Cyber Risks

Ports Need to Rethink Criminal Activity

Port computer systems are vulnerable to criminal organizations looking to steal, smuggle or commit espionage.
By: | June 6, 2016 • 5 min read
industrial port with containers

As the marine industry grows more automated, ports and related industries are increasingly vulnerable to cyber disruptions.

In the past, criminals would steal a container on the dock and drive away before anyone noticed. Today’s criminals are global. They don’t have to be in the same country to learn when a container arrives, when it clears inspection, what’s inside it, where it’s stored and when it’s moving out.

Advertisement




Computer networks changed how ports are run. Ports now use fewer workers on the ground because computers can operate vehicles remotely and GPS-based systems track and move containers semi-autonomously.

The systems may have changed, but criminals continue to try to steal containers, smuggle drugs or engage in espionage.

Ports are the economic engine that drives the economy, said Jayson Ahern, principal at The Chertoff Group and former deputy commissioner of U.S. Customs and Border Protection.

He said they need to be better protected.

“Port operators need to be looking at security in real time and rethink the risks – not just meet the minimum requirement of their governing agencies – and that’s where port operators often fall short,” said Ahern.

“Criminal activity is going to continue. Every time we plug one gap and vulnerability, they go back and adapt and diversify their approach.”

Billions in Losses

About 95 percent of world trade is transported via ship each year, according to the U.S. Department of Homeland Security.

“When we saw the impact of closing ports right after 9/11,” Ahern said, “I saw firsthand what happens when you shut down trade at our borders.”

Following the 2001 attacks, container shipping lost $1 billion each day for months after the United States closed all ports and airports, Ahern said.

More recently, a months-long labor dispute at 29 West Coast ports resulted in work slowdowns and caused billions in losses, according to Vice News. U.S. agriculture lost about $2.5 billion, while manufacturers reported an aggregate of nearly $400 million in losses for each month of the dispute.

A cyber attack could cause the same type of economic damage.

In 2013, computer problems – caused by error, not sabotage – resulted in weeks of problems at the Maher Terminal serving the port of New York and New Jersey, including closing the terminal for up to six hours at a time, according to the “Consequences to Seaport Operations from Malicious Cyber Activity” a report by DHS.

DHS also reported that an organized crime group used hackers to control the movement and location of containers at the Port of Antwerp in Belgium between 2011 and 2013; and crime syndicates penetrated the cargo systems used by Australian Customs and Border Protection in 2012.

Matthew McCabe, senior vice president, FINPRO practice, Marsh

Matthew McCabe, senior vice president, FINPRO practice, Marsh

Not only are ports vital to the economy, they are a national security issue, said Matthew McCabe, senior vice president for network security and data privacy group with the FINPRO practice at Marsh.

“We need to see more cyber security assessments,” Ahern said. “We’re not seeing it happening sufficiently enough around the world. People need to always be asking: ‘What type of monitoring and disruptions of attacks are we seeing?’ ”

A comprehensive plan needs to encompass three areas: physical security, insider threats and cyber risks, Ahern said.

Putting Plans in Place

When Martin McCluney, managing director, U.S. hull and liability practice leader at Marsh, talks to marine clients about cyber risk, he says they weigh whether to retain, manage or transfer risk into the market.

Advertisement




“We are in conversations with several operators now,” said McCluney.

“We are assisting them in their internal process to evaluate the cost/benefit of any additional insurance that may be necessary.”

Just the mere act of applying for cyber risk insurance normally sets the wheels in motion for businesses to begin a risk assessment of cyber controls, McCabe said.

There is value in going through the planning process and identifying who you would turn to in a time of crisis.

The insurance market is keen to not just provide pure risk transfer but to also provide loss prevention and post-loss advice, McCluney said.

“We ask, ‘How do you recover? What systems do they have in place to prevent and deter attacks?’ And, if systems have been compromised, what is the contingency plan once an attack has impacted them?”

Insureds should review in detail the way their existing marine and property casualty policies would respond to a cyber attack. The task can be complicated because port operators work with many third parties that ship and receive the goods on either side, so operators need to establish minimum codes of compliance with all additional parties.

Marine market policies that cover stevedoring (loading and unloading of vessels in terminal operation) do not consistently include a cyber risk solution.

The client is very likely exposed to risks that are outside the coverage, McCluney said.

For example, if handling equipment shuts down due to a computer problem but hasn’t suffered physical damage, the economic losses may not be covered under a property policy.

