if please the court herbert re representing appellant talk with starr i'd like to reserve two minutes of my time for about all the disregarding correctly held that exclusion jian travelers policy applied to aqua stars loss issues concerning exclusion gee were extensively briefed unless the court has questions about that i'm going to i would like to devote my argument today to discussing the computer fraud covering issue which travellers has asked the court to base to affirm the district court on the basis that there is no coverage of the covering language the district court correctly assumed that the losses caused by business email compromised scams fall within the broad covering language in travelers policy for computer fraud the cause and three a transfer of money from the insurance bank to a person or place outside the bank in this case there's really no dispute that the transfer element the third element was m so the question on the coverage issue is whether the cyber criminal used any computer to project only cause that transfer the computer used by the cyber criminal in this case was extensive and pervasive and i want to emphasize that point because i want to come back to it later when we talk about some of the cases that travelers cited the computer to cyber criminal in this case used computers for over a three month period of time to send dozens of spoof e mails that project only tricked aqua started to believing that its vendor wanted aqua star to send payments for the vendor's e mails to a new bank account the use  computer included hacking into a long ways server using the computer to monitor the e mail traffic using the computers to set up spoof e mail to mainz using commuters computers to sin emails directed to aqua stars computer system that showed up on aqua stars computers looking like they were emails from a long way aqua stars vendor the e mails were read on those computers forwarded on those computers and ultimately the effect of those movie mails that were sent over a three month period of time deceived aqua star into wiring it's money that it was going to use to pay longways invoices to the cyber criminal instead of to aqua star under washington law when in construing an insurance policy the question is would a layperson reasonably understand his or her loss to be covered by the covering language and aqua star submit so that a layperson would very reasonably understand the language that travelers chose to use in its policy to cover its loss travelers urges the court to construe its computer fraud definition in a very narrow way it tells you it only applies to hacking losses a hacker has to break into the insurance computer and use that computer to make a transfer that construction is unreasonably narrow and untenable the definition of computer fraud or deceive to cause someone to give someone something of value that they otherwise wouldn't have if i knock on your door and say i'm collecting donations for the red cross i'm trying to trick you into and i'm not from the red cross i'm trying to trick you into giving me money when you otherwise wouldn't have and that is what these two females did they deceived aqua star into is sinning its money to someone they otherwise wouldn't have the policy has a definition of computer violation and it's on the same page as the definition of computer fraud page seven of the policy expert of record page thirty the definition of a computer violation is damage to a computer system caused by a virus or by a person who gains an authorized access to the insurance computer system now and assured looking at paid seven the policy would see those two definitions and they would understand that the computer violation definition refers to hackers but there is no way you can look at the computer puter violation definition that specifically refers to hackers and i understand the broader definition of computer fraud to be limited to but i have a maybe a different question if i take your point that the coverage is quite broad and one of the points of the coverage is if a computer is the use of any computer that basically ultimately causes this transfer of money then it's covered under the policy and there also is a situation where if it was hacking that would be  covered because that relates to the an authorized use correct of the computer for the computer violation but they want you to violate which but ok so so then you say but then you go i then go to the exclusions and in some ways they seem like there's a mirror image because this gets me back to exclusion which says that the crime policy doesn't apply to loss or damages resulting directly or indirectly from the input of data by a natural person having authority to enter the insureds computer system so that is setting up this juxtaposition to both specific hacking where you don't have authority and to the use of not limited to the computer fraud coverage in fact it applies to all the coverages except employee theft funds transfer fraud and a computer violation and so there are number  as simply modifying because the computer fraud coverage and if you read it that broad not modifying it's an exclusion so i guess maybe i'm having some trouble understanding why exclusion  doesn't kick in here doesn't kick in for several reasons for going for one again it's not limited to computer fraud but that is making a difference is that your fraud told me why doesn't apply well because under washington law exclusions have to be considered narrowly and in the context of the policy and so if you interpret exclusion gee in the manner that the district court did here you are you end up with arbitrary i action that caused the money to be sent from bank of america to the phony bank account in japan seem a set up to transfer she's a transfer so it wasn't a direct action by the fraudster hacking in and telling and using the computer back with star to send the money there was the intermediate step of an authorized person using and read them in parallel you could get that kind of result but exclusion gee is not so limited and