Utilities Workshop – Today’s Hot Issues

1. Utilities Workshop – Today’s Hot Issues RIMS Annual Conference April 29, 2014 Moderator: Mark J. Plumer, Esq., PartnerChair, Policyholder Insurance Practice GroupOrrick Herrington & Sutcliffe LLP David S. NalepkaDirector, Insurance ServicesIntegrys Business Support LLC John L. O’MarraManaging DirectorMarsh

2. Legal Notice This presentation is for informational purposes only, and is not offered as legal advice. No attendee should act or refrain from acting on the basis of any matter contained herein without seeking appropriate legal or other professional advice on the particular facts and circumstances at issue. The views expressed herein are the authors’ own and do not necessarily represent the views of their respective firms, attorneys and/or clients.

3. Agenda • Introduction • Claims • Utility Losses that Keep Risk Managers Awake at Night (A Review of the Worst) • Cyber-Risk – A Review of the Claims and Available Coverage • Nuts and Bolts • Project Insurance • OCIPS • Vendor Endorsements • Joint Venture Insurance • Up and Coming Issues • Coal-Fired Power Plants • Decommissioning • RCRA Corrective Action for Coal Combustion Residuals • Questions and Discussion

4. ClaimsUtility Losses that Keep Risk Managers Awake at Night(A Review of the Worst)

5. Civil Claims

6. Civil Claims $39.6M verdict, Colorado, 2004 Plaintiff, an employee of a utility, climbed a telephone pole owned by a telecommunications company. The pole broke approximately 6 inches below the ground, causing the plaintiff to fall approximately 25 feet to the ground. Plaintiff suffered severe and catastrophic injuries, including permanent spinal cord injuries resulting in paraplegia. Plaintiffs sued the telecommunications company for negligence for failure to maintain, inspect, repair, and replace the telephone pole. The telecommunications company asserted third-party claims against the utility. The breakdown of the $39.6M verdict is as follows: • $9.9M for economic losses. • $1M for noneconomic losses. • $10M for potential impairment. • $18M for exemplary damages. • $750k for loss of consortium to plaintiff’s wife. $45M settlement, 1996-2006 Utility placed coal ash in 2 quarries, with permission from the Maryland Department of the Environment, in order to reclaim excavated portions of the site for future development. The coal ash originated from the utility power plants. The plaintiffs brought a class action maintaining that the waste material discharged hazardous substances, including arsenic, lead, cadmium, nickel, zinc and radium, which contaminated the drinking water supplies in the area $48M in cleanup costs, Pennsylvania, 2005 In 2005, approximately 100 million gallons of ash spilled from a utility plant in Pennsylvania, into the Delaware River. The cleanup of the incident cost $48M. In 2008, the company reached a settlement with state regulators for a $1.5M civil penalty.

7. Civil Claims $105M verdict, Pennsylvania, 2009 In December 2012, a utility sustained a $105M verdict after a mother of two died when a power line fell on her in 2009. According to testimony during the 4 week trial, the deceased plaintiff suffered severe burns over 85% of her body after a 7,200-volt power line fell on her. Plaintiff went outside with her cell phone to alert the utility that power lines were burning in trees in her back yard. Plaintiff’s 2 young daughters, and her mother in law, witnessed the tragedy. This is reportedly the largest personal injury case in Pennsylvania history. $180M settlement, Missouri, 2005 In January 2008, a court approved a $180M settlement from a utility in the state of Missouri over the collapse of a reservoir at a hydroelectric plant. The collapse injured a family of 5 and devastated a popular state park. On December 14, 2005, the reservoir collapsed allegedly due to faulty instruments that the utility delayed repairing, which caused the basin to overflow, sending a wall of water down a mountain into Johnson’s Shut-Ins State Park. The deluge injured 5 members of the park superintendent’s family, and devastated much of the tourist destination. The bulk of the settlement, roughly $103M, will go toward rebuilding the state park. $565M settlement, California, 2010 A utility will pay $565M in legal settlements and other claims stemming from a gas explosion, which killed 8 people, injured dozens, and destroyed 38 homes in 2010. The pipeline in question was 54 years old. After investigating the incident, The National Transportation Safety Board cited several failures, including inaccurate record keeping, insufficient pipeline welds, a failure to spend $50M collected by ratepayers on promised safety improvements, and other factors.