To prevent losses in a case like this, operators should consider a cyber program that would be in excess to a property program, or a difference-in-conditions policy that would fill gaps in the coverage, McCluney said.

The core benefit to cyber insurance is you are able to transfer some of the financial damage and coordinate your response plan, so there’s a mechanism ready at a time of crisis, McCabe said.

The growth of cyber insurance over the last three years bears that out. The number of U.S.-based Marsh clients purchasing stand-alone cyber insurance increased 27 percent last year compared with 2014. That followed a 32 percent increase in 2014 over 2013.

Cyber insurance growth is expected to continue apace as port operators understand the potential cyber risks they face, and conduct risk assessments in conjunction with the Maritime Transportation Security Act. The act was written after 9/11 to shore up port protections by requiring vessels and cargo-handling facilities to conduct vulnerability assessments and develop security plans.

Advertisement




The U.S. Coast Guard made additional cyber strategy recommendations in a June 2015 report.

In that report, the USCG recommended organizations view cyber security as an ongoing process, and regularly re-evaluate mitigation measures and ensure personnel understand and follow good cyber practices.

Organizations should strive to incorporate cyber security into an existing culture of safety, security, and risk management, it said, and identify a senior person responsible for cyber risk management.

Juliann Walsh is a staff writer at Risk & Insurance. She can be reached at [email protected]
Share this article:

The Law

Legal Spotlight

A look at the latest legal cases impacting the industry.
By: | May 24, 2016 • 4 min read
You Be the Judge

Court Sinks Subrogation

On March 17, 2012, the commander, a vessel owned by Nature’s Way Marine, ran aground in the mouth of a narrow channel of the Mississippi River near Crown Point, La., owned and operated by Crown Point Holdings LLC.

R6-16p14_LegalSpotlight.inddAs it maneuvered to free itself, the movements created “extreme wave wash” that broke the mooring lines of two of Crown Point’s vessels, the Port Gibson and the Buccaneer, grounding them on a mud bank.

On March 21, the Port Gibson began to take on water and sank, pulling the Buccaneer down with it. After raising the ships, it was discovered Port Gibson’s hull was punctured by a bolt-studded piece of timber.

Osprey Underwriting Agency Ltd., which issued Crown Point marine hull insurance on the Port Gibson and the Buccaneer, paid for salvage and damage expenses and then, as subrogee, it sued Nature’s Way for reimbursement, arguing the Commander’s maneuvers caused the sinking of Crown Point’s vessels.

A district court in Louisiana ruled against Osprey. It said Osprey failed to prove the Commander’s actions caused the sinking, and even if the causation could be determined, Crown Point’s failure to warn anyone of the timber impaled in the hull was a superseding cause of the sinking.

Advertisement




On March 25, the U.S. 5th Circuit Court of Appeals upheld that decision. It concluded that experts from both sides “vehemently” disagreed with how the hull impalement occurred, and that marine law required negligence to be a “substantial factor” in the damage.

Scorecard: Osprey will not be reimbursed for its costs to salvage and repair the vessels.

Takeaway: Under general maritime law, “negligence must be a ‘substantial factor’ in the injury.”

Legal Fees Contested

On Dec. 29, 2011, William R. Kowalski and Hawaii International Seafood filed suit against Anova Food LLC, claiming patent infringement and false advertising. The lawsuit accused Anova of using Kowalski’s “tasteless smoke” process to treat tuna, although Anova advertised the fish were treated by a “clearsmoke” process.

Anova retained Gary Grimmer as local counsel in Hawaii to represent it.

On Oct. 12, 2012, Anova requested a defense from the Hanover Insurance Co. and its subsidiary, Massachusetts Bay Insurance Co. (“Hanover”). Defense was granted under a reservation of rights, and the insurer agreed to pay Grimmer in accordance with its litigation guidelines and fees.

Hanover’s claim that it only agreed to hire Grimmer and not Zobrist conflicted with its payment of some of Zobrist’s legal fees, the court ruled.

Hanover stated it would not pay, however, for any fees paid by Anova prior to the claim being made.

The insurer said it would not apply the exclusion for injuries “arising out of” infringement of intellectual property, but would not indemnify Anova for any punitive damages.

On Dec. 11, 2012, the Zobrist law firm, which had a history with Anova’s intellectual property issues, filed its appearance as counsel of record for Anova, and was subsequently paid $284,624 by Hanover.

A year later, Hanover informed Anova it was transferring defense in the case from Grimmer to two other attorneys. At that time, it said that any continued involvement by Zobrist “will need to be funded directly” by Anova.

