UNCHAINED AND DECRYPTED: COVERAGE ISSUES CONCERNING AND EXPLAINED Michael S. Levine, Daniel Hentschel, Hunton Andrews Kurth Rikke Dierssen-Morice, Faegre Baker Daniels and Thomas Srail, Willis Towers Watson

October 2019

Natural catastrophes shift in the politi- and immersion of cryptocurrencies has ar- cal spectrum, and data breaches on the rived.1 world’s largest social media platforms stole headlines in 2018. Yet another subject also The same features that make block- made headlines in 2018 but rarely was it chain technology effective in securing seen “above the fold”: Blockchain tech- and other sensitive transac- nology and cryptocurrency. Whether on tions has allowed corporations to transact the internet, in a newspaper or magazine business in ways centralized banking and article, or in daily conversation, the new data management systems will not allow. technology undoubtedly appeared in the Cryptocurrencies also offer a low cost, and media with increasing frequency. From 1 major corporations, including the top on- Toshendra Sharma, Top 10 Companies That Have Al- ready Adopted Blockchain, (July 2018), https:// line retailers, to financial institutions, the www.blockchain-council.org/blockchain/top-10- implementation of blockchain technology companies-that-have-already-adopted-blockchain/

This paper was first presented and published by ABA Litigation Section, Insurance Coverage Litigation Committee meeting How Could That (Not) Be Covered? Truthiness and Coverage for False Claims Act Liability (Tucson, Arizo- na—March 1, 2019)

1 This article presents the views of the authors, which do not necessarily reflect those of Hunton Andrews Kurth LLP or its clients. The information presented is for general information and education purposes. No legal advice is intended to be conveyed; readers should consult with legal counsel with respect to any legal advice they require related to the subject matter of the article. Receipt of this article does not constitute an attorney-client relationship. Prior results do not guarantee a similar outcome. Attorney advertising. Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained fast means of transferring value and infor- The Risks mation around the globe anonymously. These technologies present an attractive al- Blockchain technology and cryptocur- ternative to the established banking, money rencies focus on changing commercial trans- and data transfer systems. Unfortunately, actions by purportedly making the transac- with all of the benefits that the revolution- tions safer and more efficient. Due to its izing technology offers, come numerous decentralized feature, blockchain technology risks. Insurance companies are actively pur- is said to be less susceptible to hacking than suing ways to insure these risks and the the traditional centralized database. Howev- companies that are utilizing blockchain er, no technology is perfect. Blockchain and technology and cryptocurrency. However, the cryptocurrencies that utilize that platform as discussed in this paper, when it comes to are computer based technological platforms, blockchain and cryptocurrency, the indus- meaning they rely on innovative and varied try’s insurance policy arsenal is still in its in- software platforms and hardware, which ex- fancy, placing much of the current claim poses the technology to data loss and corrup- load onto legacy policies that may be ill- tion, hardware disruption and cyber breach, equipped to squarely handle blockchain and among other things. cryptocurrency-related losses. Several companies already have fallen victim to fraudulent schemes and cyber hacks causing monumental losses. For in- stance, , the second largest crypto- currency exchange, suffered a platform breach just last year that resulted in the loss of $72 million in users’ cryptocurrency.2 On January 26, 2018, Coincheck, a crypto- Insurance Law Essentials Deep Dives is published in as- sociation with Insurance Law Essentials. For subscrip- currency exchange based in Tokyo, suf- tion questions or problems, contact IRMI customer fered a $534 million loss after 500 million service at (800) 827–4242. cryptocurrency coins disappeared, making Opinions in this report on financial, tax, fiscal, and legal 3 matters are those of the editors and others; you should it one of the largest hacks in history. In obtain professional counsel before taking any action on fact, CipherTrace, a blockchain security the basis of this material. firm, reported that almost $1 billion worth Reproduction of this report by any means is strictly pro- hibited. Insurance Law Essentials Deep Dives and the owl 2 logo are registered trademarks. See Clare Baldwin, worth 72 million stolen from Bitifinex exchange in Hong Kong, (Aug. 2016), Published by IRMI: https://www.reuters.com/article/us-bitfinex-hacked- International Risk Management Institute, Inc. hongkong/bitcoin-worth-72-million-stolen-from- Jack P. Gibson, Publisher Bonnie Rogers, IRMI Editor bitfinex-exchange-in-hong-kong-idUSKCN10E0KP. 12222 Merit Drive, Suite 1600 3See BBC, Coincheck: World’s biggest ever digital cur- Dallas, TX 75251 • (972) 960–7693 rency ‘theft’, (Jan. 2018), https://www.bbc.com/news/ www.IRMI.com world-asia-42845505.

