In the insurance context, new loss mechanisms are not uncommon, especially in the rapidly changing area of cyber liability insurance. In some instances, these new loss mechanisms risk muddying the waters for the otherwise well-established interpretation of decades or even centuries-old stalk provisions in insurance policies.

A recent insurance decision in the U.S. District Court for the Southern District of New York involving the cybercrime of email spoofing, SS&C Technologies Holdings v. AIG Specialty Insurance Co., should give comfort to policyholders (and put insurers on notice) that courts continue to hold tight to fundamental principles in insurance and contract laws, such as protecting the reasonable expectations of the policyholder.

Efforts by insurers to unreasonably stretch the interpretation of policy provisions in order to deny coverage run the risk of laying the foundation for a bad faith claim.

Overview 

In SS&C Technologies Holdings v. AIG Specialty Insurance Co., SS&C Technologies Holdings sued its insurer AIG for coverage under the specialty professional liability insurance provisions in a specialty risk protector policy. While AIG had initially fulfilled its duty to defend the underlying lawsuit against SS&C, AIG later denied coverage for the settlement reached in that lawsuit.

The underlying lawsuit involved a new form of cybercrime called email spoofing, which involves the use of an apparently legitimate (and familiar) email address as part of an email phishing scheme or business email compromise scheme to trick an individual or an entity into transferring funds to a source later discovered to be fraudulent.

According to the complaint, SS&C fell victim to such a scheme in its role as a fund administrator providing business processing management for one of its clients, an investment fund named Tillage Commodities Fund LP. In March 2016, SS&C was spoofed six times resulting in the transfer of funds totaling $5.9 million from Tillage to bank accounts in Hong Kong, under the instruction of emails that looked like they were (but actually were not) from Tillage.

A few days after discovering the fraudulent scheme, SS&C contacted law enforcement in Hong Kong and notified its insurer, AIG, of a potential insurance claim in anticipation of a lawsuit being filed against SS&C. Less than six months later, Tillage filed a lawsuit against SS&C in New York state court, alleging breach of the services agreement between the parties and breach of the implied covenant of good faith and fair dealing, among other causes of action.

After receiving notice of the Tillage lawsuit in connection with the insurance claim, AIG agreed to cover defense costs incurred by SS&C in connection with the lawsuit, but reserved the right to deny coverage for any later settlement or judgment based on several policy exclusions, including a so-called fraud exclusion. That fraud exclusion, Exclusion 3(a), precluded coverage for losses in connection with claims:

Alleging, arising out of, based upon or attributable to a dishonest, fraudulent, criminal or malicious act, error or omission, or any intentional or knowing violation of the law; provided, however, [AIG] will defend Suits that allege any of the foregoing conduct, and that are not otherwise excluded, until there is a final judgment or final adjudication against an Insured in a Suit, adverse finding of fact against an Insured in a binding arbitration proceeding or plea of guilty or no contest by an Insured as to such conduct, at which time the Insureds shall reimburse [AIG] for Defense Costs.

According to AIG, because “[Tillage] allege[d] [an SS&C employee] ‘worked with the fraudster[,]’ [a] final adjudication of that fact could exclude defense and indemnity coverage for this matter and trigger [AIG’s] right to recoup.”

The Tillage lawsuit subsequently settled two weeks before its scheduled trial date without any admission by, or adjudication of, wrongdoing or liability against, either party. AIG nonetheless denied coverage for the settlement amount, citing the fraud exclusion. 

SS&C filed suit against AIG in the U.S. District Court for the Southern District of New York, alleging breach of contract and breach of the implied covenant of good faith and fair dealing. AIG responded with a motion to dismiss, arguing that the fraud exclusion applied to bar coverage for the settlement, and as a result, SS&C had not been deprived of a contractual benefit or right under the policy and the bad faith claim could not independently survive.

The court ultimately denied the motion to dismiss in part, refuting both of AIG’s arguments. Although it is only an early-stage decision on a motion to dismiss, the legal issues discussed in the short opinion are fundamental ones that may be at the center of the later resolution of this insurance matter.

The Choice-of-Law Issue

It is often tempting for a party in federal court to avoid lengthy discussion of the applicable choice-oflaw analysis in briefs, instead simply citing to relevant law from all potentially applicable jurisdictions. But by so doing, a party runs the risk of inviting the court to adopt the opposing party’s analysis. AIG fell victim to just such a strategic misstep in SS&C Tech. Holdings.

Throughout its motion to dismiss and rely briefs, AIG cited both New York and Connecticut laws and condensed its choice-of-law position to a one-sentence footnote stating: “There does not appear to be any conflict with respect to the legal issues relevant to this brief, and thus choice of law principles are not at issue here.”

In contrast, SS&C devoted an entire section of its opposition brief to the choice-of-law analysis and identified a specific area of potential conflict between New York and Connecticut law as follows: “whether a claim for breach of the covenant of good faith and fair dealing is available where a breach of contract claim is also asserted.”

Applying the center-of-gravity test under the New York choice-of-law principles for contract cases, SS&C ultimately concluded that Connecticut law should apply. The court agreed and applied Connecticut law throughout the decision.

For the limited purpose of the motion to dismiss, AIG’s view appears to have been that the applicable state law would not have made a difference; however, since motion to dismiss briefs are often the first substantive briefs filed in the litigation, they can serve as a first impression for the presiding judge. 

