Be Proactive Now: Commercial Construction Quickly Joining List of Industries Vulnerable to Cyber Attacks
June 15, 2017 —
Jeffrey M. Dennis & Nathan Owens – Newmeyer & Dillion LLPCommercial contractors have long faced their own unique business risks - labor and material shortages, delay claims, bonding issues, and defects in workmanship. But, in today's ever-evolving cyber world, it is imperative that contractors understand they are vulnerable to risks beyond finishing a project on time and on budget. As we are seeing more and more each day, cyber threats impact all businesses, including the construction industry, and the failure to protect against these threats will cost your company millions in damages and reputational harm.
UNDERSTANDING CYBER THREATS
Traditionally, cyber threats are thought of as the theft of employee and customer information over the internet. Given the construction industry is the largest employer in the world, the need to protect this information is obvious. The release or loss of personnel or consumer data could lead to extensive liability under a variety of potential claims, including statutory fines. In addition to securing confidential information, companies have to protect against outside agents accessing control of a company’s security protocols, equipment or encrypting files using malicious software. The recent “WannaCry” attack demonstrates that no business is immune from cyber attacks.
EXAMPLES OF RELATED BREACHES
For those that think these scenarios do not happen, here are two examples of these types of breaches:
* In May 2013, Chinese hackers stole floor plans, server information, and security system designs from an Australian prime contractor. Fearing the risks of compromised physical and network security, the contractor incurred additional costs of $132.6 million in project delays and costs to rework the various components that had been stolen.
* Then, in December 2014, a German governmental office reported that a steel mill suffered massive damage when malware prevented a blast furnace from being properly shut down. Hackers gained access to key technology within the company, which eventually allowed them to control the production line.
THE NEW WORLD OF THE IoT
In addition to these types of “traditional” hacking threats, cybersecurity risks continue to evolve and become more complicated every day. Some of these new threats are driven by the development of a phenomenon known as the Internet of things, or IoT. The IoT is most basically defined as the interconnection of devices with on / off switches to the Internet and each other. Since the IoT is estimated to be 20 billion or more devices within 3 years, and can be combined with malicious software, IoT poses one of the most challenging risks for contractors to protect against.
The technology included in today's commercial buildings clearly opens this avenue of risk. A centralized computer control center, typically employed in new buildings, controls and maintains the systems that are vital to the operation of the building, e.g., power, elevators, HVAC, lighting, and security. What happens if a hacker gains control to one of these systems, let alone all of them? What if a hacker simply utilizes an IoT attack to overwhelm a building’s computer systems? In either scenario, at a minimum, significant disruption would occur. Worse, the health and safety of those within the building could be jeopardized. A hacker may utilize ransomware in combination with an IoT attack to take over control of the building and hold it and possibly the occupants “hostage” until a ransom is paid.
The first significant IoT attack happened in October 2016 when a major web hosting company was attacked through the IoT, causing the host site to crash. The attack did not steal information, it simply caused the site to crash. But, that crash caused world-wide disruption across the Internet.
Hackers used malicious software to access a hundred thousand common household devices — web cameras, fitness trackers, DVR’s, smart TVs and even baby monitors — to flood the hosting company’s servers with incredibly high internet traffic. This attack showed that everyday items can be hacked and controlled by cyber criminals and then used against anyone else.
As we have all seen in recent news, the WannaCry cyber attack impacted businesses across the globe. Days after the attacks, hospitals were still left feeling its impact with continued appointment and planned operation cancellations, and delays in service. We should expect to see these types of attacks increasing in frequency.
PAY ATTENTION OR FACE THE CONSEQUENCES
Make no mistake about it, the stakes are incredibly high in the realm of cyber security protection. By 2021, the annual worldwide cost attributable to cyber attacks is estimated to reach the trillions of dollars. If any of these potential attacks occur, a contractor faces significant exposure, in many forms, including:
* Monetary. Cybersecurity events result in direct monetary losses in the form of notification costs, data recovery costs, and, of course, legal and public relations fees. States are also starting to impose strict standards on companies which will result in significant regulatory punishment in the cases of cyber breaches, including the added costs associated with agency investigations, regulatory fines and consumer redress funds.
* Reputation. Perhaps more important than the monetary risk, a contractor may incur substantial reputational harm if such a breach or attack is successful. Recent data has shown that small to medium-sized companies that experience a significant cybersecurity breach go out of business within six months of the breach – due to not only high monetary costs, but severe reputational damage.
* Criminal. The recently passed New York cybersecurity regulations place potential criminal penalties on compliance personnel. Other states are likely to follow New York.
As a business leader and commercial builder, the time to act is now. While the purchase of specific cyber insurance is an important part of protecting against the risks of a cyber attack, many cyber policies contain exclusionary language embedded in the policy making coverage potentially illusory. Additional steps can and need to be taken immediately, including an honest discussion of internal cybersecurity protections, examination of risk management strategy, and the training of employees. Failure to take these important steps could result in a disastrous cybersecurity breach and the loss of millions of dollars.