8. Civil Claims $940M (projected), California, 2007 In 2010 a utility filed a document with the Securities and Exchange Commission indicating that it had already allocated $940M of its $1.1 billion in insurance coverage to settle lawsuits connected to wildfires in 2007. According to regulators and fire officials, the utility’s power lines caused three of those fires. $1.1 billion to $1.2 Billion (expected), Tennessee, 2008 A utility is expected to spend between $1.1 billion and $1.2 billion on its cleanup and recovery program in connection with damages sustained when a dike ruptured in December 2008. As a result of the rupture, over 1.1 billion gallons of coal fly ash slurry spilled into the Emory river and its Swan Pond embayment. The utility had used the pond for a half century to store coal ash and other sediments leftover from the burning of coal used to fuel a fossil plant.

9. Civil Claims – Additional Claims Information AEGIS has for its insureds additional information on its website, this includes the information on major losses and lessons learned from these events.

10. ClaimsCyber-Risk – A Review of the Claims and Available Coverage

11. Cyber-Risk – The Threat In 2012, two New York state utilities, experienced a data security incident that affected approximately 1.8 million utility customers.  In addition to its costs in responding to regulatory inquiries, the breach also involved costs related to forensic investigations, notifications to customers and credit monitoring services. In 2013, two US power generation facilities were found infected with computer malware according to the US Industrial Control Systems Cyber Emergency Response Team. Both infections were spread by USB drives that were plugged into critical systems used to control power generation equipment.  The WSJ reported that Iranian-backed hackers have escalated a campaign of cyber assaults against U.S. corporations by launching infiltration and surveillance missions against the computer networks running energy companies, according to current and former U.S. officials.   President Obama’s recent signing of the Improving Critical Infrastructure Cyber Security order in February 2013 is also an example of the continued attention of regulators on cyber concern.

12. Cyber-Risk – The Threat • Trends Giving Risk to Cyber-Risk • Near-universal reliance on electronic data, communication, and e-commerce • New technologies pose special risks (e.g., cloud storage, social media) • New products create risks (e.g., smart phone apps) • Hackers are growing bolder and more sophisticated • Utility industry is particularly vulnerable given the massive volume of customer data collected and stored According To One Survey, 76% Of Energy Utilities Experienced A Data Breach Of Some Kind In 2011. (Source: http://www.informationweek.com/attacks/76--of-energy-utilities-breached-in-past-year/d/d-id/1097030?, last visited Feb. 28, 2014)

13. Cyber-Risk – The Threat It could happen to you…- consider the following hypothetical Cyber-criminals have hacked into your company’s database! Personal and financial information (e.g., home addresses, birthdates, Social Security numbers, credit card and bank information) of thousands of customers has been exposed. Within days of the cyber-attack, the following occurs: • The database must be taken off-line and vulnerabilities repaired, disrupting your company’s business; customers and authorities must be notified of cyber-attack • Plaintiffs’ firms file putative class action lawsuits against your company seeking damages • Credit card companies demand forensic investigation pursuant to their security standards, above and beyond your company’s internal investigation – vendors must be vetted, retained, etc. • Law enforcement and regulatory authorities launch investigations • It appears necessary to offer credit monitoring and other services or incentives to assuage angry customers

14. Cyber-Risk – The Threat Data breaches can become high-profile events with significant costs • Restoring services • Security consultants • Forensic imaging • Security upgrades • Notifying customers • Identity theft protection • Credit monitoring • Card brand penalties or indemnification • Lost revenue • Drop in stock value • Loss of customer confidence • Public relations fees expenses • Legal fees for third-party lawsuits • Legal fees for government investigations • Government fines or penalties Insurance Is Available For Many Of These Categories Of Costs.

