Opinion
Supreme Court Case No. 20S-PL-617
03-18-2021
G&G OIL CO. OF INDIANA, INC., Plaintiff/Appellant, v. CONTINENTAL WESTERN INSURANCE CO., Defendant/Appellee.
ATTORNEYS FOR APPELLANT: George M. Plews, John M. Ketcham, Josh S. Tatum, Christopher J. Braun, Plews Shadley Racher & Braun LLP, Indianapolis, Indiana ATTORNEYS FOR APPELLEE: Patrick P. Devine, Jennifer Kalas, Hinshaw & Culbertson LLP, Schererville, Indiana, Adam P. Joffe, Dana A. Rice, Traub, Lieberman, Straus & Shrewsberry LLP, Chicago, Illinois ATTORNEY FOR AMICUS CURIAE INDIANA FOOD & FUEL ASSOCIATION, INC.: Thomas F. O'Gara, Indianapolis, Indiana ATTORNEY FOR AMICUS CURIAE UNITED POLICY HOLDERS: Andrew J. Detherage, Barnes & Thornburg LLP, Indianapolis, Indiana
ATTORNEYS FOR APPELLANT: George M. Plews, John M. Ketcham, Josh S. Tatum, Christopher J. Braun, Plews Shadley Racher & Braun LLP, Indianapolis, Indiana
ATTORNEYS FOR APPELLEE: Patrick P. Devine, Jennifer Kalas, Hinshaw & Culbertson LLP, Schererville, Indiana, Adam P. Joffe, Dana A. Rice, Traub, Lieberman, Straus & Shrewsberry LLP, Chicago, Illinois
ATTORNEY FOR AMICUS CURIAE INDIANA FOOD & FUEL ASSOCIATION, INC.: Thomas F. O'Gara, Indianapolis, Indiana
ATTORNEY FOR AMICUS CURIAE UNITED POLICY HOLDERS: Andrew J. Detherage, Barnes & Thornburg LLP, Indianapolis, Indiana
On Petition to Transfer from the Indiana Court of Appeals, No. 19A-PL-1498
David, Justice. In this dispute, G&G Oil Company of Indiana ("G&G Oil") purchased an insurance policy ("Policy") from Continental Western Insurance Company ("Continental"). One provision of the Policy's Commercial Crime Coverage Part—the "Computer Fraud" provision—covered loss "resulting directly from the use of any computer to fraudulently cause a transfer of money." Thereafter, G&G Oil suffered losses from a ransomware attack and filed a claim with Continental. Continental denied the claim, the trial court granted summary judgment in favor of Continental, and the Court of Appeals affirmed.
Our Court is now asked to determine whether the ransomware attack "fraudulently caused a transfer of money" and whether the loss "resulted directly from the use of a computer." Although we find that G&G Oil's losses resulted directly from the use of a computer, we find neither party has demonstrated it is entitled to summary judgment. We therefore reverse the trial court's grant of summary judgment in favor of Continental, affirm its denial of G&G Oil's motion for summary judgment, and remand this matter for further proceedings.
Facts and Procedural History
G&G Oil purchased commercial insurance from Continental for the period of June 1, 2017 to June 1, 2018. The Policy contained numerous coverages including "Commercial Crime Coverage." App. Vol. 3 at 66. Relevant to the present dispute, the Commercial Crime Coverage section of the Policy provided:
... Computer Fraud
We will pay for loss or damage to "money", "securities" and "other property" resulting directly from the use of any computer to fraudulently cause a transfer of that property from inside the "premises" or "banking premises":
a. To a person (other than a "messenger") outside those "premises"; or
b. To a place outside those "premises".
Id. at 67.
On November 17, 2017, G&G Oil discovered it was locked out of its computer systems. The company's hard drives were encrypted, and one screen prompted: "To decrypt contact [email user]. Enter password." App. Vol. 2 at 7. G&G Oil learned that its operations had been halted by a ransomware attack—a "malicious computer code that renders the victim's computer useless by blocking access to the programs and data." Id. at 7 n.1. In order to decrypt the contents of its own hard drives, G&G Oil believed it would have to contact the person or entity responsible for the attack to regain access.
