Insuring Your Business Against Cyber Risks (Part Three — Ransomware)

Below is the third in a series of posts from Emergent partner Peter Roldan on the increasing need for cyberinsurance.  His prior posts in the series are here and here.

Ransomware is a type of malware that encrypts data stored on an organization’s computer network, preventing users from accessing it unless a ransom is paid.  After infiltrating a computer network to install the ransomware—often through the use of “spearphishing” or other social engineering attacks—the attackers then demand money in exchange for an encryption key to decrypt the data being held hostage.

The use of ransomware has become more widespread because the tools used to mount an attack are easier to access than ever and the costs of an attack are minimal.  Although large companies with the resources to pay a ransom and organizations that hold particularly sensitive data, such as hospitals, are among the most common targets for ransomware attacks, any company that stores data on a network can become a victim.

Maintaining up-to-date security measures, regularly backing up data, and training employees to be aware of social engineering threats are actions all organizations should be taking in order to mitigate the threat of a ransomware attack.  Insurance is another key component of any risk-management strategy.

Many cyberinsurance policies include or offer coverage for cyberextortion, which can cover ransom payments made to recover encrypted data, as well as associated losses and expenses.  However, policyholders should be aware of the following issues that may arise when the time comes to make a claim.

Notice: Policies may require an insured to give notice of a ransomware attack as soon as it is discovered, or at the very least within 30 days.

Deductibles: Under many cyberinsurance policies, a deductible applies to all first-party claims, including ransomware.  Often, the deductible will be more than the amount of ransom being sought by an attacker.

Genuine Threat: Some policies require an insured to prove that a payment to a ransomware attacker was made under duress or that the threat was genuine and not a hoax.

Conditions: An insured may be barred from disclosing the existence of coverage for ransomware claims to an attacker.  Policyholders may also be required to cooperate with the insurer and coordinate any response efforts.

Coverage Exclusions: Many policies contain exclusions for acts of war, acts of foreign enemies, or government acts.  Acts of terrorism may also be excluded.  In addition, claims against an insured for bodily injury that may occur as a consequence of a ransomware attack (e.g., against a health care provider that loses access to patient information) are typically excluded under the liability coverage available under most cyberinsurance policies.

Security Measures: Many policies require policyholders to maintain adequate security measures, or to maintain the security measures disclosed in the policy application, and coverage may be barred if those measures are not in place when a loss is incurred.

While it is important to have cyberinsurance in place to protect your business, it is just as crucial to make sure that the policy will respond in the event of a loss.  To find out how Emergent can help you to maximize your recovery for claims for ransomware and other risks, contact us.

California Supreme Court Confirms Consumers Cannot Completely Waive Their Right to Seek Public Injunctive Relief Through an Arbitration Provision

On April 6, 2017, the California Supreme Court issued its opinion in McGill v. Citibank, N.A., Case No. S224086, which helped to refine the legal landscape regarding the enforceability of arbitration provisions in the aftermath of the United States Supreme Court’s decision in AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011).  Specifically, the McGill court held that arbitration provisions are invalid to the extent they purport to waive a plaintiff’s right to seek public injunctive relief under the Consumer Legal Remedies Act (“CLRA”), the unfair competition law (“UCL”), and the false advertising law in any forum.  In so holding, the California Supreme Court rejected defendant Citibank, N.A.’s contention that the Federal Arbitration Act (“FAA”) requires courts to enforce arbitration agreements, regardless of what they say about the availability of claims for public injunctive relief.

In McGill, the plaintiff opened a credit card account with Citibank and purchased a “credit protector” plan under which Citibank agreed to defer or credit certain amounts on the account when specific events occurred, including disability and unemployment.  At various times, Citibank gave notice to plaintiff of its intention to modify the agreement governing that account, and Plaintiff did not decline these modifications, which added an arbitration provision to plaintiff’s agreement.  The arbitration provision restricted the arbitrator to awarding relief “only on an individual (non-class, non-representative) basis” and required that claims “must proceed on an individual (non-class, non-representative basis.”  The provision contained this further limitation:  “If you or we require arbitration of a Claim, neither you, nor we, nor any other person may pursue the Claim in arbitration as a class action, private attorney general action or other representative action, nor may such Claim be pursued on your or our behalf in any litigation in any court.”

