Tag Archives: Michael Murray

Equifax Breach: The Implications

The massive data breach suffered by Equifax has both serious consequences for consumers and potentially profound long-term implications for commerce and the nascent cyber insurance industry.

In the three days since Equifax’s press release announcing the breach potentially exposing names, addresses, birthdates, Social Security numbers and other information for about 143 million U.S. consumers, both the federal Consumer Financial Protection Bureau and New York State Attorney General Eric Schneiderman have criticized the giant credit bureau’s response and, in particular, an “arbitration clause” that may severely curtail the legal rights of any consumers who take advantage of free credit monitoring offered by Equifax.

The arbitration clause is included in the terms of service for Equifax’s credit monitoring program and, as reported by the Washington Post, bars consumers from participating in class action law suits, requiring instead that all disputes be settled by “binding individual arbitration” and limiting consumers’ rights to discovery and appeal. Equifax has stated the arbitration clause won’t apply in this case, but some have warned that the company’s statement may not be legally binding. Consumer beware.

See also: VPNs: How to Prevent a Data Breach 

The harm to consumers may last a lifetime as people have the same birthdate from cradle to grave, most will have just one Social Security number and many will use but one name. Yet, Equifax is offering just one year of credit monitoring.

For now, it appears that Equifax is failing crisis response 101. Instead of impressing consumers, clients and public officials with its transparency and earnest desire to make things right, the company has attracted criticism that undermines efforts to limit damage to its reputation, rebuild trust and inspire confidence. The gold standard in crisis management remains Johnson & Johnson’s handling of the 1982 Tylenol tampering case that led to seven fatalities in Chicago. That is playbook for business.

But the Equifax breach and its response raise several other critical issues. Most obviously, what should consumers be doing to protect themselves? (See “The Equifax Data Breach: What to Do” at the Federal Trade Commission’s website for a number of useful suggestions, including checking credit reports.)

The less obvious but perhaps more profound issues raised by the massive data breach at Equifax pertain to the future of commerce and cyber insurance. With the breach exposing several of the data elements typically used to verify people’s identities, one must wonder what will happen if businesses and financial institutions lose confidence in their ability to confirm we are who we say we are. Imagine a world in which merchants can no longer accept credit cards. Imagine a world in which banks and credit unions can no longer make loans. Imagine a world in which one can no longer bank or trade securities online. And, lest one succumb to the notion that advanced biometric security measures will save the day, understand that biometric data is stored in computer files that can be hacked just like birthdates, Social Security numbers and the like. Changing stolen user IDs and passwords is easy, but what is the fix when hackers steal retinal scans, fingerprints and the like?

The hope is of course that bright minds will find ways to protect us from criminal hackers and other nefarious parties who would do us harm, and yes — bright minds are already on the case. Witness in particular the rise of cyber insurance, and focus not on the compensation paid by cyber insurers in the wake of cyber incidents but rather on the underwriting done when cyber insurance policies are written and insurers’ work with clients to prevent and control losses. In many ways, this is emblematic of a larger movement in insurance and risk management from indemnification to loss prevention as the application of advanced analytics to big data enables intervention before losses occur. But while this might seem a new model, it is actually one that has been with us for quite a long time. People don’t buy boiler and machinery insurance because they want to be paid after boilers explode. Rather, people would prefer that boilers don’t blow up, and they want the benefit of the engineering and inspection services delivered during the underwriting process.

See also: Aggressive Regulation on Data Breaches  

Nonetheless, there will be times when cyber losses occur, and cyber insurers will be called upon to respond. The Equifax breach provides a mere hint as to the coverage limits insureds may require and the amount of capacity, or capital, cyber insurers may need to cover the risk. Insurers that can figure out how to price and underwrite cyber risk have a tremendous opportunity to do well by doing good. One key will be successfully quantifying and managing aggregation risk (the accumulation of risk as a result of covering multiple insureds using the same or similar systems, etc.).

