Software Has No Physical Existence

A hack into a software company’s computers and resulting blackmail payment was not covered by insurance, according to a decision issued today by the Ohio Supreme Court

Facts

EMOI is a computer-software company that uses software it has developed, along with outside software, to provide medical offices with service and support for setting appointments, record keeping, and billing. On September 12, 2019, EMOI became the target of a ransomware attack when an unknown party, i.e., a “hacker,” illegally gained access to EMOI’s computer systems and encrypted files needed for using its software and database systems. As a result of the attack, when a file was opened, a ransom note appeared notifying the user that the files were encrypted and therefore unavailable but that the files could be restored to normal by a decryption key the hacker would provide in exchange for the payment of three bitcoins—approximately $35,000 at the time.

After looking into the timing and financial feasibility of recovering the files through the assistance of a third-party company, EMOI decided to pay the ransom. Upon payment, EMOI received an email from the hacker with a link to download a program that would decrypt the files. A majority of the system files were returned to normal following the decryption process. An automated phone system, however, remained encrypted because the decryption key had not worked on the separate server that attended to that system. There was no hardware or equipment damage as a result of the ransomware attack. Following the attack, EMOI upgraded its software systems and took other steps to protect its systems from future attacks.

The coverage dealt with “physical damage”

Computer software cannot experience “direct physical loss or physical damage” because it does not have a physical existence. See Ward at 850. Software is essentially nothing more than a set of instructions that a computer follows to perform specific tasks. Fantasy Sports Properties, Inc. v. Sportsline.com, Inc., 287 F.3d 1108, 1118 (Fed.Cir.2022) (“Software is a set of instructions, known as code, that directs a computer to perform specified functions or operations”). It is information stored on a computer or other electronic medium. See Ward at 850. While a computer or other electronic medium has physical electronic components that are tangible in nature, the information stored there has no physical presence. Id. In other words, the information—the software—is entirely intangible. Focusing on what the parties would have intended, see Alexander, 53 Ohio St.2d at 246, 374 N.E.2d 146, we are unpersuaded that the policy covered “physical damage” to computer software (an intangible) without there also being physical damage to the hardware on which the software was stored.

Because the insurance policy at issue did not cover the type of loss EMOI experienced, Owners did not breach its contract with EMOI. Accordingly, we reverse the judgment of the Second District Court of Appeals and reinstate the trial court’s grant of summary judgment in favor of Owners on EMOI’s claim of breach of contract and bad-faith denial of insurance coverage.

( Mike Frisch)