Court Opinion

ID: 4657523
Source: CourtListenerOpinion
Date Created: 2021-02-04 19:00:39.688233+00
Date Added: 2024-06-11T08:51:06.030486
License: Public Domain

Case: 20-60215     Document: 00515732729         Page: 1     Date Filed: 02/04/2021

              United States Court of Appeals
                   for the Fifth Circuit
                                                                       United States Court of Appeals
                                                                                Fifth Circuit

                                                                              FILED
                                                                       February 4, 2021
                                  No. 20-60215                           Lyle W. Cayce
                                                                              Clerk

   Mississippi Silicon Holdings, L.L.C.,

                                                           Plaintiff—Appellant,

                                       versus

   Axis Insurance Company,

                                                           Defendant—Appellee.

                  Appeal from the United States District Court
                    for the Northern District of Mississippi
                            USDC No. 1:18-CV-231

   Before Wiener, Costa, and Willett, Circuit Judges.
   Per Curiam *
          In this insurance dispute, Plaintiff-Appellant Mississippi Silicon
   Holdings, LLC appeals the district court’s grant of summary judgment in
   favor of Defendant-Appellee Axis Insurance Company. Because we agree
   that Mississippi Silicon Holdings, LLC is not entitled to coverage under the

          *
            Pursuant to 5th Circuit Rule 47.5, the court has determined that this
   opinion should not be published and is not precedent except under the limited
   circumstances set forth in 5th Circuit Rule 47.5.4.
Case: 20-60215     Document: 00515732729          Page: 2   Date Filed: 02/04/2021

                                   No. 20-60215

   Computer Transfer Fraud provision of an insurance policy it purchased from
   Axis Insurance Company, we affirm.
                               I. BACKGROUND
          Mississippi Silicon Holdings, LLC (“MSH”), a silicon metal
   manufacturer, was the victim of a cybercrime. In October 2017, MSH’s Chief
   Financial Officer, John Lalley, received an email from a regular vendor,
   Energoprom, advising that future payments should be routed to a new bank
   account. A letter relaying the same instructions, written on Energoprom’s
   letterhead and signed by an Energoprom executive, was attached to the email.
   The email body also contained previous emails between Lalley and
   Energoprom personnel concerning invoices and shipment details. Lalley
   thereafter authorized two wire transfers from MSH to Energoprom’s new
   bank account, totaling approximately $1.025 million. These payments were
   made in accordance with MSH’s three-step verification process for large
   transfers. First, Lalley initiated a transfer via the online banking system;
   second, another MSH employee confirmed the transfer on the bank’s
   website; and third, MSH’s Chief Operating Officer orally authorized the
   transfer on a phone call with a bank representative.
          But something was amiss. In December 2017, Energoprom called
   MSH to discuss outstanding payments—payments MSH believed it had
   already made. At this point, MSH realized it had been the victim of cyber
   fraud and hired a forensic investigator to investigate the scheme.
          After discovering the fraud, MSH submitted a sworn proof of loss to
   Axis Insurance Company (“Axis”), claiming $1,025,881.13 under a
   commercial crime insurance policy that covered, among other specifics,
   Computer Transfer Fraud, Social Engineering Fraud, and Funds Transfer
   Fraud. Axis granted the claim pursuant to the Social Engineering Fraud
   provision and sent MSH a check for $100,000.00 (the policy limit for that
   provision) but denied that either the Computer Transfer Fraud or Funds
   Transfer Fraud provisions were applicable. Both the Computer Transfer
   Fraud and Funds Transfer Fraud provisions had coverage limits of

