The disappearing right to independent counsel in cyber insurance

It has been established law for more than 40 years that when an insurer provides a defense under a commercial general liability (CGL) policy but reserves the right to deny coverage based on issues in the underlying lawsuit, the policyholder is entitled to select independent counsel to defend the claims. This right to independent counsel provides important protection for policyholders. It eliminates the risk that defense counsel appointed by the insurer might litigate the underlying case in a manner that impairs coverage. Yet under cyber insurance policies, insurers routinely disregard this right and impose their own choice of counsel. How is this different treatment under cyber policies justified? 

The right to independent counsel traces its origin to the seminal case San Diego Navy Federal Credit Union v. Cumis Insurance Society, 162 Cal.App.3d 358 (1984). The insurer had agreed to provide a defense with a reservation of rights to deny coverage for any damages ultimately awarded. The court ruled that the policyholder had the right to select defense counsel because the reservation of rights created a conflict of interest between the policyholder and the insurer. While both parties had a common interest in defeating liability on all claims, beyond that their interests diverged. Specifically, the insurer had an interest in obtaining findings that would eliminate coverage and steering any liability to the non-covered claims --directly contrary to the interests of the policyholder. In light of this conflict of interest, the court held that the insurer's right to control the defense and appoint counsel "must yield to its obligation to defend the policy holder."   

Ethical duties of defense counsel

In reaching this decision, the court focused on the ethical duty of defense counsel. Under the California Rules of Professional Conduct, lawyers cannot represent two clients with conflicting interests except with the written consent of both. If the policyholder does not consent to insurer-appointed counsel, "the insurer is required to provide the insured with independent counsel of the insured's own choosing who represents the insured, not the insurer." Long v. Century Indem., 163 Cal.App. 4th 1460, 1469 (2008) (emphasis and internal quotes omitted).    

In 1987, California enacted a statute codifying the Cumis holding. Civil Code Section 2860 gives the policyholder the right to select independent counsel "when an insurer reserves its rights on a given issue and the outcome of that coverage issue can be controlled by [defense] counsel." Most other states have adopted similar rules either by statute or judicial decision.   

It is quite surprising then that the right to independent counsel has vanished in cyberspace. Most cyber policies give the insurer control over selection of counsel without recognizing any exception under the Cumis doctrine. Cyber insurers insist on exercising this right even where they have issued a reservation of rights that creates a conflict of interest for defense counsel. If a policyholder pushes back, insurers will argue that the Cumis doctrine does not apply to cyber insurance.

While it is true that no published decision has applied the Cumis doctrine to cyber policies, the factors underlying the doctrine apply with equal force. When an insurer defends a claim under a cyber policy with a reservation of rights, the same adversity exists between insurer and policyholder on coverage issues. If such issues are involved in the underlying lawsuit, there is a conflict of interest that precludes defense counsel from handling the matter without the policyholder's consent. In terms of the insurance contract, the insurer cannot fulfill its duty to provide an effective defense by appointing defense counsel with divided loyalties. There appears to be no principled reason why the Cumis doctrine should not apply to cyber insurance.

What is at stake here? In short, the appointment of independent counsel allows the policyholder to defend the underlying case without impairing its insurance rights. As courts have recognized, defense counsel has ample opportunity to shape the outcome of the coverage dispute through tactical decisions regarding which facts to investigate, which witnesses to depose, which defenses to advance, among others. In addition, insurer-appointed counsel will typically share with the insurer all information obtained in the litigation--even when the information may undermine the policyholder's coverage claim. In contrast, independent counsel appointed by the policyholder is not required to share with the insurer privileged information relevant to the coverage dispute.

Protecting insurance rights

Unfortunately, it seems unlikely that insurers will recognize the right to independent counsel under cyber policies until courts rule on the issue. In the meantime, policyholders should take certain steps to protect their right to coverage.

As an initial matter, policyholders should not accept insurer-appointed counsel until the insurer has provided a written coverage position which (i) confirms it will provide a defense and (ii) sets forth any reservation of rights. When the insurer reserves rights, the policyholder should consult with coverage counsel to determine whether the insurer's reservation triggers the right to independent counsel. If the policyholder believes the right is triggered, it should inform the insurer and identify the law firm it wishes to retain.

If the insurer refuses to pay for independent counsel, as is likely, policyholders are left with options that are less than ideal. They can retain their preferred counsel at their own expense and reserve the right to recover the legal fees from the insurer. Or they can file suit against the insurer immediately to resolve the dispute. The first option requires policyholders to front the cost of their defense while the second requires them to litigate with their insurer at the same time they are defending the underlying claims.

The most effective way to protect the right to independent counsel is to address the issue when the policy is procured--well before any actual claim arises. Policyholders should negotiate endorsements that identify law firms they can retain to defend claims, with the list including firms selected by the policyholder. Many cyber policies contain such endorsements and most insurers have shown a willingness to accept them. This approach allows the policyholder to retain preferred counsel with undivided loyalty and eliminates a potential source of dispute with the insurer at the outset of a claim.