2 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained of cryptocurrencies were stolen from cryp- Whether their approach will be successful tocurrency-exchanges during the first nine remains to be seen. In contrast, the United months of 2018 alone.4 Recognizing the States District Court for the Eastern Dis- substantial need for insurance protection, trict of New York recently held that ICOs insurance companies have begun to leap to may be subjected to the same rules and insure businesses utilizing blockchain and regulations as equity market offerings.7 cryptocurrencies, but many have done so The holding contradicts several findings with plainly inadequate coverage.5 among various jurisdictions and contrib- utes to the uncertainty regarding insuring In addition to testing the limits of lega- corporations utilizing the technology. De- cy insurance products and forcing the in- spite the inconsistency among regulators, surance industry to develop new products, however, the massive boom surrounding the increasing use of blockchain and cryp- this technology is forcing insurance com- tocurrencies has forced securities and in- panies to meet their policyholders’ needs surance regulators to take notice of the or risk losing market share. emerging technology. How and by whom will the offering and trading of cryptocur- Seeking Coverage rencies be regulated continues to be unde- termined in the United States and beyond. Identifying the coverage issues likely to China and South Korea have taken the arise with claims involving blockchain and “zero tolerance” approach and have the use of cryptocurrency is paramount to banned Initial Coin Offerings (“ICO”).6 understanding whether a company is prop- erly insured for those risks. Companies uti- 4 See Gertrude Chavez-Dryfuss, Cryptocurrency theft lizing blockchain technology and/or cryp- hits nearly $1 billion in first nine months, report (Oct. 2018), https://www.reuters.com/article/us-crypto- tocurrency should assess the extent of currency-crime/cryptocurrency-theft-hits-nearly-1- coverage provided by their current insur- billion-in-first-nine-months-report- ance policies as the risks associated with idUSKCN1MK1J2. these new technologies, if left uninsured, 5See Delton Rhodes, Bitcoin Insurance Policies – What They Are and Do You Need Them, https:// can lead to dire consequence. Indeed, as coincentral.com/bitcoin-insurance-policies/ (noting the technologies become more ubiquitous, that “ was insured by Hyundai Marine & Fire it would behoove all commercial policy- Insurance and Heungkuk Fire & Marine Insurance Co. before a hack that took place in June 2018. Even holders to assess and continually reassess though the hack resulted in the loss of around $31 mil- both the extent of their exposure via block- lion in funds, the insurance coverage only provided chain and crypto-assets and the extent to $5.39 million in coverage”). which their insurance might respond to a 6See, e.g., https://techcrunch.com/2017/09/28/south- korea-has-banned-icos/; https://www.reuters.com/ loss involving those technologies. article/us-china-finance-digital-ico-analysis/crypto- currency-chaos-as-china-cracks-down-on-icos- idUSKCN1BN33R; https://www.cnbc.com/2019/01/ 7See United States v. Zaslavskiy, No. 17-CR-647 07/bitcoin-security-token-and-sto-explained.html. (E.D.N.Y. 2018).

3 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained

This article discusses some of the risks, Based on the information provided by au- gaps, and challenges that may arise when thorities, some of the patients’ personal facing claims arising from the implementa- identifying information and medical record tion of blockchain and cryptocurrency. To information have been stolen and are now address these issues in context, we have con- being sold on the dark web. To make mat- structed a hypothetical fact pattern against ters worse, the hackers successfully diverted which the emerging issues will be discussed. 100 , valued at $10,000 each, from your cyrpto-wallet into a third party off- Hypothetical shore bank account. The hijacked funds were intended for a medical supplier in ful- Imagine you are a multi-office health fillment of a one million dollar order of provider that recently transitioned its med- medical supplies. Consequently, your prac- ical file management system to a decentral- tice has lost a million dollars’ worth of Bit- ized storage system utilizing blockchain coin and still owes the medical supplier for technology. This new system stores patient the supplies that you received previously records across all office locations. The stor- and have been using for several months. age system is operated by a third party cloud provider that allows you to access You sit on the board of directors as the records and information from computers at Chief Operating Officer along with four your place of business and elsewhere. The colleagues. As demands from attorneys be- system also allows for the sharing of health gin to trickle in, both on behalf of the pa- records with other entities with access to tients and your supplier, you direct your the blockchain, thereby enhancing com- general counsel and risk manager to notify munication between patients and their your insurers and obtain coverage. You providers and reducing waiting times. fully expect that one of your four very costly insurance policies will provide cov- In addition, your practice accepts the erage for the incidents. most common form of cryptocurrency, Bit- coin, as a method of payment for services and Commercial Property Insurance prescriptions. Moreover, you have begun ac- cepting payment from your patients and their How cryptocurrencies are viewed by insurers, and paying your medical suppliers in courts can be determinative when seeking Bitcoin in order to ensure the payments get coverage for a cryptocurrency-related loss. processed instantaneously. Your virtual coins As illustrated above, the loss and theft of are stored in a standard crypto-wallet. virtual currencies has plagued the crypto- currency market all over the world. Thus, Several months into your journey, you businesses engaged in the use, holding and/ learn that the blockchain storing your or trading of cryptocurrencies must have patients’ information has been hacked. adequate insurance coverage. Many busi-