On June 19, 2014, Hanover asked for a court determination that it need not defend nor indemnify Anova. The insured filed a counterclaim for breach of contract and bad faith, arguing Hanover owed it a defense, and the unpaid balance to Zobrist of $385,153.

Anova reached a settlement with Kowalski in April 2015.

The U.S. District Court for the District of Hawaii ruled on March 24, 2016 that Hanover did have a duty to defend Anova but did not have to pay for legal services prior to Anova’s request for a defense.

Advertisement




Because factual questions remained about the legal fees paid to Zobrist, the court denied Anova’s motion for summary judgment on its claim that Hanover breached its contract.

Scorecard: Additional court proceedings will determine whether Hanover must pay $385,153 for Zobrist’s legal fees.

Takeaway: Hanover’s claim that it only agreed to hire Grimmer and not Zobrist conflicted with its payment of some of Zobrist’s legal fees, the court ruled.

Request for Defense Denied

In 2009, Larry Naquin was using a land crane owned by Elevating Boats LLC (EBI) to move a “test block” when the welding holding the crane to its base failed.

Naquin jumped from the crane house, breaking both feet and sustaining a lower abdominal hernia. He was never able to return to physical work.

R6-16p14_LegalSpotlight.inddIn May 2012, a federal jury in Louisiana awarded Naquin $2.4 million for physical and emotional pain and lost wages. EBI appealed and the negligence verdict was upheld.

Subsequently, EBI sued State National Insurance Co. and London insurers, accusing them of breaching their contracts by denying EBI’s request for defense and indemnification.

On March 22, the U.S. 5th Circuit Court of Appeals agreed with a lower court in dismissing EBI’s lawsuit.

Scorecard: The insurers are not responsible for indemnifying EBI.

Takeaway: EBI’s policy offered indemnity for the company “as owner of the Vessel,” and it was not triggered because the accident occurred on land. &

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]
Share this article:

Sponsored: Liberty Mutual Insurance

Commercial Auto Warning: Emerging Frequency and Severity Trends Threaten Policyholders

Commercial auto policyholders should consider utilizing a consultative approach and tools to better manage their transportation exposures.
By: | June 1, 2016 • 6 min read

The slow but steady climb out of the Great Recession means businesses can finally transition out of survival mode and set their sights on growth and expansion.

The construction, retail and energy sectors in particular are enjoying an influx of business — but getting back on their feet doesn’t come free of challenges.

Increasingly, expensive commercial auto losses hamper the upward trend. From 2012 to 2015, auto loss costs increased a cumulative 20 percent, according to the Insurance Services Office.

“Since the recession ended, commercial auto losses have challenged businesses trying to grow,” said David Blessing, SVP and Chief Underwriting Officer for National Insurance Casualty at Liberty Mutual Insurance. “As the economy improves and businesses expand, it means there are more vehicles on the road covering more miles. That is pushing up the frequency of auto accidents.”

For companies with transportation exposure, costly auto losses can hinder continued growth. Buyers who partner closely with their insurance brokers and carriers to understand these risks – and the consultative support and tools available to manage them – are better positioned to protect their employees, fleets, and businesses.

Liberty Mutual’s David Blessing discusses key challenges in the commercial auto market.

LM_SponsoredContent“Since the recession ended, commercial auto losses have challenged businesses trying to grow. As the economy improves and businesses expand, it means there are more vehicles on the road covering more miles. That is pushing up the frequency of auto accidents.”
–David Blessing, SVP and Chief Underwriting Officer for National Insurance Casualty, Liberty Mutual Insurance

More Accidents, More Dollars

Rising claims costs typically stem from either increased frequency or severity — but in the case of commercial auto, it’s both. This presents risk managers with the unique challenge of blunting a double-edged sword.

Cumulative miles driven in February, 2016, were up 5.6 percent compared to February, 2015, Blessing said. Unfortunately, inexperienced drivers are at the helm for a good portion of those miles.

A severe shortage of experienced commercial drivers — nearing 50,000 by the end of 2015, according to the American Trucking Association — means a limited pool to choose from. Drivers completing unfamiliar routes or lacking practice behind the wheel translate into more accidents, but companies facing intense competition for experienced drivers with good driving records may be tempted to let risk management best practices slip, like proper driver screening and training.

Distracted driving, whether it’s as a result of using a phone, eating, or reading directions, is another factor contributing to the number of accidents on the road. Recent findings from the National Safety Council indicate that as much as 27% of crashes involved drivers talking or texting on cell phones.