Subsequently, plaintiff brought a class action based on Citibank’s marketing of the credit protector plan and the handling of a claim she made after she lost her job.  In her complaint, plaintiff sought relief under the CLRA, the UCL, and the false advertising law, and requested an injunction prohibiting Citibank from engaging in further illegal and deceptive practices. 

Following Citibank’s motion to compel arbitration, the trial court held that agreements to arbitrate claims for public injunctive relief under the CLRA, UCL, or false advertising law were not enforceable under the so-called Broughton-Cruz rule, which rendered unenforceable agreements to arbitrate claims for public injunctive relief.  The Court of Appeal subsequently reversed and remanded on the basis that, pursuant to the U.S. Supreme Court’s decision in Concepcion, the FAA preempted the Broughton-Cruz rule.  Plaintiff then filed a petition for review in the California Supreme Court, arguing that the arbitration provision was invalid because the provision had the effect of waiving her right to seek public injunctive relief in any forum.  Citibank agreed that the arbitration provision cut off plaintiff’s right to seek public injunctive relief in any forum, but contended that the FAA preempted any state law preventing such waiver.

On review, the California Supreme Court clarified that the dispute did not implicate the Broughton-Cruz rule.  It reasoned that the Broughton-Cruz rule “applies only when parties have agreed to arbitrate requests for [public injunctive] relief”; in contrast, the parties in McGill had agreed to exclude requests for public injunctive relief from arbitration.  The California Supreme Court instead focused on, and rejected, Citibank’s argument that the FAA preempted state law preventing a waiver of a plaintiff’s claims for public injunctive relief.

The California Supreme Court first observed that, under Civil Code section 3513, “‘[a] law established for a public reason cannot be contravened by a private agreement.’”  It then held that waiver of a party’s right to seek public injunctive relief under the CLRA, UCL, or false advertising law in any forum would be unenforceable.

Turning then to the arbitration provision at issue, the California Supreme Court acknowledged that, under Concepcion, arbitration agreements could not be invalidated “‘by defenses that apply only to arbitration or that derive their meaning from the fact that an agreement to arbitrate is at issue.’”  However, the California Supreme Court also observed that, under U.S. Supreme Court precedent, the arbitration agreements could still be invalidated by generally applicable contract defenses, such as fraud, duress, and unconscionability. 

The California Supreme Court then noted that the prohibition in Civil Code section 3513 was a “generally applicable contract defense” in that it did not apply “only to arbitration or . . . derive[] its meaning from the fact that an agreement to arbitrate is at issue.”  In other words, any contract containing a prohibition on public injunctive relief would be invalid.  In this respect, the “FAA does not require enforcement of such a provision, in derogation of this generally applicable contract defense, merely because the provision has been inserted into an arbitration agreement.”  In so holding, the California Supreme Court further rejected Citibank’s arguments that public injunctive relief is comparable to the type of class action relief that can be waived in arbitration under Concepcion.  It also rejected Citibank’s claim that invalidation of the waiver of public injunctive relief would interfere with an “arbitration’s attribute.”

Notably, the California Supreme Court did not resolve whether other portions of the arbitration agreement remained valid despite the vitiation of waivers of plaintiff’s claims for public injunctive relief.  Since the parties had not raised the issue, the Court decided to leave these issues to the Court of Appeal on remand.

McGill provides important insights for how parties should view and structure arbitration agreements in California.  Parties preparing arbitration agreements must be careful not to incorporate requirements that run afoul of statutory prohibitions like Civil Code section 3513.  Such violations may not only void such requirements, they could possibly jeopardize the remainder of the arbitration agreement.  Similarly, parties asked to sign arbitration agreements should closely assess relevant provisions to ensure that there is no overreaching by the drafters.  When litigation becomes a possibility, those parties should also review the arbitration provisions to assess their enforceability.  Ultimately, all sides benefit when the expectations for arbitration are reasonable, clear, and enforceable, and McGill offers guiding principles on how to achieve that result to parties and their counsel.

To find out more about how Emergent helps its clients parse their most important agreements, contact us.

Scholes v. Lambirth Trucking Co.: An Important Lesson on the Statute of Limitations

Emergent partner Johnny Yeh focuses on real estate litigation, and actively canvasses the California appellate court decisions for developments in that area.  Here, he analyzes a recent opinion on the statute of limitations for property claims.  To learn more about how Johnny and Emergent can help you with your real estate dispute, contact us.

