Opinion
A-1879-21 A-1882-21
05-01-2023
MERCK & CO., INC. and INTERNATIONAL INDEMNITY LTD., Plaintiffs-Respondents, v. ACE AMERICAN INSURANCE COMPANY, ALLIANZ GLOBAL RISKS U.S. INSURANCE COMPANY, GENERAL SECURITY INDEMNITY COMPANY OF ARIZONA, HOUSTON CASUALTY COMPANY, LIBERTY MUTUAL FIRE INSURANCE COMPANY, LIBERTY MUTUAL INSURANCE COMPANY, QBE INSURANCE CORPORATION, SYNDICATE NOS. 609, 1200, 1686, 1886, 1919, 1955, 2003, 4444, 4472 and 5555, and CONSORTIUM 9536 AT LLOYD'S, LONDON, WESTPORT INSURANCE CORPORATION, XL INSURANCE AMERICA, INC., ASSICURAZIONI GENERALI S.P.A., HANNOVER RÜCK SE, HELVETIA SCHWEIZERISCHE VERSICHERUNGSGESELLSCHAFT AG, and MÜNCHENER RÜCK VERSICHERUNGSGESELLSCHAFT, Defendants, and ASPEN INSURANCE UK LIMITED, HDI GLOBAL INSURANCE COMPANY, NATIONAL UNION FIRE INSURANCE COMPANY OF PITTSBURGH, P.A., SYNDICATE NO. 1183 AT LLOYD'S LONDON, ZURICH AMERICAN INSURANCE COMPANY, MAPFRE GLOBAL RISKS, COMPAÑIA INTERNACIONAL DE SEGUROS Y REASEGUROS S.A., and VIENNA INSURANCE GROUP AG, Defendants-Appellants.
Philip C. Silverberg argued the cause for appellants Aspen Insurance UK Limited, HDI Global Insurance Company, Syndicate No. 1183 at Lloyd's London, Mapfre Global Risks, Compañía Internacional de Seguros y Reaseguros SA, Vienna Insurance Group AG, and Zurich American Insurance Company (Mound Cotton Wollan & Greengrass LLP, attorneys; Philip C. Silverberg, Bruce Kaliner (Mound Cotton Wollan & Greengrass LLP) of the New York bar, admitted pro hac vice, Hilary M. Henkind (Mound Cotton Wollan & Greengrass LLP) of the New York and Massachusetts bars, admitted pro hac vice, Maegan McAdam, William D. Wilson, and Craig R. Rygiel, on the joint briefs). Mark W. Mosier (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for respondents (Dughi, Hewit & Domalewski PC and Mark W. Mosier, attorneys; Anna P. Engh (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, Mark D. Herman (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, Mark W. Mosier and Russell L. Hewit, on the brief). Laura A. Foggan (Crowell & Moring LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for amicus curiae American Property Casualty Insurance Association (Eckert Seamans Cherin & Mellott, LLC, attorneys; Robert P. Zoller and Michael A. Alberico, on the brief). Sherilyn Pastor argued the cause for amici curiae The New Jersey Hospital Association, The National Association of Manufacturers, The Pharmaceutical Research and Manufacturers of America, The Product Liability Advisory Council, Inc., and The Restaurant Law Center (McCarter & English, LLP, attorneys; Sherilyn Paster, on the brief). Genova Burns LLC, attorneys for amicus curiae New Jersey Association of Counties (Angelo J. Genova, William F. Megna, and Lawrence Bluestone, of counsel and on the brief). Reed Smith LLP, attorneys for amicus curiae United Policyholders (Nicholas M. Insua, on the brief). Lowenstein Sandler LLP, attorneys for amicus curiae Insurance Law Scholars (Lynda A. Bennett, Andrew Reidy (Lowenstein Sandler LLP) of the District of Columbia and Massachusetts bars, admitted pro hac vice, Joseph Saka (Lowenstein Sandler LLP), of the District of Columbia, Maryland and Texas bars, admitted pro hac vice, and Rosemary Loehr (Lowenstein Sandler LLP) of the Colorado bar, admitted pro hac vice, on the brief). Greenberg Dauber Epstein & Tucker, PC, attorneys for amici curiae International Law Scholars, and Former Government Officials, Professor Chimene I. Keitner, Professor Rebecca Crootoff, Professor David Sloss, and Professor Mary Ellen O'Connell (Edward J. Dauber, on the brief).
APPROVED FOR PUBLICATION May 1, 2023
Argued February 8, 2023
On appeal from an interlocutory order of the Superior Court of New Jersey, Law Division, Union County, Docket No. L-2682-18.
James E. Rocap, III (Steptoe & Johnson LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for appellant National Union Fire Insurance Company of Pittsburgh, PA (Walsh Pizzi O'Reilly Falanga LLP, and James E. Rocap, III, attorneys; James L. Brochin, Liza M. Walsh, James E. Rocap, III, Marc D. Haefner, and Selina M. Ellis, on the joint briefs).
Philip C. Silverberg argued the cause for appellants Aspen Insurance UK Limited, HDI Global Insurance Company, Syndicate No. 1183 at Lloyd's London, Mapfre Global Risks, Compañía Internacional de Seguros y Reaseguros SA, Vienna Insurance Group AG, and Zurich American Insurance Company (Mound Cotton Wollan & Greengrass LLP, attorneys; Philip C. Silverberg, Bruce Kaliner (Mound Cotton Wollan & Greengrass LLP) of the New York bar, admitted pro hac vice, Hilary M. Henkind (Mound Cotton Wollan & Greengrass LLP) of the New York and Massachusetts bars, admitted pro hac vice, Maegan McAdam, William D. Wilson, and Craig R. Rygiel, on the joint briefs).
