Cyber Risks Insurance Coverage and Regulatory Updates for

Cyber Risks  Insurance Coverage and Regulatory Updates for

Cyber Risks Insurance Coverage and Regulatory Updates for the Coverage: Offshore Cyber Security and Insurance Evolving Where More Than EnergyRisks and Marine Sectors Data Is At Stake Cefor Annual Seminar Oslo 9 April 2015 Glenn Legge James Brown Legge, Farrow, Kimmitt, McGrath & Brown, L.L.P. www.leggefarrow.com

1 Issues to be Addressed Concerns about exposure to cyber attacks in the marine and offshore energy sectors. Enhanced government oversight and corporate obligations to protect against increasing risk of cyber attacks. U.S. Coast Guard (USCG) and Department of Homeland Security (DHS) proposed regulations for marine and offshore energy sectors. Insurance coverage issues arising from exclusions for cyber risks.

New contractual allocation clauses for cyber risks. Path Forward 2 Cyber attacks - Is the Offshore Energy Next? Is Next Now? 2014 Hackers caused a floating energy facility off the coast of West Africa to list, forcing temporary shut down. 20 June 2014 AnonGhost announced it had launched a barrage of cyber-attacks on energy companies in the Middle East and the United States. Later identified as Operation Petrol.

2 July 2014 DHSs ICS-CERT warned of malicious software used by a Russian hacking group Energetic Bear or Dragonfly targeting the energy sector and related industries. 10 December 2014 ICS-CERT identified a variant of the Black Energy malware that targeted GE Cimplicity and Siemens WinCC SCADA programs. 30 January 2015 ICS-CERT identified a remote exploit vulnerability affecting Cobham Sailor 900 VSAT, a maritime satellite broadband product and allowing attacker to bypass passwords. 3 Enhanced Government Oversight to Manage Risks of Cyber Attacks June 2013 Executive Order 13636 Improving Critical Infrastructure Cybersecurity. February 2014 Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 National Institute of Standards and Technology (NIST).

February 2014 DHS/DOE Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model (ONG C2M2) Version 1.1. July 2014 DHS Insurance Industry Working Session Readout Report. June 2014 SEC Commissioner Aguilar Addresses Corporate Obligations Concerning Cyber Risks. December 2014 DHS/USCG issue notice of proposed cybersecurity regulations. 4 Enhanced Government Oversight to Manage Risks of Cyber Attacks Executive Order 13636, Improving Critical Infrastructure Cybersecurity Adoption of the Cybersecurity Framework (Framework). Market-based incentives to encourage the development of cyber insurance.

Litigation risk mitigation for entities that adopt the Framework and meet reasonable insurance requirements. Legal benefits may include limited indemnity, higher burdens of proof, or limited penalties; case consolidations; case transfers to a single federal court. Insurance options could include a requirement for the purchase of private market liability insurance in order to apply for these liability protections and legal benefits. Executive Order 13636, June 12, 2013. 5 Enhanced Corporate Responsibility to Manage Risks for Cyber Attacks DHS Insurance Industry Working Session Readout Report,

Insurance for Cyber-Related Critical Infrastructure Loss: Key Issues, July 2014. 6 Enhanced Government Oversight to Manage Risks of Cyber Attacks DHS Insurance Industry Working Session July 2014 Round table meetings with insurance industry Oct. 2012 to Nov. 2013. Report on energy sector insurance: o Exclusion CL380 described as an exemption clause that is commonplace in property insurance written for energy sector companies. o Underwriters recognized the need to develop data templates to assess risks. o Recognized the existence of several energy sector data sets that include failure scenarios that could assist in creating underwriting data templates. 7 Most Recent U.S. Regulatory Activity 12 December 2014 USCG/DHS issued notice of public meeting and requested

comments on: Developing cybersecurity assessment methods for vessels and facilities regulated by the USCG; and Cybersecurity vulnerabilities that could cause a Transportation Security Incident (TSI) = a security incident resulting in a significant loss of life, environmental damage, transportation system disruption, or economic disruption in a particular area. USCG invited public comments in developing standards, guidelines, and best practices to protect maritime critical infrastructure, which are due by April 15, 2015. Numerous entities have already provided comment and we expect further industry involvement in the development of proposed regulations given the recent deadline extension. 8 Most Recent U.S. Regulatory Activity 28 November 2014 USCG/DHS issued notice of proposed rulemaking: To establish minimum standards for computer controlled dynamic positioning (DP) systems on MODUs and vessels working on the US Outer Continental Shelf (OCS). Catastrophic incidents resulting from loss of control of DP systems during Critical OCS Activities : o A loss of position on a MODU during well-control operations could result in a subsea spill that is difficult to contain.

o A logistics vessel could lose position and strike a floating or fixed facility, thereby causing damage to the gas export riser, which may result in an explosion, a loss of life, or an environmental event. USCG invited public comments which are due by 27 May 2015. 9 Insurance Coverage for Cyber Attacks on the Energy Sector Where is it? Type of losses and policies that may be involved in a cyber attack: Loss Policy Property of the company or third parties Property/Liability Pollution damages/liability Liability/OEE Well control and re-drill expenses COW/OEE

Business interruption, contingent business interruption and lost or delayed production of company or third parties Property/Liability Loss of intellectual property, trade secrets and financial information Cyber Risk Remediating damage to computer systems Cyber Risk Bodily injury or death claims of employees or third parties Liability Regulatory fines and/or penalties Cyber Risk Shareholder suits