After consulting the Federal Bureau of Investigation and other experts, G&G Oil initiated contact with the hackers to negotiate the release of its servers. G&G Oil ultimately paid the requested ransom with four bitcoins valued at nearly $35,000. Thereafter, G&G Oil regained access to its computer systems. G&G Oil submitted a claim for coverage of its losses under its Policy with Continental. Continental denied the claim, concluding computer hacking was "specifically excluded" from the Policy because G&G Oil declined computer hacking and computer virus coverage in an "Agribusiness Property and Income Coverages" section of the Policy. App. Vol. 3 at 161. Further, Continental denied the claim because it believed the Bitcoin was voluntarily transferred by G&G Oil to the computer hacker and therefore, the hacker did not "transfer funds directly" from G&G Oil. Id. G&G Oil then filed the present complaint seeking judicial enforcement of the Policy's Commercial Crime provision.
G&G Oil filed a motion—and Continental a cross-motion—for summary judgment. The trial court first found that G&G Oil's loss was not "fraudulently caused" but was instead the result of theft. Id. at 10. Second, the trial court determined that G&G Oil's payment to the hacker did not qualify as a loss "resulting directly from the use of a computer" under the Policy and instead "was a voluntary payment to accomplish a necessary result." Id. Accordingly, the trial court granted summary judgment in favor of Continental.
In a unanimous opinion, the Court of Appeals affirmed. G&G Oil Co. of Indiana v. Continental Western Ins. Co. , 145 N.E.3d 842 (Ind. Ct. App. 2020), reh'g denied. The court determined that "the hijacker did not use a computer to fraudulently cause G&G to purchase Bitcoin to pay as ransom" and that "[t]he hijacker did not pervert the truth or engage in deception in order to induce G&G to purchase the Bitcoin." Id. at 847. Because it determined summary judgment in favor of Continental on this issue was dispositive, the Court of Appeals did not reach the issue of whether G&G Oil's losses resulted directly from the use of a computer. Id. at 847 n.3.
G&G Oil petitioned for transfer, which we granted, thereby vacating the Court of Appeals opinion. Ind. Appellate Rule 58(A). The Indiana Food & Fuel Association, Inc. and United Policyholders have each filed a brief of amicus curiae in support of G&G Oil's petition to transfer.
Standard of Review
We review summary judgment de novo, applying the same standard as the trial court. Erie Indemnity Co. v. Estate of Harris , 99 N.E.3d 625, 629 (Ind. 2018) (citing SCI Propane, LLC v. Frederick , 39 N.E.3d 675, 677 (Ind. 2015) ). Summary judgment is appropriate "if the designated evidentiary matter shows that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Ind. Trial Rule 56(C). "Parties filing cross-motions for summary judgment neither alters this standard nor changes our analysis—‘we consider each motion separately to determine whether the moving party is entitled to judgment as a matter of law.’ " Erie Indemnity Co. , 99 N.E.3d at 629 (quoting SCI Propane, LLC , 39 N.E.3d at 677 ). "[W]e resolve all questions and view all evidence in the light most favorable to the non-moving party ... so as not to improperly deny him his day in court." Alldredge v. Good Samaritan Home, Inc. , 9 N.E.3d 1257, 1259 (Ind. 2014) (citations omitted).
Insurance contracts "are governed by the same rules of construction as other contracts." Justice v. American Family Mut. Ins. Co. , 4 N.E.3d 1171, 1175 (Ind. 2014) (quoting Colonial Penn Ins. Co. v. Guzorek , 690 N.E.2d 664, 667 (Ind. 1997) ). Interpretation of an insurance contract is a question of law, which we address de novo. Id. (citation omitted). Discussion and Decision
G&G Oil raises the same issues on transfer as it has below: Whether the ransomware attack constitutes "fraudulent" conduct under the terms of the Continental Policy and whether its loss "result[ed] directly from the use of a computer." G&G Oil answers both questions in the affirmative while Continental argues the trial court and Court of Appeals properly applied principles of insurance contract interpretation to affirm its own decision to deny coverage.
