Sprinklered Buildings Still Burn

Kurtis Suhs
Founder and Managing Director, Cyber Special Ops, LLC

Mr. Suhs serves as the Founder and Managing Director for Cyber Special Ops, LLC,  a cyber risk company that provides its clients with Concierge Cyber®, a revolutionary new delivery solution for cyber risk services modeled on concierge medicine.

Many insurance professionals have compared cyber insurance to employment practices liability (EPL) insurance which took decades for organizations to adopt; however that is where the comparison ends. Cyber insurance is more analogous to catastrophic commercial property insurance, in which state-sponsored actors and sophisticated crime syndicates target and seek to burn down your building 24/7/365 days per year.

According to FM Global, the three main reasons sprinklered buildings burn are 1) design deficiencies, 2) system impairments before a fire, and 3) system impairments during a fire.  Let’s evaluate how each of these causes compare with cyber loss.

Design Deficiency

Sometimes due to design deficiency or system impairment, an automated  sprinkler system fails to suppress a fire sufficiently and thus a building burns despite the system.

Water supply
Is the water source
—a public water supply?
—a fire pond?

Incident Response
Is the data breach team
—an external third-party service provider?
—an internal legal and infosec team?

System design
Is the system design adequate?
What is the system trying to protect?

Network Design
Is the network architecture adequate?
What is the system trying to protect?

Changes in occupancy

Changes in electronic assets                               

The building (organization) was devastated by fire (a cyberattack). The cause of the devastation was multifaced. The water supply (incident response plan) was limited because a single connection from the public water main (a few data breach firms) supplied the entire sprinkler system (cyber insurance market). However, the water supply (incident response plan) was limited and the water flow (insured’s cyber insurance coverage and limit) to the automatic sprinklered system (network defense) was marginally adequate for the task. The sprinkler system (network defense) was designed for a facility (organization) that processed a specific amount and type of paper (electronic assets). The plant (organization) was changed to process a new and greater amount of  hazardous coated paper (sensitive information). This change was made without reevaluating the sprinkler design (network design) or water supply (incident response plan).

The system (network) simply couldn’t generate enough water (cyber insurance) to mitigate this type of fire (cyberattack) and suppress it because it wasn’t designed for this use and didn’t have enough water (cyber insurance coverage and limit) for this type of fire (cyberattack). Furthermore, the local fire department (cyber insurer) wasn’t aware of the change in the amount and type of paper (the exposure basis) and thus didn’t know they were responding to a hazardous chemical fire (state-sponsored actor), which requires a very different firefighting response (incident response) as compared to a traditional uncoated paper fire (simple malware).

System Impairments Before a Fire

A fire that would normally be adequately controlled or suppressed completely can instead rage out of control and destroy the building.

There are three type of impairments that can occur before a fire (cyberattack) as follows:

  • renovation of building (network)
  • inadequate maintenance of property (network)
  • arson (state-sponsored actors and sophisticated crime syndicates).

Deliberate action by an arsonist (state-sponsored actor or sophisticated crime syndicate) can impair or disable an automatic sprinkler system (computer network) so the arsonist’s (threat actor) fire setting (cyberattack) actions will cause damage.

Arsonists (cyber attackers) learn how sprinkler systems (computer networks) work and find ways to defeat or overtax them. Limited only by their imagination, for example, they may close valves (software applications) or attempt to overtax the system (all computer servers) by setting multiple fires (cyberattacks) designed to circumvent, damage or destroy the building (organization).

System Impairments During a Fire

System impairments that can occur during a fire are often the result of human action that cause a protection breakdown.

The most common system impairment that can occur during a fire (cyberattack) is premature closure of a sprinkler system’s control valve (network defenses).

Another common system impairment is the inadequate monitoring of the sprinkler control valve (network defenses).

Call to Action:

For most businesses, the five most important categories of risk are tied to 1) theft of intellectual property, 2) business interruption, 3) theft or corruption of personally identifiable information, protected healthcare information, 4) credit and debit card data and 5) diminished cash flow. But which of these is a priority, to what degree, and for which organization assets?

If we really want to make cybersecurity better, we first need to ask what do we need to protect within the organization? All of this is highly dependent on the business, the internal network structure, and the other security controls that are in place premised upon the zero-trust information security model.

Organizations will never outpace the sophisticated cyber threat actor. Remember, the cyber adversary only has to be right once while your organization has to be right 100% of the time.

Update: Will Insurance Agents be the Next Target for COVID-Related Business Losses?

Emily Sides Bonds
Partner, Jones Walker LLP

Emily is a partner in the Birmingham office of Jones Walker LLP. Emily is licensed in Alabama and Mississippi and has been handling professional liability litigation, including the defense of insurance agents and brokers, for over 30 years.


In October 2020, I authored an article for the PLUS blog that focused on the potential claims that could be made against insurance agents with regard to COVID-19-related business losses. I concluded that, if insurance companies do not pay COVID-19-related losses, then plaintiffs’ attorneys may file claims against their clients’ insurance agents for failure to procure, negligent misrepresentation, breach of fiduciary duty, or other similar torts. My prediction has come to fruition, but so far, insurance agents are being properly dismissed from these cases. Below is a summary of these recent decisions, all of which have occurred after removal of the cases to federal court based upon the fraudulent joinder of the insurance agent.