D&O 10 CL380 INSTITUTE CYBER ATTACK EXCLUSION CLAUSE 1.1 Subject only to clause 1.2 below, in no case shall this insurance cover loss damage liability or expense directly or indirectly caused by or contributed to by or arising from the use or operation, as a means for inflicting harm, of any computer, computer system, computer software program, malicious code, computer virus or process or any other electronic system. 1.2 Where this clause is endorsed on policies covering risks of war, civil war, revolution, rebellion, insurrection, or civil strife arising therefrom, or any hostile act by or against a belligerent power, or terrorism or any person acting from a political motive, Clause 1.1 shall not operate to exclude losses (which would otherwise be covered) arising from the use of any computer, computer system or computer software program or any other electronic system in the launch and/ or guidance system and/or firing mechanism of any weapon or missile. 10/11/03 CL380 11

New Contractual Risk Allocation Clauses for Cyber Risks in the Offshore Energy Sector Contractual indemnity for damage arising from virus/malware that was delivered via contractors devices, computers or software. Indemnity obligations extend to property damage, environmental impairment, bodily injury/death resulting from virus/malware. Restricted use of wireless connections and storage devices. Requirements that contractors comply with minimum standards to protect the networks and computer resources of the contractors/service companies that may be involved in work for owners/operators. Would a violation of these contractual obligations impact liability coverage? 12 Path Forward Good News U.S. government is using regulations, commercial, financial and legal incentives to: o Encourage companies to implement measures to prevent cyber attacks. o Encourage the creation of insurance programs to respond to cyber attacks. o Asking for input from stakeholders.

History of offshore energy and marine companies and insurers have worked closely on conceptually challenging risks (Welcar 2001). Existing risk assessment templates can be used to assess cyber risks/cyber attacks require insured to exercise appropriate levels of due care and diligence (OEE, EED 8/86) Bad News Insurance coverage for energy sector cyber attacks is still a nascent risk market. Unlike some other risks, cyber attacks continue to evolve at a rapid pace. Conceptually challenging risk allocation scenarios and damage models involving multiple types of coverages and underwriting disciplines. 13

Author Glenn Legge is a partner in Legge Farrow that has represented energy companies and their insurers for over 30 years. Mr. Legge focuses his practice in the areas of commercial litigation, including energy, marine, construction and insurance coverage matters. He represents operators, contractors, service companies and insurers involved in offshore exploration, production, development, construction and decommissioning matters. Mr. Legge has tried numerous cases to verdict, has arbitrated commercial disputes through award and enforcement and has argued cases before Texas appellate courts in the 1st, 5th and 14th Districts, the Texas Supreme Court and the United States Court of Appeals for the Fifth Circuit. In the last four years he has had the honor of obtaining significant victories for the London insurance market in two matters before the Texas Supreme Court, including the only reported opinion in the U.S. interpreting the Welcar 2001 terms. You can contact Mr. Legge at [email protected] 14 Cyber Risks Insurance Coverage and Regulatory Updates for the Coverage: Offshore Cyber Security and Insurance Evolving Where More

Than EnergyRisks and Marine Sectors Data Is At Stake Cefor Annual Seminar 15 Oslo 9 April 2015 Glenn Legge James Brown Legge, Farrow, Kimmitt, McGrath & Brown, L.L.P. www.leggefarrow.com 15

Recently Viewed Presentations

  • Art History

    Art History

    Crusades begin in Europe (1095) Pilgrimages to Jerusalem begin . Pointed arch and flying buttress developed by French architects . King John of England signs the Magna Carta (1215) Pointed arch and flying buttress developed by French architects .
  • Basic Concepts of Financial Accounting

    Basic Concepts of Financial Accounting

    Basic Concepts of Financial Accounting End of Chapter 2 Basic Concepts of Financial Accounting Chapter 2 The Basic Accounting Equation Financial accounting is based upon the accounting equation. Assets = Liabilities + Owners' Equity This is a mathematical equation which...
  • Paper 1: Source Questions - HISTORY

    Paper 1: Source Questions - HISTORY

    Annotate your cartoon/ write them in your book. Is this a positive or negative source? How do we know? Which biblical figure is Briand supposed to represent? What reaction does the cartoonist want from the people attending the banquet? Why...
  • Department of Health & Human Services

    Department of Health & Human Services

    A review of the literature into physical restraint found contemporary world's best practice in support of people with disability who exhibit behaviours of concern is informed and directed by ethical, clinical and legal imperatives to at least minimise, and in...
  • Numeracy Starters

    Numeracy Starters

    Numeracy Starters Who am I? Show your working. Times me by 3 And subtract 15 You get 25 Put the lottery numbers in the correct part of the Carroll Diagram.
  • Teaching Children With Autism Spectrum Disorders Using Intelligent

    Teaching Children With Autism Spectrum Disorders Using Intelligent

    His visible speech production is highly accurate and his facial features can be manipulated to change his emotions, coloring and remove his skin, teeth, lips, etc. Baldi's mouth movements can also be aligned to live recorded speech. ... A default...
  • 80. YILINDA BÜYÜK NUTUK (Söylev)

    80. YILINDA BÜYÜK NUTUK (Söylev)

    80. YILINDA BÜYÜK NUTUK (Söylev) Yrd. Doç. Dr. Orhan Çekiç T.C. Maltepe Üniversitesi Atatürk İlkeleri ve İnkılâp Tarihi Bölüm Başkanı
  • Building a Distributed Access Management Infrastructure ...

    Building a Distributed Access Management Infrastructure ...

    Operating model as a strategic, enterprise level choice Enterprise Architecture As Strategy, Jeanne W. Ross, Peter Weill, David Robertson Architecture should align with and support chosen operating model Operating Models Diversified Operating Model Operating Models Operating Models Operating Models Operating...