15. Cyber-Risk – The Legal Landscape • Patchwork of legislative and administrative standards • Federal statutes, e.g., U.S. Electronic Communications Privacy Act (18 U.S.C. §2510 et seq.) • State statutes governing the handling and dissemination of data • Breach notification statutes requiring mandatory disclosure to consumers • FTC privacy rules • State Attorneys General • SEC reporting requirements – Division of Corporate Finance has published guidelines for public corporations who suffer cyber attack or data breaches

16. Cyber-Risk – The Legal Landscape • Civil Litigation: class action lawsuits routinely filed alleging failure to protect personal information, including claims such as: • Negligence – e.g., breach of duty to • exercise reasonable care in protecting and safeguarding personal and financial information • promptly disclose that personal and financial information has been compromised • have procedures in place to detect and prevent the loss or unauthorized dissemination of personal and financial information • Business torts – e.g., • intentional and negligent misrepresentation of adequacy of data security system • Breach of fiduciary duty to protect personal and financial information

17. Cyber-Risk – The Legal Landscape • Civil litigation (cont’d) • Invasion of privacy – most American jurisdictions recognize a common law cause of action for invasion of the right to privacy • Statutory causes of action, e.g., • California Consumer Legal Remedies Act (Cal. Civ. Code §1750 et seq.) • New York Deceptive Trade Practices law (N.Y. Gen. Bus. Law §349 et seq.) • U.S. Electronic Communications Privacy Act (18 U.S. C. §2510 et seq.)

18. Cyber-Risk – The Legal Landscape • Card Brand Claims • Any breach that compromises credit card information will trigger investigations by credit card brands (e.g., Visa, MasterCard) • Detailed forensic investigation into breach and Payment Card Industry data security compliance issues • Possible fines and penalties • Obligation to indemnify banks and card brands for actual losses • Disputes resolved by arbitration pursuant to card brand rules

19. Cyber-Risk – Coverage for Data Breach Costs • We are seeing a fundamental shift in the way the insurance industry covers cyber exposures • Insurers are vigorously contesting coverage under traditional policies • Offering replacement “cyber” policies (Tech E&O and Medial E&O) • Coverage nevertheless may be available under traditional policies • GL • Property • D&O • Crime Coverage For Cyber Events Increasingly Is Being Endorsed Out Of Traditional Policies.

20. Cyber-Risk – Cyber Coverage for Data Breach Costs • “Cyber” policies may cover five major categories of costs: • Costs of internal forensic investigations • Remedial measures • Privacy notification costs • Identity theft protection services for consumers • First-party coverage • Cost of restoring systems • Business interruption/lost revenue • Third-party claims: coverage for defense costs, settlement, or judgment • Government and regulatory investigations: coverage for defense, fines, or penalties

21. Cyber-Risk – Coverage for Data Breach Costs • “Cyber” policies contain numerous standard exclusions: • Exclusion for certain types of fines, penalties, and punitive damages • Exclusion barring coverage for costs arising out of failure to comply with PCI standards and rules • Intentional act exclusion • Prior act exclusion • Terrorism exclusion, with exception for narrowly defined “Cyber Terrorism” (requiring a “political, religious, or ideological” purpose) Cyber Policies Tend To Be Modular In Nature And Vary By Insurer; The Market For These Policies Is Not Fully Developed.

22. Cyber-Risk – Traditional Coverage for Data Breach Costs • General Liability Policies • Personal and Advertising injury coverage insures against claims for privacy violations (“written publication, in any manner, of material that violates a person’s right of privacy) • Courts have recognized broad privacy interests in this context, including (i) the “right to be free from disclosure of personal or confidential information,” also known as a “right of secrecy,” and (ii) “the right to seclusion or to be free from unwanted intrusions.” • Courts interpret “publication” broadly Some Courts Have Refused To Find That The Acts Of Third-Party Hackers Triggers Coverage E.g., Zurich Am. Ins. Co. v. Sony, No. 651982/2011 (N.Y. Sup. Ct. Feb. 21, 2014)

23. Cyber-Risk – Traditional Coverage for Data Breach Costs • Property Policies • Commercial property policies typically cover “direct physical loss of or damage to Covered Property” • Electronic data often is specifically excluded but may be covered under an “additional coverage” provision • Coverage may be subject to an exclusion for “loss or damage caused by or resulting from manipulation of a computer system . . . by any employee . . . or by an entity retained by you or for you to inspect, design, install, modify, maintain, repair or replace that system.” • Business interruption coverage • Protects a policyholder from (i) loss of income as a result of interrupted business operations; and (ii) additional expenses incurred as a result of efforts to continue business operations • May require that the disruption of the business operation be caused by a “direct physical loss or damage” – insurers may argue that security breaches do not constitute a “physical loss”