                                        2
Case: 20-60215        Document: 00515732729             Page: 3      Date Filed: 02/04/2021

                                         No. 20-60215

   $1,000,000. Axis explained that the Computer Transfer Fraud provision did
   not apply because (1) the funds were transferred with MSH employees’
   knowledge and (2) the fraud was accordingly not confined to the computer
   system, as the policy required.
           MSH sued Axis in Mississippi state court, seeking declaratory
   judgment and damages for breach of contract based on the allegedly
   erroneous denial of Computer Transfer Fraud and Funds Transfer Fraud
   coverage. 1 Axis removed the case to federal court on the basis of diversity
   jurisdiction.
           After discovery had occurred, both parties moved for summary
   judgment asking the district court to construe the Computer Transfer Fraud
   provision in their favor. The district court granted summary judgment for
   Axis, finding that, although the provision unambiguously “requires that the
   fraudulent act directly cause the loss,” the instant loss was caused not by the
   fraudulent computer use, but by the affirmative acts of MSH employees in
   initiating and authorizing the transfer. The court also concluded that the
   provision’s requirement that the transfer occur “without the Insured
   Entity’s knowledge or consent” was not satisfied, again because the transfers
   were initiated with MSH’s approval. 2 MSH timely appealed.
                           II. STANDARD OF REVIEW
           We review summary judgment rulings de novo, construing all
   evidence and inferences in favor of the non-moving party. 3 Summary
   judgment is proper if “there is no genuine dispute as to any material fact and
   the movant is entitled to judgment as a matter of law.” 4 Questions of contract
   interpretation are also reviewed de novo, “including any questions about

           1
              Although MSH maintains it is also entitled to payment under the Funds Transfer
   Fraud provision, this appeal concerns only the Computer Transfer Fraud provision.
            2
              The district court denied coverage under the Funds Transfer Fraud provision for
   largely the same reason.
            3
              Evanston Ins. Co. v. Mid-Continent Cas. Co., 909 F.3d 143, 146 (5th Cir. 2018).
            4
              Fed. R. Civ. P. 56(a).

                                               3
Case: 20-60215         Document: 00515732729               Page: 4       Date Filed: 02/04/2021

                                           No. 20-60215

   whether the contract is ambiguous.” 5 If a contract is ambiguous, the district
   court’s interpretation is reviewed for clear error. 6
                             III. LAW & DISCUSSION
          State law governs questions of contract interpretation 7; in this
   diversity action, Mississippi law applies. 8 “Under Mississippi law, an
   insurance policy is a contract subject to the general rules of contract
   interpretation.” 9 The primary concern is giving effect to the intent of the
   contracting parties. 10 The inquiry begins with the four corners of the
   contract, focusing on the plain meaning of the contract’s language. 11
   Consideration of parol and extrinsic evidence is only permissible if the
   contract’s language is ambiguous. 12 A provision is ambiguous if it is
   susceptible to two or more reasonable interpretations, not merely if the
   parties disagree about its meaning. 13 If ambiguities exist, they must be
   resolved in favor of the insured. 14 Additionally, the court must consider the
   policy as a whole and take care to give “operative effect to every provision in
   order to reach a reasonable overall result.” 15
          This dispute boils down to a disagreement over the interpretation of
   the policy’s Computer Transfer Fraud provision. That provision reads:
          The insurer will pay for loss of . . . Covered Property resulting
          directly from Computer Transfer Fraud that causes the

           5
              Pioneer Expl., L.L.C. v. Steadfast Ins. Co., 767 F.3d 503, 511–12 (5th Cir. 2014).
           6
               Alford v. Kuhlman Elec. Corp., 716 F.3d 909, 912 (5th Cir. 2013).
            7
              ACS Const. Co. of Miss. v. CGU, 332 F.3d 885, 888 (5th Cir. 2003).
            8
               McBeth v. Carpenter, 565 F.3d 171, 176 (5th Cir. 2009) (“A federal court sitting in
   diversity applies state substantive law.”).
            9
               ACS, 332 F.3d at 888 (citing Clark v. State Farm Mut. Auto. Ins. Co., 725 So.2d
   779, 781 (Miss. 1998)).
            10
               Id.
            11
               Alford, 716 F.3d at 913.
            12
               Id.
            13
               Wiley v. State Farm Fire & Cas. Co., 585 F.3d 206, 212 (5th Cir. 2009).
            14
               J & W Foods Corp. v. State Farm Mut. Auto. Ins. Co., 723 So.2d 550, 552 (Miss.
   1998).
            15
               Id.