It pays dividends to discuss a basic issue and get it right, especially where, as here, the choice-of-law issue was straightforward — the overwhelming majority of the relevant factors under the center-ofgravity test, such as the principal place of business of the policyholder, the location of the insured risk, the location at which the policy was issued and delivered and the location of the insurance broker, all pointed to Connecticut.

Interpretation of Exclusions

A key issue in the motion to dismiss was the interpretation of the first clause within the fraud exclusion, namely, a claim “alleging, arising out of, based upon or attributable to a dishonest, fraudulent, criminal or malicious act, error or omission, or any intentional or knowing violation of the law.” AIG argued that the clause did not expressly limit the fraudulent conduct to acts, errors, or omissions committed by the policyholder, and as a result, any fraudulent conduct, including acts, errors or omissions committed by a third party (such as in the Tillage lawsuit) would trigger this exclusion. 

In other words, the implication of SS&C in the fraudulent scheme was not a condition necessary for the exclusion to apply according to AIG’s interpretation.

Apart from taking a literal approach to contract interpretation, AIG also implicitly invoked the concept of expressio unius est exclusio alterius, or “inclusion of one is exclusion of the others.” AIG argued that because other exclusions contained in other sections of the same policy contained the qualifier “if committed by any of the Insured’s” attached to the clause “alleging, arising out of ... violation of the law,” the omission of the same in the fraud exclusion should be read to indicate that no such limitation existed in that exclusion.

The court countered AIG’s literal approach to contract interpretation by raising the purpose of the fraud exclusion as illuminated by the second clause, which based AIG’s right to recoup defense costs on a final adjudication against the insured in the underlying lawsuit. “The very rationale of such exclusionary provisions is that ‘a tortfeasor may not protect himself from liability by seeking indemnity from his insurer for damages, punitive in nature, that were imposed on him for his own intentional or reckless wrongdoing.’”

The court then held that, to the extent there was any ambiguity, the policy should be interpreted in favor of coverage for the policyholder, SS&C.

As to AIG’s implicit reliance on the concept of expressio unius est exclusio alterius, the court resorted to an argument that neither party had briefed — citing a provision in the policy that prohibited interpreting terms and conditions in one coverage section by reference to language in another coverage section.

AIG, in fact, had provided the court with this opportunity to examine the policy in its entirety (without turning the motion to dismiss into a summary judgment motion) by noting in its motion to dismiss brief that: “The Policy [wa]s attached as Exhibit A to Plaintiff’s Complaint and is relied upon by SS&C in bringing this suit. Accordingly, the Court may consider the Policy for purposes of this Motion without converting the matter to a Rule 56 Motion.”

AIG’s efforts to strain the interpretation of an exclusion common in liability insurance policies based on a literal reading therefore did not work, and rightly so, as the reasonable expectations of the policyholder must conform to the purpose and ordinary understanding of such exclusions. And based on the principle of contra proferentem, as invoked by the court, any ambiguity should be interpreted in favor of coverage.

Bad Faith Claim and “Mend the Hold” Doctrine

AIG’s rejection of SS&C’s bad faith claim relied almost entirely on the application of the Fraud Exclusion and SS&C’s allegedly false premise that AIG had wrongfully denied coverage for the settlement of the Tillage lawsuit. AIG reasoned that since SS&C obtained the only benefit it was allegedly entitled to under the policy — “many millions of dollars” in defense fees — SS&C had therefore suffered no wrong under the policy and any bad faith claim was merely “procedural” and not recognized under insurance law.

In response, the court found that the so-called false premise for SS&C’s bad faith claim was “not false after all” if the allegations in the complaint are taken as true (which they must be for purposes of a motion to dismiss). The court held that, assuming SS&C’s contractual right was indeed impaired as alleged in the complaint, “the fact that AIG engaged in allegedly pretextual reading of the Policy to deny coverage may qualify as an act of bad faith.”

The court further pointed to record evidence that may buttress SS&C’s potential grounds for a bad faith claim. Prior to the current litigation, AIG had asserted in its coverage correspondence that if there were to be a final adjudication against the employee of SS&C allegedly implicated in the email spoofing scheme, AIG would have a right to recoup any defense costs it had paid to SS&C. 

The court noted that this position was contrary to the interpretation of the fraud exclusion asserted in AIG’s motion to dismiss, in which AIG argued that SS&C’s implication in the fraudulent scheme was not a condition necessary for the application of the fraud exclusion. In so ruling, the court ignored AIG’s efforts to downplay the importance of the coverage correspondence by arguing that “the opinion of a claim analyst [wa]s completely irrelevant to the interpretation of an insurance contract.”

The course of dealing during the claims handling and adjustment process is undoubtedly a central and legitimate piece of evidence for a bad faith claim brought against an insurer. And SS&C Tech. Holdings is an excellent example of the mend-the-hold doctrine in insurance law, a phrase borrowed from wrestling terminology

In Harbor Insurance Co. v. Continental Bank Corp., the U.S. Court of Appeals for the Seventh Circuit summarized the history and application of the mend-the-hold doctrine in Illinois and tied the doctrine to “the consideration of good faith and ethical obligations in contract relations.” In a much quoted sentence, the court illustrated the doctrine as follows: “A party who hokes up a phony defense to the performance of his contractual duties and then when that defense fails (at some expense to the other party) tries on another defense for size can properly be said to be acting in bad faith.”

As a result, an insurer risks not only liability for its policy limit, but also liability for damages in excess of the policy limit, where an insurer flip-flops on its denial decision, or, as in SS&C Technologies Holdings, by changing the basis for its coverage denial through contradictory interpretations of the same exclusion. 

This article was first published in Law360.