A Chubb Insurance Group Cyber Liability Policy


This post discusses the insurance policy listed below. There are more than several cyber insurance policies available these days, but there is no real literature about them.  There are one or two pieces in law reviews, but there is no real discussion of what the policies contain or how they work.  This is an attempt to do just that.  This policy is narrower than others and it is not a paradigm of cyber liability insurance policies.

There are not (or few and hard to find) judicial decisions on cyber insurance policies/contracts, e.g., treating coverage matters. There may be a few out there, but they are not reported, and I have found no real references. One of the propositions that the forgoing implies is that I do not believe that I am giving a comprehensive account of this policy, or others I have discussed and will discuss. In addition, I do not so much suggest that what I am saying can be taken as gospel. That sort of thing, if it comes at all, is far off in the future.  If you are inclined to think I am a prophet, I am flattered, and while you may be right, do not bet large sums on it, although you have my permission to cite me in coverage opinions, law review or magazine articles,  court briefs–or, for that matter, judicial opinions.

I will not be giving a full explication of the policy; much of it is left out. The main concentration is on the insuring agreement, the definitions, and the exclusions. Not even all of them are discussed.  The main reason for this is that many of the components of not only the exclusion section, but the conditions and the miscellaneous sections, are not really very interesting in studying and thinking about cyber policies. One reason for this is that they are quite similar to what has been characteristic of insurance policies for many years.

My comments on the policy, immediately below, will be enclosed in brackets, “[   ].”

This insurance policy–or a predecessor–was issued for the first time in 2000. The following comes from a 2006 version.  It is a liability policy–a third-party policy.

Chubb Group of Insurance Companies


1. Insuring Clause [Insuring Agreement]

The Company shall pay on behalf of each Insured all Loss on account of any Claim first made during the Policy Period arising out of the Insured’s Internet Activities which occurred on or after the Retroactive Date set forth in ITEM 7 of the Declarations.

[This insuring agreement cannot be understood without grasping the relevant definitions, at least to some extent.  One important thing about it is characteristic of many policies that have been in use for many years, e.g., Directors and Officers Liability Policies.  Policies like that have a certain period of coverage, and or more events must happen during that interval.  These include (1) events giving rise to a claim against the insured, (2) the claim against the insured, (3) claims by the insured “against” the insurer seeking coverage, or (3) up to all of them.   In this case, that which gives rise to the claim-again-the-insured must occur during the policy period, as must the claim against the insured itself, as well as the insured’s claim against the insurer. Because of this ostensibly fixed schedule, the insurer offers extension periods.  They can be retroactive or for the future.  Thus if a claim-against-the-insured is originally required to be submitted during the policy period, that time interval can be increased by an interval of time back into the past, or it can be stretched out into the future.  The insurer may or may not have a right to refuse these extensions.  In any case, extensions demand payment of an additional premium.]

[On items on a Declarations Page/Sheet, see the discussion of definition (f) and (g).]

2. Definitions

(b) Defense Costs means that part of Loss consisting of reasonable costs, charges, fees (including but not limited to attorneys’ fees and experts’ fees) and expenses (other than regular or overtime wages, salaries or fees of the directors, officers or employees of the Named Insured) incurred in defending Claims, and the premium for appeal, attachment or similar bonds.

[The language of this definition entails that the insurer’s costs of defense will diminish the amount available to compensate the complainant against the insured.  This proposition is reinforced elsewhere in the policy.]

(f) Internet Activities means
(i) display or use of other Matter on an Internet Site;
(ii)  transmission of Matter via an Internet Site; or
(iii) the disseminating of Matter by any other means of publication or communication shown
in Item 8 of the Declarations.

(g) Internet Site means an Internet site shown in Item 8 of the Declarations.

(h)  Loss means any amount which an Insured becomes legally obligated to pay on account of any Claim, including but not limited to damages (including punitive and exemplary damages, where insurable by law), judgments, settlements, costs, and Defense Costs. . . .

[Remember: Defense costs are part of the loss so that the expenditure of defense costs reduces the amount that is available to pay the indemnity part of the claim.]

(i) Matter means printed, verbal, numerical, audio, or visual expression, or another expression, regardless of the medium upon which such expression is fixed.

3. Exclusions

The Company shall not be liable for Loss on account of any Claim made against any Insured:

Anti-Trust:  (d) arising out of allegations of price-fixing, restraint of trade, monopolization, unfair trade practices, or any actual or alleged violation. . . .

Patent Infringement  (h) arising out of any actual or alleged infringement, contribution to infringement, or inducement of infringement of any patent[.]

Governmental Actions:  (i) brought by any federal, state, or local regulatory agency or other administrative body alleging the violation of any federal, state, or local laws or regulations.

[So far as I can tell, the rest of the 14 or so exclusions, depending on how they are counted, are not very interesting either because they are part of common sense, because they are not uniquely related to cyber insurance situations, or because they or some close variation of them, are well known from other types of currently existing commercial liability policies.

Reporting and Notice 5.  Insureds must give Chubb written notice of a claim against it “as soon as practicable” but within 60 days and no longer. This demand is described as a “condition precedent to their exercising their rights hereunder. . . .”  In addition, it is also a “condition precedent” of an insured exercising any of its rights that it provide the insurer (Chubb) with such information and cooperation as it may reasonably require.

[This clause is common all over the industry. The first part is commonly called the “Late Notice Requirement” or the “Late Notice Condition,” while the second half is often called the “Duty to Cooperate Clause.”  Insurers usually describe these requirements as conditions, but a number of courses have ruled against this understanding of the clauses. The reason is that the clauses, as set forth in the policies, are held not actually to be conditioned for various reasons; instead, those courts treat them as covenants, meaning simple promises in the contract. This distinction can make a lot of difference in litigation, but it is easiest for the insured to act in accordance with the language of the insurance contract, and avoid that dispute even if the law is “on his side.”]