                                                 4
Case: 20-60215      Document: 00515732729           Page: 5    Date Filed: 02/04/2021

                                     No. 20-60215

          transfer, payment, or delivery of Covered Property from
          the Premises or Transfer Account to a person, place, or
          account beyond the Insured Entity’s control, without the
          Insured Entity’s knowledge or consent.
           The district court and the parties on appeal focus on whether the loss
   “result[ed] directly from” the fraud scheme, but we first consider whether
   that provision was intended to cover the fraud scheme that occurred in this
   case. The policy defines “Computer Transfer Fraud” as “the fraudulent
   entry of Information into or the fraudulent alteration of any Information
   within a Computer System.” “Information” is further defined as “electronic
   data and computer programs.” “Electronic Data,” in turn, means “facts or
   information converted to a form which is usable in a Computer System and
   stored on electronic processing media for use by a Computer Program.”
   “Computer Program” is defined as “a set of related electronic instructions
   that direct and enable a Computer System to receive, process, store, retrieve,
   send, create, or otherwise act upon Electronic Data.” Finally, “Computer
   System” is defined as “computer hardware, software and all components
   thereof linked together through a network of devices accessible through the
   internet . . . that are operated by . . . the Insured Entity and used to collect,
   transmit, process, maintain, store and retrieve Electronic Data.”
          MSH contends that the receipt of the fraudulent email falls within the
   Computer Transfer Fraud provision. Axis argues that the instant scheme
   does not constitute Computer Transfer Fraud because the scheme only
   involved emails that “did not have any functionality that permitted them to
   do anything other than sit in [MSH’s] email system,” and suggests that some
   kind of “hacking” is required.
         Both this court and others have ruled that the mere receipt of an email
   does not constitute computer fraud in the context of similar insurance

                                          5
Case: 20-60215        Document: 00515732729              Page: 6      Date Filed: 02/04/2021

                                         No. 20-60215

   provisions. 16 Although the instant scheme involved the creation of a
   “fraudulent channel” in MSH’s email system through which the scammers
   could monitor and, when necessary, alter emails sent between MSH and
   Energoprom, we agree that the manipulation of emails in this manner does
   not constitute Computer Transfer Fraud as defined by the insuring
   agreement. The fraudsters apparently gained access to the company’s email
   system, but they did not manipulate those systems through the introduction
   of data or programs that could independently instruct the Computer System
   “to receive, process, store, retrieve, send, create, or otherwise act upon
   Electronic Data.” At best, the breach allowed the fraudsters to monitor the
   computer system and to act based on the information they learned.
           Additionally, contract terms cannot be read in isolation. Even if we
   were to assume that the instant scheme constituted Computer Transfer
   Fraud, other language in the provision clearly suggests that this was not the
   type of scheme Axis agreed to insure MSH against. The provision only covers
   losses resulting from Computer Transfer Fraud that “causes the transfer . . .
   of Covered Property from [the Insured’s account] to a[n] . . . account beyond
   the Insured Entity’s control, without the Insured Entity’s knowledge or
   consent.” MSH argues on appeal that the district court erred in concluding

           16
              See Apache Corp. v. Great Am. Ins. Co., 662 F. App’x 252, 258 (5th Cir. 2016)
   (“To interpret the computer-fraud provision as reaching any fraudulent scheme in which
   an email communication was part of the process would . . . convert the computer-fraud
   provision to one for general fraud.”); see also Taylor & Lieberman v. Fed. Ins. Co., 681 F.
   App’x 627, 629 (9th Cir. 2017) (“First, there is no support for [an insured’s] contention
   that sending an email, without more, constitutes an unauthorized entry into the recipient’s
   computer system.”); Pestmaster Servs., Inc. v. Travelers Cas. & Sur. Co. of Am., 656 F.
   App’x 332, 333 (9th Cir. 2016) (“Because computers are used in almost every business
   transaction, reading this provision to cover all transfers that involve both a computer and
   fraud at some point in the transaction would convert this Crime Policy into a ‘General
   Fraud’ Policy.”); Kraft Chem. Co., Inc. v. Fed. Ins. Co., 2016 WL 4938493, at *6 (Ill. Cir.
   Ct. Jan. 05, 2016) (“The gravamen of Plaintiff’s allegations giving rise to the purported
   fraud emanate from the transmission of an email containing a fraudulent address from the
   sender. As a matter of law, this without more cannot constitute computer fraud pursuant
   to the Policy.”).