4 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained nesses affected by losses involving crypto- structure, machinery and equipment and currency have turned, in the first instance, outdoor property. Id. Thus, on its face it ap- to their commercial property insurance pears improbable that the Bitcoin stolen in policies. Whether cryptocurrency losses the hypothetical would constitute covered are covered under these legacy policies property as virtual coins are not the type of raises a host of issues, only some of which property to be considered a “building.” In have been touched on by the courts. These addition, since the Bitcoin in the hypotheti- issues include, among many others: cal belonged to the policyholder, not a cus- tomer or employee, it would not be consid- • Whether cryptocurrency constitutes ered “personal property of others.” “Covered Property”; As it relates to finding coverage under • Whether the loss of cryptocurrency the subpart for “Business Personal Proper- constitutes “Direct Physical Loss”; ty,” it may appear that a business involved in the exchange of cryptocurrencies, like the • Whether cryptocurrency constitutes medical provider in the hypothetical, should “Money” or “Securities”; and be entitled to coverage for losses relating to virtual currencies. A business owner like the • How (and when) to value cryptocur- one in the hypothetical may surmise that the rency. stolen Bitcoin had been stored in the busi- Commercial property insurance policies nesses’ crypto-wallet, which is property that typically provide coverage for “direct physi- is owned and used by the business. cal loss of or damage to Covered Property at But fitting the stolen cryptocurrency the premises described in the Declarations into one form of “property” is not the end caused by or resulting from any Covered of the inquiry. To trigger coverage, the Cause of Loss.”8 “Covered Property” under covered property must suffer a “direct a traditional commercial property insurance physical loss” or “damage.” Courts have policy is addressed in three subparts: held that an insured did not sustain a “direct (1) Building; (2) Business Personal proper- physical loss” to its property under its busi- ty; and (3) Personal Property of others. ness property insurance policy for losses resulting from fraudulent securities Covered property falling under the sub- schemes.9 In those circumstances, the poli- part for Building usually includes: Founda- cyholder sustained economic losses arising tions of buildings, structures, machinery, completed additions to the building or 9Schmidt v. Travelers Indem. Co. of America, 101 F.Supp.3d 768 (S.D. Ohio 2015); Florists’ Mut. Ins. Co. v. Ludy Greenhouse Mfg. Corp., 521 F.Supp.2d 8 ABA Insurance Services, Specimen Policies and En- 661, 680 (S.D. Ohio 2007); see also Tschimperle v. dorsements, Property form ECP 00 560 08 16, http:// Aetna Cas. & Sur. Co., 529 N.W.2d 421, 425 (Minn. abais.com/Data/Sites/1/media/specimen/pnc/ 1995) (“loss of [an] investment does not constitute property.pdf. damage to tangible property”).

5 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained out of the use of fraudulent checks. Id. The This provision is ripe with issues that courts in those cases reasoned that the funds arise in the context of a cryptocurrency in question did not have a physical existence loss. “Money,” for example, is typically de- and, thus, were not susceptible to physical fined in a commercial property policy as loss or damage, unlike situations where a “currency, coins and bank notes in current check might be destroyed by a fire.10 Simi- use and having a face value and Travelers larly, it is arguable that cryptocurrency is not checks, register checks and money orders a tangible item. Indeed, one of the main ad- held for sale to the public.” Id. The term vantages provided by this technology is that “Securities” traditionally means negotiable the currency is virtual in nature. Insurers and non-negotiable instruments or con- may rely on absence of any “direct physical tracts representing either “money” or loss” as a means to avoid coverage under a property but not “money.” Id. Thus, in the commercial property policy. context of our hypothetical, it becomes necessary to determine as a threshold matter Even if a business owner, like the med- whether cryptocurrency is “money” or ical provider from our hypothetical, were “securities” within the context of a busi- able to trigger coverage under its commer- ness’s commercial property insurance poli- cial property insurance, there still are cov- cy? As is usually the case in law, however, erage limitations that must be overcome. the answers to these questions are not clear. For instance, traditional commercial prop- erty insurance policies typically contain the Currently, there is little continuity following coverage limitation: among jurisdictions and regulators when it comes to characterizing cryptocurrency. Property Not Covered Whether or not cryptocurrency is “mon- ey”, “securities” or “property” has been Covered Property does not include: subjected to heavy debate. While some courts have found cryptocurrency to be Accounts, bills, currency, food money, others disagree and have held that stamps or other evidences of debt, cryptocurrencies shall be treated like secu- “money”, notes or “securities”, ex- rities.11 To add to the confusion, the cept as provided under the Cover- Commodity Futures Trading Commission age Extensions or Flex Additional has determined that virtual currencies are, Coverage for Accounts Receivable. in fact, “commodities,” and thereby sub- Lottery tickets held for sale are not securities; 11Compare U.S. v. Murgio, 209 F.Supp.3d 698, 707– 10 (S.D.N.Y., 2016) (finding that bitcoins are Id. “funds” not “money”) under 18 U.S.C. § 1960 with U.S. v. Ulbricht, No. 14-CR-68 KBF, 2014 WL 10Schmidt, 101 F.Supp.3d 768 at 781 (“This is not an 3362059 (S.D.N.Y. 2014) (concluding that Bitcoin is instance in which, for example, cashier’s checks were money within the context of the federal anti-money destroyed and lost in a fire.”). laundering statute).

