Court Issues Surprising Decision on Phone Call Recording

• Author: Frances Codd Slusarz
• Pages: 22-23

As Cybercrime

Increases, Companies

Look to Insurance

By Grant H. Ha ckley, Litigation News

Contributing Editor

As cybercrime g rows, companies

are looking to insu rance policies to

minimize losses . The U.S. Co urt of

Appeals for the E leventh Circuit has

held that a cyberc rime policy covered

a $1.7 million lo ss from a spear-phish-

ing attack. Yet, exper ts suggest that

coverage may be nuanced and advise

that clients sho uld examine policies

closely and train e mployees on how

to avoid cybercrime schemes.

Spear-phishin g does not involve

a harpoon. Ra ther, it is a fraudulen t

attempt, usual ly by email, to obtain

sensitive information from or induce

activity by a speci f‌ic recipient. This is

done by masking th e identity of the

sender as som eone trustwor thy and

typically involves c reating a sense of

secrecy and urgency.

In Principle Solutions Group, LLP

v. Ironshore Indemnity, Inc., the

Eleventh Circuit addr essed insur-

ance coverage for a los s arising from

spear-phishing. Principle’s controller,

Loann Lien, re ceived an email pu r-

portedly from th e f‌irm’s managing

director about secret negotiations

for a “key acquisition ” and directing

her to follow wiring in structions sh e

would receive shor tly. Five minutes

later, Lien received instr uctions for

a $1.7 million tra nsfer to a Chinese

bank. Lien le arned the next day that

the email from the m anaging director

had been spoo fed, but by then the

money was gone.

Principle sou ght coverage from

Ironshore und er a commercial c rime

policy that covered “ [l]oss resulting

directly from a fr audulent ins truc-

tion to a f‌inancial in stitution to

debit [Principle’s] transfer account,

and transfer, pay or del iver money

or securities fro m that account.”

Ironshore denied coverage. In the

ensuing litigatio n, the U.S. District

Court for the N orthern Dis trict of

Georgia grante d Principle’s motion

for summary j udgment, an d a divided

panel of the Eleventh C ircuit armed .

The Eleventh Circuit fo cused on

the policy’s def‌i nition of a fraudulent

instruction a s an “electronic o r writ-

ten instructio n initially received by

[Principle], which instruction purports

to have been issued by an e mployee,

but which in fac t was fraudule ntly

issued by someo ne else without

[Principle’s] or the empl oyee’s knowl-

edge or consent.” Ironshore had

argued that because the outside law-

yer provided the act ual wiring infor-

mation, the fraudulent instruction

did not meet the de f‌inition as hav-

ing been issue d by an employee. The

court rejected Ironshore’s “divide-

and-conquer” approach because

“[n]othing in the policy lang uage war-

rants the assum ption that the two

[communications] could not be part

of the same frau dulent instru ction.”

Corporations and carriers should

beware that coverage for c yber-

crime tuns on nuanced language.

“The insura nce policies are wr itten by

insurers to respo nd to a new wave of

problems. With emerging risks, dier-

ent carriers h ave dierent langu age

to address new probl ems,” says John

B. Mumford Jr., Ric hmond, VA, for-

mer cochair of the A BA Litigation

Section’s Insurance Coverage

Litigation Committee.

“In Principle Solutions, the court

was really parsin g out what these few

words meant,” observes Mumford.

Indeed, contractual interpretation will

determine whether a loss is covered

or litigation succes sful. On a case-by-

case basis, “cover age comes down

to what the policy la nguage says,”

Mumford adds.

As a result, insur eds should not

assume they are covered by co mmer-

cial crime or othe r policies. “Policy

terminology is evolv ing,” notes Sean

O’D. Bosack , Milwaukee, WI, cochair

of the Litigation Section’s Corporate

Counsel Committee. “Corporate cli-

ents should review th eir coverage,”

Bosack says. “ My advice is they should

ensure they are talk ing to a very

sophisticated b roker. They are bet-

ter o being over-covered rath er than

under-covered, both i n dollar value

and scope of coverage ,” he adds.

There are other ways cor pora-

tions can protect t hemselves from th e

risk. “Nowadays, companies can par-

ticipate in f‌irmwide training to avoid

spear-phishing and other attacks,”

he says. “Som etimes, as a ben ef‌it of

the insurance pr emium, carr iers and

brokers will provide th at training, and

sometimes car riers will require that

the insured cer tify that the training

has taken place ,” advises Bosac k. In

the meantime, b e careful with that

email from your bo ss.

Court Issues

Surprising Decision

on Phone Call

Recording

By Frances Codd Slusarz, Litigation

News Contributing Editor

For many years, California has

required all pa rties to consent be fore

a telephone ca ll could be recorded.

Under the Ca lifornia Invasion of

Privacy Act (CIPA), busines ses that

neglected to war n that “calls may be

recorded” ris ked damages of $5 ,000

per recording and multimillion-dollar

class action laws uits. Califo rnia’s

Court of Appe al for the Fourth

Appellate Distr ict rejected th at rule

in Smith v. LoanMe, I nc., ruling that

Penal Code se ction 632.7 of CI PA

prohibits wiretappers and eavesdrop-

pers from record ing calls but do es

not bar individual call participants

from doing so.

Smith is the f‌irst ap pellate deci-

sion interpreting th is statute. Several

federal distri ct courts have analyzed

the issue, and th e decisions vary. ABA

Litigation Secti on leaders say it is to o

soon to predict th e long-term eec ts

of Smith, but one thin g is certain:

until the Califor nia Supreme Court

resolves the issue, uncertainty and

forum shopping shall prevail.

CIPA section 632 .7 states: “Every

person who, with out the consent of

all parties to a com munication , inter-

cepts or receives an d intentionally

records . . . [calls involving mob ile or

cordless phon es] shall be punished

. . .” Section 632 .7 creates a private

right of action for C IPA violations and

imposes dama ges of at least $5 ,000

per violation. The multimillion-dollar

question is wheth er a call participant

violates CIPA by recordin g the call

22 | SECTION OF LITIGATIO N

Published in Litigation News Volume 46, Number 3, Spring 20 21. © 2021 by the American Bar A ssociation. Repr oduced with permissi on. All rights reser ved. This informati on or any portion the reof may not be copie d or disseminated in any

form or by any means or sto red in an electronic da tabase or retrieval sy stem without the ex press writt en consent of the Amer ican Bar Associatio n.

THE LATEST DEVELOPMENTS IN LITIGATION

NEWS & ANALYSIS