Section 230 of The Communications Decency Act - Executive Order 13636

Executive Order 13636

• Pursuant to Executive Order 13636, issued on February 12, 2013, and online legal interpretation thereon, internet companies, webhosts, and websites should act now to protect themselves from losses, including examining their insurance portfolios to ensure that adequate insurance coverage currently exists. If a company does not have stand-alone coverage for cyber risk, companies should highly consider acquiring cyberliability policies that can protect against either third-party or first-party losses, or both.

Third-party cybersecurity insurance policies may provide coverage for: liability for permitting access to identifying information of customers; transmitting a computer virus or malware to a third-party customer or business partner; failing to notify a third party of their rights under the relevant regulations in the event of a security breach; and potential “advertising injury,” i.e., harms through the use of electronic media, such as unauthorized use or infringement of copyrighted material, as well as libel, slander, and defamation claims. Furthermore, first-party cybersecurity insurance policies may provide coverage for: the costs of providing notice to individuals whose identifying information was compromised; the costs associated with determining the scope of the breach and taking steps to stop the breach; public relations services to counteract the negative publicity that can be associated with a data investigation; the costs of responding to government investigations; the costs of replacing damaged hardware or software; the costs of responding to parties vandalizing the company’s electronic data; and business interruption costs.

Moreover, with the imposition of this Executive Order, there likely will be increasing private litigation against companies that experience a cybersecurity incident, with the potential for significant losses resulting from governmental fines or damages awarded in litigation.