6 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained ject to regulation by the Commodity Fu- Court’s characterization of the virtual cur- tures Trading Commission.12 rency at issue and its reliance on outside sources can be applied to similar contexts One court has weighed in on the de- and provides guidance to policyholders bate, however, and provided guidance (or facing similar claims. some may argue confusion) in the context of insurance coverage. An Ohio Court in Assuming, however, that our hypo- Kimmelman v. Wayne Ins. Group, 18- thetical cryptocurrency loss is covered, hy- CV-1041 (Court of Common Pleas, pothetical, how should that loss be valued, Franklin County, Ohio Sept. 25, 2018), and when? As Bitcoin became increasingly ruled that stolen Bitcoin qualified as popular, the price of the coin surged to up “property” and not “money” under an in- to $20,000 in December of 2017, but sured’s homeowners’ policy.13 The Court closed 2018 with a value of only $3,747.15 relied upon the IRS’s acting policy in rela- These values demonstrate the extreme vol- tion to virtual currencies when making its atility of cryptocurrencies. A review of the determination. Specifically, the Court de- valuation methods contained in standard cided that because virtual currencies are commercial property policies suggest that recognized as property for “federal tax those policies do not contemplate the types purposes, is treated as of rapid and substantial changes in value property.”14 The issue before the court in seen with cryptocurrencies. Kimmelman was whether a specific sub- limit limiting the recovery of lost “money” Commercial property policies typically applied to the theft of Bitcoin. Though have valuation provisions that set forth the Kimmelman was decided outside the con- manner by which the value of a loss is to be text of a commercial property policy, the calculated using either the lost or damaged property’s “Replacement Cost Value” as 12See Commodity Futures Trading Commission v. of the time of loss or damage or the prop- McDonnell, 287 F. Supp.3d 213 (E.D.N.Y. 2018) erty’s depreciated “Actual Cash Value.”16 (stating that “Virtual currencies are ‘commodities’ subject to regulation by the Commodity Futures Replacement cost “is measured by what it Trading Commission”). would cost to replace the damaged proper- 13Kimmelman v. Wayne Ins. Group, 18-CV-1041 ty” whereas actual cash value is generally (Court of Common Pleas, Franklin County, Ohio defined as “fair market value” or Sept. 25, 2018). 14 Kimmelman, 18-CV-1041 (“Accordingly, the only 15 authority the Court can rely on in determining the Sam Ouimet, Down More than 70% in 2018, Bitcoin status of Bitcoin is the Internal Revenue Service No- closes Its Worst Year on Record, (January 2019) tice 2014-21. Under Notice 2014-21, the IRS states, https://www.coindesk.com/down-more-than-70- ‘For federal tax purposes, virtual currency is treated as in-2018-bitcoin-closes-its-worst-year-on-record. property.’ Accordingly, the Court finds Bitcoin, al- 16ABA Insurance Services, Specimen Policies and En- though termed ‘virtual currency,’ is recognized as dorsements, Property form ECP 00 560 08 16, http:// property by the IRS and shall be recognized as such abais.com/Data/Sites/1/media/specimen/pnc/ by this Court.”). property.pdf.