Each of these questions involves interpretation of the Policy's terms. We have long recognized, "[a]n insurance policy is a contract like any other ... but we do apply some specialized rules of construction in recognition of the frequently unequal bargaining power between insurance companies and insureds." Justice , 4 N.E.3d at 1176 (citations omitted). One such rule is that courts construe ambiguous terms against the policy drafter and in favor of the insured. Id. (citing Am. States Ind. Co. v. Kiger , 662 N.E.2d 945, 947 (Ind. 1996) ); see also Eli Lilly and Co. v. Home Ins. Co. , 482 N.E.2d 467, 470 (Ind. 1985) (observing "[a]n ambiguous insurance policy should be construed to further the policy's basic purpose of indemnity").
We recognize, however, a term is not ambiguous by the mere fact that the parties differ as to its meaning. Haag v. Castro , 959 N.E.2d 819, 821-22 (Ind. 2012). Nor is a term necessarily ambiguous if a particular policy does not define the term. Id. Indeed, we have cautioned that "parties to an insurance contract may not invite judicial construction by creating ambiguity. They may not make a term ambiguous by simply offering different policy interpretations." Erie Indemnity Co. , 99 N.E.3d at 630.
We proceed then with the understanding that "insurance policy provisions are ambiguous only if they are ‘susceptible to more than one reasonable interpretation.’ " Id. (quoting Holiday Hosp. Franchising, Inc. v. AMCO Ins. Co. , 983 N.E.2d 574, 578 (Ind. 2013) ) (emphasis in original). Whether two or more reasonable interpretations for a term exist is viewed "from the perspective of ... ordinary policyholder[s] of average intelligence." Id. (quoting Allgood v. Meridian Sec. Ins. Co. , 836 N.E.2d 243, 246-47 (Ind. 2005) ). "If reasonably intelligent policyholders would honestly disagree on the policy language's meaning," the term is ambiguous and subject to judicial construction. Id. (citation omitted). "Conversely, if reasonably intelligent policyholders could not legitimately disagree as to what the policy language means, we deem the term unambiguous and apply its plain ordinary meaning." Id.
With these rules of construction in mind, we now analyze each of the disputed Policy terms.
I. The Policy phrase "fraudulently cause a transfer" is unambiguous, but neither party is entitled to summary judgment.
As a preliminary matter, we recognize Continental's argument that G&G Oil specifically declined computer virus and hacking coverage under the Agricultural Output Coverage Part of the Policy. Like the Court of Appeals below, however, we do not believe G&G Oil's declination of computer virus and hacking elsewhere in the Policy is dispositive of this claim. See G&G Oil Co. , 145 N.E.3d at 846 n.2. While one might venture to guess coverage would have been provided under those provisions, the structure of the present Policy leads us to believe each part should be read individually unless otherwise specified. Therefore, we concern ourselves only with whether coverage is provided under the Commercial Crime Coverage provisions of the Policy.
We now direct our attention to the term "fraudulently cause a transfer." G&G Oil argues that the trial court and Court of Appeals offered either too narrow an interpretation or that two or more reasonable interpretations of "fraudulent" exist such that the term is ambiguous as a matter of law. While no doubt many insurance policy terms could be ambiguous if one were to squint hard enough, our task here is to assess whether the term "fraudulently cause a transfer" under this policy is subject to more than one reasonable interpretation viewed from the standpoint of a reasonably intelligent policy holder. See Erie Indemnity Co. , 99 N.E.3d at 630. Analyzing multiple sources including dictionary definitions and recent federal cases, we find that the term is unambiguous and its straightforward definition was construed too narrowly by the courts below.
Our Court has defined actual fraud as a "(i) material misrepresentation of past or existing facts by the party to be charged (ii) which was false (iii) which was made with knowledge or reckless ignorance of the falseness (iv) was relied upon by the complaining party and (v) proximately caused the complaining party injury." Rice v. Strunk , 670 N.E.2d 1280, 1289 (Ind. 1996). Various dictionaries offer similar definitions. One defines "fraud" as "[a] knowing misrepresentation or knowing concealment of a material fact made to induce another to act to his or her detriment" and alternatively as "[a] reckless misrepresentation made without justified belief in its truth to induce another person to act" or "[u]nconscionable dealing." BLACK'S LAW DICTIONARY (11th ed. 2019). An additional authority defines fraud as "intentional perversion of truth in order to induce another to part with something of value or to surrender a legal right" or as "an act of deceiving or misrepresenting: TRICK." MERRIAM-WEBSTER.COM DICTIONARY (Jan. 25, 2021), [https://perma.cc/X2H6-SAF6].