                                               6
Case: 20-60215         Document: 00515732729               Page: 7       Date Filed: 02/04/2021

                                           No. 20-60215

   that “the transfers must be without Mississippi Silicon’s knowledge or
   consent – not that the fraud must be.” 17
          The policy means what it says: Coverage under the Computer
   Transfer Fraud provision is available only when a computer-based fraud
   scheme causes a transfer of funds without the Insured’s knowledge or
   consent. Here, three MSH employees affirmatively authorized the transfer;
   it therefore cannot be said that the fraud caused a transfer without the
   company’s knowledge. Had Axis intended, as MSH suggests, to only protect
   against employee collusion, it could have limited the provision to transfers
   that occur “without the Insured Entity’s knowledge of or consent to the
   Computer Transfer Fraud.” Rather than include such language, however,
   the agreement plainly limits coverage to instances in which the transfer is
   made without knowledge or consent. 18

           17
               In support of this argument, MSH cites Medidata Solutions, Inc. v. Federal
   Insurance Co., in which the court held that Medidata’s knowledge of a transfer was
   insufficient to preclude coverage under a provision that compensated the insured for losses
   resulting from “fraudulent . . . instructions” purporting to be from Medidata directing a
   bank to transfer funds “without [Medidata’s] knowledge or consent” because “the validity
   of the wire transfer depended upon [Medidata’s] knowledge and consent which was only
   obtained by trick.” 268 F. Supp. 3d 471, 480 (S.D.N.Y. 2017), aff’d, 729 F. App’x 117 (2d
   Cir. 2018). However, the relevant portion of Medidata involved a funds transfer fraud
   provision, not a computer transfer fraud provision, and the use of the word “fraudulent” as
   a modification of “instruction” suggests that the Medidata’s knowledge of the fraudulent
   nature of the instruction, rather than just the instruction itself, is relevant to coverage.
   Further, although Medidata arguably supports MSH’s position, it is not binding, and
   applying its analysis would require us to overlook the plain language that the instant policy
   employs.
            Moreover, other courts have held the exact opposite. For example, in Taylor, the
   Ninth Circuit denied coverage under a policy that covered fraudulent instructions issued
   to a financial institution to transfer funds from the insured’s account “without an Insured
   Organization’s knowledge or consent” because “although [the Insured] did not know that
   the emailed instructions were fraudulent, it did know about the wire transfers.” 681 F.
   App'’ at 629; see also Sanderina, LLC v. Great Am. Ins. Co., 2019 WL 4307854, at *4 (D.
   Nev. Sept. 11, 2019).
            18
               Consider, by way of contrast, the insurance provision in Principle Solutions Group,
   LLC v. Ironshore Indemnity, Inc., 944 F.3d 886 (11th Cir. 2019). That provision covered

                                                 7
Case: 20-60215         Document: 00515732729                Page: 8        Date Filed: 02/04/2021

                                            No. 20-60215

          Moreover, the policy already limited coverage in the manner MSH
   suggests. The Policy also contained coverage (which MSH received) for
   Social Engineering Fraud, which is defined as follows:
          The Insurer will pay for loss of Money or Securities resulting
          directly from the transfer, payment, or delivery of Money or
          Securities from the Premises or a Transfer Account to a
          person, place, or account beyond the Insured Entity’s control
          by:
                 a. an Employee acting in good faith reliance upon a
                 telephone, written, or electronic instruction that
                 purported to be a Transfer Instruction but, in fact, was
                 not issued by a Client, Employee or Vendor[.]
           The policy admittedly anticipates situations in which one fraud could
   fall under various fraud-related provisions. 19 The fact that MSH recovered
   under the Social Engineering Fraud provision in the instant case is not itself
   dispositive. However, as the district court noted, the Social Engineering
   Fraud provision specifically contemplates situations in which an employee
   relies in good faith on a fraudulent instruction. The Computer Transfer
   Fraud provision does not. Instead, the Computer Transfer Fraud provision
   specifically disclaims coverage for transfers made with the insured’s