7 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained

“[r]eplacement cost minus normal depre- the asset had increased following the fire. ciation,” where depreciation is defined as a Conversely, if the asset had lost value “decline in an asset’s value because of use, during that period, the insurer would un- wear, obsolescence, or age.” Applying doubtedly argue in favor of a lower valua- these valuation methods to a cryptocur- tion. Ultimately, however, the proper rency loss can prove to be unworkable. manner for valuing a crypto asset, like any other insured property, will come down to For example, in our hypothetical, the the policy’s explicit valuation terms. stolen Bitcoin was valued at $10,000 per coin at the time that it was stolen for a total Cyber Liability Insurance value of $1,000,000.; however, what if the Bitcoin was worth $3,000,000 on the date Companies utilizing blockchain tech- the loss was actually discovered? Does the nology and cryptocurrency are subject to insurer owe you the $1,000,000 based on hacking and data breaches that have the the value at the time of theft, or potential to impact their ability to access $300,000,000 based on the value of the as- blockchain information or crypto assets. set when the theft was discovered? Or, Even worse, these exposures have the po- adding a third wrinkle; what if the value of tential to result in permanent loss of assets the asset had decreased following the date and confidential information. Numerous of discovery to $1.5 million as of the date jurisdictions have recognized that a duty of of loss adjustment? care exists when it comes to protecting a customer’s confidential information.18 In The difficulties here turn on the fact that traditional commercial property poli- 18In re Sony Gaming Networks and Customer Data Breach Security Litig., 996 F. Supp. 2d 942, 966 cies may not contain a valuation mecha- (S.D. Cal. 2014) (holding “the existence of a legal du- nism designed to address rapidly fluctuat- ty to safeguard a consumer’s confidential information ing values.17 The lack of clear guidance entrusted to a commercial entity … [is] well support- ed by both common sense and [applicable state] lends itself to arguments favoring either law”); In re: The Home Depot, Inc., Customer Data side. For instance, utilizing a replacement Security Breach Litig., No. 1:14-MD-2583-TWT, cost valuation, a policyholder might rea- 2016 WL 2897520, at *3 (N.D. Ga. May 18, 2016) (“A retailer’s actions and inactions, such as disabling sonably argue that he/she should be enti- security features and ignoring warning signs of a data tled to at least $1,000,000, since that was breach, are sufficient to show that the retailer caused the value of the property at the time of the foreseeable harm to a plaintiff and therefore owed a duty in tort.”); In re Target Corp. Customer Data Se- loss. Using an actual cash value method, on curity Breach Litig., 64 F. Supp. 3d 1304, 1308 (D. the other hand, a policyholder might rea- Minn. 2014) (“[G]eneral negligence law imposes a sonably argue that it should receive more general duty of reasonable care when the defendant’s own conduct creates a foreseeable risk of injury to a than $1,000,000, since the actual value of foreseeable plaintiff.”); Resnick v. AvMed, Inc., 693 F.3d 1317, at 1326-28 (11th Cir. 2012) (finding 17Trinidad v. Florida Peninsula Ins. Co., 121 So.3d 433 health care provider had a duty to secure customers’ (Fla. 2013). information).

8 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained addition, courts have held that cyber polic- vate information, and privacy law viola- es may provide coverage in situations tions. In the hypothetical presented above, where confidential information is disclosed the hackers penetrated the blockchain that to third parties.19 Unsurprisingly, there- stored the insured’s patients’ confidential fore, policyholders will look to their cyber information and sold that information to liability insurance policies when faced with third parties. In that situation, the medical claims resulting from hacks and cyber provider may look to its cyber liability pol- breaches. icy in an effort to obtain coverage for claims asserted against it by the patients as Many of the cyber liability insurance well as the breach response costs that the policies available in today’s insurance mar- practice incurs as it complies with the vari- ket are confined and their coverages are ous and rigorous breach notification laws varied. These differing policies give rise to and regulations that may be triggered by a host of issues in the context of blockchain such an incident. and cryptocurrency losses just as they do in the context of other cyber and privacy Cyber policies typically provide cover- breaches and incidents. Common among age for data breach liability. An insuring these issues are the following: agreement might contain language stating that “[t]he Insurer will indemnify the In- • Does the release of blockchain data sured for Loss resulting from Claims for trigger coverage under a cyber poli- Wrongful Privacy and Security Acts made cy? against the Insured if such Claims are first made during the Policy Period or the Dis- • Who has “custody or control” of in- covery Period.”20 The policy might define formation stored on a blockchain? “Wrongful Privacy and Security Acts” as:

Cyber liability insurance is intended to Any actual or alleged error, omission, address first-party losses and third-party li- misstatement, act of negligence, or ability as a result of data security incidents, breach of duty committed by the In- the disclosure of or failure to protect pri- sured or a Service Provider in connec- tion with a Privacy and Security Act that 19Smith v. Triad of Alabama, LLC, No. 1:14-CV-324- results in the unauthorized access to WKW, 2015 WL 5793318, at *9 (M.D. Ala. Sept. 29, Confidential Information in the custody 2015) (finding that plaintiffs in a data breach case es- tablished injury in fact where they alleged identity or control of the Insured, an Electronic theft and fraudulent tax returns were filed in their Data Processor, or a Service Provider. names); In re Anthem, Inc. Data Breach Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *26 (N.D. Cal. May 27, 2016) (finding that plaintiffs’ alle- Id. gations of using their own time to monitor their cred- it in the aftermath of a data breach was injury in fact 20ABA Insurance Services, Specimen Policies and En- sufficient to confer standing). dorsements, Cyber Cover form EEO 40 997 (02 15).

