Eighth Circuit rules cyberattacks are less predictable than rainstorms
Posted on 07/11/2016 at 12:00 AM by John Lande
This blog recently covered a decision by the United States District Court for the District of Minnesota that found coverage under a bank’s financial institution bond for losses resulting from a cyber-attack. The bond carrier resisted paying the claim because, the bond carrier argued, the losses resulted from employee conduct, which was excluded from the bond’s coverage.
After the district court decision the bond carrier appealed to the United States Court of Appeals for the Eighth Circuit. The Eighth Circuit agreed with the district court and found that the bond carrier had to provide coverage under the financial institution bond for the cyber-loss.
In reaching its decision the Eighth Circuit explained:
[A]n illegal wire transfer is not a “foreseeable and natural consequence” of the bank employees' failure to follow proper computer security policies, procedures, and protocols. Even if the employees' negligent actions “played an essential role” in the loss and those actions created a risk of intrusion into Bellingham's computer system by a malicious and larcenous virus, the intrusion and the ensuing loss of bank funds was not “certain” or “inevitable.” The “overriding cause” of the loss Bellingham suffered remains the criminal activity of a third party. Therefore, the district court properly granted summary judgment to Bellingham.
(emphasis added). The Eighth Circuit contrasted the employee conduct that caused the cyber-loss with moisture damage resulting from defective construction. The Eighth Circuit explained that moisture damage is a foreseeable consequence of defective construction because rainstorms are predictable, and when it rains defective construction will allow damaging water infiltration. The Eighth Circuit does not view cyber-attacks as having the same sort of inevitability.
The Eighth Circuit’s decision is important for banks for two reasons. First, it demonstrates that a bank’s financial institution bond may provide coverage for losses resulting from cyber-attacks. Second, given the ubiquity of cyber-attacks the Eighth Circuit’s rationale may soon be overcome by reality—cyber-attacks are as predictable as rainstorms.
The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.
Categories: Construction Law, Cybersecurity Law, John Lande, Banking Law
Questions, Contact us today.
The material, whether written or oral (including videos) that is posted on the various blogs of Dickinson Bradshaw is not intended, nor should it be construed or relied upon, as legal advice. The opinions expressed in the various blog posting are those of the individual author, they may not reflect the opinions of the firm. Your use of the Dickinson Bradshaw blog postings does NOT create an attorney-client relationship between you and Dickinson, Bradshaw, Fowler & Hagen, P.C. or any of its attorneys. If specific legal information is needed, please retain and consult with an attorney of your own selection.