Casa Colina, Inc. v. Hartford Fire Ins. Co., 2020 U.S. Dist. LEXIS 236698 (C.D. Cal. Dec. 15, 2020).

In this case, certain business entities that provide rehabilitative and medical-surgical services sued their insurance carrier for failure to provide business interruption coverage as a result of the COVID-19 pandemic. The plaintiffs also sued their insurance agents for “failing to obtain the appropriate coverage as requested; failing to accurately represent and report the coverage obtained, and failing to properly warn Plaintiff of potential coverage limitations, gaps, or exclusions.” Id. at *1-2 (quoting the plaintiffs’ complaint). The plaintiffs originally filed the lawsuit in California state court, and the defendants removed the case to federal court based upon the fraudulent joinder of the insurance agents. The district court denied the plaintiffs’ subsequent motion to remand and held that there was no possibility that the plaintiffs could prevail against the insurance agents.

In Casa Colina, the district court analyzed California law in reaching its conclusion. California law generally recognizes that there is no duty of an insurance agent to recommend or advise the insured on differing or other types or amounts of coverage. However, California permitted three exceptions to that rule: “when (1) the agent misrepresents the nature, extent, or scope of the coverage being offered or provided; (2) there is a request or inquiry by the insured for a particular type or extent of coverage; or (3) the agent assumes an additional duty by either express agreement or by ‘holding himself out’ as having expertise in a given field of insurance being sought by the insured.” Id. at *2. The plaintiffs in Casa Colina pled that all three exceptions applied, but the district court disagreed. The district court found the allegation that the agent promised “full and adequate insurance” was not sufficient to qualify as a misrepresentation under California law because it was not a specific, affirmative representation that coverage would be available during a viral pandemic. Id. at *4-5. In addition, there was no heightened duty to inform plaintiffs that there would be no coverage for a viral pandemic because there were no allegations that the plaintiffs specifically requested a policy to cover business-interruption losses caused by a pandemic. Id. at *5. Finally, the district court found that the agent’s website, which mentioned the agent’s ability to procure business interruption insurance, did not qualify as the agent holding itself out as an expert such that additional duties could be imposed on the agent in procuring the requested coverage. Because there was no possibility of recovery against the agents, the plaintiffs’ motion to remand was denied, and the insurance agent was subsequently dismissed from the case. Id. at *9.

Terry Black’s Barbecue, LLC v. State Auto. Mut. Ins. Co., 2020 U.S. Dist. Lexis 207636 (W. D. Tex. Nov. 5, 2020).

The plaintiffs were companies that owned and operated barbecue restaurants in Texas. State Auto, the plaintiffs’ insurance carrier, denied their claims for business interruption coverage due to the COVID-19 pandemic. The plaintiffs quickly filed suit in state court against both State Auto and the insurance agent who had procured the insurance policies. The plaintiffs contended that the insurance agent was negligent “in failing to evaluate the sufficiency of the coverage limits it was recommending and selling to Plaintiffs.” Id. at *2.

State Auto removed the lawsuit to federal court on the basis that the insurance agent had been fraudulently joined in the case, and accordingly, its citizenship should be disregarded in determining diversity jurisdiction. The magistrate judge recommended to the district court that the plaintiff’s subsequent motion to remand be denied. The magistrate judge’s report and recommendation on plaintiff’s motion to remand focused on the issue of ripeness. As we know, courts do not decide matters that are not ripe, i.e. matters that are premature or speculative. The magistrate judge in that case determined that the allegations of plaintiffs that the insurance agent “was negligent … [i]f Business Income loss coverage is found not to exist under the facts and circumstances of the Cause” presented a claim that was not yet ripe for review. Id. at *9. Accordingly, the magistrate judge concluded and recommended that the motion to remand be denied. Id. Notably, the plaintiffs did not object to the magistrate judge’s report and recommendation and, thus, it was adopted by the district court. See Terry Black’s Barbecue, LLC v. State Auto. Mut. Ins. Co., Case 1:20-cv-00665-RP, Doc. 21 (W.D. Tex. Nov. 23, 2020).

PSG-Mid Cities Med. Ctr., LLC v. Jarrell, 2020 U.S. Dist. Lexis 237119 (N.D. Tex. Dec. 17, 2020).

After having its claim for COVID-19-related business losses denied by Continental Casualty Company, the plaintiff, a hospital providing elective surgeries, filed suit against the carrier and its insurance agents. The plaintiff filed the case in state court in Texas, and the carrier removed the case to federal court based upon fraudulent joinder of the insurance agent. The plaintiff’s motion to remand was denied. Interestingly, the plaintiff pled that the alleged negligent misrepresentation of the insurance broker occurred after the COVID-19-related business losses. Numerous claims were pled, but all failed, essentially based upon lack of reliance or damages caused by the alleged misrepresentation.