   losses resulting from a “fraudulent instruction” that “direct[ed] a financial institution to
   debit [Principle’s] transfer account and transfer, pay or deliver money or securities from
   that account.” Id. at 889. A fraudulent instruction was defined as an “electronic or written
   instruction initially received by [Principle], which instruction purports to have been issued
   by an employee, but which in fact was fraudulently issued by someone else without
   [Principle’s] or the employee’s knowledge or consent.” Id. at 890. The Principle policy
   clearly indicates that the insured’s knowledge about the fraud itself would preclude
   coverage, but does not limit coverage to instances when the resulting transfer is unknown
   to the insured.
            19
               Considering the fact that the policy states that “[i]f a single loss is covered under
   more than [one] Coverage, the limit of Insurance that applies to such loss will not exceed
   the highest Limit of Insurance for each loss that applies,” the district court concluded that
   “the fact that the Social Engineering Fraud provision is applicable on these facts does not
   preclude MSH from obtaining additional coverage if a different provision with a higher
   policy limit is in fact applicable.” We agree with this sound reasoning.

                                                  8
Case: 20-60215         Document: 00515732729               Page: 9       Date Filed: 02/04/2021

                                           No. 20-60215

   knowledge. Had Axis intended to provide coverage in instances of Computer
   Transfer Fraud when MSH knew of the transfer but, in good faith, believed
   it to be legitimate, that provision would have said so.
           Our obligation to read the integrated provision as a whole bolsters our
   conclusion that coverage is not due. Although Computer Transfer Fraud is
   subject to a precise definition under the policy, the specific provision plainly
   does not extend to all instances of Computer Transfer Fraud—only to those
   that caused a funds transfer without MSH’s knowledge. By imposing the
   knowledge requirement, the policy narrowed the scope of the provision,
   limiting the types of computer transfer fraud that would trigger coverage to
   instances in which a computer itself is tricked into fraudulently transferring
   funds from MSH’s bank account to a third party without MSH’s knowledge.
   Unfortunately for MSH, coverage simply does not extend to the fraud
   scheme at issue here.
           Because we conclude that the MSH’s knowledge of (and involvement
   in) the instant transfer precludes coverage in this case, we need not address
   whether its loss “result[ed] directly from” the fraud scheme. 20 Further,
   because we agree that the policy clearly and unambiguously precludes
   coverage, we conclude that the district court did not abuse its discretion in
   concluding that MSH’s objections to the magistrate judge’s discovery ruling
   were moot. 21

           20
               This is a complicated question we will, no doubt, need to answer one day. But
   because we can resolve this case on simpler grounds, today is not that day. Compare
   Principle, 944 F.3d at 892 (interpreting the phrase as implying a proximate causation
   standard in the context of a similar insurance policy) with Interactive Commc’ns Int’l, Inc. v.
   Great Am. Ins. Co., 731 F. App’x 929, 931 (11th Cir. 2018) (unpublished) (applying a “direct
   means direct” approach because “one thing results ‘directly’ from another if it flows
   straightway, immediately, and without any intervention or interruption”) and with Am.
   Tooling Ctr., Inc. v. Travelers Cas. & Sur. Co. of Am., 895 F.3d 455, 460 (6th Cir. 2018)
   (declining to decide whether “direct” means immediate or proximate because coverage
   was available under either definition).
            21
               On appeal, MSH also argues that the district court erred in denying as moot
   MSH’s objections to a magistrate judge’s discovery order that prevented MSH from

                                                 9
Case: 20-60215       Document: 00515732729              Page: 10      Date Filed: 02/04/2021

                                         No. 20-60215

           AFFIRMED.

   compelling the production of documents related to subsequent modifications made to the
   language of the crime coverage provisions of the insurance policy. The magistrate judge
   denied the request, citing Federal Rule of Evidence 407, which bars evidence of subsequent
   remedial measures to prove culpable conduct, and noting that MSH had not shown why
   the requested information would be relevant. MSH objected to the ruling, but the district
   court denied those objections in its summary judgment ruling, explaining that because the
   policy unambiguously prevented MSH from recovering under the policy, any subsequent
   changes in the policy’s language were irrelevant and the objections thus moot.

                                              10