24. Cyber-Risk – Traditional Coverage for Data Breach Costs • D&O Policies • Lawsuits alleging wrongful acts and negligence may trigger Side C “entity” coverage. • However, policy may exclude coverage for claims involving invasion of privacy or, specifically, data breaches • Crime Policies • First-party losses may be covered under computer fraud extensions • E.g., Retail Ventures Inc. et al. v. National Union Fire Insurance, 691 F.3d 821 (6th Cir. 2012) (finding coverage for hacker’s theft of debit and credit card information of millions of DSW customers)

25. Nuts and BoltsJoint Venture Insurance

26. Joint Venture Insurance Issues • Who Manages JV? Which partner buys insurance? • Risk Tolerance – Deductibles & Limits • JV’s contracts & insurance requirements (Occurrence or Claims made based policies) • D&O Insurance coverage • Must provide coverage for D&Os from both JV partners

27. Include within Corporate Program or Separate Policies

28. Nuts and BoltsProject Insurance – OCIPS

29. Project Insurance

30. Insurance in ContextWhat Insurance Can and Can’t Do • Not all risk is insurable • There is an interplay between insurable and uninsurable risk • Regardless of insurance in place, loss avoidance and mitigation are preferable to an insurance settlement • Insurance can remove barriers to collaboration • Insurers provide their best terms and conditions to projects where risk is managed

31. Insurance in ContextConsider/Anticipate all Stakeholders • Owners • Equity Investors/Partners • Lenders • Engineering, Procurement and Construction (EPC) Contractors • Engineers • Trade Contractors • Insurers • Original Equipment Manufacturers (OEM’s)

32. Insurance in ContextConstruction Risk Management • Identify/Quantify the risk to all stakeholders • Determine the most effective methods to control and mitigate risk • Assign/Define contractual responsibilities • Determine the coverage and limits necessary to protect the parties and the work • Identify which party is in the best position to provide each coverage • Communicate/Collaborate

33. Controlled Insurance Program (CIP)Benefits • Secure coverage and high limits • Coverage for all participants • Removes barriers to small/disadvantaged contractors • Insurer loss control services supplement those of Contractor and Owner • Supported by contractual safety requirements, site safety plan • Completed operations extended through statute of repose • Growing popularity of GL Wraps in states with anti-indemnification statutes • Control over the claims process

34. OCIP vs. CCIPPractical Considerations • Coverage • Price • Market relationships • Cash flow • Risk / rewards • Long-tail claims • Adjustment of contract price • Program administration • Coverage for multiple contracts • CIP from the subcontractors’ point of view

35. Nuts and BoltsProject Insurance – Vendor Endorsements

36. Vendor Endorsements – The Basic Issues • Contractual risk transfer is used to shift financial responsibility from one contracting party to another through a variety of different mechanisms • Contractual indemnity provisions • Insurance

37. Vendor Endorsements – Indemnity • Indemnity Agreements • Contract provision that requires one party to assume financial responsibility for the liability of another party • May include defense obligations • May include time limit for giving notice of claims • Requirements can flow in either direction (to or from contractor), or both • Scope generally may be agreed by the parties • Degree of fault of indemnitor (triggered by gross negligence, negligence, or strict liability claims?) • Degree of fault of indemnitee (is there an exception for indemnified party’s gross negligence, sole negligence, etc.?) • Knock for knock (oil and gas, railroads, etc.) • Legal principles: express indemnity obligations generally supported by common law except state statutes may make it illegal to indemnify another party for intentional misconduct or for its sole negligence (e.g., Cal. Civ. Code§2782; 740 Ill. Comp. Stat. 35/1; Mich. Comp. Laws Ann. § 691.991)

