Planet Money - Risky business

Episode Date: April 27, 2022

Two stories on how businesses are using insurance to navigate new kinds of risks. First, how music venues are handling pandemic-related risks. And how Russia's invasion of Ukraine is affecting cyber insurance. | Subscribe to our weekly newsletter here.Learn more about sponsor message choices: podcastchoices.com/adchoicesNPR Privacy Policy

This is Planet Money from NPR. Today, we are going to talk about insurance, specifically business insurance. Business insurance is important to Summer Gerbing. She owns a small live music club in California. A couple of years ago, her policy included liability, in case somebody got hurt, workers' comp, and business interruption insurance. And that very last one became pretty important during the pandemic. Thank God we got this coverage.

Thankfully, we, you know, kept up on all those payments. Overall, Summer's policy covered her for a million dollars. But when the state shut down concerts and Summer had to close her doors, she filed a claim with her insurer and it did not go well. You know, we got denied. Hello and welcome to Planet Money. I'm Darian Woods. The economic world is full of risk and uncertainty. And companies and businesses often deal with this unpredictable world by turning to insurance.

Today on the show, two stories from Planet Money's daily podcast, The Indicator, about how businesses are trying to deal with new kinds of risks. Sally Herships and I will be back after this. The first of our two stories today is about how the insurance industry got even more risk-averse during the pandemic. Summer Gerbing owns the Ivy Room. It's an independent music venue in Albany, California. The bands that play there have names like Sven and the Masterful Orchestra and La Di Da.

Very good. So when you and I, Darian, walk into a place like The Ivy Room, we're like checking out the music, maybe thinking about getting a drink. But as a business owner, when Summer looks around, she is thinking liability. I mean, But as a business owner, when Summer looks around, she is thinking liability. I mean, liquor does a funny thing to people. And there's liability every time I'm looking out on the floor. You know what I mean? There's always something that I'm like, liability, liability. Someone could fall off a barstool.

I've been a bartender. I've seen it. They could slip on a banana peel or choke on some peanuts. So many possibilities for lawsuits. Summer bought the Ivy Room back in 2015. And most businesses don't earn a profit for the first couple of years. There are the operating costs. There's payroll. The club needed a renovation also. Summer wanted to be a responsible business owner, and she wanted to make sure the Ivy Room was covered. Absolutely. You have to get insurance. It is so crucial. You have to protect your business. But those premiums were pricey. Summer says for her small business, affording them was hard. And how much were your payments?

$1,700 a month. Absolutely ridiculous. Ridiculous, maybe. But still,700 a month. Absolutely ridiculous. Ridiculous maybe, but still, she felt secure. If anything happened, the Ivy Room was covered. Then the pandemic. And we know what happens next. This was not the time that you're going to be going to see live music at an indoor venue when everyone is just packed together, just breathing on each other. No, no breathing on anyone. Summer had about 20 employees and she was worried about them. They needed their paychecks. But she thought she had that business interruption insurance. She thought she would be okay. So she put in a claim. And about a week later, it was breakfast time and she was at home with her twin three-month-old sons when an email

popped up from her insurance broker. Her claim was denied. I was disappointed, of course, but I wasn't shocked. Still, Summer wasn't going to give up. California had basically ordered her business to shut down, so Summer felt like her business interruption policy should have covered her. So she contacted a lawyer. We did. We thought that we have to fight for our business and we have to fight for other businesses. It's just not fair. It comes to the point where we're doing our part in this relationship. You should be doing yours. Sarah Cronin is an entertainment lawyer in LA, and part of her job is handling what's called insurance recovery work.

Which are disputes with insurance companies where we represent the policyholder. Ooh, disputes. So are there any of those happening right now? There are tons of them happening right now. Like the lawsuit that Summer contacted her own lawyer about. It became a class action suit asking for millions in damages. According to the University of Pennsylvania's COVID litigation tracker, 1,500 cases have been filed by live venues since March 2020, which Sarah says is a lot.

Even Live Nation, the company that owns Ticketmaster, sued its insurer. Insurance policies with all that small print can be complicated. Insurance works by spreading risk. But when you have a catastrophic event, everyone is affected, so you can't spread the risk. That's why it's hard to get earthquake insurance. Everyone in the area is affected all at once. It's also why it's increasingly hard to get wildfire insurance in California or flood insurance in Florida. And that's why pandemic coverage in particular is so rare. Just too much to cover.