Mark W. Mosier (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for respondents (Dughi, Hewit & Domalewski PC and Mark W. Mosier, attorneys; Anna P. Engh (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, Mark D. Herman (Covington & Burling LLP) of the District of Columbia bar, admitted pro hac vice, Mark W. Mosier and Russell L. Hewit, on the brief).
Laura A. Foggan (Crowell & Moring LLP) of the District of Columbia bar, admitted pro hac vice, argued the cause for amicus curiae American Property Casualty Insurance Association (Eckert Seamans Cherin & Mellott, LLC, attorneys; Robert P. Zoller and Michael A. Alberico, on the brief).
Sherilyn Pastor argued the cause for amici curiae The New Jersey Hospital Association, The National Association of Manufacturers, The Pharmaceutical Research and Manufacturers of America, The Product Liability Advisory Council, Inc., and The Restaurant Law Center (McCarter & English, LLP, attorneys; Sherilyn Paster, on the brief).
Genova Burns LLC, attorneys for amicus curiae New Jersey Association of Counties (Angelo J. Genova, William F. Megna, and Lawrence Bluestone, of counsel and on the brief).
Reed Smith LLP, attorneys for amicus curiae United Policyholders (Nicholas M. Insua, on the brief).
Lowenstein Sandler LLP, attorneys for amicus curiae Insurance Law Scholars (Lynda A. Bennett, Andrew Reidy (Lowenstein Sandler LLP) of the District of Columbia and Massachusetts bars, admitted pro hac vice, Joseph Saka (Lowenstein Sandler LLP), of the District of Columbia, Maryland and Texas bars, admitted pro hac vice, and Rosemary Loehr (Lowenstein Sandler LLP) of the Colorado bar, admitted pro hac vice, on the brief).
Greenberg Dauber Epstein & Tucker, PC, attorneys for amici curiae International Law Scholars, and Former Government Officials, Professor Chimene I. Keitner, Professor Rebecca Crootoff, Professor David Sloss, and Professor Mary Ellen O'Connell (Edward J. Dauber, on the brief).
Before Judges Currier, Mayer and Enright.
OPINION
CURRIER, P.J.A.D.
On leave to appeal, we consider whether plaintiff Merck & Co., Inc.(plaintiff or Merck) is entitled to insurance coverage under the "all risks" property insurance policies issued by defendants after a cyberattack infected and damaged thousands of plaintiff's computers in its global network. Defendants denied coverage under the "Hostile/Warlike Action" exclusion included in all their policies. The trial court granted plaintiffs' summary judgment motions, finding the exclusion did not apply to plaintiffs' claims.
Plaintiff International Indemnity Ltd. is a captive insurance company wholly owned by Merck.
Many of the defendants resolved their claims with plaintiffs during the discovery period and the pendency of the appeal. At the time of oral argument before this court, there were eight remaining defendants/appellants. We refer to appellants as "the Insurers".
In considering the plain language of the exclusion, and the context and history of its application, we conclude the Insurers did not demonstrate the exclusion applied under the circumstances of this case, namely, that this cyberattack was a "hostile" or "warlike" action as contemplated under the exclusion. Therefore, we affirm.
I.
Merck is a multinational pharmaceutical company based in New Jersey. Plaintiffs instituted suit against multiple insurers and reinsurers seeking declaratory judgment that Merck was entitled to coverage under twenty-six "all risk" property policies for losses caused by a June 2017 malware/cyberattack known as NotPetya.
The name NotPetya derived from the distinction of the malware from another ransomware known as "Petya."
From June 1, 2017 to June 1, 2018, Merck's property insurance program included the "all risks" property policies in a three-layer structure, with $1.75 billion in total limits above a $150 million deductible. The eight Insurer's policies insured percentages of coverage in one, two or all three of the layers. In total, the parties dispute $699,475,000 in coverage or just under forty percent of Merck's total coverage for the policy period.
Each of the 2017-2018 policies included two coverage clauses and one exclusion significant to this appeal.
Section 5, entitled "LOSS OR DAMAGE INSURED" states:
This policy insures against all risks of physical loss or damage to property, not otherwise excluded in this policy, while at an Insured Location except as hereinafter excluded.
Physical loss or damage shall include any destruction, distortion or corruption of any computer data, coding, program or software except as excluded specifically in clause 6.M., Electronic Date Recognition Exclusion,and as hereinafter excluded.
Clause 6.M does not apply to Merck's NotPetya claim.
Section 7, entitled "COVERAGE," includes subsection C, entitled "COMPUTER SYSTEMS-NON PHYSICAL DAMAGE." It states:
In addition to the coverage provided herein, this Policy covers the Actual Loss Sustained and Extra Expense incurred by the Insured during the Period of Interruption directly resulting from the failure of the Insured's Electronic Data Processing Equipment or Media to operate, provided such failure is the direct result of a malicious act directed at the NAMED INSURED.
The hostile/warlike action exclusion was also included in each of the 2017-2018 policies, under Section 6, entitled "LOSS OR DAMAGE EXCLUDED." Section 6 excludes damage arising from twenty specific causes or events. Section 6 (A)(1) provides that "[t]his policy does not insure" against:
Loss or damage caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack:
(a) by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval, or air forces;
(b) or by military, naval, or air forces;
(c) or by an agent of such government, power, authority, or forces[.]
A.
On June 27, 2017, a malware known as NotPetya infected Merck's computer and network systems. Prior to that date, someone had gained access to the computer systems of a Ukrainian company that had developed an accounting software called M.E. Doc used by Merck and other companies in Ukraine. The NotPetya malware was delivered into the accounting software.
