• Atlanta
• Boston
• Dallas
• Ft. Lauderdale
• London
• Minneapolis
• New York
• Oakland
• Philadelphia
• Washington, DC

By Jane E. Warring and Shannon M. O'Malley

To read this article in PDF format, please click here.

In the last week of December 2022, the Ohio Supreme Court published a much-anticipated decision in the EMOI Services LLC v. Owners Insurance Co. case.[1] The decision was bold, and the court made no attempt to limit its holding to the facts or language at issue in EMOI.

Rather, the court announced a bright-line rule: Software can never be physically damaged. As cryptocurrency and non-fungible tokens are stored on open-source software known as the blockchain, this ruling has obvious implications for the loss of these intangible assets.

The policyholder in EMOI had not purchased a cyber insurance policy. Rather, it purchased a business owners' policy that included data compromise and electronic equipment endorsements.

Based on name alone, one might have expected the data compromise endorsement to respond to loss arising out of a ransomware attack. However, both the policyholder and the insurer agreed that the policy's exclusion for loss arising out of any "threat, extortion or blackmail" rendered this endorsement inapplicable.

Instead, the parties' dispute centered on the applicability of the electronic equipment endorsement, which insured direct physical loss or damage to media, where "media" was defined to include software.

The insurer argued that physical damage requires structural alteration of tangible material.[2] EMOI argued that the hacker "manipulated the computer software program" by encrypting the code and that this constituted physical loss.[3]

In May 2021, the trial court punted the issue, holding that even if

the software was 'damaged' while it was encrypted, given the fact that EMOI has all the data it did before the ransomware attack, and that its software is now fully-functional, the Court  finds that the 'media' is no longer damaged.[4]

On this basis, the trial court granted summary judgment in favor of the insurer.

In a controversial decision in November 2021, the Ohio Court of Appeals reversed the grant of summary judgment for the insurer based on three key issues.

First, the appellate court disagreed with the trial court with respect to the facts. The appellate court appropriately noted that the trial court's ruling ignored the fact that the decryption key had not restored all of the systems. Some systems remained affected.

Second, the appellate court expressed confusion over what exactly happens when data is encrypted. The appellate court bemoaned the lack of expert opinion on this issue, which might have assisted the court in determining whether encryption causes physical damage: "The record contains minimal information about how encryption occurs and its effects on computer data."[5]

Third, the appellate court raised an illusory coverage issue, stating that if the software was tangible enough to insure, it was tangible enough to be damaged. The implication of this holding was that if it the policy insured physical loss or damage to software, there must be some circumstance in which software can experience physical loss or damage.

Reversing the appellate court, the Ohio Supreme Court addressed all three of the appellate court's issues with the trial court's ruling. The court acknowledged that the decryption key did not successfully restore all of the insured's software; however, it concluded that "computer software" was only insured to the extent it was contained on damaged physical hardware, such that the coverage for software was not illusory. According to the court, software has no physical existence.

The latter point is key.

While the parties and the appellate court focused on cases discussing whether physical damage required physical alteration, the Ohio Supreme Court determined that this entire analysis was unnecessary. Thus, under the court's analysis, not only was the cause of the alleged damage at issue not physical, but the property itself was not physical either.

Much of the insurance coverage litigation arising out of the COVID-19 pandemic involved policyholders' claims that their property — restaurants, theaters, etc. — had sustained physical damage by an intangible force: the presence of a virus. By contrast, in EMOI, neither the property, i.e., instructions in software, nor the cause of the alleged damage, i.e., alteration of the code, were determined by the court to have any physical existence.

Whether the court's analysis is well founded from a scientific perspective requires an analysis deeper than any party argued, or any court has addressed.

The court in Ward General Insurance Services Inc. v. Employers Fire Insurance Co.,[6] perhaps came the closest when it explained:

Here, the loss suffered by plaintiff was a loss of information, i.e., the sequence of ones and zeroes stored by aligning small domains of magnetic material on the computer's hard drive in a machine-readable manner.

In Ward, the court pieced together the overlapping definitions of "physical," "material," and "tangible" to hold that "physical" requires "tangible matter ... perceptible to the sense of touch."[7]

In the end, the Ohio Supreme Court in EMOI has issued an edict of law, rather than of science. Under Ohio law, software is not physical and can never be physically damaged. Given the reasoning employed by the Ohio Supreme Court in this latest EMOI decision, its holding has limited, if any, precedential value for claims involving real property or tangible personal property.

It will, however, have implications in what we expect to be a growing body of case law analyzing loss or damage to intangible assets like cryptocurrency and NFTs. The blockchain is open-source software that contains instructions regarding the ownership of cryptocurrency and NFTs.

After EMOI, there is no silent cyber risk of coverage for loss of cryptocurrency or NFTs under policies that require physical loss or damage, at least in Ohio. With that said, insurers that cover theft without a physical loss or damage requirement remain at risk depending on the language of their policies.

Both Ward and EMOI highlight the need for the insurance industry to develop a more nuanced understanding of rapidly evolving technologies. It should not be lost on us that the dispute in EMOI arose under an equipment endorsement.

In 2023, it would be difficult to find a manufacturing operation — an inherently physical business — that is not heavily dependent on software. Many believe we are on the brink of a revolution in artificial intelligence where software not only executes specific preprogrammed instructions but learns and operates beyond them.

Writing or purchasing insurance coverage without a complete understanding of all technologies relevant to the insured's business may lead to coverage disputes.

Jane Warring and Shannon O'Malley are partners at Zelle LLP.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of their employer, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

[1] EMOI , L.L.C. v. Owners Ins. Co. , ---N.E.3d---, 2022-Ohio-4649, 2022 WL 17905839 (Ohio Dec. 27, 2022).

[2] See Owners' Motion for Summary Judgment, 2021 WL 7208667 (Ohio Com. Pl.).

[3] EMOI's Response to Owner's Motion for Summary Judgment, 2021 WL 7208666 (Ohio Com. Pl.).

[4] EMOI , LLC v. Owners Ins. Co., No. 2019 CV 05979, 2021 WL 7184553, at *4 (Ohio Com. Pl. May 4, 2021).

[5] EMOI , LLC v. Owners Ins. Co. , 2021-Ohio-3942, ¶ 49, 180 N.E.3d 683, 694 (Ohio Ct. App. 2021).

[6] Ward General Insurance Services v. Emp'rs Fire Ins. Co. , 114 Cal. App. 4th 548, 556, 7 Cal. Rptr. 3d 844, 851 (2003).

[7] Id. at 556.