When you have so many people like Summer, there just isn't enough money to cover everyone. Plus, pandemics happen rarely, which can make it really hard for insurers to predict and plan for them. One representative of the insurance industry wrote me in an email, to the extent any pandemic insurance was available before COVID-19, it was limited, expensive, and rarely purchased. But Sally, as we were talking about, like there is at least one example of people who did think ahead and buy pandemic coverage. The organizers of Wimbledon, the tennis tournament, they thought it was worth it. They'd been paying for pandemic coverage for close to a couple of decades. So when the annual competition was canceled in 2020,

they got a reported $140 million payout. Well-played organizers of Wimbledon. They thought ahead. But Wimbledon's coverage was for pandemics specifically. The National Association of Insurance Commissioners says the kind of policy that Summers' Ivy Room had, business interruption, is not intended to provide coverage against communicable diseases or government-ordered closures that happened to so many venues during the pandemic. Business interruption is part of this larger category called property insurance, which is meant to cover destruction from something like a fire. Either way, even if someone could afford pandemic coverage today, like the people

at Wimbledon, that kind of coverage has virtually disappeared now. Now with event cancellation insurance, every insurance company throws on a communicable disease exclusion so that there would not be coverage. No pandemic coverage. Before COVID, it was rare, but let's just let that sink in for a minute, Darian. Let's marinate. Let's see, you're a live events venue. Now, if there is a spike in the pandemic, you cannot get any insurance coverage. Pretty sobering. Now, an event so big that it changed what insurers will and won't cover, that does have a precedent. One of the most costly events in insurance history. After 9-11, insurance companies added terrorism exclusions because they didn't want to face

those big losses again. And it's the same thing for the pandemic. They want to make sure they're not in a position where they're facing billions, trillions of dollars of losses again. So if I'm a small business owner, what do I do to prepare for that kind of loss? Sure. So you definitely get your insurance because that's important, but you're also going to need to think from a business perspective, how do you deal with that risk without insurance? How do I deal with that risk without insurance?

You need a good business person, not your person. Because yeah, you would not be able to look to insurance to solve that problem for you right now. Sarah says there have been some small procedural victories for businesses suing their insurers, but the vast majority of decisions have been in the insurance company's favor. And that's what happened to Summer. Her lawsuit took a year and she lost. Again, she says she's disappointed but not surprised. Summer found a way to make it work. She joined a group of thousands of other small venues that formed a national association, and they lobbied Congress and got up to $15 billion in grants.

And that's just one of the ways that Summer says she's managed to stay afloat. She says that grant she got will give her a cushion to keep going for a year or two. The Ivy Room is back up and running. The staff is wearing masks, which Summer hopes will make everyone feel safe. And she's still signed up for insurance,

although it doesn't include pandemic insurance. So the pandemic was one event that a lot of businesses and insurance companies didn't see coming. Up next, businesses that are facing a new frontier of risk. This is Planet Money. I'm Darian Woods. And I'm Paddy Hirsch. The United States is not at war with Russia, but Russian hackers are at war with the U.S.

At least that's the message that President Biden sent in a recent speech directed to American businesses. ...planning a cyber attack against us. As I said, the magnitude of Russia's cyber capacity is fairly consequential, and it's coming. It's not clear how many American companies have been targeted by Russian hackers since the West and its partners imposed sanctions, but companies are trying to prepare themselves. Some have the resources to build systems to keep hackers out, but that can be a long and expensive process. Yeah, instead, many companies will likely rely on insurance to cover any losses that they might suffer in an attack.

But corporations that have already been hacked or wormed or otherwise cyber assaulted by entities with connections to the Kremlin have found that their insurance comes with a catch. And once again, there is one single line in company insurance policies that is allowing insurance companies to get off the hook. A different line this time. This one allows insurers to deny companies coverage from cyber attacks, or at least attempt to deny them. And that is causing a big stir in the insurance business today. It's a sad fact of modern life that hacking or being hacked has kind of just become another part of doing business for companies these days. Josephine Wolfe is a professor of cybersecurity policy at the Tufts Fletcher School. She says that up until relatively recently, most companies have relied on their regular insurance policies

to protect themselves against hacks and worms and ransomware and all sorts of other cyber nasties. Pretty much all companies have what we call property and casualty insurance, which covers pretty much all risks to a firm's property, including business interruption risks, where if you have to shut down operations for a while. And those property and casualty policies even include business interruption because of things like malware and computer security incidents. But computer security incidents or hacking, like holding companies for ransom,

have now become so prevalent that some companies have taken one more step to protect themselves, and they've bought specific specialty cyber insurance as well. The problem, Josephine says, though, is that cyber insurance typically doesn't provide much in the way of coverage, financially speaking. is that cyber insurance typically doesn't provide much in the way of coverage, financially speaking. Those policies, because there's a lot of uncertainty around cyber risk, tend to be capped fairly low. So most companies can only get a few million dollars worth of cyber coverage. And when hackers attack, they can cause a lot more damage than a few million dollars. Ransomware attacks can be particularly painful, and they can go as high as $50 million. In a situation like that, cyber insurance for, you know, a handful of a few million is not going to cut it.

Yeah, and with so many companies withdrawing from Russia or refusing to do business with Russian companies, there are now a lot more names on Russia's hacking hit list, which means a lot more companies looking for coverage from cyber attacks. But because the cyber insurance coverage is so low, Josephine says, companies that do get hacked will often make a claim against both their cyber insurance and their regular generic, you know, property and casualty insurance. That's because property and casualty covers them for a lot more money. And this would be a smart move. Apart from that single line that is included in most insurance policies, it's called a war exclusion.