Several recent federal decisions echo these definitions. Albeit in the context of bankruptcy, the Seventh Circuit has held that fraud is not limited to misrepresentations and misleading omissions, but rather:
Fraud is a generic term, which embraces all the multifarious means which human ingenuity can devise and which are resorted to by one individual to gain an advantage over another by false suggestions or by the suppression of truth. No definite and invariable rule can be laid down as a general proposition defining fraud, and it includes all surprise, trick, cunning, dissembling, and any unfair way by which another is cheated.
McClellan v. Cantrell , 217 F.3d 890, 893 (7th Cir. 2000) (quoting Stapleton v. Holt , 207 Okla. 443, 250 P.2d 451, 453-54 (1952) ).
In a distinguishable—though factually similar—case, the Sixth Circuit considered an insurance policy defining computer fraud as the "use of any computer to fraudulently cause a transfer of Money, Securities or Other property from inside the Premises or Financial Institution Premises to a person ... or to a place outside the Premises...." Am. Tooling Center, Inc. v. Travelers Cas. & Sur. , 895 F.3d 455, 461 (6th Cir. 2018) (cleaned up). The parties there disputed whether the computer itself must cause a transfer or whether a computer could be used in the process of a fraudulent transfer. Id. Ultimately, the panel found the policy definition did not require that the fraud cause a computer to do anything. Id. at 462 (quotation omitted). The court, then, found the policy protection against computer fraud extended beyond "hacking and similar behaviors in which a nefarious party somehow gains access to and/or controls the insured's computer." Id. at 461-62.
These definitions and cases bring us to a few important observations. First, the interplay between computer fraud coverage and computer hacking is an emerging area of the law. Courts have had limited opportunities to construe these types of provisions. Second, computer hacking can take multiple forms. It can hardly be disputed that today's digital environment invites evolving degrees of cyber-malfeasance.
Ultimately, we do not think reasonably intelligent policyholders would disagree over this term's definition. Cf. Erie Indemnity Co. , 99 N.E.3d at 630. The definitions from caselaw and dictionaries are not that far apart, and the term "fraudulently cause a transfer" can be reasonably understood as simply "to obtain by trick." See, e.g., McClellan , 217 F.3d at 893. Applying this straightforward definition as a matter of law, we now analyze the party's cross-motions for summary judgment.
Each party has designated certain evidence in support of its motion. G&G Oil alleged that its computer systems were "obtained by trick" in its claim letter to Continental stating: "It is our belief that the hijacker hacked into our system via a targeted spear-phishing email with a link that led to a payload downloading to our system and propagating through our entire network ..." App. Vol. 3 at 154. G&G Oil's additional evidence consists of Continental's denial letter, G&G's dispute letter, Continental's letter affirming denial of coverage, and detailed statements to prove damages. Conversely, Continental designated G&G Oil's original complaint, its answer to G&G Oil's complaint, and portions of the Policy.
We start with G&G Oil's motion for summary judgment. Resolving all questions and construing this evidence in the light most favorable to Continental, Alldredge , 9 N.E.3d at 1259, we cannot say with confidence G&G Oil has designated reliable evidence to entitle it to summary judgment. We do not think every ransomware attack is necessarily fraudulent. For example, if no safeguards were put in place, it is possible a hacker could enter a company's servers unhindered and hold them hostage. There would be no trick there. G&G Oil's belief of a spear-phishing campaign does not entitle it to summary judgment.
Nor is summary judgment appropriate for Continental. Applying the same in-the-light-most-favorable standard to Continental's motion, we think—as above—there is a question as to whether G&G Oil's computer systems were obtained by trick. Though little is known about the hack's initiating event, enough is known to raise a reasonable inference the system could have been obtained by trick. Resolving this question in G&G Oil's favor precludes summary judgment for Continental. Id. ; see also Hughley v. State , 15 N.E.3d 1000, 1004 (Ind. 2014) (finding "Indiana consciously errs on the side of letting marginal cases proceed to trial on the merits"); Warner Trucking, Inc. v. Carolina Cas. Ins. Co. , 686 N.E.2d 102, 104 (Ind. 1997).
