Growing Pains for Rideshare Services
In the long run, ridesharing software services will be part of city transport systems around the country, and the new business they foster will grow markets for commercial lines of insurance. But those eventualities are far down the road.
Right now, ridesharing businesses are stuck in a jam of pending legislation and even, litigation.
When services like Uber and Lyft made their debuts, it seemed like such as simple premise: a virtual clearinghouse of drivers with an empty seat in the car matched with potential passengers willing to toss them a few bucks towards gas.
From the start, the services were adamant that they were software companies, not taxi operators, and that drivers were not even independent contractors, but private citizens willing to give a stranger a lift.
Regulators are starting to see things differently, and the courts will soon weigh in as well. Bills specifying obligatory insurance types and amounts, as well as assigning liability in case of loss, are now pending in at least five states — Arizona, Colorado, Georgia, Maryland and Oklahoma — as well as in municipalities such as Chicago, Seattle, Minneapolis, Milwaukee, Pittsburgh and Dallas.
California was the first state to enact rules governing ridesharing operations, and in a tragic irony, San Francisco is the venue for one of the first lawsuits involving a fatality. On New Year’s Eve, a driver who was registered with Uber, but was not working a call at the time, accidentally killed a young pedestrian at a notorious intersection in downtown San Francisco. The driver was arrested and his case is pending, but the stricken family is also suing Uber.
The first complication, said property and casualty underwriters and brokers, is that private automobile insurance specifically excludes use of the vehicle for hire.
Covering the Gap
In response to the tragic accident, Uber recently announced that it would expand its insurance coverage.
Previously, it required drivers to have $1 million of commercial insurance to cover driver liability from the time they accept a trip request through their app until completion of the ride. Uber also included $1 million coverage for uninsured/underinsured motorists, and contingent comprehensive and collision insurance, up to $50,000 per incident.
Although the company noted that “the vast majority of personal insurance policies” would cover the driver when they have the app open and are available, but have not yet received a transportation request, Uber decided to “cover any potential ‘insurance gap’ by providing contingent coverage of $50,000 for bodily injury for an individual; a total of $100,000 for bodily injury for an incident; and $25,000 for property damage for an incident.
“Uber is taking this step to eliminate any ambiguity while the insurance industry and state governments update policies and regulations for the new world of ridesharing transportation,” the company announced.
Lyft also followed suit, announcing it would provide “backstop coverage” to drivers when their app is open but the drivers are not yet providing rides. That protection is to be rolled out over time, state by state, according to reports.
Neither company responded to requests for comment.
“Ridesharing is going on all over the country,” said Robert Passmore, senior director of personal lines policy at the Property Casualty Insurers Association of America. “The California Public Utilities Commission [CPUC] was the first, and so far the only state, to attempt to regulate the business.
“Uber and Lyft and the other rideshare services have always stressed that they are not transportation companies,” he said, “but so far that argument has not convinced anyone.”
Last autumn, the CPUC ruled that rideshare services were indeed transportation companies, but the companies are appealing that decision.
“In our industry, when someone hears words like ‘excess’ and ‘contingent’ coverage, we know that there has to be primary coverage that specifically addresses the activity,” said Passmore.
In the case of automobile coverage just the opposite is true, with personal policies specifically excluding rides for hire.
Passmore said his association and P&C underwriters in general do not oppose rideshare services.
“The reason we are getting involved in this issue is that it does present opportunities for carriers. There needs to be coverage intended specifically to address the risk in question.”
He also noted that many smaller cities are underserved by taxi and radio-car services, so that once the insurance and liability questions are resolved, rideshare services will be a boon for those local economies.
Indeed, he believes that the software firms and underwriters can make it a common cause. “The software companies have a great deal of data about how and where and why people drive and ride. That data is of great interest to the underwriting community,” Passmore said.
Broadening the focus, Stephen Hackenburg, chief broking officer for national casualty at Aon, said: “We are all working on contingent exposures. The industry is getting smarter, expanding exclusions of negligent supervision, situations where there can be failure of oversight or failure of due diligence. The ISO 2013 general liability policies had expanded exclusions of negligent supervision.”
As an example, Hackenburg offered a scenario: A vacationing family wants to take an off-road tour, and the hotel or cruise ship concierge books them or refers them to one. If something goes wrong, the hotel or cruise line can try to claim that the tour operator is a separate operation.
“But,” he said, “any enterprising lawyer could make a case out of what did the hotel or cruise line do to verify the safety of the tour operator.”
One possible partial solution, Hackenburg said, is the kind of blanket liability policy that some importers are starting to buy to cover their international suppliers.
