Best Practices: Mediating Cyber Insurance Claim Disputes
By Daniel Garrie (July 26, 2019)
With cyber threats on the rise, many companies are purchasing cyber insurance policies to help mitigate risk. However, because cyber insurance is a relatively new field, there is not currently a standard-form cyber insurance policy in the marketplace. Insurers have not settled on precedent policy language and there has been little case law on coverage disputes, creating an air of uncertainty around many facets of cyber policy coverage and a customer base of insureds with little or no knowledge of what they are purchasing.
To complicate the matter, these disputes often involve intricate information systems, which can present highly technical issues of fact. Because of these challenges, mediating cyber insurance coverage disputes with the right mediator (or mediators) is often the best course of action for both the insurer and insured.
So, what makes a mediator the “right” mediator? Company executives and their general counsel should remember that the key to successfully mediating cyber claims is using a mediator who understands insurance, the law and the underlying technical systems at play in a given cyber insurance dispute. This will article outline some of the reasons why mediating cyber insurance claims can benefit insurers and insureds, and will provide guidance on choosing the right mediator.
Benefits of Using Mediation in These Disputes
Both parties typically stand to benefit from mediating cyber insurance disputes rather than litigating them. Engaging in litigation in such an unsettled area of the law is risky for both sides. There have been only a handful of cyber policy coverage rulings thus far and for many cyber coverage disputes likely to arise, these rulings will not be instructive or lead to predictive outcomes. Predicting how courts will rule on a given dispute will be challenging, and challenging litigation is often expensive litigation. With no precedent, a cost/benefit analysis of litigation is difficult to undertake. Mediation offers a level of predictability not yet available for the cyber insurance realm of litigation.
Litigation is also notoriously expensive, not only in terms of legal and expert consulting fees, but also in the cost of recruiting key technical resources to prepare for the case, rather than securing the business. These costs can be prohibitive for many insureds, especially smaller companies, which are increasingly being targeted by cyber criminals. Mediation is often less expensive than litigation for cyber disputes, and a mediator with the right qualifications can remove the need to hire experts and consultants to educate the court and lawyers on the technology. Mediation also provides for more procedural flexibility than litigation, which enables companies to more effectively manage their technical resources while a dispute is ongoing.
Furthermore, mediation provides the parties privacy and allows them to keep the dispute out of the public eye, which can benefit both parties. Obviously, insureds that have recently suffered a data breach will want to avoid publicizing it; however, keeping cyber coverage disputes confidential is often desirable for insurers as well. Besides being expensive in capital, publicly litigating a cyber coverage case can have reputational costs. A contentious cyber coverage litigation may receive a lot of publicity and portray the insurer as an opportunistic or predatory agency, which could cause a loss of business. Because the cyber insurance market is rapidly expanding and would-be insureds have many choices, any loss of goodwill could cause insurers to miss out on acquiring key clients in these pivotal early stages while the market is still developing.
How to Select Your Mediator
Deciding to mediate, however, is merely the first step towards effectively resolving a cyber coverage dispute; the key is using the right mediator. Often, the lawyers involved in a dispute have little technical experience. One of the most important parts of the mediator’s job is guiding the parties and their lawyers through the technical nuances of the systems at issue. It is important to keep in mind there are many areas of expertise in the field of technology and that competence in one area does not necessarily imply competence in another. Therefore, it is critical that the mediator is not only technically competent, but also familiar with the specific information systems the insured is using.
The mediator also needs to know insurance law and, ideally, have familiarity with both the insured’s business and the insurance business generally. Because the role of a mediator differs from that of a judge who makes rulings on the law, having a more intimate understanding of both sides’ perspectives and business needs is important to a successful mediation. This enables the mediator to engage in creative solutions, which are often crucial in cyber coverage disputes, due to the variety and negotiability of cyber insurance policies.
For some, this situation may beg the question: “Won’t it be difficult and time consuming to find a mediator who meets all these criteria?” Sure, retaining such a specialist will require effort, but it can save money in the long run. Cyber disputes often get bogged down when lawyers insist on making legal arguments where focusing on the technical issues would be more productive. This tends to drive up costs as the proceedings become more time consuming, less efficient and increasingly dependent on third-party experts and consultants.
In that cyber insurance is still an emerging legal field, mediators that are experts in both technology and insurance may be far and few between. While such mediators do exist, parties may also consider co-mediation as a strategy to settle their case. Using two mediators—one with expertise in insurance and another with expertise in technology — is an efficient allocation of legal resources. By using mediators who are masters in their own respective fields, the need for third-party consultants and experts is mitigated, and can be a long-term cost-saving strategy.
With cyber insurance disputes, mediation is a more cost-effective and more collaborative option than litigation. Above all else, the right mediator or mediators can cut to the heart of the technical, legal and business issues at play and remove much of the need for third-party experts and consultants. In this way, making the extra effort up front to find the right mediator can make a big difference in the time, cost and feasibility of reaching an efficient and effective resolution.