Harvey Hammers Home NFIP Issue

The economic devastation and human suffering that Hurricane Harvey inflicted on vast numbers of people will sorely test the National Flood Insurance Program (NFIP) as it comes up for renewal, with the NFIP lapsing if Congress and the president fail to act by the end of the month. Some in the federal government, state regulators, industry experts and this economist favor solutions encouraging private sector participation in flood insurance markets. Near-term, the most likely and wisest course seems to be a short extension allowing the Federal Emergency Management Agency (FEMA) and NFIP to focus on settling claims while politicians and policy experts develop longer-term solutions.

With the U.S. Government Accountability Office (GAO) reporting the NFIP was $24.6 billion in debt before Hurricane Harvey, many in government and elsewhere feel significant reforms are needed. Other knocks against the NFIP as currently constituted include its reliance on allegedly inaccurate and out-of-date flood insurance rate maps (FIRMS), its failure to charge actuarially appropriate premiums and policy limits too low to provide adequate insurance protection. Some also contend that the NFIP encourages excessive risk taking and poor land use by providing subsidized insurance coverage for properties that repeatedly get flooded out, effectively divorcing those who choose to reside in flood prone locations from the consequences of their decisions.

Uncertainty about the exact extent of the devastation caused by Harvey will persist for some time, as the huge number of properties damaged by the storm, difficult conditions and continuing lack of access to some of the hardest-hit areas all add to the time necessary to assess losses. Further complicating efforts to understand the magnitude of the losses caused by Harvey, published reports often fail to clearly distinguish between economic losses, insured losses covered by private carriers and insured losses covered by the NFIP. Nonetheless, it appears Hurricane Harvey may exhaust the NFIP’s financial capacity, causing the program to go still deeper in debt.

See also: Harvey: First Big Test for Insurtech  

The NFIP purchased private reinsurance covering 26% of its losses between $4 billion and $8 billion, but Fitch Ratings believes losses from Hurricane Harvey could consume the NFIP’s $1.04 billion in reinsurance protection.

As Congress and the president ponder the way forward, the options available to them include several that would facilitate development of private markets for flood insurance akin to the private markets for homeowners insurance. Key elements of such solutions include measures clarifying mortgage lenders’ ability to use flood coverage underwritten by private carriers to satisfy insurance requirements imposed by Fannie Mae and Freddie Mac.

The development of private markets for flood insurance will also require that the NFIP adopt actuarially sound pricing. Simply put, private carriers that must cover their costs and earn an adequate rate of return on capital would be at a tremendous disadvantage competing against taxpayer-subsidized coverage from the NFIP. And it would certainly help if carriers currently participating in the NFIP’s WYO Program were allowed to also offer alternative coverage. Currently, the WYO Program includes a non-compete clause that precludes carriers from offering alternative standalone flood insurance.

The constituencies supporting increased private sector involvement in flood insurance markets include the National Association of Insurance Commissioners, the Property Casualty Insurers Association of America, the National Association of Mutual Insurance Companies and the American Insurance Association, which have all come out in favor of the Flood Insurance Market Parity and Modernization Act passed unanimously by the House in 2016.

Thinking more broadly, there may be no need for the federal government to participate directly in the flood insurance business. Mechanisms akin to state FAIR and Beach Plans could serve as insurers of last resort for property owners unable to obtain coverage from private carriers. Or, we could transition from the NFIP as it exists today to a new NFIP modeled on the Terrorism Risk and Insurance Program (TRIP) introduced after the terrorists destroyed the World Trade Center on Sept. 11, 2001. Under that program, insurers must offer terrorism coverage, with policyholders then free to accept or decline. If insured losses from a terrorist attack exceed specified triggers, the federal government provides reinsurance protection, and insurers subsequently reimburse the federal government.

Thinking still more broadly, there may be no need for the federal government to participate in the flood insurance business at all. With trillions of dollars flowing through global capital markets, catastrophe bonds and other insurance-linked securities could enable insurers and reinsurers to obtain all of the capacity necessary to cover flood risk without any federal reinsurance backstop.

See also: Time to Mandate Flood Insurance?  

An ideal solution would enable one policy to provide coverage for both wind losses and flood losses. As long as those losses are covered by separate policies, policyholders and insurers will remain burdened with having to distinguish wind losses from flood losses— a frequently contentious and often expensive undertaking that adds to the time necessary to settle claims.

