

Intellectual Property Law .............................$45.00 International & Comparative Law ................ $15.00 Labor & Employment Law ............................$40.00 Municipal Law .............................................. $15.00 Public Utility Law .........................................$25.00 Real Property, Probate & Trust Law .............$35.00 Solo & Small Firm Practice ...........................$35.00 Tax Law ......................................................... $15.00 Workers’ Compensation Law .......................$30.00

Section Registration Request Form*

Important Tax Information—Your dues payment will not be deductible as a charitable contribution but will, in general, be deductible for most members as a business expense, except to the extent provided in the next sentence. Pursuant to the Revenue Reconciliation Act of 1993, PBA estimates that 4% of your dues payment will not be deductible as an ordinary and necessary business expense because of PBA’s lobbying activities on behalf of its members.

2016

Sch

edul

e of

Due

s EARLIEST ADMIT DATE TO ANY STATE BAR PRORATED SCHEDULE DUES GOV’T ATTY.*On or before 9/19/12 Nov.–March ...................................$325.00 $260.00 April–June .......................................244.00 195.00 July–Sept. ........................................ 163.00 130.00 Oct.–Dec. . ..........................................82.00 65.00

9/20/12 thru 9/19/13 Nov.–March .................................. $260.00 $208.00 April–June ....................................... 195.00 156.00 July–Sept. ........................................130.00 104.00 Oct.–Dec. . ..........................................65.00 52.00

9/20/13 thru 9/19/14 Nov.–March ...................................$195.00 $156.00 April–June ....................................... 147.00 117.00 July–Sept. ..........................................98.00 78.00 Oct.–Dec. . ..........................................49.00 39.00

9/20/14 thru 9/19/15 Nov.–March ...................................$130.00 $104.00 April–June .........................................98.00 78.00 July–Sept. ..........................................65.00 52.00 Oct.–Dec. . ..........................................33.00 26.00

On or after 9/20/15 FREE

Lawyers not admitted to practice Nov.–May ....................................... $175.00 N/Ain PA (Associate Membership) June–Dec. ........................................ 88.00 N/ANot Admitted to PA Bar

*Agovernmentattorneyisdefinedasanattorneywhoisemployedfulltimebyalocal,state,orfederalgovernmentagencyoranonprofitlegalservicesagency,asopposedtoanindependentcontractor.

If you are a private practitioner in one of the counties listed, you must first be a member of a local bar association

before joining the PBA. If you have any questions or need a referral to a local bar association, please call 800-932-0311 or 717-238-6715.

Check here if you are a new section member or you have not belonged to the selected section for five years or longer. You will receive a free, one-year section membership! (Limitedtoonefreesectionmembership.)

Adams, Armstrong, Beaver, Bedford, Berks, Bradford, Butler, Cambria, Cameron, Carbon, Centre, Clarion, Clinton, Crawford, Cumberland, Dauphin, Elk, Erie, Fayette, Franklin, Fulton, Greene, Huntingdon, Juniata, Lackawanna, Lancaster, Lawrence, Lebanon, Lehigh, Lycoming, Mercer, Mifflin, Montgomery, Northampton, Northumberland, Pike, Potter, Schuylkill, Somerset, Susquehanna, Tioga, Union/Snyder, Venango, Washington, Wayne, Westmoreland, Wyoming/Sullivan, York.

Join

The Insurance Staff Attorney Committee

of The Pennsylvania Bar Association

The Insurance Staff Attorney Committee shall promote the interests of staff counsel, foster quality professional conduct and provide appropriate service to its members in cooperation with the PBA.

Any member of the Pennsylvania Bar Association is eligible to join the committee. Simply fill out and return this form.

note: you must be a member of the Pennsylvania Bar Association to join.Full Name of Applicant____________________________________________ Supreme Court I.D. #______________________

Firm or Office Address______________________________________________________________________________

City _________________________________________________________ State____________________ Zip__________________

Phone______/______-__________ FAX #______/______-__________ E-mail_______________________________________

Home Address _________________________________________________________________________________________

City __________________________________________________________ State_____________________ Zip________________

County__________________________________________ Please send all PBA mailings to my: Home Office

Applicant’s signature___________________________________________________________________________________

Complete and return to: Pennsylvania Bar Association Committee & Section Dept. 100 South St., P.O. Box 186 Harrisburg, PA 17108

For More Information Call PBA: 800-932-0311 (toll free in U.S.) or 717-238-6715

1/11

1 Treat with civility the lawyers, clients, opposing parties, the Court, and all the officials with whom we work. Professional courtesy is compatible with vigorous advocacy and zealous representation.

2 Communications are lifelines. Keep the lines open. Telephone calls and correspondence are a two-way channel; respond to them promptly.

3 Respect other lawyers’ schedules as your own. Seek agreement on meetings, depositions, hearings and trial dates. A reasonable request for a scheduling accommodation should never be unreasonably refused.

4 Be punctual in appointments, communications and in honoring scheduled appearances. Neglect and tardiness are demeaning to others and the judicial system.

The practice of law is a profession, a genuine calling inspirited with service to the system of justice, not a common business enterprise. The quality of the profession is only as worthy as the character of the people who practice it.

Self-esteem, shared respect for each other, the clients we serve, the judges and the officers with whom we work, are essential to it.

Civility is a virtue, not a shortcoming. Willingness to temper zeal with respect for society’s interest in preserving responsible judicial process will help to preserve it.

Unwritten rules of professional courtesy have long sustained us. Since they are sometimes forgotten, we should set them down again and conscientiously observe them.

5 Procedural rules are necessary to judicial order and decorum. Be mindful that pleadings, discovery processes and motions cost time and money. They should not be heedlessly used. If an adversary is entitled to something, provide it without unnecessary formalities.

6 Grant extensions of time when they are reasonable and when they will not have a material, adverse effect on your client’s interest.

7 Resolve differences through negotiation, expeditiously and without needless expense.

8 Enjoy what you are doing and the company you keep. You and the world will be better for it.

Beyond all this, the respect of our peers and the society which we serve is the ultimate measure of responsible professional conduct.

PBA Working Rules of Professionalism

Date post:	28-Dec-2019
Category:	Documents
Upload:	others
View:	22 times
Download:	0 times