Tektrol Ltd v International Insurance Company of Hanover Ltd & Anor

Exclusions in an all-risks insurance policy should, where possible, be construed narrowly. The policy presumptively covers risks unless they are clearly excluded. Contra proferentem resolves genuine doubt but does not create or enlarge ambiguity.

An exclusion for corruption caused deliberately by malicious persons did not encompass a virus released by a remote hacker without targeting the insured’s systems. In its context, the stipulated malice had to be directed at those systems. An exclusion for erasure, loss, distortion or corruption of computer information addressed electronic interference. Its reference to “loss” did not extend to information becoming unavailable because the physical computer was stolen.

Tektrol Ltd insured its business under an all-risks business interruption policy. A virus erased copies of essential source code held on a laptop and at a remote site. About two weeks later, burglars stole the computers and hard-copy record containing the remaining copies.

Langley J held that the virus fell within an exclusion for information deliberately corrupted by malicious persons. He also held that the theft caused an excluded “loss” of computer information. His decision was reported as [2004] EWHC 2473 (Comm).

The insured appealed. The central questions were whether the malicious-persons exclusion extended to a generalised virus attack and whether “loss” of information included its unavailability through theft of the hardware on which it was stored.

1. Appeal allowed by a majority. Buxton LJ and Sir Martin Nourse held that neither the virus nor the burglary fell within the exclusions relied upon. Carnwath LJ agreed concerning the virus but dissented concerning the burglary.

2. Insurance exclusions should, where possible, be construed narrowly. An all-risks policy presumptively covers all risks except those clearly and unambiguously excluded. The contra proferentem principle assists only where there is genuine doubt. It cannot create doubt or magnify an ambiguity. Context and the evident purpose of an exclusion remained central to its construction.

3. Exclusion 7(b)(i), concerning erasure or corruption deliberately caused by rioters, strikers, persons involved in civil disturbance or malicious persons, did not encompass the virus. Although its author was malicious and deliberately sought to damage susceptible computers generally, the surrounding categories indicated interference directed at the insured’s systems or premises. A generalised attack by a remote hacker was materially different. An insurer wishing to exclude every loss caused indirectly by hacking needed clearer and more specific language.

4. By a majority, exclusion 7(b)(ii) did not exclude the loss arising from the burglary. The associated words “erasure”, “distortion” and “corruption”, their ordering, and the clause’s focus on software showed that “loss” referred to loss through electronic interference. Redundancy among overlapping words was characteristic drafting designed to cover a conceptual target comprehensively. It did not justify extending the clause to the distinct event of information becoming unavailable because its physical medium was stolen.

5. That construction was reinforced by exclusion 13, which addressed computers and data-processing equipment and expressly preserved cover for qualifying theft. The insurer could not use the single word “loss” in the software-focused exclusion to remove the burglary cover preserved by the hardware-focused provision.

6. Carnwath LJ would have held that exclusion 7(b)(ii) emphasised the nature of the thing lost rather than the mechanism of loss. On that reading, information lost through theft of a computer was covered only if caused by a defined peril. The majority rejected that construction.

1. Court of Appeal (Civil Division): By [2005] EWCA Civ 845, allowed the insured’s appeal by a majority. The court unanimously held that the virus exclusion did not apply and held by a majority that the information-loss exclusion did not encompass loss through theft of the computers.

2. High Court, Queen’s Bench Division (Commercial Court): Langley J, in [2004] EWHC 2473 (Comm), held that the relevant exclusions defeated the claim in respect of both the virus and the burglary.