Be Proactive Now: Commercial Construction Quickly Joining List of Industries Vulnerable to Cyber Attacks
June 15, 2017 —
Jeffrey M. Dennis & Nathan Owens – Newmeyer & Dillion LLPCommercial contractors have long faced their own unique business risks - labor and material shortages, delay claims, bonding issues, and defects in workmanship. But, in today's ever-evolving cyber world, it is imperative that contractors understand they are vulnerable to risks beyond finishing a project on time and on budget. As we are seeing more and more each day, cyber threats impact all businesses, including the construction industry, and the failure to protect against these threats will cost your company millions in damages and reputational harm.
UNDERSTANDING CYBER THREATS
Traditionally, cyber threats are thought of as the theft of employee and customer information over the internet. Given the construction industry is the largest employer in the world, the need to protect this information is obvious. The release or loss of personnel or consumer data could lead to extensive liability under a variety of potential claims, including statutory fines. In addition to securing confidential information, companies have to protect against outside agents accessing control of a company’s security protocols, equipment or encrypting files using malicious software. The recent “WannaCry” attack demonstrates that no business is immune from cyber attacks.
EXAMPLES OF RELATED BREACHES
For those that think these scenarios do not happen, here are two examples of these types of breaches:
* In May 2013, Chinese hackers stole floor plans, server information, and security system designs from an Australian prime contractor. Fearing the risks of compromised physical and network security, the contractor incurred additional costs of $132.6 million in project delays and costs to rework the various components that had been stolen.
* Then, in December 2014, a German governmental office reported that a steel mill suffered massive damage when malware prevented a blast furnace from being properly shut down. Hackers gained access to key technology within the company, which eventually allowed them to control the production line.
THE NEW WORLD OF THE IoT
In addition to these types of “traditional” hacking threats, cybersecurity risks continue to evolve and become more complicated every day. Some of these new threats are driven by the development of a phenomenon known as the Internet of things, or IoT. The IoT is most basically defined as the interconnection of devices with on / off switches to the Internet and each other. Since the IoT is estimated to be 20 billion or more devices within 3 years, and can be combined with malicious software, IoT poses one of the most challenging risks for contractors to protect against.
The technology included in today's commercial buildings clearly opens this avenue of risk. A centralized computer control center, typically employed in new buildings, controls and maintains the systems that are vital to the operation of the building, e.g., power, elevators, HVAC, lighting, and security. What happens if a hacker gains control to one of these systems, let alone all of them? What if a hacker simply utilizes an IoT attack to overwhelm a building’s computer systems? In either scenario, at a minimum, significant disruption would occur. Worse, the health and safety of those within the building could be jeopardized. A hacker may utilize ransomware in combination with an IoT attack to take over control of the building and hold it and possibly the occupants “hostage” until a ransom is paid.
The first significant IoT attack happened in October 2016 when a major web hosting company was attacked through the IoT, causing the host site to crash. The attack did not steal information, it simply caused the site to crash. But, that crash caused world-wide disruption across the Internet.
Hackers used malicious software to access a hundred thousand common household devices — web cameras, fitness trackers, DVR’s, smart TVs and even baby monitors — to flood the hosting company’s servers with incredibly high internet traffic. This attack showed that everyday items can be hacked and controlled by cyber criminals and then used against anyone else.
As we have all seen in recent news, the WannaCry cyber attack impacted businesses across the globe. Days after the attacks, hospitals were still left feeling its impact with continued appointment and planned operation cancellations, and delays in service. We should expect to see these types of attacks increasing in frequency.
PAY ATTENTION OR FACE THE CONSEQUENCES
Make no mistake about it, the stakes are incredibly high in the realm of cyber security protection. By 2021, the annual worldwide cost attributable to cyber attacks is estimated to reach the trillions of dollars. If any of these potential attacks occur, a contractor faces significant exposure, in many forms, including:
* Monetary. Cybersecurity events result in direct monetary losses in the form of notification costs, data recovery costs, and, of course, legal and public relations fees. States are also starting to impose strict standards on companies which will result in significant regulatory punishment in the cases of cyber breaches, including the added costs associated with agency investigations, regulatory fines and consumer redress funds.
* Reputation. Perhaps more important than the monetary risk, a contractor may incur substantial reputational harm if such a breach or attack is successful. Recent data has shown that small to medium-sized companies that experience a significant cybersecurity breach go out of business within six months of the breach – due to not only high monetary costs, but severe reputational damage.
* Criminal. The recently passed New York cybersecurity regulations place potential criminal penalties on compliance personnel. Other states are likely to follow New York.
As a business leader and commercial builder, the time to act is now. While the purchase of specific cyber insurance is an important part of protecting against the risks of a cyber attack, many cyber policies contain exclusionary language embedded in the policy making coverage potentially illusory. Additional steps can and need to be taken immediately, including an honest discussion of internal cybersecurity protections, examination of risk management strategy, and the training of employees. Failure to take these important steps could result in a disastrous cybersecurity breach and the loss of millions of dollars.