9 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained

As discussed above, a distinct feature of Though there is no case law interpreting blockchain technology is its decentralized the language as it relates to blockchain aspect, which functions via peer-to-peer technology, an insurer might argue that transactions. As such, a user’s “Confidential use of blockchain technology essentially Information,” such as the medical provid- inhibits a corporation’s ability to retain ex- er’s patients’ records, is not held by a single clusive “custody or control” of the sensi- Service Provider at a single location. Rather tive information, although such an argu- blockchain technology keeps data in an en- ment would effectively render the crypted ledger, which is distributed across coverage illusory. Conversely, policyhold- synchronized, replicated databases.21 Ac- ers may be able to argue that liability cess to or breach of data stored on a block- should be shared—and coverage thereby is chain likely involves accessing information triggered—among each user of the block- owned or maintained not only by the in- chain, since each user had equal “custody sured, but by many other entities as well. and control” of the confidential informa- This raises several unique questions with re- tion. spect to insuring an unauthorized dissemi- nation of that information. For instance, Commercial Crime Insurance does each user of the blockchain have “cus- tody and control” of the confidential data Theft and the fraudulent transfer of vir- that resides on that chain such that the dis- tual currencies by third-party actors is a closure of data on a blockchain triggers cov- concern for businesses engaged in the use erage under cyber liability insurance held by of cryptocurrency. Companies facing each user of the blockchain? Or, does it cryptocurrency losses may seek coverage trigger coverage under only the policy held under their commercial crime policies. As by the entity to whom the confidential in- with other lines of coverage, claims for formation was initially entrusted? blockchain and cryptocurrency-related losses raise a number of coverage issues un- Ultimately, the answer may turn on der commercial crime insurance policies, determining which entity or entities actu- including: ally had “custody or control” of the sensi- tive information within the blockchain. • Does the theft of cryptocurrency trigger coverage? 21HIPPA Journal, The Benefit of Using Blockchain for Medical Records, (September 2017), https:// • Is cryptocurrency “Other Property” www.hipaajournal.com/blockchain-medical-records/ as defined in a commercial crime (“Rather than store data in a single location, block- chain keeps data in an encrypted ledger, which is dis- policy? tributed across synchronized, replicated databases. Each block is linked to the previous block by a • Is cryptocurrency held within an unique public key with access to data carefully con- trolled.”). “Insured’s Premises”?

10 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained

Insuring agreements within commer- “banking premises:” (a) To a person cial crime policies typically provide cov- (other than a “messenger”) outside erage for a loss that an insured sustains re- those “premises;” or (b) To a place sulting directly from an “occurrence” outside those “premises.” taking place at any time which is “discov- ered” by an insured during the policy pe- Id. riod.22 An “occurrence” is usually de- fined as “(1) An individual act; (2) The The “Inside the Premises—Theft of combined total of all separate acts wheth- Money and Securities” insuring agreement er or not related; or (3) A series of acts provides coverage for: whether or not related; committed by a person acting alone or in collusion with [L]oss of “money” and “securities” in- other persons, involving one or more in- side the “premises” or “banking prem- struments, during the Policy Period.” Id. ises”: (1) Resulting directly from Commercial crime policies typically in- “theft” committed by a person present clude multiple insuring agreements, inside such “premises” or “banking which are intended to cover losses similar premises”; or (2) Resulting directly to the one illustrated in the hypothetical from disappearance or destruction. above. In the hypothetical illustrated above, For instance, a majority of commercial hackers diverted Bitcoins from the poli- crime policies provide coverage for cyholder’s crypto-wallet into an offshore “Computer Fraud,” and “Inside the Prem- account. Because cryptocurrency is vir- ises—Theft of Money and Securities.” tual, the hacker inevitably used a com- However, coverage under either insuring puter in performing his/her actions. The agreement is limited to certain circum- policyholder may therefore reasonably stances. believe that both insuring agreements have been triggered for the criminal loss. The “Computer Fraud” insuring Here too, however, the terms of cover- agreement typically provides coverage for: age may not squarely fit the facts of a crypto-loss. [L]oss of or damage to “money,” “se- curities” and “other property” resulting Both insuring agreements provide cov- directly from the use of any computer erage for the loss of or damage to “mon- to fraudulently cause a transfer of that ey,” and “securities.” In fact, unlike the property from inside the “premises” or traditional commercial property policy dis- cussed above, the Computer Fraud insur-