Jeffrey M. Dennis currently serves as Newmeyer and Dillion’s Managing Partner and, as a business leader, advises his clients on cybersecurity related issues, introducing contractual and insurance opportunities to lessen their risk. You can reach Jeff at jeff.dennis@ndlf.com.
J. Nathan Owens is the Managing Partner for Newmeyer & Dillion’s Las Vegas office. With more than 10 years in the construction industry as a former contractor himself, Nathan understands the complex issues builders and developers face in all aspects of development and construction. You can reach Nathan at nathan.owens@ndlf.com.
About Newmeyer & Dillion
For more than 30 years, Newmeyer & Dillion has delivered creative and outstanding legal solutions and trial results for a wide array of clients. With over 70 attorneys practicing in all aspects of business, employment, real estate, construction and insurance law, Newmeyer & Dillion delivers legal services tailored to meet each client’s needs. Headquartered in Newport Beach, California, with offices in Walnut Creek, California and Las Vegas, Nevada, Newmeyer & Dillion attorneys are recognized by The Best Lawyers in America©, and Super Lawyers as top tier and some of the best lawyers in California, and have been given Martindale-Hubbell Peer Review's AV Preeminent® highest rating. For additional information, call 949-854-7000 or visit http://www.newmeyeranddillion.com/.
Read the court decisionRead the full story...Reprinted courtesy of
Res Judicata Bars Insured from Challenging Insurer's Use of Schedule to Deduct Depreciation from the Loss
June 10, 2024 —
Tred R. Eyerly - Insurance Law HawaiiThe insured was barred by res judicata from filing a second lawsuit challenging the insurer's method of establishing the amount of the loss. Burke v. GeoVera Spec. Ins. Co., 2024 U.S. App. LEXIS 9186 (5th Cir, April 16, 2024).
On August 29, 2021, Hurricane Ida caused wind damage to the Burkes' home. They filed a claim with their insurer, GeoVera Specialty, and received payment. In calculating the payment, GeoVera Specialty adjusted the damage claim pursuant to its Roof System Payment Schedule, which lists the criteria used in reducing roof damage claims based on depreciation. Based on that schedule, GeoVera Specialty reduced the roof damage component of the Burkes' claim by forty-eight percent.
In March 2022, the Burkes filed suit alleging that GeoVera Specialty undervalued their claim. On September 8, 2022, the parties filed a joint motion to dismiss the lawsuit after reaching a settlement, which the district court granted.
Read the court decisionRead the full story...Reprinted courtesy of
Tred R. Eyerly, Damon Key Leong Kupchak HastertMr. Eyerly may be contacted at
te@hawaiilawyer.com
Fifth Circuit: Primary Insurer Relieved of Duty to Defend Without Release of Liability of Insured
March 02, 2020 —
Bethany L. Barrese & Ashley McWilliams - Saxe Doernberger & Vita, P.C.In Aggreko, LLC v. Chartis Specialty Ins. Co.,1 the Fifth Circuit affirmed a decision by the Texas District Court and held that a Covenant Not to Execute constituted a “settlement” sufficient to exhaust policy limits and terminate a primary insurer’s duty to defend.
This case arose out of a wrongful death suit filed by the parents of James Brenek II (“Brenek”). In 2014, Brenek was fatally electrocuted by an electrically energized generator housing cabinet while performing work on a rig in Texas for Guichard Operating Company, LLC (“Guichard”), a Louisiana-based drilling subcontractor. Guichard had leased the generator from Aggreko, LLC (“Aggreko”). A rental agreement between Guichard and Aggreko required Guichard to maintain commercial general liability insurance during the lease period and list Aggreko and the rig owner, Rutherford Oil Corporation (“Rutherford”), as additional insureds under
the policy.
Guichard’s primary insurance carrier, The Gray Insurance Company (“Gray”), agreed to defend and indemnify Aggreko and Rutherford in the wrongful death suit. The Gray policy had a limit of $1,000,000, subject to a $50,000 self-insured retention.
Reprinted courtesy of
Bethany L. Barrese, Saxe Doernberger & Vita, P.C. and
Ashley McWilliams, Saxe Doernberger & Vita, P.C.
Ms. Barrese may be contacted at blb@sdvlaw.com
Ms. McWilliams may be contacted at amw@sdvlaw.com
Read the court decisionRead the full story...Reprinted courtesy of
Anti-Concurrent Causation Clause Eliminates Loss from Hurricane
September 06, 2021 —
Tred R. Eyerly - Insurance Law HawaiiThe court found the insured was not covered for losses caused by Hurricane Laura due to the implementation of the policy's anti-concurrent causation clause. Aegis Sec. Ins. Co. v. Lejeune, 2021 U.S. Dist. LEXIS 106804 (W. D. La. June 7, 2021).
At the time of the hurricane, the insureds' home was covered by a manufactured home insurance policy issued by Aegis. The policy excluded coverage for damage "caused by, contributed to or aggravated by" flooding. The policy's anti-concurrent causation clause read, "We do not pay for loss to the types of property covered under this policy caused by any of the following. Such loss is excluded regardless of any other cause or event contributing concurrently or in any sequence to the loss." The policy's exceptions followed.