38. Vendor Endorsements – Indemnity • Indemnity Agreements (cont’d) • Example: Deepwater Horizon Explosion – BP contracted with Transocean to conduct exploratory offshore drilling with the Deepwater Horizon, a drilling unit owned by Transocean. In April 2010, after an onboard explosion, the unit sank and a massive oil spill resulted. • Drilling contract contained the following indemnification provisions: • Article 24.1: CONTRACTOR [Transocean] shall assume full responsibility for and shall protect, release, defend, indemnify, and hold COMPANY [BP] and its joint owners harmless from and against any loss, damage, expense, claim, fine, penalty, demand, or liability for pollution or contamination, including control and removal thereof, originating on or above the surface of the land or water, from spills, leaks, or discharges of fuels, lubricants, motor oils, pipe dope, paints, solvents, ballast, air emissions, bilge sludge, garbage, or any other liquid or solid whatsoever in possession and control of CONTRACTOR…. • Article 24.2: COMPANY [BP] shall assume full responsibility for and shall protect, release, defend, indemnify, and hold CONTRACTOR [Transocean] harmless from and against any loss, damage, expense, claim, fine, penalty, demand, or liability for pollution or contamination, including control and removal thereof, arising out of or connected with the operations under this CONTRACT hereunder and not assumed by CONTRACTOR in Article 24.1 above….

39. Vendor Endorsements – Insurance • Insurance Requirements – Contract provision that specifies the types and minimum amounts of insurance that parties are required to obtain to cover risks related to their performance under the contract • Coverage for the work the contractor is performing • Coverage for contractor’s indemnity obligation • May specify types of insurance required (e.g., GL; products liability; professional liability; cyber), specific coverages, minimum policy limits, maximum SIR/deductible) • May specify that contractor’s insurance will apply on a primary (first-in-line) and non-contributing basis vis-á-vis company’s insurance • May name company as additional insured under contractor’s policy (specifically or by way of “blanket” Additional Insured endorsement)

40. Vendor Endorsements – Insurance • Example: Deepwater Horizon drilling contract contained the following provisions: • 20.1 INSURANCE – “Without limiting the indemnity obligations or liabilities of CONTRACTOR [Transocean] or its insurer, at all times during the term of this CONTRACT, CONTRACTOR shall maintain insurance covering the operations to be performed under this CONTRACT as set forth in Exhibit C.” • Exhibit C: “Insurance Requirements” • Established the types and minimum level of coverage that Transocean was obligated to maintain • Provided that Transocean was required to carry all insurance at its own expense and that the policies “shall be endorsed to provide that there will be no recourse against [BP] for payment of premium.” • Stated: “[BP], its subsidiaries and affiliated companies, co-owners, and joint venturers, if any, and their employees, officers and agents shall be named as additional insureds in each of [Transocean’s] policies, except Workers’ Compensation for liabilities assumed by [Transocean] under the terms of this Contract.”

41. Vendor Endorsements – Interplay Between Indemnity and Insurance • Indemnity and insurance requirements are distinct obligations that can differ in scope and application • Example: Deepwater Horizon • Trial court found that since Transocean did not assume liability for an oil spill beneath the surface of the water, under indemnity agreement quoted earlier, BP was not an “additional insured” under Transocean’s policies. In re Deepwater Horizon, 2011 WL 5547259 (E.D. La. Nov. 15, 2011) • Fifth Circuit reversed, construing drilling contract’s indemnity and insurance requirements as “separate and independent” despite the clear intent of the indemnity, thus allowing BP direct access to Transocean’s $750 million insurance tower. In re Deepwater Horizon, 750 F.3d 338 (5th Cir. 2013). • On re-hearing, Fifth Circuit withdrew its opinion and certified questions of contract construction to the Texas Supreme Court • Takeaway: Clear drafting and description of interplay between indemnity and insurance is crucial

42. Up and Coming IssuesCoal-Fired Power Plants

43. Up and Coming IssuesCoal-Fired Power Plants – Decommissioning

44. Up and Coming Issues -- Decommissioning • Environmental standards (EPA) effect on existing coal plants? • Plants nearing end of design life. • Upgrade Environmental Controls, Repower, or shutdown? • Project insurance for major upgrades (OCIPs, Builders Risk, etc.).

