Comment Re:But If they're negligent... (Score 1) 122
If Sony's issues were due to their own negligence in securing their network, why should the insurance company have to pay? If I'm driving drunk my insurance company isn't going to cover my car when I get into an accident, so why the hell should an insurance company cover this?
That's a lousy analogy because drunk driving is a criminal behavior. In many places it is illegal for an insurance company to write a policy that covers personal liability for criminal acts, but they frequently can cover extremely stupid acts of negligence or even (rarely) corporate liability for the crimes of individuals.
But that doesn't seem to be relevant in this case, since Zurich seems to be suing over finer points of coverage terms rather than over whether Sony was negligent in their sloppy security. Zurich is expert in the finer points of defining degrees and scopes of negligence and writing them into umbrella corporate liability insurance policies, so that seems an unlikely area for them to be litigating. The article says nothing about negligence, but it does imply that Zurich is looking to get a grey area settled over where security breach harm sits in the legal taxonomy of torts. They are claiming that their policy doesn't cover any of the claimed harm in the suits against Sony, and that if it does then Sony's other insurers are also on the hook.
If Sony was a person this wouldn't even be a question...
Right, because a person cannot run a global conglomerate business doing billions of dollars of commerce daily with hundreds of millions of customers. If Sony was a person the underlying event could not have occurred.
More to the point you were trying to make and stipulating your dubious theory that this is about negligence... A business entity has more complicated liabilities and needs more complex insurance than an individual because it is made up of many people with non-homogeneous knowledge and motivations and distinct functions and responsibilities as part of the business. A corporation can sometimes be held liable for damage from intentional actions by low-level employees that were unforeseen, unpreventable, and in violation of corporate policy. That doesn't even have an analogy in an individual person. However, if a person is negligent in a way that contributes to harm to others, it can be a complicated process involving both fact and law to determine whether a particular insurance policy will cover that harm. For example, suppose that I had a swimming pool in my back yard that I let neighborhood kids use without any real supervision. One day the local bully comes by, pulls out the pump power line, tosses it in the pool, and starts pushing kids in. They all get scared out of their skulls and get minor shocks, maybe a lot of bruises, maybe even a few broken bones. I would get sued. If my homeowner's insurance had a specific rider covering harm to guests in my swimming pool, my insurance company would probably make some judgment as to whether to defend those suits or settle them, no matter how careless I was, and go after the bully on the other end. If my homeowner's policy didn't explicitly acknowledge the pool or explicitly excluded pool-related liability, I could have a problem much like the one Sony now has with Zurich.
The slimeballs who cracked Sony should be hoping for a Zurich win against Sony and subsequent wins in similar escape suits by the other insurers. Insurers have terrifying legal teams and a lot of law tilting the playing field in their favor. In many cases, the direct perpetrators of a harmful act can be pursued by an insurer to cover whatever the insurer paid on claims plus legal fees, while lacking the protections that a criminal defendant gets when being prosecuted by the government. Sony could go after them as well, but they probably would be as good at it.