The Risky Business of ISP Insurance — continued

Craig Poulton, Poulton Associates, Inc. president and principal, operates an insurance and risk management firm out of Salt Lake City. Poulton said premiums for decent ISP coverage are rising while the number of insurance carriers who will actually cover providers is shrinking.

"It's affecting particularly the small ISPs because the carriers see significant exposure in the smaller ISP and not enough premium to make the assumption of that exposure worthwhile," Poulton said. "That's a dilemma for small ISPs—to find an insurance carrier that won't bankrupt them to give them coverage that is meaningful."

Many smaller ISPs buy into a basic business owner's package policy, Poulton said, a policy that could potentially come back to haunt them. Apparently Cloud Nine bought a similar insurance policy. What many ISP operators fail to realize is that these policies cover physical damages, such as from a fire or earthquake, but do not cover virtual damages, such as problems arising from viruses, spam, hacker attacks, copyright infringement, and the like.

Poulton recommends that ISP businesses buy several policies to cover their assets:

• Errors & Omissions (E&O): Commonly mistaken as malpractice coverage, a good E&O policy will cover most ISPs in legal trouble over content issues that aren't covered in the standard business owner's policy.
• Products & Completed Operations: Coverage most commonly used by businesses that manufacture, sell, or distribute products—or services.
• Advertising Injury Coverage: For ISPs, an advertising injury policy protects them from "injury" litigation filed against them for copyright infringement, piracy and privacy violations.

The cumulative price tag of all this coverage is nothing to sneeze at, which is why many smaller ISPs stick with a basic business owner's package and take their chances.

For ISPs that earn less than $1 million a year in sales revenues, the premiums for an adequate—not ironclad—insurance like the three policies described above run anywhere from $5,000 to $10,000 a year. Of course, this does not include worker's compensation coverage, personal liability, and "normal" business insurance policies.

AIGeBRS offers a comprehensive package of insurance policies specifically tailored for e-business, but this offering is not designed for small, local ISPs. Its bare-bones premiums start at $40,000 a year. This is a plan that Yahoo, one of AIGeBRS' clients might be able to afford, but not the Ma 'n Pa ISP business based on Main Street U.S.A.

While the price tag knocks out about 90 percent of local ISP businesses in the U.S., the company's AIG NetAdvantage Complete is a good starting point for ISPs looking to build a "wish-list" of coverage for their current insurance carrier.

The AIG NetAdvantage program includes:

• Web content liability: Covering copyright infringement and intellectual property violations.
• Internet E&O: An online "malpractice" policy.
• Security liability: Covers security breaches include unwanted intruders, DDoS attacks, and virus retransmission.
• Data protection: Covers costs for damaged or corrupted data.
• E-business interruption: Claim damages for lost revenues from downtime.
• Cyber extortion: Coverage in case a network intruder steals information like credit card numbers and holds it for ransom.
• Other liabilities: AIG will even pay public relations fees incurred if your network goes down and you have to recoup your reputation because of the downtime.

Most importantly, AIGeBRS puts applicants through a mini-security test to determine the ISPs network vulnerabilities. This service is free of charge, even if you don't select the company as your ISPs insurance carrier.

Even if your ISP business is willing to bite the bullet and assume the burden of carrying annual insurance costs, there are other hurdles to overcome.

Poulton's firm has a deal with the ISP Consortium to provide its members with insurance services. According to Poulton, roughly 25 percent of applicants are denied coverage because the ISP business has not done its homework assessing risk management issues like network backup systems and terms of service (ToS) agreements with their clients.

IP perils
Poulton said that his insurance carrier would not bother moving forward with an ISP that doesn't have its operations in order.

"The big issue for smaller ISPs is that they're in a very complex business from a risk management standpoint and they're viewed as an exceptionally difficult risk to ensure and make money on by insurance companies," he said. "An ISP that doesn't pay attention to risk management and doesn't pay attention to the insurance purchasing mechanism will not get adequate insurance."

Now, this doesn't paint a rosy picture for ISPs looking to protect their business operations from lawsuits. In the end, those providers that want to make sure they're shielded from harmful litigation are going to have to cough up a chunk of cash every year and beef up their risk management policies.

But the money spent is a drop in the bucket as opposed to the potentially crippling costs involved in protecting your business in today's lawsuit-happy environment.

— End

< Back to page 1