so if you see if you interpret the exclusion to apply any time and shared of the an employee of the insurance authorize employee access is a computer and uses it in some way it is in the chain of events that lead to a loss you've written you end up with this exclusion swallowing the coverages that are in the policy known as because it has courts have the coverage of the policy still protect a direct hacking and use of the insured computer without any human intervention by any authorized human correct yes or any other week for example i hacker one of the ways that hackers work is they get into your computer system and they monitor your keystrokes and then they learn about them then they get access to your passwords and then they can get onto your computer and so they might go up come on and change the accounting records and then set up some payments that weren't authorized someone in the accounting department thing gets goes on it's one of the system logs in completely innocently not having any idea to the accounting e mails the armored car company and says we need to pick up a hacker monitor you know reads those e mails sets up a hijacking and attacks the armored car because they know that the route that the armored cars going to take in the sending of an email an innocent thing done by the employee results in a loss of coverage because somebody sent an e mail that's not what an insurer would expect this to this exclusion to cover the this there's no court in the country other than the just report below who is it interpreted this exclusion this broadly the morgan stanley court which interpreted  identical language in exclusion said that it was intended to apply when employees accessed the or authorized persons access the computer system to steal or commit a fraud from the from the insurer in addition under washington law efficient proximate cause of the roll applies and what that says is when you have a covered peril in combination with excluded peril and they're both in the chain of events you have coverage in other words in this case the computer fraud the spoof e mails the use of the computer to trick aqua star into stating this chain of events in the motions leads to this innocent action by mr banko to create a spreadsheet that  is not in any way causing the transfers to the washington sufficient proximate cause for all the exception cannot swallow the coverage and act in that case in that context alternately the best guide for this court it seems there is some collision in your argument here because on the one hand you're saying that the losses were directly caused by computer fraud with no intervening steps and then you say that the email scheme basically was a chain or a series of events requiring the application of the efficient proximate cause rule so the transfer itself i mean but you argued in your brief that they were directly caused by computer fraud so i'm just using your words computer fraud so you could substitute a fraudulent we caused transfer to make is the follow so the transfer has to directly cause the loss when i transfer my money when i wire my money from my bank account to a criminal's bank account i immediately indirectly lose it there's no intervening steps between the transfer which is an element of the definition of computer fraud and internal like trying to format and exclusion age so documents or instruments documents that dictionary definition of documents is a document is something that establishes a pro will or a legal document of some type so you need to mail is not a document in this context an email is not a document your honor email is already in an electronic format this disc exclusion refers to converting documents to electronic format and so properly construed first of all if you construe document to mean every thing in a right that's a writing there's no reason to have the word or a commercial instrument so or fraudulently instruments if you take the adjective to go there so the real question as instruments seems to be irrelevant if you're really looking at  and your your argument as a document can't be an electronic document elect a document if you define document to mean anything in writing then there's absolutely no reason to have the other clause or correct second emails are already electronic and so converting something that's electronic to an electronic format doesn't make sense in the context of the policy third letter i would ask you does a document actually even exist if it's an not converting anything you're creating an email right you're not converting a document to an electronic form when you are looking at an email and typing typing information from the email into a spreadsheet as opposed to for example scanning a document  a hard copy and scanning and converting it to tronic document right correct your honor and the washing supreme court has has warned about the literal interpretation of exclusions and insurance companies right exclusions very broadly covering language very narrowly contrary to the rules of construction of insurance policies which is exactly the opposite it can't apply exclusions literally as they're written because that results in these sorts of  exclusions swallowing the coverage the example that i gave in the brief was the policy that excluded losses due to the release of a pollutant and a tank full of a pollutant ruptured and the physical impact of that damage or hurt somebody at the washington supreme court said you could literally read this exclusion as it's written to apply but that's not what was intended in this policy what we really intend it was the release of a pollutant that then causes someone to become ill not that you know you know causes injury because of the physical impact of the release the other reason that exclusion it doesn't apply your honour's the efficient proximate cause will again apply as if if if we disagreed with your view of efficient proximate cause then we're going to be looking at these various exclusions including exclusion age do you have a position on that correctly or what's your position