American Oil and Gas Reporter - December 2017 - 81

pected coverage for such fees.
Insurance policies typically exclude
coverage for "criminal" or "dishonest"
acts of employees. Many cybercrimes involve the bad acts of former employees
or independent contractors no longer employed by the company, but who still can
disrupt computer systems. Businesses
should seek amendments to these exclusions so that criminal acts of former employees are covered.
Another factor to consider is coverage
triggers. Viruses, ransomware and other
malicious code may lie dormant in a
company's systems for years before they
are discovered. Even when breaches are
discovered, companies may not understand
the scope or impact of the loss for some
time. As a result, "occurrence-based"
policies, which traditionally apply only
where a covered incident "occurs" during
the policy period, should be amended to
ensure they cover data breaches discovered
during the policy period, rather than only
those that took place during the policy
period. Where the coverage is under a
claims-made policy, it is important to ensure retroactive dates and other timebased exclusions will not exclude coverage
once an intrusion or damage is discovered.
Finally, many cyber insurance forms
provide coverage for fraudulent or wrongful acts by hackers who "directly" cause
the loss at issue. Insurers in many cases
have argued that this direct causation requirement bars coverage because the
wrongful conduct (e.g., spoofed e-mails,
fraudulent communications with employees) was only an "incidental" part of the
scheme. Direct causation language should
not be fatal to most claims, but policyholders should negotiate more favorable

LAWRENCE J.
BRACKEN II

Lawrence Bracken is a partner in
the Atlanta office of Hunton & Williams
LLP, where he is a member of the firm's
commercial litigation and insurance
coverage practices. He has represented
oil and gas industry clients in litigation
and insurance coverage matters for
more than 30 years.

insuring agreements that address this potential insurer defense.
Best Practices
In addition to addressing these specific
coverage provisions, oil and gas companies
should conduct detailed risk analysis at
the time of traditional and cyber insurance
policy placement or renewal. Insurance
analysis often focuses on claim analysis
in light of policy terms, but the insurance
application and renewal process also is
an important step in addressing a company's specific risks to maximize potential
insurance recoveries in the event of a
loss or claim.
There are specific best practices oil
and gas companies should follow for insurance placement and renewal applications. First, critical personnel need to be
involved in the process to ensure the
business is submitting the most accurate
information from employees most likely
to have knowledge of the relevant facts,
especially with respect to information
technology, computer systems and prior
cyber events.
Prior applications should be reviewed
at renewal to identify any key changes or
areas to supplement, and to ensure that
the company follows through with implementing procedures and risk controls
identified in an insurance application.
Questions should be answered fully whenever possible, but companies also should
not be afraid to qualify answers when
necessary. For example, it is prudent to
be wary of responding to questions about
existing cyber events because such events
could go undiscovered for months or
even years.
The impact of breaches involving
critical suppliers or infrastructure also

MICHAEL S.
LEVINE

Michael Levine is a partner in the
Washington, D.C., office of Hunton &
Williams LLP, where he is a member of
the firm's insurance coverage practice.
He regularly advises and represents
clients in the oil and gas industry.

needs to be considered. The oil and gas
industry relies on various links in the
supply chain to ensure products are obtained, transported, delivered, and consumed as efficiently and safely as possible.
The success of oil and gas companies is
intertwined with the operations and viability
of other related entities. For that reason,
companies should consider whether additional coverage extensions or endorsements, such as dependent service provider
or contingent business interruption coverage, are needed.
Not all cyber insurance forms are
created equal, making it paramount to
ensure cyber coverage addresses current
risks. Recent cyber coverage decisions
have demonstrated that seemingly basic
cyber losses may not be covered under
an insurance policy based on the policyholder's type of business, the type of
claim, or the specific computer systems,
databases, or network at issue. Do not
stop thinking about insurance after policies are in place, as significant obligations
or revisions may be necessary to maintain
adequate coverage following a change
in control, a change in the scope of
services or work performed, the introduction of new cyber risks, or the implementation of new contracts or additional insureds.
An insurance policy is a specialized
contract. Like any other contract, a policy
can be negotiated and amended to address
specific risks and concerns of the policyholder. Experienced insurance brokers
and coverage counsel can help policyholders identify and negotiate appropriate
policy endorsements to address those
risks and concerns, and aggressively protect a policyholder's rights to maximize
recovery in the event of a claim.
r

GEOFFREY B.
FEHLING

Geoffrey Fehling is an associate in
the Washington, D.C., office of Hunton
& Williams LLP, where he is a member
of the firm's insurance coverage and
commercial litigation practices.
Fehling represents clients in insurance
coverage disputes involving a variety of
cyber, environmental and other liability
and property claims.
DECEMBER 2017 81

American Oil and Gas Reporter - December 2017

Table of Contents for the Digital Edition of American Oil and Gas Reporter - December 2017