Jeffrey M. Dennis currently serves as Newmeyer and Dillion’s Managing Partner and, as a business leader, advises his clients on cybersecurity related issues, introducing contractual and insurance opportunities to lessen their risk. You can reach Jeff at jeff.dennis@ndlf.com.
J. Nathan Owens is the Managing Partner for Newmeyer & Dillion’s Las Vegas office. With more than 10 years in the construction industry as a former contractor himself, Nathan understands the complex issues builders and developers face in all aspects of development and construction. You can reach Nathan at nathan.owens@ndlf.com.
About Newmeyer & Dillion
For more than 30 years, Newmeyer & Dillion has delivered creative and outstanding legal solutions and trial results for a wide array of clients. With over 70 attorneys practicing in all aspects of business, employment, real estate, construction and insurance law, Newmeyer & Dillion delivers legal services tailored to meet each client’s needs. Headquartered in Newport Beach, California, with offices in Walnut Creek, California and Las Vegas, Nevada, Newmeyer & Dillion attorneys are recognized by The Best Lawyers in America©, and Super Lawyers as top tier and some of the best lawyers in California, and have been given Martindale-Hubbell Peer Review's AV Preeminent® highest rating. For additional information, call 949-854-7000 or visit http://www.newmeyeranddillion.com/.
Read the court decisionRead the full story...Reprinted courtesy of
Definitions Matter in Illinois: Tenant Held Liable Only for Damage to Apartment Unit
September 09, 2024 —
Gus Sara - The Subrogation StrategistIn Phila. Indem. Ins. Co. v. Gonzalez, No. 1-23-0833, 2024 Ill. App. Unpub. LEXIS 1372, the Appellate Court of Illinois considered whether the terms of a lease agreement limited a tenant’s liability for fire damages, a fire caused by her negligence, to her apartment unit only. The plaintiff insured the subject apartment building, which incurred damage to several units as result of a fire in the tenant’s unit. The lease defined “Premises” as the specific apartment unit occupied by the tenant and held the tenant responsible for damage caused to the Premises. While the court found that the lease permitted the plaintiff to subrogate against the tenant, it held that the lease terms limited the damages to the tenant’s apartment unit only.
In Gonzalez, the plaintiff’s insured owned a multi-unit apartment building in Chicago. In September 2019, the building owner entered into a lease agreement with the defendant for apartment Unit 601. The lease stated that Unit 601 was the “Leased Address (Premises).” Another provision stated that building owner “hereby leases to Tenant(s) and Tenant(s) hereby leases from Landlord(s) for use as a private dwelling only, the Premises, together with the fixtures and appliances (if any) in the premises…” The lease also stated that “Tenant shall be liable for any damage done to the premises as a result of Tenant’s or Tenant’s invitees, guests or others authorized to reside in the Premises [sic] direct action, negligence, or failure to inform Landlord of repairs necessary to prevent damage to the Premises.”
Read the court decisionRead the full story...Reprinted courtesy of
Gus Sara, White and WilliamsMr. Sara may be contacted at
sarag@whiteandwilliams.com
Architect Responds to Defect Lawsuit over Defects at Texas Courthouse
October 08, 2013 —
CDJ STAFFLee County, Texas has sued the architect responsible for designing the drainage system at its historic courthouse. The suit seeks $1.7 million in damages to pay for replacing the defective system and repairing the building from damage sustained due to soil saturation.
Dale A. Rabe responds that the county commissioners were more concerned with “beautifying the building” than on needed foundation repairs. Further, Mr. Rabe notes that “Lee County contracted directly with a civil engineering firm to design a drainage system.” But according to Mr. Rabe what they used instead was “a cheaper pump-based design to save money.” And even there, “Lee County failed to maintain the drainage system properly.
Read the court decisionRead the full story...Reprinted courtesy of
Corporate Transparency Act’s Impact on Real Estate: Reporting Companies, Exemptions and Beneficial Ownership Reporting (webinar)
December 04, 2023 —
Pillsbury's Construction & Real Estate Law Team - Gravel2Gavel Construction & Real Estate Law BlogOn October 23, 2023, colleague
Andrew Weiner and Kevin Gaunt, counsel at Hunton Andrews Kurth, examined the Corporate Transparency Act (CTA), effective Jan. 1, 2024, and its impact on real estate entities and transactions, including who is considered a reporting company subject to new beneficial ownership information (BOI) reporting requirements and whether an exemption applies. The panel also discussed certain state laws that impose similar reporting requirements as the CTA and described best practices for real estate counsel to assist their clients with preparing for the CTA’s implementation and ongoing compliance.
The panel also reviewed other important considerations, including:
- Which real estate entities will likely be most affected by the CTA’s implementation and why?
- What exemptions may apply?
- How will the CTA’s reporting requirements affect real estate transactions for lenders and investors/buyers?
Read the court decision
Read the full story...