As predicted, plaintiffs will include their insurance agent as a defendant in lawsuits related to the denial of insurance coverage for COVID-19-related business losses. Thus far, removal based upon the fraudulent joinder of the insurance agent has been successful. Insurance agents are being dismissed because courts have found that there is no possibility of a claim against the agent. If you are presented with such a case, removal to federal court should be the first consideration by counsel. Analysis of that state’s laws relating to negligent procurement and misrepresentation is crucial. I suspect we will see more crafty pleading in these claims to avoid the results that occurred in the three cases listed above. I will continue to monitor these very interesting claims.  If you have any questions or would like more information, please feel free to email me at ebonds@joneswalker.com.


Ten Ways to Avoid Committing Legal Malpractice in a Pandemic

Alesia S. Sulock, Marshall Dennehey Warner Coleman & Goggin

Alesia S. Sulock is an associate in the Professional Liability Department in the Philadelphia office of Marshall Dennehey Warner Coleman & Goggin. She has significant experience in legal malpractice matters, including those arising from underlying commercial litigation, criminal matters, professional liability matters, medical malpractice matters, personal injury matters, transactional matters and others. She also routinely represents attorneys in defense of Dragonetti and abuse of process claims, as well as in disciplinary matters.  She may be reached at assulock@mdwcg.com.

Practicing law in these times brings unique challenges and increased risks for attorneys, many of whom must adapt to working from home and all of whom must find new ways to provide exceptional client service.  These ten tips can help attorneys avoid malpractice concerns and provide the best representation possible, even during a pandemic.

  1. Calendar. Using a diary system is a recommendation we routinely make in presentations covering attorney best practices.  Missed deadlines are a primary allegation in many malpractice claims, and for good reason.  Courts do not hesitate to dismiss claims or disregard arguments which are not timely brought.  Now more than ever, it is imperative to keep track of deadlines.  If you are used to relying on the paper calendar that hangs in your office, consider recreating one at home.  If you rely on your assistant to keep track of your schedule, work out a way that can continue outside of the office.  Setting frequent reminders on a phone or computer may assist with avoiding missed deadlines.
  2. Plan Ahead and Leave Extra Time. CDC guidelines, state recommendations, and local mandates are constantly changing in these unprecedented times. One simply cannot rely on the ability to operate in the way you are accustomed.  It is important to plan ahead for the possibility that the office may close, you may be tied up with homeschooling children, or you may have to quarantine with your beloved (but perhaps distracting) family for two weeks.  It’s best to endeavor to have work in a position where things will not fall to pieces if you have to step away for a day or otherwise adapt.  Similarly, to the extent possible, do not leave time-sensitive matters until the last minute.  Plan as if you may not be able to work all night to finish that brief the day before it is due, because that may very well be the case.  Likewise, technical difficulties or delays in mail delivery may cause filing to take longer than you expect.
  3. Practice Civility. Keep in mind that there are bound to be times when you or your opponent truly do need extra time or other accommodations.  Be civil and even kind to your colleagues.  Grant extensions when reasonably requested and when they will not prejudice your client, not only because it is the right thing to do, but also because you may need the accommodation next time.
  4. Remain in Contact. Constant communication with clients is another “must-do” in normal times, and it is even more important now.  If your client is away from the computer and less responsive to email now, pick up the phone and then document the  conversation in writing.  Courts may be closed or operating on extended deadlines, but your client will be wondering what is happening with his or her case.  Keep clients informed, even if the update is simply that there is no update but you are working the case to the best of your ability.
  5. Protect Attorney-Client Privilege. Communications with your client are only privileged if they are between you and your client.  If you are working from home, find a quiet and private place where you can have confidential conversations, outside of the earshot of family members or roommates. It would be wise to instruct your clients to do the same.
  6. Put It in Writing. This is good advice at all times, but even more important now.  Clients may be distracted when you call them, with small children running around or health concerns weighing on their minds.  Follow up on conversations in writing to ensure complete understanding on both sides, and to avoid confusion down the road.
  7. Refuse to Dabble. With courts closed and deadlines extended, some attorneys may be light on work.  This is not an invitation to practice in an area where you lack the necessary expertise.  Resist the urge to take on matters you are not equipped to handle, without doing the necessary background work to learn how to provide competent representation in that area.
  8. Act Professionally. Clients, courts and your opponents expect you to act and dress like a lawyer, even from home.  Maintain a level of professional decorum, particularly on video calls, and certainly in court appearances.  Dressing too casually may not be malpractice itself, but it is to your client’s benefit to put your best face forward, even from the living room.
  9. Get Creative. Find new ways of working.  If you cannot sit down with a client, consider scheduling a zoom meeting or screen sharing while on the phone.  Become familiar with ways of sending and reviewing documents electronically.  Take care to provide clients with the same level of representation you have always provided, albeit from afar.
  10. Maintain Your Own Well-Being. Recent trends have suggested a lawyer’s duty to provide competent representation includes maintaining the lawyer’s own mental and physical health in order to work most effectively on behalf of his or her clients.  In a time where many worry about financial strain, social isolation, and physical health, it is critical that lawyers reflect upon their own mental and physical health, address concerns early, and seek help when needed.