Phone and Internet availability, while vastly increasing the speed of communication in the business world, is not without its own particular risk. FC&S® frequently receives questions about coverage for financial loss arising from these modes of communication, such as the following:

My insured has two T-1 lines for phone and Internet communications. His normal phone bill for these are about $8,000 to $10,000 per month. The system was hacked into by unknown parties, and a monthly bill in excess of $100,000 was generated during that month. Where would coverage fall for a claim of this nature?

Absent a special type of coverage for this type of loss, I doubt that coverage can be found for this loss on either the typical crime or commercial property policies.

The standard ISO Commercial Crime Coverage form provides coverage for employee theft, forgery or alteration, theft of money and securities from inside the premises, robbery or safe burglary of other property inside the premises, loss of money, securities, or other property (italicized terms are defined in the form) outside the premises, computer and funds transfer fraud, and money orders and counterfeit money.

Coverage For 'Other Property'
Several of the insuring agreements offer coverage for loss of or damage to money, securities, or other property. It is clear that phone and Internet minutes are not money or securities. But what about “other property” as defined on the crime form?

ISO defines “other property” as any tangible property other than “money” and “securities” that has intrinsic value (emphasis added). The requirement that loss must involve tangible property with intrinsic value is key here. The T-1 lines, which are tangible and do have intrinsic value, were not damaged. The financial loss—the huge phone bill—was caused by an unauthorized party using the lines, not by damaging them. Even during the month of unauthorized use, the customer was not deprived of using them. The phone minutes are merely evidence of value.

A Florida case, Peoples Telephone Co., Inc., v. Hartford Fire Insurance Company, while not an identical situation, offers guidance on this issue. In Peoples, an employee misappropriated mobile telephone serial and identification numbers that Peoples used to activate cell phones. Peoples claimed it had incurred significant charges for unauthorized telephone usage as a result of the theft and tried to recover $660,000 from Hartford. The $660,000 represented usage charges billed to Peoples by its cell phone providers.

Peoples involved an employee dishonesty claim, and the crime insurance cited provided coverage for “loss of, and loss from damage to” covered property. Covered property meant money, securities, and property other than money and securities. The Hartford form defined property other than money and securities as “any tangible property other than money and securities that has intrinsic value,” a definition that mirrors the ISO definition of other property.

In reviewing the case, the court went to Black's Law Dictionary for the definition of tangible property. Black's defined tangible property as “that which may be felt or touched, and is necessarily corporeal, although it may be either real or personal.” The law dictionary defined intrinsic as “internal; inherent; pertaining to the essential nature of a thing.” Intangible property is defined as property with no intrinsic and marketable value—merely the representative or evidence of value.

The Peoples court cited another Florida case, Old Republic Ins. Co. v. West Flagler Assocs., Ltd., in its reasoning. In West Flagler, the court was determining whether stolen trifecta tickets were tangible property as used in a commercial general liability (CGL) policy. The value of the tickets had been diminished by the alleged issuance of bogus tickets. This court reasoned that only the economic value of the tickets was diminished; the tangible tickets themselves were not damaged.

Quantifying Potential Loss
Another issue raised by the Peoples court was how an insurance company could establish a premium for insuring the misappropriation of items such as the serial and identification numbers. As stated in the record, the unauthorized cell phone usage would have been difficult to quantify prior to the loss. The charges could have been much greater or much lower, depending on the speed with which the unauthorized cell phones were programmed.

I believe this argument is identical to the situation with the T-1 lines. How would an insurance company or a client quantify the potential loss for the unauthorized usage of the T-1 lines?

Some may question whether the computer fraud insuring agreement would apply to this loss. This coverage pertains to loss resulting directly from a fraudulent entry of “electronic data” or “computer program” into or a change of “electronic data” or “computer program” within any computer system that results in the transfer, payment, or delivery of money, securities, or other property to others. While the T-1 lines in question did serve the customer's Internet connection, they do not qualify as a computer program or electronic data. As defined on the crime form, electronic data means information, facts, images or sounds stored on, created or used on, or transmitted to or from computer software. Phone minutes do not fall within this definition.

Turning to the ISO commercial property coverage form, we find coverage for direct physical loss of or damage to covered property at the premises described in the policy that is caused by or resulting from a covered cause of loss. The broadest covered cause of loss provides for risks of direct physical loss unless it is excluded. The “covered property” is further delineated as the type of property described in the coverage provisions for buildings, business personal property, and personal property of others. Although the form does not contain the words tangible property, all of the examples are, indeed, tangible.

Property not covered includes, among other categories, accounts, bill, currency, and “other evidences of debt” and electronic data. However, there is an additional coverage for up to $2,500 for loss of electronic data. Like the crime form, the usage of the T-1 lines does not qualify as “electronic data.” And the broadest of the possible causes of loss do not include anything remotely akin to hacking.

Like the crime policy, I believe the commercial property form does not provide for economic losses such as the excess phone charges.

The T-1 hacking situation with its $100,000 financial loss may seem a bit unusual, but this type of risk is becoming common for both individuals and corporations. Ten days ago my credit card was misappropriated—how, I do not know. But thousands of dollars or unauthorized charges were made on the account. I was lucky, caught the charges quickly, and the bank rejected them, so no economic loss was incurred.

The company with the hacked T-1 lines was not so fortunate. The unauthorized usage was not caught before charges had escalated, and a large economic loss occurred. Unfortunately, without specialized coverage or forgiveness from the phone company, this corporation is self-insuring the loss.

Diana Reitz, CPCU, is editorial director for the reference division of The National Underwriter Company, which includes FC&S Online. She may be reached at dreitz@sbmedia.com.

Special Reports /

Hacked! Commercial Communication Risks

Related Stories

Recommended For You