“If you are a toy company, and something you imported from China is found to have lead in it, it will be very difficult to try to go after some nebulous manufacturer in China. Instead you get a foreign-supplier liability policy and schedule all your sources. You can either just eat the cost, or try to get them to pay for some or all of it.”
He said the same would apply to a large company doing business with small firms that are often undercapitalized. Cruise lines make significant profits from booking land-side tours, but if there is a problem, the vacationers are going to sue the cruise line, not the guy with the jeep.
Hackenburg also noted that there are other options, including creating an affinity program within a captive that small vendors and suppliers can buy into. “We work closely with our clients on contingent exposures,” he said. “There are actually lots of tools available. You just have to have those discussions.”
He said that online businesses from ridesharing to tour booking to international supply chains are bringing more disparate interests together. That creates many new business opportunities, but also a whole new web of liabilities. Far better to make some decisions in advance than when the car is in the ditch.
Hacking into cars is not a future concern. It is possible now, and the potential danger will increase as carmakers continue to enhance connectivity features in automobiles.
But even that threat pales against the potential damage cyber attacks could wreak when driverless cars take to the roads for real.
One common perceived threat here and now comes from the ease of access that manufacturers have built in for drivers. If a driver can unlock a car door and start the engine using a cell phone, an unauthorized person can turn off that engine and lock the doors from a cell phone.
Taking a drive into the near future, could someone arrange for all of the cars on a Los Angeles freeway to have their engines turned off at the exact same time?
Even now, the ability to hack into and remotely control a car is a clear and present danger.
Video: Behind the wheel of a car, you may be able to text, watch a movie or even sleep — if it’s a computer-controlled, driverless car. The WSJ’s Michael Kofsky heads to the test track to show how it works and safety questions it raises.
A pair of security engineers — doing their research with an $80,000 grant from the Pentagon — were able to hack into the systems of Toyota and Ford cars, and override a driver’s braking attempts, according to an account of the scenario in Forbes.
The pair was able to “demonstrate a range of nasty surprises: everything from annoyances like uncontrollably blasting the horn to serious hazards like slamming on the Prius’ brakes at high speeds. They sent commands from their laptops that killed power steering, spoofed the GPS and made pathological liars out of speedometers and odometers,” according to Forbes.
Expanding such abilities simultaneously to a fleet of cars is a feat yet to be accomplished.
“It could be possible to hack into one or another vehicle, but there is nothing that can stop the whole fleet at the same time,” said Mark Brooks, senior research engineer at the Southwest Research Institute (SwRI) in San Antonio. “Current levels of connectivity are not seen as major threats because they are not continuous.”
No One at the Wheel
“Even when a driver is using a navigation system, that is just a single download. The industry is much more concerned about continuous streaming back and forth, as with driverless cars,” he said.
Driverless cars rely on a number of sensors to operate, and are definitely vulnerable to attack, according to one of the hackers at the Def Con Hacking Conference in August.
“I’m a huge fan of unmanned vehicles,” said a hacker who goes by the name of Zoz to Venture Beat, a blog that focuses on technology. “I love robots. I think they’re the future. But, like everything else humans ever made, it’s going to get hacked.”
Google’s driverless car’s primary system is a “laser range finder mounted on the roof of the car,” which generates a 3D map of the area, according to IEEE, a technology professional organization.
“The vehicle also carries other sensors, which include: four radars, mounted on the front and rear bumpers, that allow the car to ‘see’ far enough to be able to deal with fast traffic on freeways; a camera, positioned near the rear-view mirror, that detects traffic lights; and a GPS, inertial measurement unit, and wheel encoder, that determine the vehicle’s location and keep track of its movements.”
Zoz told Venture Beat that it would not require sophistication to attack and derail those sensors, and he pointed out that engineers in Iran were able to hack and capture a U.S. drone by “spoofing” the GPS and feeding it incorrect location information.
Death and destruction are always a worry when hackers can subvert an operating system, but apportioning liability is also a major concern, SwRI’s Brooks said.
“If there were any problems, whose fault would it be? The carmaker? The navigation OEM? The software company? The driver? These are the discussions everyone is starting to have.”
Those initial conversations can be difficult, said Dave Wasson, professional and cyber liability practice leader at brokerage Hays Cos. in Chicago.
“The issues are known. People are aware of the risks. But at the moment there is kind of a paralysis because it is unclear how to quantify these risks, and also because even if we could quantify them, there are very limited options yet in how to deal with them.”