22Brown Stone Agency, Specimen Policies, Commer- ing agreement specifically provides expan- cial Crime Coverage Form (CR 00 20 05 06). sive language, which encompasses not only

11 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained

“money” and “securities,” but also “other “money.”25 Courts that have addressed property.” As explained above, there ap- this issue have reached inconsistent out- pears to be a lack of consistency among ju- comes.26 risdictions when it comes to characterizing cryptocurrency as “money” or “securi- Another issue that may arise under ties.” commercial crime policies is whether the theft occurred on or off the premises. Regardless whether cryptocurrency Each of the insuring agreements above constitutes “money” or “securities,” cov- contains language requiring that the erage may still be available if the crypto- transfer occur from “inside the premises.” asset meets the policy meaning of “other Given the “virtual” nature of cryptocur- property.” Commercial crime policies rency, however, it is difficult to say that typically define the term “other property” the asset resides inside of a premise. At as “any tangible property other than least one insurance company has argued ‘money’ and ‘securities’ that has intrinsic against coverage for the loss of Bitcoin value but does not include any property under a commercial crime policy on the excluded under this insurance.”23 This basis that the virtual coins weren’t physi- definition would appear to be helpful to cally in the policyholder’s offices.27 In an insured in a jurisdiction that finds that instance, the carrier relied on the cryptocurrencies do not meet the defini- definition of the term “premises,” which tions of “money” or “securities.” How- was defined as “the interior of that por- ever, at least one federal appeals court, tion of any building you occupy in con- applying California law, has found the ducting your business.” Id. Specifically, term “tangible property,” in the insurance the insurer took the position that because context, to mean “things that can be the stolen Bitcoins were stored on digital touched, seen, and smelled.”24 It may wallets online and transferred on a block- therefore be difficult for a policyholder to chain, and were not on the physical argue, at least under California law, that premises of the insured, the Bitcoin trans- cryptocurrency is “tangible property” actions did not involve a transfer of prop- since it cannot be touched, seen or erty from inside the insured’s premises to smelled and exists solely in virtual form. outside the premises. The policyholder In such a case, the policyholder must at- tempt to fit its cryptocurrency into the 25See, e.g., Am. Online, Inc. v. St. Paul Mercury Ins. definitions of either “securities” or Co., 347 F.3d 89, 96 (4th Cir. 2003) (“The insurance policy in this case covers liability for ‘physical damage to tangible property,’ not damage to data and soft- 23Supra, xvi. ware, i.e., the abstract ideas, logic, instructions, and 24 information.”). very Dennison Corp. v. Allendale Mut. Ins. Co., 310 26 F.3d 1114 (9th Cir. 2002) (quoting, Kazi v. State Supra, xvii. Farm Fire & Cas. Co., 24 Cal.4th 871, 880, 103 27See BitPay Inc. v. Massachusetts Bay Insurance Co., Cal.Rptr.2d 1, 15 P.3d 223 (2001). 1:15-cv-03238, (N.D. Ga. 2015).

12 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained responded by claiming that the coverage • Are ICOs within the scope of cover- was illusory, considering the policy con- age under D&O policies? tained a specific endorsement adding Bit- coin to the definition of “money,” illus- Standard D&O policies provide cover- trating that there are arguments to be age for “[l]oss resulting from Claims first made in favor of coverage. Id. The matter made during the Policy Period or the Dis- settled before a determination could be covery Period against the Insured Persons rendered. for Wrongful Acts for which the Insured Persons are legally obligated to pay[.]”28 The location of stolen or otherwise misappropriated cryptocurrency will con- A Wrongful Act is usually defined as: tinue to be an issue in the application of policy wording such as the examples Any actual or alleged error, omission, above. However, policyholders utilizing misstatement, misleading statement, ne- cryptocurrencies can help avoid that issue glect or breach of duty by: by endorsing their policies to expressly ad- dress the loss or theft of cryptocurrencies. (1) any Insured Person in the dis- charge of their duties while act- Directors & Officers Liability ing solely in the capacity as such; Insurance (2) any Insured Person while acting Directors and Officers Liability insur- solely in the capacity as director, ance policies provide coverage for claims officer, or member of the board against directors, officers and other insured of trustees of a not-for-profit persons for wrongful acts committed in entity pursuant to Section II (B); their official capacity at or on behalf of the or insured company. The risk of being hacked and lack of regulation as it relates to (3) the Company or any person or the holding and trading of cryptocurren- entity for which the Company is cies can expose directors and officers to lia- legally responsible, but only to bility, including liabilities under federal, the extent that coverage is state or foreign securities laws. This poten- granted to the Company by In- tial exposure raises a number coverage is- suring Agreement made a part sues as it relates to blockchain technology of this Policy. and cryptocurrency. For instance,

• Do traditional D&O exclusions 28ABA Insurance Services, Specimen Policies and En- clearly apply to blockchain technol- dorsements, Directors & Officers Liability Policy ogy? Specimen form (07 09).