In any case, private sector insurers and reinsurers now have access to data and sophisticated flood models that enable them to price and underwrite flood risk intelligently. And developments such as the new commercial flood insurance program recently introduced by ISO and Verisk Analytics set the stage for greater participation in flood insurance markets by ever greater numbers of insurers, as will the corresponding personal property flood insurance program they plan to roll out later this year. With state regulators and insurers aligned, it seems all that’s necessary to unleash the power of private markets is action on the part of Congress and the president. Why not send them a postcard?

Hurricane Harvey: A Moment of Truth

The first major hurricane to make landfall in the U.S. since hurricanes Dennis, Katrina, Rita and Wilma in 2005, Hurricane Harvey will cause billions of dollars in economic damage and disrupt countless lives. In the wake of massive economic losses and untold human suffering, including loss of life, millions of individuals and businesses will turn to their insurers for help. This will be a make-or-break experience, a real moment of truth.

Insurers will be presented with a golden opportunity to justify the public’s trust and earn the respect of policyholders, regulators, legislators and others in government. But insurers also run the risk of failing to live up to expectations and incurring the wrath of voters and their elected representatives.

See also: Flood Risk: Question Is Where, Not When  

The first test may well be distinguishing damage caused by wind from damage caused by flooding, as virtually all insurance policies exclude losses due to flooding (the exception being those policies issued by the National Flood Insurance Program). Insurers will need to be careful, thorough and fair when settling claims.

Equally important, insurers will need to be perceived as having been so, and communication will be key. Insurers would be well advised to do what they can to make policyholders feel they have been treated with respect, dignity and compassion even when their claims must be denied or settled for some amount less than the claimant sought.

Moreover, insurers would be well advised to settle claims as quickly as possible without unduly sacrificing sound loss adjustment and efforts to weed out fraud and abuse.

Finally, with the media sure to draw attention to heartbreaking stories about human tragedy in Harvey’s aftermath, insurers might benefit from doing what they can to shine a light on their efforts to help individuals and businesses recover. Surely it is worth noting that, as others evacuate, insurers gear up to send large numbers of claim adjusters to work in extremely difficult conditions in hard-hit areas.

Hurricane Harvey will also lead to many other moments of truth. For example, the devastation caused by Harvey may well prove to be the first real test at extreme scale of new insurtech created to improve loss adjustment. Will use of drones, aerial imagery, artificial intelligence, digitalization, big data, predictive analytics and the like prove as beneficial as hoped? Will insurtech entrepreneurs and insurers who have invested in these technologies be vindicated? And, on a more positive note, will experience coping with Harvey reveal new opportunities to use emerging technologies to increase speed, efficiency and fairness?

Insured losses from Hurricane Harvey may also test reinsurance mechanisms, including catastrophe bonds, other insurance-linked securities and sidecars. And what about so-called hedge fund reinsurers, which sought to profit by investing insurance float using strategies like those typically employed by hedge funds? Will they continue to participate as claims mount, or will they instead seek to exit the business? Some past catastrophes triggered significant inflows of fresh capital, as investors sensed opportunities to profit from a turn in reinsurance markets. Such was the case following Katrina, Rita and Wilma in 2005. Will the “fast money” come rushing in again, and, if it does, will it prove to also be “smart money”?

All of the above raises the question, “Will Hurricane Harvey lead to a reset of catastrophe models, pricing for hurricane risk and underwriting?” Some past storms, such as Hurricane Andrew in 1992, convinced insurers that they had previously underestimated hurricane risk and thus led to dramatic resets in coastal property insurance markets, with attendant price increases and availability problems. Whether Harvey brings about such a reset seemingly depends on whether current catastrophe models did an adequate job alerting insurers to the risk of an event like Hurricane Harvey. If so, changes in coastal property insurance markets may be muted. If not, expect price increases and availability problems.

See also: Is Flood Map Due for a Big Data Make-Over?  