on exclusion age  not my intention right there's no exchange with the cyber criminal he gave up a start and nothing of value for its money that exclusion as it's been interpreted is to make it clear that a commercial crime policy does not apply to losses in commercial transactions so if i sell you one hundred widgets and you tell me that they're great and i get them on their grade c and i say you defrauded me that's not covered in a commercial prime policy that you don't think that these wire payments are covered then they were not part of the transaction of purchase or exchange with the cyber criminals ultimately your honor the the case that probably provides the best guidance to the court is the owens case i know it was it was vacated by stipulation while it was on appeal but none of the cases that have been cited are published decisions or press or precedential so i encourage the court to to consider owens which is very carefully considered computer use is required but that a reasonable insured in that case would reasonably understand that his loss was covered look focusing on the amount of computer use allows the court to avoid the concern expressed by the past master panel that if you interpret the policy too broadly you open the policy up and it becomes basically a general fraud policy thank you think we've exceeded your time considerably banks thankfully save your argument thank you in morning please the court carry valarie on a for travelers as is apparent from the briefs and the cases cited by both parties here this is not on chartered territory there are a number of cases the scuffing computer fraud coverage from a variety of jurisdictions including the ninth circuit here in the past master case and the weight of authority for that last ports travelers position in this case that it is the an authorized use of a computer to transfer money that is covered not the authorized use of the computer to transfer money under false pretenses there is a difference between breaking into a computer and utilizing it from the various purposes and duping and employees into using that computer for ultimately nefarious purposes if we think about this what happened here didn't require a computer at all this is this is a scam a con that is as old as time i don't need to use a computer to convince you if you're gullible to give me your money because i'm somebody else that you think you owe money to or because i tell you my circumstances are different than they actually are and you take pity on me and give me money that's been going on since the beginning of time when we developed a postal service people started sending letters trying to solicit money there's a there's a seventeenth century scam called the spanish prisoner where somebody was requesting money to get out of a spanish prison that's a false pretense when we finally develop the telephone the same thing could happen we don't need a computer to do this this is duping there is a fair spreading of the risks here the insurance company in this case acknowledged that it would cover and protect the insured from any hacking into a computer this is a legitimate and worrisome concern the insurer has assumed the risk of someone breaking into your computer causing it to transfer money from your bank account to some some other bank account and stealing that money were do we find that in the policy in the language having to do with hacking that is fraudulent we cause in the in the definition of computer fraud as the past master court found fraudulent modifies the term because it does not modify the term transfer you have to fraud julie cause a transfer if it hacking is not used but what what section of the policy are you referring to i mean i'm referring to the ensuring agreement tell me what section what paragraph i don't have the specific section and five minutes later helpful because you're forcing us to rely on pacific language that you can't point to us but it's the definition of computer fraud in the policy i mean that's where you would look to find out what  so do you or do you not agree that this was computer for us i just cannot agree this was computer fraud and your in your view this was not computer fraud that my computer fraud is defined in the policy now not of it was not computer fraud then we don't even have to go into looking at exclusion r h orgy that is absolutely correct ok got it so in terms of assuming the risk here we have a situation and just to give you the factual background to show mr valery and yes i have before me if you are twenty six computer crime computer fraud is that where you're saying it's fine the company will pay the insured for the jurors direct loss of or direct loss from damage to money securities or other property directly caused by computer fraud that are directly caused by computer fraud but then there is a definition your honor of computer fraud in the policy in the definition section and that defines computer fraud as to fraudulent because a transfer of money and it's the fraudulent cause that is essential and when the past master court the ninth circuit took to mean hacking the term hacking was used in that case by the court it was used in the taylor lieberman case which was also due to fraud case from the ninth emails and accounts and that fraudulently causes a transfer why isn't it covered where you have you have a number of well because the the again the emails are not the direct cause remember the original ensuring agreement talks about resulting directly from computer fraud so there is that causation element it must be direct the use of it of an e mail which you receive is one step in a chain which ultimately leads to the transfer of money but the ultimate transfer of that money is not done by that e mail the transfer of money is done by there is no coverage exclusion she merely underscores what we see in the ensuring agreement the ensuring agreement covers the the unauthorized transfer of money from the victim to fraudster the exclusion is belts and suspenders it says look if you or it or someone that works