After the storm, the insureds submitted their claim. Aegis filed suit for declaratory judgment. Aegis relied upon reports that the manufactured home and barn owned by the insureds were damaged by winds, then displaced and destroyed by storm surge associated with the hurricane. The home first sustained damage from the storm's high winds before it was displaced from its concrete piers by a 12 to 16 foot storm surge.
Read the court decisionRead the full story...Reprinted courtesy of
Tred R. Eyerly, Damon Key Leong Kupchak HastertMr. Eyerly may be contacted at
te@hawaiilawyer.com
Repairs Commencing on Defect-Ridden House from Failed State Supreme Court Case
October 15, 2014 —
Beverley BevenFlorez-CDJ STAFFIn the Windmill Harbour area of Hilton Head Island, South Carolina, Danielle Smith is repairing her home after “spending almost $25,000 on unsuccessful legal battles and two years to secure a loan,” according to the Beaufort Gazette. The contractor who custom built the home was unlicensed, and “[t]he synthetic stucco used to build the house was faulty, causing water damage throughout that will cost $500,000 and six months to repair.”
Back in 2008, Smith’s case reached the state Supreme Court. The court ruled against her, reasoning “that the former owner, who had hired subcontractors to build the house, could not be held liable for the damage because he built it as a private home and had originally intended to never sell it.”
Read the court decisionRead the full story...Reprinted courtesy of
Real Estate & Construction News Round-Up (10/05/22) – Hurricane Ian, the Inflation Reduction Act, and European Real Estate
October 24, 2022 —
Pillsbury's Construction & Real Estate Law Team - Gravel2Gavel Construction & Real Estate Law BlogThis week’s round-up features Hurricane Ian’s effect on the construction labor pool, the Inflation Reduction Act’s projected impact on the real estate and construction industry, Europe’s real estate market, and more.
- The Inflation Reduction Act (IRA), designed to reduce the nation’s carbon footprint by jump-starting innovation and adoption of cleaner energy sources, also contains large segments aimed at real estate and construction. (Chava Gourarie, Commercial Observer)
- Damage caused by Hurricane Ian’s massive storm surge, flooding and winds is projected to hike demand for experienced construction workers. (Zachary Phillips, Construction Dive)
- According to the National Multifamily Housing Council’s monthly construction survey released Sept. 29, 2022, almost all developers are experiencing construction delays. (Paul Bergeron, Globest)
Read the court decisionRead the full story...Reprinted courtesy of
Pillsbury's Construction & Real Estate Law Team
Two Lawyers From Hunton’s Insurance Recovery Group, Andrea DeField and Latosha Ellis, Selected for American Bar Association’s 2022 “On The Rise” Award
August 15, 2022 —
Kevin V. Small - Hunton Insurance Recovery BlogPartner, Andrea DeField, and counsel, Latosha Ellis, were each recently awarded “On the Rise – Top 40 Young Lawyers” honors by the American Bar Association’s Young Lawyers Division. The award honors 40 of the nation’s most promising lawyers under the age of 40 or who have been licensed for 10 years or less. Recipients demonstrate high achievement, innovation, vision, leadership, and service to the profession and their communities, including extensive knowledge in litigation or transactional work and commitment to pro bono, charitable, or professional volunteer work, all while making a lasting impact in their respective fields. More information may be found
here.
Reprinted courtesy of
Kevin V. Small, Hunton Andrews Kurth
Mr. Small may be contacted at ksmall@HuntonAK.com
Read the full story... Read the court decisionRead the full story...Reprinted courtesy of
Excess Policy Triggered Once Retention Paid, Even if Loss Not Covered By Excess
July 23, 2014 —
Tred R. Eyerly – Insurance Law HawaiiThe Fifth Circuit determined that the Umbrella policies took effect once the primary insurance was exhausted by claims not covered by the Umbrella policies. Indem. Ins. Co. of N. Am. v. W&T Offshore, 2014 U.S. App. LEXIS 11775 (5th Cir. June 23, 2014).
W&T had primary and Umbrella/Excess coverage to protect its offshore oil rigs from hurricane damage. The primary policies covered property damage and third party claims. The Umbrella policies only covered third-party claims. All policies covered Removal of Debris (ROD).
In September 2008, Hurricane Ike caused damage to 150 offshore platforms in which W&T had an interest. W&T submitted over $150 million in claims for property damage to the primary carriers. The primary policies had a $10 million self-insured retention (SIR). The primary policies covered $150 million in coverage over the $10 million SIR. Anticipating that W&T would submit all of its ROD claims, which were estimated to exceed $50 million, the Umbrella carriers filed suit for a declaratory judgment.
Read the court decisionRead the full story...Reprinted courtesy of
Tred R. Eyerly, Insurance Law HawaiiMr. Eyerly may be contacted at
te@hawaiilawyer.com