Last, and let’s hope least, Hurricane Harvey may test insurers’ enterprise risk management. Prior to Harvey, the property/casualty industry had ample surplus, and most insurers were well capitalized. But surplus was not evenly distributed across insurers, and only the surplus of those insurers that wrote policies covering properties struck by Harvey is available to cover claims from Harvey.

If an insurer only wrote risks in Oregon, its surplus won’t be called upon to cover claims from Harvey. Bottom line, insurers that covered properties affected by Harvey, that were aware of potential losses and that have ample financial resources to cover claims and continue operations can give themselves good grades for enterprise risk management.

On the other hand, Insurers that covered properties affected by Harvey, that were surprised by their losses and that lack the resources to cover claims must give themselves failing grades for enterprise risk management.

And then there is a gray area: insurers that intelligently judged the risk of insolvency to be acceptably small, took a calculated risk and then lost that bet. Though such insurers will fail, it cannot be said that their enterprise risk management failed. Eliminating even the most remote chance of insolvency is not practical. Neither is it economically viable. Sound enterprise risk management consists of: 1) understanding risks; 2) making conscious, intelligent decisions about which risks to take, which risks to avoid, which risks to mitigate and which risks to transfer; and, 3) enforcing controls that keep operations within the bounds established by an enterprise’s appetite for risk.

Plunging Costs for Autonomous Vehicles

Personal auto liability is U.S. property/casualty insurers’ largest line of business, and personal auto insurers face a long and daunting list of challenges. But many of those challenges will merely alter competitive dynamics within auto insurance markets, enabling the best insurers to gain market share at the expense of weaker competitors (e.g., those insurers that master telematics and the associated big data issues can look forward to stealing share from those that don’t.)

Unlike the majority of other challenges, the advent of autonomous vehicles threatens all personal auto insurers, because liability will shift from vehicle owners to auto manufacturers or those who provide the systems and software that enable autonomous driving. Simply put, the market for personal auto liability insurance is likely to shrink dramatically at some point, with a number of auto manufacturers already committing to accept liability when their autonomous vehicles are at fault in accidents.

None of this would be of any consequence if the cost of autonomous vehicles placed them out of reach of the typical consumer. But technology costs for autonomous vehicles are plunging. According to a recent article in the Washington Post, the cost of LIDAR (the “eyes” for autonomous vehicles) is poised to drop from $75,000 to a mere $500 or less. (See here)

Yes, it will be years before autonomous vehicles constitute the lion’s share of the vehicles on the road, and today’s personal auto liability insurers have some good years ahead of them. But change is coming, and, as Sun Tsu said, all battles are won or lost before they are ever fought. Is it really too soon for personal auto liability insurers to begin positioning for the world just now coming in to focus on long-range scanners?

 

Solving the Insurance Talent Crisis

A lot of ink has been devoted to the looming talent crisis in insurance, bemoaning the difficulty of attracting qualified young people to careers in an industry that is a cornerstone of commerce and one that helps countless people and businesses around the globe recover when the worst occurs. And one need not look far to see the cause of the problem. More often than not, we –insurance professionals — are the cause.

How many of us have felt a twinge of embarrassment when strangers at cocktail parties ask what we do? How many of us have worried about being perceived as leading boring, little lives?

Yet, we in insurance get to spend our days thinking about hurricanes, tornadoes, wildfires, earthquakes, car crashes, cyber crime, fraud, pandemics, terrorism and a host of other equally exciting risks affecting people in all walks of life and businesses in every field of endeavor. And we are increasingly using cutting-edge technology, big data and predictive analytics to enhance risk assessment, pricing, loss adjudication and every other aspect of insurance operations. Moreover, insurers are intimately involved in capital markets, managing billions upon billions in investments, not to mention that insurers’ very reason for being is to provide vital help when people and businesses need it the most.

Bottom line, if you’re concerned about the amount of grey hair you see in the insurance business and the difficulty of enticing budding data scientists, technologists, entrepreneurial spirits and the best and brightest of tomorrow’s leaders to consider careers in insurance, please allow me to suggest that you become an ambassador in service to the cause.

All it takes is talking with pride about the problems we solve, the good that we do and the fun that we have along the way.