Merck explained the malware attack in its "IT Compliance Investigation Interim Summary Report":
Merck and other companies doing business in the Ukraine use a trusted third-party application called M.E. Doc for processing and transmission of invoice, tax, and other financial data to the Ukrainian government. Based on third-party analysis, Merck understands that prior to April 14, 2017, threat actors gained access to the M.E. Doc vendor's source code and software update distribution infrastructure for the M.E. Doc system. Using this access, the threat actors built backdoors into M.E. Doc software updates that allowed for the threat actors to access customer systems using M.E. Doc software. Using these backdoors, the threat actors established a command and control infrastructure capable of sending, receiving, and executing code on the networks of companies using M.E. Doc software without detection through anti-virus or other malware detection tools or sensors.
Threat actors directed malicious versions of the M.E. Doc software to existing M.E. Doc customers using the standard M.E. Doc update method. Merck received the malicious updates through its server located in Ukraine, which automatically conducts periodic checks for new versions of the M.E. Doc software for updating purposes. As a result of these compromised updates, prior to June 27, 2017, threat actors could send instructions and retrieve reconnaissance information from companies' infected systems through command-and-control capabilities. Such transmissions were disguised as legitimate, routine checks for M.E. Doc updates.According to the parties' experts,
Once on a system or network, NotPetya would attempt to encrypt certain data on the system, rendering the data inaccessible and preventing most users from recovering their files, and once complete, would leave the infected system in an inoperable state.
After encrypting data on an infected system or network, NotPetya displayed a message offering to provide a decryption key to recover the data in return for payment of a ransom, presenting itself as ransomware.
Victims of NotPetya paid thousands of dollars within hours . . . .
NotPetya's propagation within networks was rapid and extensive and crossed many national borders.
Within ninety seconds of the initial infection, approximately 10,000 machines in Merck's global network were infected by NotPetya; about 20,000 machines were infected within five minutes. Ultimately, over 40,000 machines in Merck's network were infected. Merck contends the malware "caus[ed] production facilities and critical applications to go offline and create[ed] massive disruptions to Merck's operations, including its manufacturing, research and development, and sales operations."
The NotPetya malware spread to at least sixty-four different countries, including Russia. Among the companies infected by NotPetya were "a number of leading Russian companies, including Russia's largest oil producer, Rosneft; one of Russia's top lenders, Home Credit bank; and Evraz, a Russian steel manufacturing and mining company." NotPetya also infected the systems of other multinational companies. While the attack caused property damage, there was no evidence the NotPetya malware caused bodily injury or death.
B.
In July 2017, Merck submitted a notice of loss to the Insurers for the NotPetya damage. The Insurers responded with a reservation of rights letter. In March 2018, the Insurers sent another reservation of rights letter, this time expressly raising the hostile/warlike action exclusion. Defendant National Union did not join in this reservation of rights letter.
Merck filed its complaint on August 2, 2018. On August 20, 2018, most of the Insurers denied coverage for Merck's NotPetya-related claims based on the hostile/warlike action exclusion. The Insurers noted that Kroll Cyber Security (Kroll), their "cyber consultant," had concluded that Merck's systems were infected with NotPetya, which was "introduced into Merck through a server located in its Ukraine office that was running M.E. Doc (a tax software application used by Merck and other companies operating in Ukraine)." Kroll also concluded, "with high confidence, that the NotPetya cyber-attack was very likely orchestrated by actors working for or on behalf of the Russian Federation."
The parties disputed attribution for the cyberattack. The trial court did not need to reach that issue in granting partial summary judgment.
On the same day, National Union sent Merck a reservation of rights letter, stating that "[b]ased on Kroll's findings and the publicly available information on the NotPetya cyber-attack," National Union reserved its rights based on the "WAR AND TERRORISM EXCLUSION" in its policy. It is undisputed that this exclusion is materially identical to the hostile/warlike action exclusions contained in the other Insurers' policies.
II.
Between April and September 2021, following extensive discovery, the parties filed numerous motions and cross-motions for summary judgment or partial summary judgment on a variety of issues, including the applicability of the hostile/warlike action exclusion.
On December 6, 2021, the trial court granted plaintiffs' motion for partial summary judgment, finding the hostile/warlike action exclusion did not apply to exclude coverage for Merck's losses caused by NotPetya. In its written opinion, the court analyzed the applicable contract-interpretation legal principles and case law. The court concluded:
Given the plain meaning of the language in the exclusion, together with the foregoing examination of the applicable caselaw, the court unhesitatingly finds that the exclusion does not apply. As [p]laintiff[s] correctly note[] in [their] brief, no court has applied a war (or hostile acts) exclusion to anything remotely close to the facts herein. The evidence suggests that the language used in these policies has been virtually the same for many years. It is also self-evident, of course, that both parties to this contract are aware that cyber attacks of various forms, sometimes from private sources and sometimes from nation-states[,]
have become more common. Despite this, Insurers did nothing to change the language of the exemption to reasonably put this insured on notice that it intended to exclude cyber attacks. Certainly they had the ability to do so. Having failed to change the policy language, Merck had every right to anticipate that the exclusion applied only to traditional forms of warfare. Given the rules of construction, Merck's position that they did not anticipate that the exclusion would be applied to acts of cyber based attacks reasonably shows that the expectation of the insured was that the exclusion applied only to traditional forms of warfare. Accordingly, the [c]ourt finds that the exclusion is not applicable under the facts presented.