A Flawed System
Wasson added that a reordering of the current liability structure is both necessary and inevitable. “Right now, you have a pull market, with small OEMs seeking coverage because the first-tier OEMs and carmakers demand that they be indemnified. But that is not sustainable. A client might demand a $15 million cover from a small supplier, but that cover could cost the supplier $50,000 when he only grosses $100,000 on the contract.”
It is a situation where bigger companies are offloading their risk management onto smaller ones, and that, Wasson said, is flawed.
“Even when the suppliers comply, often the package does not work the way either the supplier or the OEM client thinks it will,” he said.
“Eventually the large firms will realize that they need to take this as primary,” Wasson said. “They have the assets, the skills, the risk managers, and the brokerage relationships to get it done properly.
“Besides, they are the ones who are going to get sued. They can turn to their indemnification contracts, but if the small supplier with few assets goes bankrupt, then what? It’s the company with the badge on the car that people are going to go after.”
As those issues percolate, commercial vehicle operators have other challenges as well.
“One really big cyber issue for a logistics company or express delivery service would be to have the GPS signals for their vehicles scrambled, or the electronic shipment documents tampered with,” said Steve Surber, area vice president for Arthur J. Gallagher in Irvine, Calif.
A cyber attack could be used to divert a shipment, cover theft, tamper with cargo, or even just to delay a shipment that is time sensitive. And the theft could be of the truck or trailer itself, some of which are worth up to $60,000, he said.
On another level, hacking can be used to disrupt the loss control systems of trucking lines, many of which use GPS and electronic reporting to track their fleet performance, Surber said.
Cyber alterations of such reporting could hide potential liability issues such as speeding, sleeping, unauthorized stops, fuel diversion, or many other misdeeds by shippers, loaders, drivers or consignees.
“Companies already rely heavily on computer systems and networks to help with loss control,” he said.
Among insurers, coverage is still evolving, he added. “There is some coverage from cyber policies, but mostly we are still seeing claims handled through general liability.”
Wasson, at Hays Cos., said that while the cyber risk and liability markets are pull markets at present, with owners seeking to transfer risk, the business is not without push.
“We are energetic about working with our carriers,” he said. “There is coverage and there is capacity.”
Cyber Security Efforts
In April, an automotive consortium started revving up its efforts to enhance cyber security.
The Automobile Consortium for Embedded Security — a part of SwRI — includes automakers, original equipment manufacturers, other suppliers, and cyber security experts.
The program aims to provide “pre-competitive and non-competitive research in automotive embedded systems security to protect the safety, reliability, brand image, trade secrets and privacy of client members’ future products,” according to the organization.
“As soon as they start claiming their vehicles are secure, they would paint a target on themselves. It’s not like safety or fuel economy. With security, there are bad guys and you don’t want to attract their attention.”
The consortium, Brooks said, “is looking at emerging research both in new technologies and new protections for embedded security for the automotive world.”
“There are lots of theoretical threats,” he said, “but we want to be sure we are focusing our efforts on the most relevant ones.”
The unique challenge is that automakers want to enhance the protections in their vehicles, but ironically, it is not something they want to advertise.
“As soon as they start claiming their vehicles are secure, they would paint a target on themselves.
“It’s not like safety or fuel economy. With security, there are bad guys and you don’t want to attract their attention.”
He said that automakers also are hesitant to unilaterally invest in cyber security efforts.
“As we started talking to automakers, we found them eager to be part of developing security, but it’s tough for them to take the lead or commit a lot of money to something that will not help them sell cars,” Brooks said.
“They also don’t want to reinvent the wheel,” he said. “They are very interested in solving common problems with peer-reviewed research and applications.”
Complete coverage on the inevitable cyber threat:
Risk managers are waking up to the reality that the cyber risk landscape has changed.
Cyber: The New CAT. It’s not a matter of if, but when. Cyber risk is a foundation-level exposure that must be viewed with the same gravity as a company’s property, liability or workers’ comp risks.
Critical Condition. The proliferation of medical devices creates a host of scary risks for the beleaguered health care industry.
Unmanned Risk. The dark side of remote-controlled drones, which have already been hacked — by students.
An Electrifying Threat. There is a very real possibility hackers could devastate the nation’s power grids — for a potentially extended period of time.
Passionate About Technology
If you overheard the passion and enthusiasm that Brit Waters uses to describe his most important business technology, you would immediately assume it was the latest smartphone or tablet. But it’s not Apple or Google that generates so much enthusiasm, it’s the Riskonnect risk management platform.
“Riskonnect revolutionized how our department does business. This system changed the way we gather, analyze and communicate information. It’s made us more efficient, effective and reliable,” said Waters, Manager, Risk Management at Avery Dennison Corporation. “These are not bandages, but complete solutions.”