This result is consistent with the trial court's own analysis that seemingly hedges toward finding that the computer hackers obtained access to G&G Oil's computers by trick, finding "the hacker inserted himself into G&G Oil's system. That may have involved some sort of deception , but no more than [a house burglar climbing through a window or a car thief using a stolen key]." App. Vol. 2 at 10 (emphasis added). Based on the above definition of this term, we find the trial court construed this term too narrowly. Accordingly, we cannot grant either party's motion for summary judgment on this point.
This does not end our inquiry. We must still examine whether G&G Oil's loss "resulted directly from the use of a computer." If the answer is no, Continental is entitled to summary judgment overall and coverage was properly denied.
II. There is sufficient causal connection between the alleged fraud and G&G Oil's loss such that the loss resulted directly from the use of a computer.
G&G Oil contends its loss resulted directly from the use of a computer under the terms of the Policy because a computer was part and parcel of the entire scheme. Continental argues, and the trial court concluded, that G&G Oil's voluntary transfer of Bitcoin was an intervening cause that severed the causal chain of events. It follows that we must define "directly" and determine whether G&G Oil's actions fall within that definition.
We start by defining the Policy term "resulting directly from the use of a computer." Black's Law Dictionary defines "directly" as "In a straightforward manner," "In a straight line or course," and "Immediately." (11th Ed. 2019). Similarly, Merriam-Webster dictionary defines the term as "in a direct manner," "without delay: IMMEDIATELY," and "in a little while: SHORTLY." MERRIAM-WEBSTER DICTIONARY (Feb. 12, 2021), [https://perma.cc/4GB9-M6TV]. Citing a prior edition of Black's Law Dictionary, our Court has observed that, at least as an adjective, "the word ‘direct’ means, among other things, immediate; proximate; without circuity." Ind. Dept. of State Rev. v. Colpaert Realty Corp. , (1952), 231 Ind. 463, 477, 109 N.E.2d 415, 422 (citation omitted). So, too, have other jurisdictions settled on a definition of "immediate" or "proximate." See, e.g., Curtis O. Griess & Sons, Inc. v. Farm Bureau Ins. Co. of Neb. , 247 Neb. 526, 528 N.W.2d 329, 332 (1995) (defining "direct" as "immediate or proximate as opposed to remote or incidental"); Cincinnati Ins. Co. v. Norfolk Truck Center, Inc. , 430 F.Supp.3d 116, 129 (E.D. Va. 2019) (observing, arguendo , that "some intervening cause could sever the chain of events between loss and use of a computer, if that intervening cause was sufficiently significant to destroy the straightforward or proximate relationship between the use of a computer and the loss" and defining direct as "something that is done in a ‘straightforward’ or ‘proximate’ manner and ‘without deviation’ or ‘without intervening agency’ from its cause").
These definitions inform our understanding of the Policy term "resulting directly from the use of a computer." In order to obtain coverage under this provision, G&G Oil must demonstrate that its loss resulted either "immediately or proximately without significant deviation from the use of a computer." We think that G&G Oil has satisfied that definition.
Analyzing G&G Oil's actions in this case, its transfer of Bitcoin was nearly the immediate result—without significant deviation—from the use of a computer. Though certainly G&G Oil's transfer was voluntary, it was made only after consulting with the FBI and other computer tech services. The designated evidence indicates G&G Oil's operations were shut down, and without access to its computer files, it is reasonable to assume G&G Oil would have incurred even greater loss to its business and profitability. These payments were "voluntary" only in the sense G&G Oil consciously made the payment. To us, however, the payment more closely resembled one made under duress. Under those circumstances, the "voluntary" payment was not so remote that it broke the causal chain. Therefore, we find that G&G Oil's losses "resulted directly from the use of a computer."
Conclusion
Although G&G Oil's losses resulted directly from the use of a computer, we find neither party is entitled to summary judgment. We therefore reverse the trial court's grant of summary judgment in favor of Continental, affirm its denial of G&G Oil's motion for summary judgment, and remand this matter for further proceedings.
Rush, C.J., and Massa, Slaughter, and Goff, JJ., concur.