We granted the Insurers leave to appeal. We also granted the following groups and entities leave to appear as amicus curiae: American Property Casualty Insurance Association (American Property); New Jersey Association of Counties; United Policyholders; the New Jersey Hospital Association, the National Association of Manufacturers, the Pharmaceutical Research and Manufacturers of America, the Product Liability Advisory Council, Inc., the Restaurant Law Center (collectively the Amici Companies); Insurance Law Scholars, and individual "law professors and former government lawyers" Chimène I. Keitner, Rebecca Crootof, David L. Sloss, and Mary Ellen O'Connell (collectively, the Individual Lawyers).
III.
On appeal, the Insurers assert the trial court erred in concluding the hostile/warlike exclusion did not apply to the NotPetya cyberattack. Amici American Property, the "primary national trade association for home, auto, and business insurers," agrees with the Insurers' position and contends that damage caused by any unfriendly action of any nature undertaken by a "nation-state" falls under the plain meaning of the hostile/warlike action exclusion.
The other amici urge this court to uphold the trial court's ruling. The New Jersey Association of Counties is "a non-partisan organization that provides a unified and proactive voice for county governments in New Jersey." It contends that accepting the Insurers' interpretation of the hostile/warlike exclusion "would operate to change the settled meaning of war exclusions and . . . also threaten to undo the policy interpretation rules that local governments have historically relied upon" to ensure adequate insurance coverage.
United Policyholders is "a dedicated advocate and information resource for individual and commercial insurance consumers throughout the entire United States." It contends the trial court "correctly interpreted the war exclusion based on its plain language" and "correctly adhered" to "established principles of New Jersey insurance law."
The Amici Companies are "associations composed of companies engaged in various businesses or industries in New Jersey and elsewhere," that "rely significantly upon insurance policies to provide coverage for their various risks and they rely on New Jersey law that protects their insurance rights." The companies urge this court to affirm the trial court's ruling because "the Insurers' proposed interpretation and application of policies' standard-form War Exclusions, if adopted, could have far-reaching, detrimental impact on the many insurance products that policyholders buy to protect themselves from risks in this and other states."
Insurance Law Scholars is "a group of law professors from across the country whose area of academic focus is insurance law," giving them "a special interest and expertise in and substantial exposure to questions involving commercial property insurance policies, war-exclusion clauses, and insurance claims for cyber-related losses." It submits that the trial court's decision should be affirmed because it was "supported by the drafting history of war exclusions" and because the Insurers "failed to use readily available insurance policy provisions that would have excluded or limited the coverage provided for cyber-related events."
The Individual Lawyers are "law professors and former government lawyers with expertise in international law and the laws of war, who have an interest in the proper characterization of various types of malicious cyber activity." They argue that "[t]he terms 'war' and 'hostilities' are terms of art that have long been understood as describing the use of armed force between rival states," that "[t]he U.S. government has been careful not to broaden the legal definitions of these categories, despite the advent of various types of malicious cyber activity," and that interpreting the NotPetya attack as the Insurers urge would be inconsistent with international law.
IV.
We "review a grant of summary judgment de novo, applying the same standard as the trial court." Norman Int'l, Inc. v. Admiral Ins. Co., 251 N.J. 538, 549 (2022) (quoting Woytas v. Greenwood Tree Experts, Inc., 237 N.J. 501, 511 (2019)). Thus, we consider "whether the competent evidential materials presented, when viewed in the light most favorable to the non-moving party in consideration of the applicable evidentiary standard, are sufficient to permit a rational factfinder to resolve the alleged disputed issue in favor of the non-moving party." Brill v. Guardian Life Ins. Co. of Am., 142 N.J. 520, 523 (1995).
Summary judgment must be granted "if the pleadings, depositions, answers to interrogatories and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact challenged and that the moving party is entitled to a judgment or order as a matter of law." R. 4:46-2(c). "If there is no genuine issue of material fact, we must then 'decide whether the trial court correctly interpreted the law.'" DepoLink Ct. Reporting & Litig. Support Servs. v. Rochman, 430 N.J.Super. 325, 333 (App. Div. 2013) (citations omitted).
A.
"A court's interpretation of an insurance contract is a determination of law." Cypress Point Condo. Ass'n, Inc. v. Adria Towers, L.L.C., 441 N.J.Super. 369, 375 (App. Div. 2015), aff'd, 226 N.J. 403 (2016). "We afford no special deference to a trial court's interpretation of the law and the legal consequences that flow from the established facts." Ibid. (citing Manalapan Realty, L.P. v. Twp. Comm. of Manalapan, 140 N.J. 366, 378 (1995)).
We begin our review by applying well-established contract interpretation principles. "Insurance policies are reviewed using contract principles," and "will be enforced as written when [their] terms are clear in order that the expectations of the parties will be fulfilled." Norman Int'l, 251 N.J. at 552 (quoting Mem'l Props., LLC v. Zurich Am. Ins. Co., 210 N.J. 512, 525 (2012)). Policies must be construed "as a whole and effect given to every part thereof." Herbert L. Farkas Co. v. N.Y. Fire Ins. Co., 5 N.J. 604, 610 (1950). Terms in an insurance policy "are given their 'plain and ordinary meaning.'" Norman Int'l, 251 N.J. at 552 (quoting Mem'l Props., 210 N.J. at 525).
Generally, the insured must establish whether a particular claim falls within the basic terms of the policy. IMO Indus. Inc. v. Transamerica Corp., 437 N.J.Super. 577, 624 (App. Div. 2014). Once it is shown that a claim falls within a policy's scope of coverage, the insurer bears the burden of establishing that an exclusionary provision of the policy applies. Norman Int'l, 251 N.J. at 552; see United Rental Equip. Co. v. Aetna Life & Cas. Ins. Co., 74 N.J. 92, 99 (1977) ("When an insurance carrier puts in issue its coverage of a loss under a contract of insurance by relying on an exclusionary clause, it bears a substantial burden of demonstrating that the loss falls outside the scope of coverage.").
Insurance policy exclusions must be construed narrowly. Princeton Ins. Co. v. Chunmuang, 151 N.J. 80, 95 (1997). Accord Ariston Airline & Catering Supply Co. Inc. v. Forbes, 211 N.J.Super. 472, 478 (Law Div. 1986) (quoting Pan Am. World Airways, Inc. v. Aetna Cas. & Surety Co., 505 F.2d 989, 1000 (2d Cir. 1974)) (noting that "[t]he experienced all risk insurers should have expected the exclusions drafted by them to be construed narrowly against them and should have calculated their premiums accordingly").
"On the other hand, 'clauses that extend coverage are to be viewed broadly and liberally.'" Villa v. Short, 195 N.J. 15, 24 (2008) (quoting Gibson v. Callaghan, 158 N.J. 662, 671 (1999)). In short, "[p]rinciples of insurance contract interpretation 'mandate [a] broad reading of coverage provisions, [a] narrow reading of exclusionary provisions, [the] resolution of ambiguities in the insured's favor, and [a] construction consistent with the insured's reasonable expectations.'" Hampton Med. Grp., P.A. v. Princeton Ins. Co., 366 N.J.Super. 165, 172 (App. Div. 2004) (latter four alterations in original) (quoting Search EDP, Inc. v. Am. Home Assurance Co., 267 N.J.Super. 537, 542 (App. Div. 1993)). "If there is any doubt, uncertainty or ambiguity in the phraseology of a policy, or if the phraseology is susceptible to two meanings, the construction favoring coverage must be adopted." Ibid. (quoting Aetna Ins. Co. v. Weiss, 174 N.J.Super. 292, 296 (App. Div. 1980)).
"Exclusionary clauses are presumed valid if they are 'specific, plain, clear, prominent and not contrary to public policy.'" Mem'l Props., 210 N.J. at 528 (quoting Chunmuang, 151 N.J. at 95). "If the terms used in an exclusionary clause are ambiguous, 'courts apply the meaning that supports coverage rather than the one that limits it.'" Ibid. (quoting Flomerfelt v. Cardiello, 202 N.J. 432, 442 (2010)).
Where, however, the terms of an exclusion are clear and unambiguous, "a court should not engage in a strained construction to support the imposition of liability." Ibid. (quoting Flomerfelt, 202 N.J. at 442); see also Walker Rogge, Inc. v. Chelsea Title & Guar. Co., 116 N.J. 517, 529 (1989) (noting that "courts should not write for the insured a better policy of insurance than the one purchased"). As our Supreme Court has explained:
[C]ourts must be careful not to disregard the "clear import and intent" of a policy's exclusion, and we do not suggest that "any far-fetched interpretation of a policy exclusion will be sufficient to create an ambiguity requiring coverage." Rather, courts must evaluate whether, utilizing a "fair interpretation" of the language, it is ambiguous.
[Flomerfelt, 202 N.J. at 442 (citations omitted).]
B.
Against this backdrop we turn to the policy and exclusion at issue. As stated, at the time of NotPetya, Merck was insured under twenty-six "all risks" property insurance policies. We have stated that an all risk insurance policy "creates a 'special type of insurance extending to risks not usually contemplated, and recovery under the policy will generally be allowed . . ., in the absence of fraud or other intentional misconduct of the insured, unless the policy contains a specific provision expressly excluding the loss from coverage.'" Victory Peach Grp., Inc. v. Greater N.Y. Mut. Ins. Co., 310 N.J.Super. 82, 87 (App. Div. 1998) (quoting 43 Am. Jur. 2d Insurance § 505 (1982)).
Merck's claim for coverage for damages incurred as a result of NotPetya was covered under Sections 5 and 7 of the Insurers' policies unless excluded under a specific provision. The Insurers invoked the hostile/warlike action clause as that exclusion.
The Insurers assert summary judgment should have been granted in their favor because the exclusion "is clear and unambiguous, and it plainly applies to the NotPetya attack." Although they concede the word "warlike" might not be applicable, they assert the word "hostile" should be read in the broadest possible sense, as meaning "adverse," "showing ill will or a desire to harm," "antagonistic," or "unfriendly." According to the Insurers, any action that "reflects ill will or a desire to harm by the actor" falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power, in this case the Russian Federation.
However, the plain language of the exclusion does not support the Insurers' interpretation. The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will.
V.
Although there is no precedent considering the hostile/warlike action exclusion, our Supreme Court has consistently required the need for plain language pertinent to the situation to permit the enforcement of an exclusion.
For example, in Mem'l Props., the allegations against the insureds, the owner and manager of a cemetery and crematory, were that the remains of certain bodies in their care had been unlawfully dissected and that tissue, bone, and organs had been illegally harvested and sold. 210 N.J. at 516-17. The Court addressed the question of whether an "'improper handling' exclusionary clause, barring coverage for bodily injury or property damage arising from specified acts and omissions including '[f]ailure to bury, cremate or properly dispose of a deceased body'" applied to preclude coverage for the claims. Id. at 517. The Court held that "[t]he conduct of which [the insureds] [we]re accused-participation in a common undertaking to dissect and remove body parts from the decedents without legal authorization-falls squarely within the parameters of the clause." Id. at 528. Because none of the asserted causes of action were "independent of the illegal harvesting allegations," the exclusion at issue "plainly encompasse[d] all of the claims asserted" against the insureds. Id. at 528-29.
Similarly, in United Rental, the Court noted that the insurance policies at issue excluded "those losses occasioned by the lifting of any load which exceeded the registered lifting or supporting capacity of any machine otherwise within the scope of coverage." 74 N.J. at 95. The Court noted that proving the applicability of the exclusion was a "demanding standard," but the insurer "succeed[ed] in clearly showing that the loss fell within the terms of the exclusionary clause" with unrebutted proof and an admission by the insured that the accident injuring the plaintiff was caused by a crane in an overloaded condition. Id. at 100; see also Norman Int'l, 251 N.J. at 546, 555-56 (broad and unambiguous language excluding any claim "in any way connected with" insured's "operations" or "activities" in designated counties in New York applied to claim for injury to Home Depot worker using blind-cutting machine supplied and maintained by insured); Villa, 195 N.J. at 26 (holding that the phrase "an insured" was not ambiguous and included all persons who could make a claim under the policy and noting courts "will not search for ambiguities where there are none"); Am. Motorists Ins. Co. v. L-C-A Sales Co., 155 N.J. 29, 41-42 (1998) (exclusion for claims "arising out of and in the course of employment" clearly and unambiguously precluded coverage for wrongful discharge claim, which "unquestionably arose out of and in the course of [the plaintiff's] employment, as did the essential factual allegations on which the cause of action was predicated"); Abboud v. Nat'l Union Fire Ins. Co. of Pittsburgh, Pa., 450 N.J.Super. 400, 407-08 (App. Div. 2017) (finding no ambiguity in "insured vs. insured" exclusion in a directors and officers liability policy that expressly disallowed coverage for claims raised by either an executive of the company or the company itself).
In each of these cases, the scope of the exclusion was clear and specific, and the conclusion that the circumstances at issue fell within that scope was evident. None of the cases held that words in an exclusion should be interpreted using the broadest dictionary definition available, as the Insurers contend.
Coverage could only be excluded here if we stretched the meaning of "hostile" to its outer limit in an attempt to apply it to a cyberattack on a non-combatant firm that provided accounting software updates to various non-combatant customers, all wholly outside the context of any armed conflict or military objective. But that approach would conflict with our basic construction principles requiring a court to narrowly construe an insurance policy exclusion. The specific, plain, clear, and prominent meaning of, and the clear import and intent of, a word or phrase in an exclusion does not equate to its broadest possible interpretation, but rather its narrowest. See Chunmuang, 151 N.J. at 95; Flomerfelt, 202 N.J. at 442; Mem'l Props., 210 N.J. at 528.
We agree with the trial court that the plain language of the exclusion did not include a cyberattack on a non-military company that provided accounting software for commercial purposes to non-military consumers, regardless of whether the attack was instigated by a private actor or a "government or sovereign power."
We have addressed the exclusion in terms of the presented circumstances before us. And we have found the Insurers have not satisfied their burden to show it could be fairly applied to the NotPetya cyberattack. That is the scope of our review. Therefore, we decline the Insurers' request to delineate the exact scope of what cyberattacks might be encompassed under the hostile/warlike exclusion.
VI.
A.
We also consider the history of the war exclusion. Here, all of the experts agreed that insurance policies have included standard-form coverage exclusions known as "war exclusions" for centuries. Merck's expert stated that "[a]s early as the eighteenth century, the war exclusion was introduced by insurers in the London-based Lloyd's market to exclude 'war risks' from marine coverage policies in response to increasing war-related risks in the shipping trade." Similar language was used in "war exclusions" appearing in policies issued in both the United States and the United Kingdom. The experts concurred that the phrase "hostile or warlike action," or similar variants, have appeared in war exclusions since the 1950s. The Insurers' representatives agreed that property policies always contain an exclusion similar to the hostile/warlike action exclusion.
B.
As we have stated, there is no precedent interpreting the exact language at issue here and no cases that involve a cyberattack. However, the few cases cited by the parties reinforce our conclusion that similar exclusions have never been applied outside the context of a clear war or concerted military action and they do not support the Insurers' arguments.
In Diamond Shamrock Chems. Co. v. Aetna Cas. & Sur. Co., 258 N.J.Super. 167, 179, 197 (App. Div. 1992), we considered the scope of coverage and whether liability policies issued to Diamond Shamrock, one of the manufacturers of the herbicide Agent Orange, covered liability for pollution discharges in the United States caused by Diamond Shamrock's deliberate conduct. We also addressed whether a war risk exclusion barred coverage for monies Diamond Shamrock had paid as part of the settlement of a class action brought by Vietnam veterans who were exposed to Agent Orange while stationed in Vietnam. Id. at 179-80.
We explained:
The purpose of a war risk exclusion is to eliminate an insurer's liability in circumstances in which it is impossible to evaluate the risks. The clause effectuates this purpose by excluding coverage for claims occasioned by the special hazards of war. Military service in a war theater "is fraught with incalculable dangers." It is difficult to assess the scope of the risks assumed by members of the armed forces in view of modern methods of warfare, keeping in mind the potential devastation that attends the battlefield. The risk inherent in military service waging war is not contemplated in the premiums, which are based upon civilian accident and mortality experience. It is difficult to devise an actuarial guide for properly determining the amount of premiums. Moreover, the perils of war are so great that insurers are often reluctant to undertake such insurance risks. An insurance company clearly has the right to limit its liability for risks associated with war hazards.
[Id. at 231 (citations omitted).]