On April 6, 2017, the Court of Appeal for the Third Appellate District issued its opinion in Scholes v. Lambirth Trucking Co., which discusses several interesting real estate principles, most of which relate to the statute of limitations – i.e., the time period in which a lawsuit has to be commenced to be timely.

In Scholes, the defendant had a storage site next to the plaintiff’s property, which it used to grind wood products and to store wood chips, sawdust, and rice hulls. which would blow over onto the plaintiff’s property.  (OK, Google, what are rice hulls?)  Following warnings from local authorities that the storage site created a fire hazard, a fire broke out on the defendant’s property on May 21, 2007, which then spread to the plaintiff’s land.

The plaintiff filed a complaint on May 21, 2010, three years to the day of the fire.  The original complaint simply indicated that it concerned a “dispute compensation on insurance claim.”  The plaintiff otherwise alleged he had suffered general and property damages arising from the fire.  The plaintiff later filed an amended complaint, which was dismissed with leave to amend after the defendant moved for judgment on the pleadings.

On August 9, 2011, the plaintiff filed a second amended complaint and, for the first time, asserted causes of action for trespass, based on the fact that combustible materials had trespassed onto his property from defendant’s property and fueled the subsequent fire.  The defendant demurred to this complaint on the basis that it was barred by the statute of limitations, and the trial court sustained the demurrer with leave to amend.

On November 10, 2011, the plaintiff filed a third amended complaint alleging counts for negligent trespass, intentional trespass, and strict liability.  The plaintiff alleged that the fire had destroyed personal property, growing crops, other growth, motor vehicles, other mechanical equipment, and a walnut orchard.  He also requested triple damages under Civil Code section 3346 for the damage to the orchard.  Defendant demurred against the third amended complaint on the basis that it was barred by the statute of limitations.  This time, the court sustained the demurrer without leave to amend.

On appeal, the Scholes court explored a variety of issues, including the points below.

Trespass by Fire

The court first looked at which statute of limitations applied to the dispute.  The defendant argued that the two-year statute of limitations in Code of Civil Procedure (“CCP”) section 339(1) should apply, whereas the plaintiff argued that the three-year statute of limitations in CCP 338(b) – which deals with injuries to property – should apply.

In arguing for a two-year statute of limitations, the defendant reasoned that there wasn’t an actual entry onto the plaintiff’s property or a direct injury amounting to trespass.  Citing to case law over a century old, the defendant argued that the consequential damage created by the fire could not be classified as a trespass under CCP 338(b).  The court didn’t accept this argument, noting that newer case law reflected a more recent trend allowing trespass actions where the injury is consequential and indirect, such as where a fire moves from one property to a neighboring property.

The Relation-Back Doctrine

Finding that the three-year statute of limitations applied did not fully resolve whether plaintiff’s action was timely, however.  The fire happened on May 21, 2007, and the plaintiff only first mentioned his trespass theory in his second amended complaint, which had been filed on August 2011, over four years after the fire occurred.  To avoid this timing problem, the plaintiff argued that his trespass claims related back to his original complaint under the so-called “relation-back doctrine.”

In examining this argument, the court noted that “[u]nder the relation-back doctrine, in order to avoid the statute of limitations, the amended complaint must: rest on the same general set of facts as the [original] complaint, refer to the same same accident and same injuries as the original complaint, and refer to the same instrumentality as the original complaint.”

Upon comparing the facts alleged in the original complaint and the second amended complaint, the court found that the original complaint was “devoid of factual allegations” and failed to meet even the “minimal fact pleading requirement.”  There was no identification of the property at issue or specification of the damages suffered; nor did the original complaint provide factual information relating to the fire.  It also did not specify any causes of action.  In other words “[n]othing in the original complaint set[] forth any factual basis for [plaintiff’s] subsequent claims for [trespass].”  Since the original complaint failed to put the defendant on notice of the cause of action that would ultimately be asserted against it – i.e., trespass – the plaintiff could not rely on the relation-back doctrine to make its trespass claims timely.

Injuries to Trees

In a bid to keep his claims alive, the plaintiff then raised another interesting argument.  The plaintiff argued that, since his orchard had been damaged, the five-year statute of limitations set forth in Civil Code 3346(c) applied to his action, which would render the trespass claims in his second amended complaint timely.

The Scholes court, citing Gould v. Madonna, 5 Cal. App. 3d 404 (1970), rejected this argument on the basis that Civil Code 3346(c) did not apply to property damage from fires that had been negligently set.  Rather, Gould held that Health and Safety Code sections 13007 and 13008 applied to damages arising from negligent fires and observed that the legislature had set up an entirely different statutory scheme to address those types of cases.