13 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained

Though D&O polices regularly pro- clusions. In fact, a judge in the Eastern vide coverage regarding a wide range of District of New York recently held that claims, the policies contain certain exclu- ICOs may be covered by securities laws in sions that may impact claims involving the context of a criminal proceeding. The blockchain and cryptocurrency-related holding will likely embolden insurers to losses. For instance, a majority of D&O li- deny coverage; however, as discussed ability policies contain exclusions for pri- above, a policyholder may point to recent vacy risks.29 These exclusions can be im- case law stating that cryptocurrencies are plicated by claims against entities engaged not “securities” or “money.” in the use of blockchain and cryptocurren- cies where such claims involve the alleged Change Is Happening disclosure of confidential information, as occurred in the hypothetical above. Blockchain technology and cryptocur- rencies are in their infancy and the rules Another issue that is likely to impact and regulations governing those technolo- claims under D&O policies for loss involv- gies are only beginning to take shape. Even ing blockchain and cryptocurrency con- further behind the curve is the insurance cerns the “securities offering” or the “Bro- industry, which continues to struggle to kerage/Advisory Services” exclusion that is effectively insure businesses involved in often found in D&O policies.30 These ex- these sectors. Nevertheless, major insurers clusions operate to limit coverage for like Great American Insurance Group, claims involving certain types of securities Lloyd’s, XL Catlin, Chubb, and Mitsui transactions and brokerage services. Initial Sumitomo Insurance have recently intro- Coin Offerings (“ICOs”) and public offer- duced insurance products touted as being ings involving virtual currencies have in- geared specifically for cryptocurrency and creased in frequency and scope and that blockchain related technology.31 trend can be expected to continue as the technologies continue to proliferate. The Insurance Services Office (“ISO”) Whether ICOs and public virtual coin of- also is now offering ISO forms specifically ferings are considered “securities” subject tailored to cryptocurrency risks.32 For in- to the same rules and regulations as equity stance, language found in some of the ISO market offerings may impact the applica- bility of the securities and brokerage ex- 31Dennis Mangoli, Cryptocurrency Insurance: More Companies Join The Bandwagon, (Feb. 2018), https://www.ccn.com/cryptocurrency-insurance- 29See, e.g., L.A. Lakers, Inc. v. Fed. Ins. Co., No. CV more-companies-join-the-bandwagon/ 14-7743 DMG (SHx), 2015 WL 2088865, at *5-9 32See ISO Form CR 25 46 11 15; ISO Form CR 25 45 (C.D. Cal. Apr. 17, 2015); LAC Basketball Club Inc. 11 15; IS Form FI 20 74 10; 16, IS Form CR 00 20 v. Fed. Ins. Co., No. CV 14-00113 GAF (FFMx), 11 15; ISO Form CR 00 25 11 15; IS Form CR 00 2014 WL 1623704 at *4-5 (C.D. Cal. Feb. 14, 2014). 11 15; ISO Form CY 00 01 01 18; ISO Form CY 00 30Supra, xxxiv. 11 01 18.

14 Unchained and Decrypted: Coverage Issues Concerning Blockchain and Cryptocurrencies Explained forms explicitly expands the definition of ize commercial transactions around the “money” to include “virtual currencies.” world. As has been the case in the past and Other forms contain a broad exclusion for will continue to be in the future, with new “Loss involving virtual currency of any technology will come new risks. As evi- kind, by whatever name known, whether denced above, the current state of insur- actual or fictitious, including, but not lim- ance policies fail to effectively protect cor- ited to, , crypto currency, porations that have ventured into the or any other type of electronic currency.” world of blockchain technology and cryp- The ISO forms are currently limited to tocurrency. The insurance industry must commercial crime, cyber liability, and fi- develop adequate tools and insurance poli- nancial institution coverage, thus, gaps cies that address policyholders’ needs. Fully among the coverages offered under these understanding the innovative technology new forms and legacy coverages such as will be a step in the right direction in order those under commercial property policies, to ensure suitable coverage is available. will continue to exist. Though the new ISO forms are far from perfect and cur- rently do not specifically address coverage for blockchain technology, these forms in- dicate an incremental movement to address the potential pitfalls and coverage issues that arise from the use of these new tech- nologies.

Conclusion

With the unceasing development of technological advances, it has become in- creasingly clear that blockchain technology and cryptocurrencies will soon revolution-

15