The factors driving increased frequency in the commercial auto market.

In addition to increased frequency, a variety of other factors are driving up claim severity, resulting in higher payments for both bodily injury and property damage.

Treating those injured in a commercial auto accident is more expensive than ever as medical costs rise at a faster rate than the overall Consumer Price Index.

“Medical inflation continues to go up by about three percent, whereas the core CPI is closer to two percent,” Blessing said.

Changing physical medicine fee schedules in some states also drive up commercial auto claim costs. California, for example, increased the cost of physical medicine by 38 percent over the past two years and will increase it by a total of 64 percent by the end of 2017.

And then there is the cost of repairing and replacing damaged vehicles.

“There are a lot of new vehicles on the road, and those cost more to repair and replace,” Blessing said. “In the last few years, heavy truck sales have increased at double digit rates — 15 percent in 2014, followed by an additional 11 percent in 2015.”

The impact is seen in the industry-wide combined ratio for commercial auto coverage, which per Conning, increased from 103 in 2014 to 105 for 2015, and is forecast to grow to nearly 110 by 2018.

None of these trends show signs of slowing or reversing, especially as the advent of driverless technology introduces its own risks and makes new vehicles all the more valuable. Now is the time to reign in auto exposure, before the cost of claims balloons even further.

The factors driving up commercial auto claims severity.

Data Opens Window to Driver Behavior

To better manage the total cost of commercial auto insurance, Blessing believes risk management should focus on the driver, not just the vehicle. In this journey, fleet telematics data plays a key role, unlocking insight on the driver behavior that contributes to accidents.

“Roughly half of large fleets have telematics built into their trucks,” Blessing said. “Traditionally, they are used to improve business performance by managing maintenance and routing to better control fuel costs. But we see opportunity there to improve driver performance, and so do risk managers.”

Liberty Mutual’s Managing Vital Driver Performance tool helps clients parse through data provided by telematics vendors and apply it toward cultivating safer driving habits.

“Risk managers can get overwhelmed with all of the data coming out of telematics. They may not know how to set the right parameters, or they get too many alerts from the provider,” Blessing said.

“We can help take that data and turn it into a concrete plan of action the customer can use to build a better risk management program by monitoring driver behavior, identifying the root causes of poor driving performance and developing training and other approaches to improve performance.”

Actions risk managers can take to better manage commercial auto frequency and severity trends.

Rather than focusing on the vehicle, the Managing Vital Driver Performance tool focuses on the driver, looking for indicators of aggressive driving that may lead to accidents, such as speeding, sharp turns and hard or sudden braking.

The tool helps a risk manager see if drivers consistently exhibit any of these behaviors, and take actions to improve driving performance before an accident happens. Liberty’s risk control consultants can also interview drivers to drill deeper into the data and find out what causes those behaviors in the first place.

Sometimes patterns of unsafe driving reveal issues at the management level.

“Our behavior-based program is also for supervisors and managers, not just drivers,” Blessing said. “This is where we help them set the tone and expectations with their drivers.”

For example, if data analysis and interviews reveal that fatigue factors into poor driving performance, management can identify ways to address that fatigue, including changing assigned work levels and requirements.  Are drivers expected to make too many deliveries in a single shift, or are they required to interact with dispatch while driving?

“Management support of safety is so important, and work levels and expectations should be realistic,” Blessing said.

A Consultative Approach

In addition to its Managing Vital Driver Performance tool, Liberty’s team of risk control consultants helps commercial auto policyholders establish screening criteria for new drivers, creating a “driver scorecard” to reflect a potential new hire’s driving record, any Motor Vehicle Reports, years of experience, and familiarity with the type of vehicle that a company uses.

“Our whole approach is consultative,” Blessing said. “We probe and listen and try to understand a client’s strengths and challenges, and then make recommendations to help them establish the best practices they need.”

“With our approach and tools, we do something no one else in the industry does, which is perform the root cause analysis to help prevent accidents, better protecting a commercial auto policyholder’s employees and bottom line.”

To learn more, visit https://business.libertymutualgroup.com/business-insurance/coverages/commercial-auto-insurance-policy.

SponsoredContent

BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty Mutual Insurance. The editorial staff of Risk & Insurance had no role in its preparation.


Advertisement





Liberty Mutual Insurance offers a wide range of insurance products and services, including general liability, property, commercial automobile, excess casualty, workers compensation and group benefits.
Share this article: