Republished from Tressler’s Privacy Risk Report blog.

On May 20, 2016, the U.S. Court of Appeals for the 8th Circuit affirmed a District Court decision finding coverage for a loss under a financial institution bond issued by BancInsure, Inc. (BancInsure) to the State Bank of Bellingham (Bellingham). Bellingham made a claim under the bond when one of its computers became infected with malware that allowed criminals to transfer $485,000 held at Bellingham to an account at a foreign bank. By the time the illegal transfer was discovered, the funds were not recoverable. The District Court granted Bellingham’s motion for summary judgment finding coverage under the financial bond.

Before reaching its decision, the 8th Circuit examined the “concurrent-causation doctrine” as adopted under Minnesota law, which holds that “[a]n insured is entitled to recover from an insurer when the cause of the loss is not excluded under the policy. This is true even though an excluded cause may have contributed to the loss.” In its decision, the 8th Circuit applied Minnesota’s concurrent-causation doctrine as follows:

[W]here an excluded peril “contributed to the loss,” an insured may recover if a peril is… “the efficient and proximate cause” of the loss.  Conversely, it follows that if an excluded peril is the efficient and proximate cause of the loss, the coverage is excluded.  An “efficient and proximate cause,” in other words, is an “overriding cause.” 

BancInsure first argued that the concurrent-causation doctrine does not apply to financial institution bonds. Specifically, BancInsure took the position that “despite the general applicability of the concurrent-causation doctrine to Minnesota insurance contracts, the doctrine is not similarly applicable to financial institution bonds because a financial institution bond requires the insured initially show that its loss directly and immediately resulted from dishonest, criminal, or malicious conduct.” In rejecting BancInsure’s argument, the 8th Circuit found “[n]o Minnesota case precludes application of the concurrent-causation doctrine to financial institution bonds.” Therefore, under Minnesota law, the 8th Circuit found no reason to treat financial bonds differently than any other insurance contract.

Next, BancInsure asserted the language in the bond “contracted around the doctrine.” In an argument relying heavily on the exclusions in the bond, BancInsure argued the policy language was intended to “contract[] around the concurrent-causation doctrine because [the] exclusions also apply to ‘indirect’ causation.” The 8th Circuit held the provisions BancInsure relied on for this argument were not sufficiently direct to get around the concurrent-causation doctrine. In acknowledging parties can contract around the doctrine, the 8th Circuit held that Minnesota law requires such language to be “clear and specific.” The court held there was no provision that was sufficiently clear or specific in the bond at issue in this case.

Finally, BancInsure claimed the trial court incorrectly held hacking by a criminal third party into the bank’s computer system was the overriding or efficient and proximate cause of the loss. Rather, BancInsure argues this question should have been resolved by a jury. In rejecting BancInsure’s argument, the 8th Circuit relied on its decision in Friedberg v. Chubb & Son, Inc., where Minnesota’s concurrent-causation doctrine was closely examined in a first-party property case where the insureds’ home suffered extensive water damage. During an investigation of the water intrusion, it was determined that defective construction of the home caused the water damage. In finding the policy in Friedberg did not provide coverage, the 8th Circuit held that “although the water intrusion played an essential role in the damage to the [] house, it was a foreseeable and natural consequence that water would enter.”

Based on the reasoning in Friedberg, the 8th Circuit held the trial court correctly opined that “the efficient and proximate cause of the loss in this situation was the illegal transfer of the money and not the employees’ violations of policies and procedures.” Specifically, the court held that “[u]nlike the water damage in Friedberg, an illegal wire transfer is not a ‘foreseeable and natural consequence’ of the bank employees’ failure to follow proper computer security policies, procedures, and protocols.” That is, even if the employee’s actions are found to have played an essential role in a virus attacking the bank’s system, “the intrusion and the ensuing loss…suffered remains the criminal activity of a third party.”

This decision demonstrates that courts are going to go back to the well-established concepts even when technology gives rises to new factual backgrounds and circumstances. For example, in this decision, the court goes back to fundamental first-party insurance concepts with the concurrent-causation doctrine. Consequently, while the facts are unique with technology, hacking and cyber claims, we can expect courts to first look to establish law to solve coverage issues.