The operative language of the war risk exclusion at issue in Diamond Shamrock stated:
[This contract shall not apply] except in respect of occurrences taking place in the United States of America . . . to any liability of the Assured directly or indirectly occasioned by, happening through or in consequence of war, invasion, acts of foreign enemies, hostilities (whether war be declared or not), civil war, rebellion, revolution, insurrection, military or usurped power or confiscation or nationalization or requisition
or destruction of or damage to property by or under the order of any government or public or local authority.[Id. at 226 (alteration in original).]
We observed that the parties agreed "the principal purpose of Agent Orange, indeed, its only foreseeable use, was to wage war in Vietnam." Id. at 233. "Agent Orange was an instrument of war which was effectively used in Vietnam." Ibid. We found the exclusion applied because the "occurrence" of injury to the veterans happened outside of the United States, and the "liability of the assured [was] directly or indirectly occasioned by, happen[ed] through or [was] in consequence of war." Id. at 226-27, 241-42 (last two alterations in original).
The Insurers assert that Diamond Shamrock supports its position because we "concluded that the exclusion applied to preclude coverage for injuries sustained as a result of exposure to herbicides, though that form of warfare was not specifically identified in the exclusion." We disagree with the Insurers' contentions. Diamond Shamrock did not consider "forms" of warfare or suggest that herbicides used outside of a purely military context could fall within the scope of the exclusion. To the contrary, we simply applied the admittedly broad language of the exclusion as plainly written-to exclude coverage for injuries to military personnel who were actively engaged in a war by a chemical whose sole purpose was to assist in the waging of that war. Nothing in Diamond Shamrock suggests that a non-military-related injury caused by a non-military agent to non-military personnel would fall within the scope of the exclusion.
In Stanbery v. Aetna Life Ins. Co., 26 N.J.Super. 498, 500 (Law Div. 1953), the insurance policy at issue provided double indemnity for accidental death with certain exceptions, including death "from military or naval service in time of war." The plaintiff's decedent was killed by a mine explosion while serving in the United States Army in Korea. Id. at 501.
The plaintiff argued that the exclusion did not apply because "the conflict in which the United States has been and still is engaged in Korea is not a war but merely 'a police action'" and only Congress has the power to declare war. Id. at 502-03. The plaintiff relied on a Pennsylvania case, Beley v. Pa. Mut. Life Ins. Co., 95 A.2d 202, 204 (Pa. 1953), which had permitted recovery of double indemnity benefit for a soldier killed in Korea, reasoning that the conflict was not war in "the constitutional or legal sense of that word." Id. at 503.
The Stanbery court determined the Beley decision was "a legalistic, technical construction of the word 'war,'" while New Jersey courts had "given the word a realistic interpretation when used in private contracts or documents." Ibid. After examining various definitions of war as encompassing an armed conflict between nations or states, the court reasoned:
The word "war" when used in a private contract or document should not be construed on a public or political basis, in a legalistic or technical sense, but should be given its ordinary, usual and realistic meaning, viz., actual hostilities between the armed forces of two or more nations or states de facto or de jure.
[Id. at 505 (first citing Schaffer v. Oldak, 12 N.J.Super. 80, 84 (Ch. Div. 1951); and then citing O'Neill v. Cent. Leather Co., 87 N.J.L. 552, 553-55 (1915)).]
The court reasoned that the conflict in Korea was "a war in the ordinary and usual meaning of the word," and "[t]o hold otherwise and rule the Korean war is not a war seems . . . inexplainable and absurd." Ibid.; accord Miele v. McGuire, 53 N.J.Super. 506, 514 (Law Div. 1959), modified on other grounds, 31 N.J. 339 (1960) (holding that Korean conflict was a "war" of the United States within meaning of two veterans' tenure acts, and honorably discharged veteran of United States Army, who served in the Korean conflict, was entitled to protection of those acts); see also, e.g., Langlas v. Iowa Life Ins. Co., 63 N.W.2d 885, 888 (Iowa 1954) (holding Korean conflict was a "war" within exclusionary provision of policy); Lynch v. Nat'l Life & Accident Ins. Co., 278 S.W.2d 32, 38 (Mo.Ct.App. 1955) (same); Gagliormella v. Metro. Life Ins. Co., 122 F.Supp. 246, 247-48, 250 (D. Mass. 1954) (recognizing contrary results in some cases but holding that a marine killed in action in Korea was killed as the result of an act of "war" within the meaning of provisions of policies excusing insurer from liability for additional death benefits).
In Int'l Dairy Eng'g Co. of Asia v. Am. Home Assurance Co., 352 F.Supp. 827, 828 (N.D. Cal. 1970), aff'd, 474 F.2d 1242 (9th Cir. 1973), the insured operated a milk processing plant about five miles east of Saigon, Vietnam. It sought coverage for damage to its property "destroyed by a fire caused by the landing of an aerial parachute flare dropped by an unidentified airplane." Ibid. The exclusion at issue provided in pertinent part:
Notwithstanding anything contained to the contrary, this insurance is . . . warranted free from the consequences of hostilities or warlike operations (whether there be a declaration of war or not), but this warranty shall not exclude . . . fire . . . unless caused directly . . . by a hostile act by or against a belligerent power.
[Ibid. (alterations in original).]
The court held the exclusion applied because the flare that started the fire "was obviously dropped in connection with military operations." Id. at 831. It found "the flares in question were dropped . . . either in connection with a combat operation against enemy forces or in connection with operations to detect and to discourage or destroy infiltrators and that in either case these flares, still burning, drifted over [the] plaintiff's processing plant and started the fire." Id. at 829.