And insurance policies have pretty much always had them since the 1700s. War is so unpredictable and so big and so difficult to model that the insurers can't work that into their risk calculations. And because insurers can't work out how to insure against war, they basically wrote their policies to say that if there is a war, then all bets are off and you can't make a claim. Pretty simple. We interrupt this program to bring you a special news bulletin. But then came December the 7th, 1941.

The Japanese have attacked Pearl Harbor, Hawaii by air. 2,403 Americans were killed in the attack. Some of these people had insurance policies and their families made claims with their insurance companies. And in many cases, the insurers say, no, that was an act of war. That wasn't something we could have modeled in this person's life expectancy. That's excluded. But some of these plaintiffs don't stand for this. They make the argument that, hold on, Pearl Harbor happened in peacetime. Congress didn't declare war until the next day. And several of those cases go to court, and the courts actually have different opinions,

depending on where they are, about whether or not Pearl Harbor is an act of war. The insurers win some, they lose some, and then they start making darn sure that they are not going to get caught out like this again. They start tweaking the language in their policies to make that war exclusion absolutely watertight. And this is not just for life insurance. This is for everything. So the crucial language is usually something along the lines of a hostile or warlike act

in times of peace or war. And you sort of see that language evolve over time. And then there are usually a few criteria that sort of go below that, that say a hostile or warlike act, including something that's perpetrated by a government or a military, something that's related to civil unrest or disruption. And it's this war exception that's roiling the insurance industry right now, as businesses brace themselves to defend against Russian hackers. Companies are realizing their cyber

policies may not give them enough coverage to compensate for an attack, and they could be denied coverage on their property and casualty policies. The insurers, of course, are arguing what they have said for years, that attacks by Russian hackers, and there have been plenty of them, are acts of war, even though the U.S. is not at war with Russia, and even though the company itself may not be the actual target of an attack. Like in the case of the New Jersey pharmaceutical company Merck, whose computers were infected in 2017 by a Russian virus called NotPetya. The NotPetya malware was a piece of malware that was distributed through a piece of Ukrainian

accounting software. Most of the infected computers were in Ukraine. But because all of our computers are connected, those infections then spread all over the world. Merck's insurer naturally argued that the initial attack in Ukraine was an act of war and therefore Merck wasn't covered. A superior court judge disagreed and ruled in Merck's favor earlier this year. Still, Josephine says, companies are scrambling to make sure that they're covered. I think everybody right now, pretty much across the globe, is worried about Russian cyber attacks and retaliation for sanctions and retaliation for all sorts of activity.

Insurers are scrambling too, in their case, to manage this new risk that is taking a pickle bite out of their profits. And they say, OK, you know, this is a problem for us. We need to raise our premiums. And you have companies going back to renew and being told your premiums have increased 200 percent, 300 percent. In the first quarter of 2021, U.S. cyber insurance premiums rose an average of 18 percent. But guess what?

Companies keep paying. Because what's the alternative? Hacking isn't going away. And Russian hackers are more motivated than they've ever been to attack American businesses. And this is, of course, pretty bad for consumers like you and me, Paddy, for two reasons. First, because as these premiums go up and companies have to pay more, they'll inevitably pass on the costs to consumers. And that means that prices will go up. Yes. And second, Josephine says, because of moral hazard. Remember the way the big banks were bailed out by the government in the financial crisis? One argument at the time was that the

crisis was a catastrophic one-time thing that it was impossible to predict or plan for. And the government needed to provide assistance. One of the things that insurers have been sort of pushing the government on for a few years now is we'd like something equivalent in cyber. We'd like sort of, you know, some backstop. So if something really catastrophic happens in cybersecurity, we will have some support from the government and not just be on the hook to pay out all of those claims ourselves. Josephine says the government has already made a vague pledge to insurers that it will backstop them if things go really bad. Which just goes to show that whether it's phishing or ransomware, denial of service attacks or data theft, hacking is here to stay. Yes. And in the meantime, companies will be looking to insurance for protection.

Insurance that's going to become increasingly expensive, maybe even provided by the government. insurance that's going to become increasingly expensive, maybe even provided by the government. And the cost of all this insurance, as you so correctly said, Darian, will likely be passed on to you, the consumer, in the form of higher taxes and higher prices. Have a nice day. Thanks, Paddy.

Don't shoot the messenger. You're all the way into California as well, even if I had a giant bone arrow. That's a long shot. If you have a story to tell about insurance and risk, we would love to hear it. You can email us at planetmoney at npr.org. We're also at Planet Money on all the social media platforms. The Indicator is also on

Twitter at The Indicator. Today's Indicator episodes were originally produced by Jamila Huxtable and Jess Kung with help from Gilly Moon and Isaac Rodriguez. They were fact-checked by Corey Bridges and edited by Kate Kunkannon. This Planet Money episode was produced by Willa Rubin with help from Gilly Moon. It was edited by Jess Jiang and Alex Goldmark is our executive producer. This is NPR. Thanks for listening.

This is NPR. Thanks for listening.