Avery Dennison is a multinational company offering labeling and packaging materials and solutions whose applications and technologies are an integral part of products used in every major market and industry. The company operates in more than 50 countries with over 26,000 employees and $6 billion in revenues in 2013.
“Riskonnect revolutionized how our department does business. This system changed the way we gather, analyze and communicate information. It’s made us more efficient, effective and reliable. These are not bandages, but complete solutions.”
– Brit Waters, Manager, Risk Management, Avery Dennison Corporation
The company partnered with Riskonnect, the provider of premier, enterprise-class technology platforms. In just 18 months, the system not only revolutionized the department but also delivered wide-ranging value for plenty of other parts of the organization. Those departments utilize the system to manage financial assets, keep track of vehicles and will soon oversee facilities requests.
‘The Simplicity is Unreal’
For global property insurance renewals, Riskonnect changed the way Avery Dennison collects data on its 300 manufacturing facilities, warehouses and other properties around the world. Gone are the days of sorting through hundreds of separate emails with information about the properties and merging hundreds of separate spreadsheets into one.
Not only was the old process cumbersome, it left lots of room for error.
With Riskonnect, the process is automated. It sends emails to the more than 100 individual contacts and the users insert the information into the Riskonnect portal themselves — something that makes Waters’ life a whole lot easier.
“I hit a button once and it runs the report for me. The simplicity is unreal,” he said. “Plus, it gives us better information that we can communicate to our insurance carriers, and gives them increased confidence about the risks they’re insuring.”
Waters said it’s a big time-saver. “Before, the process could take up to three months, and now we get it done in less than a month.”
One thing he’s particularly excited about is the configurability of the portal. If he wants to customize it, he can easily do so without going through a computer programmer or contacting an account executive.
“It gives you the power to set up the system as you need it, not as someone else envisions you need it,” said Waters.
The Riskonnect portal is also the primary source for reporting workers’ compensation claims. Again, the Riskonnect system simplified the process. Before, employees had to call a 1-800 number or fill out a long form and fax it to the Third Party Claims Administrator (TPA). Now they just log on and use the claims reporting portal, which is equipped with drop-down menus and other efficiencies that help expedite the process.
“We take the guessing game out of their hands,” said Waters. “In a matter of minutes, they get a confirmation email that the claim has been submitted to the TPA.”
Through the Riskonnect dashboard tools, Waters and his department can learn a lot about trends in workers’ comp claims. The system tracks claims year-to-date, costs, causes of injury and even the top body parts that are hurt. Then risk management communicates that information to local managers to make sure that safety-and-prevention programs are appropriate and will help reduce the amount of claims and their costs.
“The Riskonnect dashboards layout all this valuable information in easy-to-use tables and charts, making it simple for us to study the data and implement necessary safety changes,” said Waters.
ROI on a Values Collection Module
At the start of the process, Waters never imagined just how many other departments would use the tool. The finance department uses the system for asset management. The fleet administrator uses it to have drivers sign off on its manuals. Even the facilities department is jumping on board, using the Riskonnect system to identify when properties need repairs to big-ticket items like roofs or windows.
The company is also looking to report global property claims, transit claims and employers’ liability claims through the platform. It’s even evaluating if it can use it on the shop floor with health-and-safety team members having easy access to the system via iPads.
”The Riskonnect platform can help many different departments with a wide variety of tasks,” said Waters. “It’s really making risk management a much more strategic contributor to the company.”
“I hit a button once and it runs the report for me. The simplicity is unreal,” Waters said. “Plus, it gives us better information that we can communicate to our insurance carriers, and gives them increased confidence about the risks they’re insuring. Before, the process could take up to three months, and now we get it done in less than a month.”
Waters’ enthusiasm for the product is clear, but he’s not alone. End-users are raving about how easy, intuitive and customizable it is. For example, training end-users used to consist of holding approximately 15 different webinars to walk everyone through the process. Now, it’s accomplished in one easy-to-understand mass communication through the Riskonnect portal.
The end users even helped Waters and the Avery Dennison team add efficiencies that improve the entire process. On the property reporting side, they suggested adding an attachment tool for adding spreadsheets – so the information is easy to find the following year.
“It’s amazing when you give the end users a product and you see how they come back to you with advice that you never even thought of,” said Waters. “That speaks volumes for the system.”
In just 18 months, Riskonnect changed the way Avery Dennison does business — something Waters can’t hide his enthusiasm about.
“I don’t consider them just a vendor,” said Waters. “I consider them a long-term strategic partner.”