Hardware and Software Thefts

Companies have rapidly become dependent on computers. When a company’s computer system is down, regardless of the cause, the company risks losing weeks, months, or possibly years of data. Businesses store the majority of their information on computers. Customer databases, contact information, supplier information, order forms, and almost all documents a company uses to conduct business are stored on the computer system. Losses from theft of proprietary information, sabotage of data networks, or telecom eavesdropping can cause major losses to the infrastructure base of a business, whether it is done by outside hackers or by insider disgruntled employees.

Hackers and crackers can cause expensive, if not fatal, damage to a company’s computer systems. HackersVirtual vandals who try to poke holes in a company’s security network. are virtual vandals who try to poke holes in a company’s security network.George S. Sutcliffe, Esq., E-Commerce and Insurance Risk Management (Boston: Standard Publishing Corp., 2001), 13. Hackers may be satisfied with defacing Web sites, while crackersVandals who want to break in to a company’s security network and steal proprietary information for personal gain. are vandals who want to break in to a company’s security network and steal proprietary information for personal gain. Potential terrorists are usually classified as crackers. Their objective is to hit specific companies in order to bring systems down, steal data, or modify data to destroy its integrity. InsidersInternal employees who vandalize a company because they are upset with it for some reason. are internal employees upset with the company for some reason, perhaps because of a layoff or a failure to get an expected promotion. Inside access to the company computer network, and the knowledge of how to use it, gives this group the potential to cause the most damage to a business.

A virusProgram or code that replicates itself inside a personal computer or a workstation with the intent to destroy an operating system or control program. is a program or code that replicates itself inside a personal computer or a workstation with the intent to destroy an operating system or control program. When it replicates, it infects another program or document.Adapted from the online glossary of Symantec, a worldwide provider of Internet security solutions, at http://www.symantec.com/avcenter/refa.html.

Technological Changes

Another risk companies face in the cyber world is the rapid advancement of technology. When a company updates its computer system, its software package, or the process for conducting business using the computer system, business is interrupted while employees learn how to conduct business using the new system. The result of this downtime is lost revenue.

Regulatory and Legal Changes

Almost as quickly as the Internet is growing, the government is adding and changing applicable e-commerce laws. In the past, there were few laws because the Internet was not fully explored nor fully understood, but now, laws and regulations are mounting. Thus, companies engaged in e-commerce face legal risks arising from governmental involvement. An example of a law that is likely to change is the tax-free Internet sale. There is no sales tax imposed on merchants (and hence the consumer) on Internet sales between states partly because the government has not yet determined how states should apportion the tax revenue. As the volume of online purchases increases, so do the consequences of lost sales tax revenue from e-commerce.

Lack of qualified lawyers to handle cases that arise out of e-commerce disputes is another new risk. There are many areas of e-law that lawyers are not yet specialized in. Not only are laws complex and tedious, they are also changing rapidly. As a result, it is difficult for lawyers to stay abreast of each law that governs and regulates cyberspace.

Trademarks Infringements

Domain name disputes are a serious concern for many businesses. In most cases, disputes over the rights to a domain name result from two specific events. Domain name hijackingWhen an individual or a business reserves a domain name that uses the trademark of a competitor. occurs when an individual or a business reserves a domain name that uses the trademark of a competitor. The other event arises when a business or an individual reserves the well-recognized name or trademark of an unrelated company as a domain name with the intent of selling the domain name to the trademark holder. Seeking compensation for the use of a registered domain name from the rightful trademark holder is known as cybersquattingSeeking compensation for the use of a registered domain name from the rightful trademark holder..George S. Sutcliffe, Esq., E-Commerce and Insurance Risk Management (Boston: Standard Publishing Corp., 2001), 13.

A recent case involving cybersquatting is People for the Ethical Treatment of Animals v. Doughney. In August 2001, the Fourth Circuit Court of Appeals held that the defendant, Michael Doughney, was guilty of service mark infringement and unfair competition, and had violated the Anti-Cybersquatting Consumer Protection Act (ACPA). Doughney had created a Web site at http://www.peta.org, which contained the registered service mark PETA. People for the Ethical Treatment of Animals (PETA) is an animal rights organization that opposes the exploitation of animals for food, clothing, entertainment, and vivisection. When users typed in http://www.peta.org, they expected to arrive at the site for People for the Ethical Treatment of Animals. Instead, they surprisingly arrived at People Eating Tasty Animals, a “resource for those who enjoy eating meat, wearing fur and leather, hunting, and the fruits of scientific research.” The site contained links to a number of organizations that held views generally opposing those of PETA.People for the Ethical Treatment of Animals v. Doughney, No. 00-1918 (4th Cir2001); http://www.phillipsnizer.com/internetlib.htm. On two occasions, Doughney suggested that if PETA wanted one of his domains, or objected to his registration, it could “make me an offer” or “negotiate a settlement.”

Web site hijackingWhen a Web site operator knowingly deceives the user by redirecting the user to a site the user did not intend to view. occurs when a Web site operator knowingly deceives the user by redirecting the user to a site the user did not intend to view. A recent case, Ford Motor Company v. 2600 Enterprises et al., caught attention in December 2001 when 2600 Enterprises automatically redirected users from a Web site they operate at a domain name directing profanity at General Motors to the Web site operated by Ford at http://www.ford.com. The defendants redirected users by programming an embedded link, which utilized Ford’s mark, into the code of the defendants’ Web site.Ford Motor Company v. 2600 Enterprises et al., 177 F. Supp. 2d 661, 2001, U.S. District Court Lexis 21302 (E.D. Michigan2001); http://www.phillipsnizer.com/int-trademark.htm. Domain-name hijacking, cybersquatting, and Web site hijacking for the sake of parody or satire is protected by the First Amendment, but sometimes the pranksters’ only purpose is to harass or extract profit from the trademark owner.Monte Enbysk, “Hackers and Vandals and Worms, Oh My!” Microsoft bCentral newsletter, http://www.bcentral.com.

Internet-Based Telephony Crimes

One of the fastest-growing communication technologies is Internet-based telephony—known as voice-over-Internet protocol (VoIP). The National Institute of Standards and Technology warned that this technology has “inherent vulnerabilities”Simon London, “Government Warns Users on Risks of Internet-Based Telephony: Voip Is Growing in Popularity as the Technology Proliferates, but Inherent in the Service, Warns the Government, Is Increased Security and Privacy Flaws,” Financial Times, February 6, 2005, http://www.ft.com/cms/s/0/5fca499c-7554-11d9-9608-00000e2511c8.html (accessed March 15, 2009). because firewalls are not designed to help in securing this industry, which is grew by $903 million in 2005, up from $686 million in 2004.

E-Commerce Property Insurance

According to the 2004 CSI/FBI Computer Crime and Security Survey described above, only 28 percent of 320 respondents had any external insurance policies to help manage cyber security risks. Traditional property insurance covers physical damage to tangible property due to an insured peril. Electronic data can be considered property in most instances, but standard commercial insurance policies, discussed in Chapter 1 "The Nature of Risk: Losses and Opportunities", contain exclusions that “explicitly invalidate coverage for exposures in relation to the use of technology.”“New Policy Offered to Cover Tech Risks,” National Underwriter Online News Service, July 2, 2002; Stand Alone E-Commerce Market Survey, by IRMI at http://www.irmi.com/Expert/Articles/2001/Popups/Rossi02-1.aspx. Some insurers now offer customized e-commerce insurance policies that expand the areas of coverage available for e-commerce property risk. ISO has an e-commerce endorsement that modifies insurance provided under commercial property coverage. Under this endorsement,

The endorsement has four sections. Section I describes the electronic data coverage. Section II defines the period of coverage as well as the coverage of business income, extra expenses, and resumption of e-commerce activity. Section III classifies covered and excluded perils; exclusions include mechanical breakdown; downtime due to viruses, unless the computer is equipped with antivirus software; errors or omissions in programming or data processing; errors in design, maintenance, or repair; damage to one computer on the network caused by repair or modification of any other computer on the network; interruption as a result of insufficient capacity; and unexplained failure. Section IV of the endorsement is for other provisions, explained in Chapter 10 "Structure and Analysis of Insurance Contracts".

In addition to this endorsement, a few insurers have created a variety of e-commerce policies. Some of the companies include ACE USA, Chubb, AIG, the Fidelity and Deposit Companies (members of Zurich Financial Services Group), Gulf Insurance Group, Legion Indemnity Company, and Lloyd’s of London. This list is by no means inclusive.George S. Sutcliffe, Esq., E-Commerce and Insurance Risk Management (Boston: Standard Publishing Corp., 2001), 13. These companies provide not only first-party e-commerce property and business interruption coverage, but also liability coverage for third-party liability risks. The liability coverage will be discussed in Chapter 12 "The Liability Risk Management". Because e-commerce does not see geographical boundaries, many policies provide worldwide e-commerce coverage.