Y2K An Inherent Vice — Insurance Claim For Remediation Denied

Originally published in Blakes Bulletin on Information Technology, November 2006

Do you remember the Year 2000 (Y2K) computer issue? In what was said by the Alberta Court of Queen’s Bench to be the only Y2K insurance claim ever brought in Canada and the only one then remaining to be resolved in North America, an insurance claim for coverage of Y2K remediation costs and damages was denied in American Home Assurance v. Canadian Pacific Railway.

Canadian Pacific Railway (CPR) claimed over CAD 51 million from its insurers for direct loss and damages from, and costs to remediate, what the court referred to as the "Y2K problem". The court rejected the claim, concluding that: (i) because the Y2K problem had become notorious and almost certain by 1997, it was not a fortuitous risk which was to be borne by the insurers; (ii) the Y2K problem was an inherent vice as the result of conscious design decisions and so was excluded from coverage; and (iii) a claim under the policies’ "sue and labour" provisions was not available because the Y2K problem was not an insured peril.

To foreshadow its reasons, the court carefully summarized the Y2K problem and its history. In the 1960s, when computer memory and data storage space were limited and very expensive by today’s standards, computer programmers designed programs that used as little memory and storage as possible. In date code functions, considerable space was saved by storing and manipulating the date code in two digits rather than four. This meant that a four-digit year (e.g., "1968") would be stored and processed only as the last two digits (e.g., "68").

By the late 1980s, technology had advanced so that the storage limitations were practically eliminated and the rationale for the two-digit code was essentially obsolete. However, most organizations chose not to change their computer systems to a four-digit code due to the cost, complexity and inconvenience. Programmers continued to use the two-digit date code in new development so that new programs would remain compatible with the vast amount of existing two-digit date data, and new systems often reused date reprocessing routines from older systems. As a result, the two-digit code remained the standard for date processing, manipulation and storage.

Many systems that used the two-digit code would not have been able to handle dates beyond December 31, 1999 correctly. They would interpret the year 2000 and beyond as the year 1900 and following. While this problem was recognized as early as the 1970s, it was not until the mid 1990s that there was a growing awareness of a need for specific programs to address the Y2K problem. Organizations undertook extensive remediation efforts to become "Y2K Compliant".

CPR undertook Y2K remediation efforts, including the wholesale modification, retirement and replacement of computer systems that were identified as likely to experience problems when the date rolled over to 2000.

CPR’s relevant insurance policies provided primary coverage limits of CAD 10 million and excess limits of a further CAD 90 million, subject to a CAD 2 million deductible. The insuring clause stated, in part, that "Subject to the terms, conditions and exclusions hereinafter contained, this policy insures the interest of the Insured in all property of every kind and description ... against all risks of direct physical loss or damage occurring during the period of this policy."

One section of the policies specifically covered "… computer process control equipment and data processing systems, including equipment, computer assisted equipment ... and active data processing media", but also excluded "loss, damage or expense caused directly or indirectly by ... inherent vice, wear and tear, and gradual deterioration or depreciation ...".

The policies also included a "sue and labour" clause which read, in part, "In case of imminent or actual loss, it shall be lawful and necessary for the insured ... to sue, labour, and travel for, in and about the defence, safeguard and recovery of the property insured hereunder, or any part thereof ... "

In September 2000, CPR swore a proof of loss for Y2K remediation costs of almost CAD 38 million. The insurers rejected the proof of loss, and commenced a lawsuit to seek a declaration that the Y2K remediation costs were not covered by the policies. CPR counterclaimed for over CAD 51 million on the grounds that it suffered direct loss and damages due to the Y2K problem or, in the alternative, because it incurred costs from Y2K remediation efforts.

The insurers denied any liability to indemnify CPR and defended on a number of grounds, including that: (i) there was no direct physical loss or damage to CPR’s computer systems; (ii) any damage was occasioned by an inherent vice and was, therefore, an excluded peril; (iii) the amounts incurred constituted the cost of making good a defective design or were a loss occasioned by the obsolescence of insured property; (iv) the amounts incurred constituted expenditures to avoid loss, damage or expense caused by or resulting from error or omission in computer programming; and (v) there was no coverage under the policy’s sue and labour provision because the expenses were not incurred to avert any imminent or actual loss covered by the policy.

In assessing whether an insurance policy covers a claimed loss, a court must examine the provisions of the particular insurance policy and the surrounding circumstances at issue to determine if the events fall within the terms of coverage of the policy. The insured has the onus of proving on a balance of probabilities that it sustained a fortuitous loss or damage to its property during the policy period, or that it was faced with an imminent or actual loss that is covered under the policy in accordance with the sue and labour provisions.

The fundamental characteristic of insurance contracts is the transfer of the "risk of random loss" from the insured to the insurer. The court held that, since the loss that CPR suffered was not fortuitous, it was not covered under the policy. "Fortuitous" means that the cause of the loss is neither intentional nor inevitable. The Y2K problem was not the result of improperly designed code or careless implementation of the design, but rather was the result of an intentional decision to limit computer systems’ ability to recognize date information. By 1997, the Y2K problem was notorious and universally considered to be an event of absolute certainty and, therefore, was not a fortuitous risk that was transferred to the insurers.

The court also denied the claim on the basis that the loss was caused or made necessary by an inherent vice, and therefore was occasioned by an excluded peril. An "inherent vice" is a condition inherent in the insured property which causes it to be damaged when it is exposed to normal conditions. It is a quality that is necessarily incidental to the property rather than occasioned by an adventitious cause.

CPR argued that the losses and the expenses were necessitated by the need for systems to be compliant with external systems. However, the court said that the two-digit code was not a faulty design or design defect, but rather a planned and conscious design decision by the original programmers that worked well for over 25 years. The fact that the design was perpetuated due to an unwillingness to replace the system despite its obsolescence does not mean that it was faulty. The Y2K problem is more accurately understood as a planned obsolescence without taking into consideration the consequences of the decision, and is an inherent vice rather than a design defect.

The court considered three United States’ decisions, including one of an appellate court, all of which denied coverage for Y2K remediation claims. All of those decisions held that Y2K remediation efforts fell under the inherent vice exclusions in the policies. The American Home Assurance court said that there was nothing in this case which was materially distinguishable from the United States’ authorities.

CPR’s claim also failed because there was no "imminent or actual loss" from an insured peril as required to recover under the "sue and labour" clause. Expenses incurred under a sue and labour clause are only recoverable if they have been incurred for the purpose of averting or diminishing a loss covered by the policy but the loss was not covered under the policy. The United States’ decisions were also of this view.

The court held that CPR was not entitled to coverage for any expenses or losses claimed on the basis of the Y2K problem. CPR could not convert the remediation costs into property losses and claim them from the insurers.

North American courts have not been favourable to Y2K problem claims against insurers because the two-digit coding has been consistently found to be an inherent vice. This decision on Y2K may close the Canadian legal book on what was an interesting time for IT professionals and lawyers about a decade ago.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.