Defense and Settlement 6.  The Company shall have the right and duty to defend any Claim covered by this Policy…The Company may make any investigation it deems necessary and may, with the consent of the Named Insured, make any settlement of any Claim it deems expedient… Defense Costs are part of and not in addition to the Limits of Liability set forth in the Declarations, and the payment by the Company of Defense Costs reduces and may exhaust such Limits of Liability.

[The “duty to defend clause” is often among the most important clauses in the insurance policy. This matter is commonly known, so nothing more needs to be said about it here and now. It must be remembered that the amount that is paid for a defense, shrinks the amount of money available to pay the plaintiff if that is necessary. This feature is not common in ordinary commercial or personal liability policies, but it is common in malpractice policies, aka “E & O Policies,” aka “Errors and Omissions policies.”  Usually, these policies are for “professional” malpractice, e.g., doctors, lawyers, accountants, engineers, architects, and so on. Duty to defend clauses usually contains investigation clauses, cooperation clauses, and clauses regarding a settlement. Settlement clauses can be particularly important. They usually authorize the insurer to settle a case with the consent of the insured. However, if the insured refuses to consent, the insurer’s obligation to pay damages may be restricted to the amount for which the case could have been settled.  (Sometimes, the insured also ends up being liable for attorney’s fees accumulated after the case could have been settled.  That is not the case in this policy.)]

There are a number of other clauses, most of the routine, so they will not need to be discussed here.  Here are their titles:

  • Allocation [as between covered and uncovered events]
  • Extended Reporting Periods
  • Spousal Liability Coverage
  • Other Insurance [sometimes other insurance policies pay first]
  • Representations and Severability [Assertions in the application must be true and are part of the policy.
  • Territory [where there is coverage]
  • Notice
  • Subrogation
  • Action Against the Company, i.e., the insure [Insured’s full compliance with the terms of the contract is a condition precedent upon the insured suing the insurer.  Seldom enforced these days.]
  • Bankruptcy
  • Authorization
  • Alteration and Assignment [The insured may not do either one.  Strictly enforced.]
  • Cancellation and Non-renewal.

[Sometimes these “conditions” or “conditional clauses” or “alleged conditions,” can contain what might be called “tricks.”  Consider the “Late Notice Clause,” which requires that the insured give notice no later than the 60th day.  Does this mean provide or receive? If the request for coverage is sent by mail, several days may pass. So might a late-night notice be emailed to an insurer?  This sort of thing does not come up often and generally, the reasonable insurer doesn’t seek to enforce this clause over these kinds of situations, except–maybe–where fraud is plausibly thought to exist.]


Essay on Coverage

This discussion will concern one aspect of coverage: that which is obviously included in or involved with the Insuring Agreement, Definition (f), and the Definitions contained therein.
Definition (f) begins with the Definition of Matter. Generally speaking,  the defined term “Matter” refers to a concatenation of instruments of communications, and the communication they can be used for can be of any sort. The human voice, however, is not mentioned though it seems to me that it is implied.

An Internet site is a “something” by means of which communication can occur over the Internet. (n: Internet Site is any Internet site listed on the declaration page of the policy. Notice that cyber communication systems are not within the definition and therefore not insured.

[1] (f)(i)So an Internet Activity is, among other things, the display of Matter on an Internet site listed in the policy–that is an Internet Site;

[2] (f)(i)An Internet Activity, is also, among other things, other use of Matter on an Internet site listed in the policy–that is Internet Site  (I take the phrase “other use” to include a variety of other uses, and note that the term is not defined in the policy.  I think it’s reasonably clear that the word “use” really means other “uses.”)

[3] (f)(ii) transmission of Matter via an Internet Site; (It is unclear whether “transmission” means out, in, or both. I see no difficulty in taking that word to mean both outgoing and incoming.

[4]  (f)(iii) dissemination of Matter by any other means of publication or communication shown in the specified place in the policy. I find (f)(iii) puzzling:

First, the difference between transporting and disseminating is not obvious. Either of them could be be intentional or unintentional. One can transport one thing, but the idea of dissemination seems to imply “moving” more than one thing.
Second, (f)(iii) dissemination pass through an Internet Site before can be something insured.  Of course the communications device that falls within (f)(iii) has to be listed in the specified place in the policy. Does that makes it discretionary for the underwriter for the insurer to decide how to deal with a particular dissemination device, say, the Wall Street Journal.  Or does is make it discretionary for the underwriter of the insurer to decide what categories of dissemination outside of Internet will trigger coverage through (f)(iii), say, newspapers, but not TV.

It would not surprise me for the insurer to opt for the former, say, there must be a particular magazine listed if it is to trigger insurance through (f)(iii), e.g., The New York Review of books
It would not surprise me for the insured to opt for the latter, e.g., magazines or magazines containing book reviews and so forth
I am inclined to think that the near sentence in (f)(iii) means extra-Internet category.

This reasoning does not need an argument from ambiguity.  An ambiguity argument may be needed to distinguish general categories from categories that are not general and are nothing but semantic games designed to make the particular look general
Third, why might (f)(iii) be included in this kind of policy when (f)(iii) falls within CGL coverage, when liable, etc.from Coverage B is involved? Maybe its to deal with the insuring the insured’s  passing along incoming messages libelous information.

In any case, the fact that this is a liability policy is quite clear. We shall be examining some first-party policies and other liability policies as blog-chapters go along