for you puts in what you get as false information and you put that into a computer and it ultimately causes a transfer of funds that's not covered because the person who put that in there had the authority to do so now if anyone acting with authority is putting information into a computer that's not hacking hacking require somebody without authority to come in and cause this to happen and that did not happen can i ask a question oh but but then this whole scenario start because the computer was hacked to begin with not the hacking actually took place on the vendor side in other words whoever the fraudster was somehow managed to secure the vendor's emails found out that a star owed money to the vendor then duped aqua star by not using the vendor's email but by using an email that was very similar to the vendor's email but wasn't that that hacking the efficient cause of this  this loss in the first place if there had been hacking of that computer the person who is authorized to transfer the money would have never transfer the money right i  suppose ultimately that is true yes ok so there was a computer that was used there was hacking and there was someone who was duped into believing that they were transferring the money to the people they were supposed to be transferring the money too again if you read it that way your own of this is a general fraud policy you don't need a computer to do that again right you can do that with a phone call you do that with an in person interview you can do that with a with a with a letter i mean the point here is we are preventing the insured has assumed a risk on behalf of the insured that that it will protect it against certain causes of loss those being the invasion of that computer the fraud gently cause the transfer if somebody dupes you into with a forty transferring that money that's a whole different circumstance why why does the policy say that i mean you say that so well you know i understand everything you just said but you're a lawyer and used to be one but the insured isn't so why doesn't the policy just state that in clear concise terms i bet far be it from me to to to a pine on how policies are written i will tell you what the ninth circuit said in past master the ninth circuit did say the policy could be better written but that  no insured could reasonably believe that this was a general fraud policy and therefore there is no reasonable expectation of coverage into the situation again as i said a belt and suspenders exclusion but it does it does apply in any event because that is exactly the scenario that we have here now aqua's starr has presented a number of scenarios in their brief which indicate that exclusion gee is not limited to computer fraud it's it covers other ensuring agreements as well forgery for example but they say they use the example if i may of  somebody creating a forward certificate with a computer and then presenting it to a bank altered forged that theoretically i guess i'm not following really because of course nobody at the bank was authorized to do that so i'm not quite sure how that would work but i guess my basic argument would be forgery is forgery the other example they gave was robbery what if somebody comes in the bank and steal something but they gain access because somebody let them in through the use of a computer pat or what if somebody steals from your armored car because somebody e mailed the crooks as to where you would be forgeries forgery robbery is robbery burglary is burglary computer fraud is computer fraud and that's exactly what we have what they're saying here what they're saying is the use as soon as i push that button i put in the false information unknowingly but with authorization i push that button that when he's gone of course the exclusion applies how could it not apply it is the efficient cost well what if you had a situation where instead of hacking the vendor's computer this company's computer was hacked and then you had someone with authority believing that they were transferring the money to say one of the people they normally do business with someone had authority they pushed the button they transferred the money with their recovery which i believe there would be because the input of data was not authorized the if you're if what if the sonar you're saying is that a crook somehow put data into the computer and then the employees simply use that data to transfer money described the fraudulent e mail that was received was in aqua stars computer system and used to transcribe one of the spreadsheets so it's not meant to not materially different than the hack in question just presented past master is a published memorandum disposition involving a vendor that had obtained authority to make direct withdrawals from the insurance account the ninth circuit panel only said that when you have a withdraw that's authorized and later ron the vendor steals your money that transfer wasn't fraudulent lee caused it didn't say that hacking is required alternately the concern about converting this policy of a general fraud policy is can be addressed by focusing on the amount of computer usage courts have had no problem saying that the use of a phone isn't the same thing as a use of a computer that the use of a computer the computer and bright point is in a facsimile was too remote in tangential to consider to be considered computer usage that the use  computer to draft a prospectus that was relied upon by investors was too remote intangible to be computer usage under the policy but the computer uses in this case is far more substantial and finally your hono eight years ago the owens court told travelers that its policy language was too broad and was broad enough to cover a b e c scam travelers continues to sell this overbroad coverage and ask the courts to unreadably on a narrowly construed the laws of insurance require you to construe covering language broadly and liberally in a manner that a lay person reading the policy would reasonably understand travelers ask a stark request for it to do that in this case