Based on the above, the court decided that the plaintiff had failed to demonstrate how his third amended complaint could be amended to avoid the statute of limitations.

Conclusion

While Scholes articulates a variety of interesting points of law, the lesson is clear.  Parties and their lawyers should invest time and energy to fully analyze their claims before commencing suit.  Moreover, the analysis should be performed well before the statute of limitations has run to make sure that the limitations period is not a bar to the action.

Federal Court Affirms Availability of ERISA Surcharge Remedy to Employees

Emergent LLP recently scored a major victory in an action pending in the Southern District of New York, successfully convincing Senior U.S. District Court Judge Alvin K. Hellerstein to reconsider a prior ruling, and confirming the availability of an important remedy to employees who have suffered harm after being misled by their private pension and health care plans.

In 2011, the Supreme Court issued its decision in CIGNA v. Amara, 563 U.S. 421 (2011), and clarified that the Employee Retirement Income Security Act of 1974 (“ERISA”) entitles employees harmed by a breach of fiduciary duty to recover monetary compensation in the form of equitable remedies, which focus on the court’s view of fairness.  Since CIGNA, attorneys for employees and their beneficiaries have fought for a broad interpretation of when these monetary remedies are available, while attorneys for ERISA fiduciaries, such as employers and plan administrators, have fought to limit their availability.

Last summer, Emergent filed suit against investment bank Societe Generale on behalf of the widow of a former Societe Generale attorney for breach of fiduciary duty under ERISA.  The lawsuit stems from misrepresentations made by Societe Generale regarding the attorney’s life insurance benefits, and seeks monetary compensation for the harm caused by those misrepresentations under the equitable remedy known as “surcharge.”

Societe Generale moved to dismiss the lawsuit, but Judge Hellerstein denied the motion, allowing the widow’s claims against her husband’s former employer to proceed.  However, Judge Hellerstein struck the claim for surcharge, holding that in order to receive the remedy, the widow was required to show “intentionally deceptive conduct” on the part of Societe Generale.  Emergent moved for reconsideration of the order, on the grounds that the Supreme Court did not endorse any such requirement in CIGNA.  While such motions are rarely granted, the judge agreed that his ruling was in error, and on March 15th granted the motion, restoring the surcharge claim.  A copy of the order is linked here.

The case is captioned Goldenberg v. SG Americas, Inc., Case No. 16-cv-6390 (S.D.N.Y.).  Emergent partner Peter Roldan leads the firm’s representation of the employee’s widow.  To find out more about how he and Emergent can help you with your dispute, contact us.

Emergent Partners Publish Article on Anti-SLAPP

Emergent LLP partners Seth Rosenberg and Christopher Wimmer have published an article on California's Anti-SLAPP statute, which protects against lawsuits based on participation in the legal process.  The cover story of March's Plaintiff magazine, "Talk Softly, or Carry a Big (Anti-SLAPP) Stick" discusses how the statute applies to attorneys sued for speaking publicly about their cases, examines three recent Court of Appeal cases, and proposes practical tips for counsel when interacting with the media.

Real Estate Litigator Johnny Yeh Joins Emergent

Emergent LLP is pleased to announce that Johnny Yeh, an experienced litigator specializing in real estate and commercial disputes, has joined the firm as a partner in its San Francisco office.  Johnny is a Columbia Law School and Yale University alum.  He regularly counsels and advocates for clients in matters pertaining to condominiums, homeowners associations, and other common interest developments, and frequently represents property owners in boundary and nuisance actions, as well as lawsuits involving broken real estate contracts.  Johnny also routinely handles breach of contract, fraud, unfair competition, and employment actions.

Prior to joining Emergent, Johnny worked with premier law firms in San Francisco and New York City, including Latham & Watkins LLP and Quinn Emanuel Urquhart & Sullivan, LLP, concentrating on complex, commercial, and patent litigation, and representing national corporations, government sponsored enterprises, hedge funds, and foreign companies.  He also co-founded the boutique law firm McLaughlin Yeh LLP.

Johnny’s big firm experience bolsters Emergent’s existing complex commercial litigation practice, while his real estate knowledge expands the firm’s capabilities in that area.

To find out how Johnny and Emergent can help you, email him or contact us.