The court further noted:
The term "hostilities" and "hostile act," as used in this standard exclusion clause has been defined as actual operations of war, either offensive, defensive or protective by a belligerent.
It has also been held that the hostile act need not involve the overt use of a weapon which is in itself, capable of inflicting harm; it can be an operation such as the extinguishment of a navigational light or the outfitting of a ship-if done for a hostile purpose.
Although flares are not themselves weapons designed to destroy or harm, all of the purposes for which flares were being used in Viet[n]am (with the possible exception of use merely to illuminate an air strip whose runway lights malfunctioned) would be "hostile acts" by a belligerent in the sense that all those purposes involved use of flares in conjunction with weapons capable of firepower and to expose enemy forces to that firepower.
[Ibid.]
Pan Am. World Airways, 505 F.2d at 997-98, concerned insurance coverage for the destruction of an aircraft that was hijacked by two armed men to Beirut, Lebanon and then destroyed in an explosion after the passengers and crew were allowed to disembark. The Second Circuit affirmed the district court's holding that "the all risk insurers failed to meet their burden of proving that the cause of the loss was fairly within the intended scope of any of the exclusions," including a war risk exclusion. Id. at 998. The court noted:
English and American cases dealing with the insurance meaning of "war" have defined it in accordance with the ancient international law definition: war refers to and includes only hostilities carried on by entities that constitute governments at least de facto in character. For example, in Britain S.S. Co. v. The King, [(]1921[)], 1 AC 99 (HL), an action on dovetailing marine and war risk policies, Lord Atkinson stated that "hostilities," a term certainly of no narrower scope than "war," "connotes the idea of belligerents, properly so called, enemy nations at war with one another." Id. at 114. In Vanderbilt v. Travelers' Ins. Co., 184 N.Y.S. 54 (N.Y. Sup. Ct. 1920), aff'd, 194 N.Y.S. 986 (App. Div. 1922), aff'd, 235 N.Y. 514, (1923), the deceased lost his life when the Lusitania was sunk by a German submarine. His life was insured by a policy that excluded death due to "war." Notwithstanding the beneficiaries' protestations that the deceased was not a combatant, the New York courts held that the death was due to war, finding that the Lusitania was sunk in accordance with the instructions of a sovereign government, Germany, by naval forces of that government, during a period when a war was in progress between Great Britain and Germany.[Id. at 1012-13.]
Noting that the insured aircraft "carried no cargo of military stores" and "no cargo destined for a theater of war," and that "[i]ts owner was not the national of any Middle Eastern belligerent," the court held there was "no basis whatsoever for any claim that the insured Pan American was involved in a warlike operation." Id. at 1017; see also Universal Cable Prods., LLC v. Atl. Specialty Ins. Co., 929 F.3d 1143, 1146-47, 1160 (9th Cir. 2019) (holding that exclusions for "war" or "warlike action" did not apply to damages incurred by insured due to Hamas firing rockets from Gaza into Israel because Hamas was not acting as a de jure or de facto sovereign at the relevant time); Holiday Inns, Inc. v. Aetna Ins. Co., 571 F.Supp. 1460, 1463, 1503 (S.D.N.Y. 1983) (declining to apply exclusion for "[w]ar, invasion, act of foreign enemy, hostilities or warlike operations (whether war be declared or not), civil war, mutiny, insurrection, revolution, conspiracy, military or usurped power," where damages to insured's Beirut hotel were caused by "a series of factional 'civil commotions,' of increasing violence" rather than a war between sovereign or quasi-sovereign states).
In Queen Ins. Co. of Am. v. Globe & Rutgers Fire Ins. Co., 282 F. 976, 978-80 (2d Cir. 1922), the court considered coverage for cargo loss that occurred when two ships, traveling as part of a convoy for safety during a time of war, collided. The collision was caused by faulty navigation. Id. at 980.
The court did not specifically address a war risk exclusion, but it conducted a similar analysis in determining whether the insured's loss was covered by its marine policy or its war risk policy. See id. at 978-82. The court explained:
In order to impose liability under the war risk clause policy, "all forms of hostilities or warlike operations of whatever kind" must consist of some form or kind of hostility or warlike operations which have proximately caused the loss. Remote consequences of hostilities cannot become a recoverable loss, even if they may be said to be proximately caused by something itself ascribable as a consequence of hostilities. [Britan S.S. Co.] v. The King, [(]1921[)], 1 AC 99, 107, 131 (HL).[Id. at 978.]
The court further noted:
The purposes of the adventures of the ships were peaceable. Neither vessel was doing a warlike act, and those who issued the order to the navigators of the vessels did not consider their orders to be warlike, even though performed in a war period. In a word, nothing of actual hostilities was present at the time of the collision.
[Id. at 980.]
Accordingly, the court held that the loss did not fall within the insured's war risk policy. Ibid.
The reason the ships were traveling in a convoy was due to the presence of war. But because the shipping was wholly commercial and the collision was directly caused by faulty navigation, the court did not find the "but for" link to the war sufficient to incur coverage under the war risk policy. Similarly, here, the NotPetya attack is not sufficiently linked to a military action or objective as it was a non-military cyberattack against an accounting software provider.
Contrary to the Insurers' contentions, these cases demonstrate a long and common understanding that terms similar to "hostile or warlike action" by a sovereign power are intended to relate to actions clearly connected to war or, at least, to a military action or objective. Therefore, in addition to the plain language interpretation of the exclusion requiring the inapplicability of the exclusion, the context and history of this and similarly worded exclusions and the manner in which similar exclusions have been interpreted by courts all compel the conclusion that the exclusion was inapplicable to bar coverage for Merck's losses.
Affirmed.