45. Up and Coming Issues – Decommissioning • Coverage options for plants nearing end of life: • Full Replacement Cost • Full Replacement Cost w/ sublimit for specific plants • Actual Cash Value • No insurance – fully self-insured • Insurance requirements may exist in: • Mortgages • Lease, Purchase Power, Interconnection, or Joint Plant agreements • Contracts with third parties

46. Up and Coming IssuesRCRA Corrective Action for Coal Combustion Residuals

47. Coal-Fired Power PlantsGroundwater Contamination from Coal Combustion Residuals • Coal combustion residuals (“CCRs”) are the materials that remain after burning coal for electricity: fly ash, bottom ash, slag, and flue gas desulfurization waste • CCRs are one of the largest waste streams generated in the United States • CCRs typically contain metals, including arsenic, mercury, boron, and cadmium • CCRs are disposed of in wet form (sluiced to surface pond) or dry form (trucked to a landfill). • Coal combustion products (“CCPs”) are CCRs that are not disposed of, but instead beneficially used in such things as cement, concrete, road base, wallboard, and agriculture • Historically disposed CCRs may have caused groundwater contamination • Existing state-based regulations may not have required groundwater characterization and remediation • New federal regulations WILL require groundwater characterization and remediation

48. Coal-Fired Power PlantsGroundwater Contamination from Coal Combustion Residuals • 1976 – Resource Conservation and Recovery Act (“RCRA”) • Subtitle C provides standards for hazardous waste, with federal and state enforcement • Subtitle D provides guidance for non-hazardous wastes, for state and local enforcement and through citizen suits • 1980 – RCRA amended by the Solid Waste Disposal Act Amendments • Temporarily excluded CCRs from regulation, pending special studies (completed in 1988 and 1999) • 1984 – RCRA amended by the Hazardous and Solid Waste Act Amendments (“HWSA”) • Heightened standards for landfills and surface impoundments (double liners, leachate collection systems, leak detection systems, groundwater monitoring) • 2010 – EPA issues two proposals, regulation of CCR under Subtitle C and Subtitle D • Subtitle C wastes already have groundwater regulations in 40 CFR 264.90-101 • Subtitle D wastes will have groundwater regulations in new section, 40 CFR 257.90-101, which are detailed and lack flexibility by the States • 2012 – Lawsuits from private parties seek to compel EPA to finalize a decision • 2013 – Court granted summary judgment on the merits to Plaintiff’s claims • 2014 – In a January Consent Decree, EPA agreed to issue a “notice taking final action” by December 14, 2014. At that time, EPA will announce whether Subtitle C or Subtitle D will be selected.

49. Coal-Fired Power Plants – RCRA Corrective Action for Coal Combustion Residuals – Potential Insurance Recovery • Groundwater contamination from historical CCRs may be an insurable event • Historic CGL policies typically provide coverage for “damages . . . arising from an occurrence [or accident] . . . including . . . a continuous or repeated exposure to conditions. . . .” • General-liability policies typically cover liability arising out of (i) bodily injury, (ii) property damage, (iii) personal injury, and (iv) advertising injury • Courts in most jurisdictions have held that damage to groundwater constitutes damage to a public resource (i.e., damage to third-party property for purposes of insurance coverage) • Question is whether a process of contamination was in progress during relevant policy periods • To the extent historical leaching of CCRs gives rise to liabilities – even liabilities imposed retroactively due to a change in regulation – those liabilities are potentially covered under historic CGL policies

50. Coal-Fired Power Plants – RCRA Corrective Action for Coal Combustion Residuals – Recovery Obstacles • Insurers may argue that the cost of performing a statutory obligation (i.e., investigation and cleanup under CERCLA or RCRA) should not be considered recoverable • The vast majority of courts now hold that CERCLA-type clean-up costs and RCRA-type corrective action are “damages” • Insurers may argue that the cost of investigating and remediating ash landfills is an ordinary cost of doing business • The question is whether the costs are remedial in nature • Notice of claim is complicated by the fact that environmental liabilities evolve over time • Notice under historic policies is ordinarily not due until a claim is asserted. In many states, “late” notice does not preclude coverage unless and to the extent an insurer is prejudiced • Pollution exclusions • Since 1985, CGL form includes “absolute” pollution exclusion • Prior exclusions had exceptions that allowed coverage for “sudden and accidental” releases or for “sudden, unexpected, and unintended” events • The meaning of “sudden” has been heavily litigated: does sudden mean “short in duration,” or “unanticipated?”