The Risky Business of ISP Insurance

Getting good coverage and finding an affordable insurance program is a matter of risking capital with risk management. What do ISP owners fear more—losing business to unforeseen events or doing business with no insurance at all?

by Jim Wagner Managing Editor, ISP-Lists [February 8, 2002]

Insurance companies that don't trust your business model or even understand the connectivity industry represent the first hurdle for many ISP owners. The result is that ISP businesses are offered the worst of both worlds—extensive cookie-cutter policies for a premium price that don't cover real-world liabilities.

Worst case scenario
One of the most recent examples that comes to mind is the Great Britain-based ISP Cloud Nine. The service provider was brought to its knees early in January by a distributed denial of service (DDoS) attack. While Cloud Nine officials aren't able to discuss the specifics of the attack while the incident is under investigation, the company did send an e-mail to subscribers informing them that its insurance policy didn't cover the attack. The six-year-old firm was forced to shut down its operation and sell its business—and its 2,500 customers—to one-time rival Zetnet Internet Services.

Most ISPs, when they sign up for business-class insurance, think they are covered in the event of a service disruption like that experienced by Cloud Nine. Guess what—ISP operators need to read the fine print because few insurance polices cover this type of cataclysmic event.

Insurance policies come in all shapes and sizes, but most aren't tailored to meet the specific needs of ISP businesses. Most insurance companies don't have extensive dealings with ISPs and the communications industry in general, so many insurance firms don't know how to classify ISPs.

Assigned risk
AIG e Business Risk Solutions is a division of insurance giant American International Group. Its technology partners include Computer Associates International, Inc., Predictive Systems, Inc., and Unisys.

Ty Sagalow, AIGeBRS chief operating officer and executive vice president, says his company has extensive dealings with ISPs, both regional and national, but the market for small, local ISPs business insurance is zero.

"The concept of Internet risk insurance is a relatively new concept, and the industry has only had products focusing on New Economy risks for two years. Prior to that there wasn't such a thing," Sagalow said. "It's going to be very difficult for [small ISPs] to find insurance, because many of the small [insurance] carriers are finding that they can't afford to make insurance available. There are very few that have the infrastructure to provide insurance for ISPs."

Major U.S. insurer The Hartford Financial Services Group, Inc., indicated it would not offer ISP business insurance plans in the foreseeable future because of possible legal hassles and restitution payments.

Laura Johnson, The Hartford vice president, said the company is looking into providing insurance policies for ISPs down the road, but won't offer coverage until their experts gather all the necessary information.

"ISPs not only face typical errors and omissions exposures—meaning it either works or it doesn't—but depending how the ISP is set up and the services they provide, and who their target market is, if the ISP's service goes down and the companies depending on their service cannot conduct business, they could potentially sue the ISP," Johnson said.

Part of the problem for insurance companies is that annuity premiums, reserves, and dividends are determined from a compiled listing of industry statistics. This information is used to develop the actuarial tables that the insurance industry depends on. Given the brief history of the ISP industry, many insurers have only begun to collect the necessary data to determine payoffs and premiums.

Best case scenario
Dana Coates is a licensed insurance broker who's been dealing with ISPs since the early 1990s and has been focusing on wireless ISPs (WISPs) as of late. According to Coates, who runs an ISP insurance brokerage called ISP Insurance.com, it's not going to get any easier for providers to find business insurance in the coming years.

"It's not that the bigger insurance companies won't cover ISPs. It's that they don't have a comfort level yet with ISPs," Coates said. "There are lots of exposures—untraditional and yet undiscovered exposures—that they're afraid of dealing with."

Coates cited a typical example what insurance companies fear.

"Let's say a child is reading e-mails the ISP routinely delivered into the family inbox. The child is inevitably exposed to a pornographic message," Coates continued. "What insurance company wants to take on a case against a traumatized tot in a court of law? What insurance company wants to take on potential clients that could result losses of millions of dollars?"

Coates noted that the legal system has been ruling in favor of shifting the blame from ISPs to the point of origin of the offensive e-mail, but all it takes is one case to bring on a flood of litigation contesting that the ISP is to blame.

"Even though there are agreements (customers) sign before they get the Internet service, one of these days there's going to be a sharp lawyer out there who'll say, 'we're going to sue you anyway.' "

Go to page 2: Today's business reality >