Reprinted courtesy of Pillsbury's Construction & Real Estate Law Team
Drastic Rebuild Resurrects Graves' Landmark Portland Building
September 14, 2020 — Nadine M. Post - Engineering News-Record
Fifteen minutes into a 105-minute job interview for the $195-million overhaul of the long-troubled Portland Public Service Building in Oregon’s largest city, owner’s rep Mike Day threw a curve ball to the unwitting design-build team of Howard S. Wright Construction Co. and architect DLR Group. Already hard at work solving Day’s first faux crisis scenario—a budget buster that threatened the viability of the makeover of the notoriously dysfunctional landmark—they had to regroup.
Reprinted courtesy of Nadine M. Post, Engineering News-Record
Ms. Post may be contacted at postn@enr.com
Read the full story... Read the court decision
Read the full story...
Reprinted courtesy of
Terminating the Notice of Commencement (with a Notice of Termination)
July 19, 2017 — David Adelstein - Florida Construction Legal Updates
The notice of commencement is important for purposes of construction lien priority. Stock Bldg. Supply of Florida, Inc. v. Soares Da Costa Const. Services, LLC, 76 So.3d 313, 317 (Fla. 3d DCA 2011) (“[A] notice of commencement serves to determine the priority of liens under the Construction Lien Law.”). A lien relates back in time to the date the notice of commencement was recorded assuming the notice of commencement is still in effect when the lien is recorded (or an amended noticed of commencement is recorded). Lien priority is very important and the reason why a contractor should always want to ensure there is an effective notice of commencement in place rather than an expired notice of commencement.
For the same reasons why a contractor wants to ensure there is an effective notice of commencement, there are times an owner wants to terminate a notice of commencement. An owner may want to terminate the potential priority of a construction lien. For instance, say the owner is refinancing or obtaining a construction loan in the midst of construction. A lender will want to ensure its mortgage maintains first priority and certainly priority over a potential construction lien. Otherwise, why would a lender finance the construction if it does not maintain first priority. It generally will not. Thus, an owner needs to terminate the notice of commencement so that the closing occurs on the loan and the mortgage recorded before a new notice of commencement is recorded and construction continues. Read the court decision
Read the full story...
Reprinted courtesy of David Adelstein, Florida Construction Legal Updates
Mr. Adelstein may be contacted at Dadelstein@gmail.com
Car Crashes Through Restaurant Window. Result: Lesson in the History of Additional Insured Coverage
December 29, 2020 — Randy J. Maniloff - White and Williams LLP
Back in the day, additional insureds were oftentimes afforded coverage for liability “arising out of” the named insured’s work for the additional insured. When confronted with such language, courts often concluded that it dictated “but for” causation. In other words, but for the named insured doing the work for the additional insured, the additional insured would not be in the liability-facing situation that it is in. The result in some cases: additional insureds were entitled to coverage for their sole negligence. Decisions reaching such a conclusion were generally not well-received by insurers. This was especially so when you consider that the premium received by insurers, for the AI coverage, may not have been enough to buy a package of Twizzlers.
Insurer frustration with such decisions -- which insurers did not believe expressed the intent of additional insured coverage -- led ISO to make revisions to additional insured forms in 2004 (later revisions followed). At the heart of these revisions was an attempt to require fault on the part of the named insured before coverage could be afforded to the additional insured. (This is a very brief and simple history of this complex issue.) Read the court decision
Read the full story...
Reprinted courtesy of Randy J. Maniloff, White and Williams LLP
Mr. Maniloff may be contacted at maniloffr@whiteandwilliams.com
Texas Shortens Cut-Off Date for Suits Against Homebuilders Who Provide a 6-Year Written Warranty
June 26, 2023 — Kim Altsuler - Peckar & Abramson, P.C.
Summary of the new law as it pertains to builders of new homes:
The existing 10-year statute of repose for builders of new homes (the ultimate cut-off date for filing suit) has been shortened to 6 years if the builder provides a 1-2-6 written warranty (1-year workmanship and materials; 2-year plumbing, electrical and HVAC; 6-year structural).
Extended time to bring suit if written claim presented during the period of repose:
If a written claim for damages, contribution, or indemnity is presented to the builder during the applicable limitations period and the 6-year statute of repose applies, the time to sue is extended one year from the date the claim is presented. In practical effect, this means that if a written claim is presented and the statute of repose expires before suit is filed, suit may still be filed provided it is within one year of the date the written claim was made.
When the new law goes into effect:
The new law is effective as of June 9, 2023 and applies to suits commenced on or after that date. However, if the contract under which the claim is brought was entered into before June 9, 2023, the former 10-year version of the statute of repose applies. In other words, the statute applies to contracts entered into on or after June 9, 2023, if the contract has at least a 1-2-6 warranty. Read the court decision
Read the full story...
Reprinted courtesy of Kim Altsuler - Peckar & Abramson, P.C.
Ms. Altsuler may be contacted at kaltsuler@pecklaw.com
