Given the continuing problems faced by policyholders in the coverage of "computer fraud," a district court in Michigan claimed that a manufacturer could not recover $ 800,000 in money lost after an employee mistakenly linked payment for legitimate vendor invoices to a fraud bank account after receiving a spoofed mail requesting payment. In American Tooling Center, Inc. v. Travelers Casualty and Surety Company of America No. 16-12108 (EDM.M. 1, 2017), the District Court applied state law which favors a narrow interpretation of the Crime Policy computer fraud control to determine that the policyholder had not suffered a "direct" loss "directly caused" by the use of any computer.
The policyholder, American Tooling Center, is a tool and death manufacturer that outsource Some of its work with suppliers located abroad. In 201
ATC sought coverage from the insurer under "computer fraud", which in the relevant section states that the insurer "pays insured for the insured's direct loss or direct loss from money damage … directly caused by computer fraud." The insurer denied coverage and claimed that ATC 's loss was not a "direct loss" which was "directly caused by the use of a computer".
The court agreed and, by giving a summary judgment the insurer raised the defense of many common insurance companies related "direct loss", "interference causes" and alleged "hacking" claims that have been rejected or restricted by other courts (see previous blog posts about them) questions here and here).
Although it applies to the insurer, American Tooling identifies many problems that policyholders should consider when negotiating coverage and covering cybercrime. Court pro-policy holder "direct loss" cases quoted by ATC who found that "direct" used in the rules on computer fraud was synonymous with "presence" or "dominant" cause – on the grounds that the Sixth Circumference (application of Michigan law ) dictated a more stringent definition of "direct", meaning "immediate" and "without any intervention". The Michigan cases invoked by the court were discernible, ATC argued on the grounds that they interpreted "direct" loss only when the policyholder attempted to obtain cover for a loss suffered by a third party, which was not applicable to the ATC dispute in which the cybercrime committed ATC of their own money.
The Court found that the fraudsters did not "directly" caused the transfer of funds from ATC's bank account due to intermediate events between ATC's receipt of fraudulent e-mails and funds transfer, namely ATC's production environment verification stones and approval and initiation of the transfers without verifying bank account information. Other courts have rejected similar insurance arguments in order to interpret in detail "direct" loss in favor of coverage where the chain of events leading to the fraudulent transmission was initiated by the fraudulent e-mail ( see eg ] Medidata The decision is discussed below. As can be seen from American Tooling and other recent social technical cases, state law can vary significantly for many important coverage issues. It is therefore important that policyholders are aware of the consequences that divergent state laws may have when considering legal issues in connection with political negotiations and when trying to cover a certain loss.
American Tooling The court tried to distinguish between the decision published by the defense Medidata (discussed here) on the grounds that the disputed crime policy in Medidata did not include the additional requirement that "direct loss" also "directly caused" by computer fraud. In this case, the court referred to the fifth Apache decision often by insurers to deny the coverage of social engineering fraud, but which policyholders (and Medidata the court have critically criticized as impartial as the actual fraudulent assignment was initiated As a direct result of the criminal sending a spoofed email, however, policyholders should be aware of the different languages in the rules on computer fraud and, if possible, negotiate a more favorable cause signal.
Despite the unfortunate judgment of American Tooling policyholders should not despair, social technology coverage continues to be a fact-intensive investigation that depends on the nature of the cyber attack and the specific political language, which varies significantly among criminal policies. American Tooling the case can be distinguished by unique facts and application of Mi We will continue to monitor this case and other social technical cases, as we expect this area of law to evolve rapidly, as fraudulent transfers become more widespread. In the meantime, policyholders should review their crime policy with an experienced advisor to determine which audits may be necessary before or during renewal to avoid a similar result.