Web Site Design Provides Clues To Underwriting Online Risks.

Anti-virus software and fire walls are some of the things that make a company's Web site a good risk for insurers.

The Internet has changed the world in countless ways, including the exposures that companies face when they go online and the standards for those who insure them, said Kae Lovaas, vice president of technology at St. Paul Cos.

Before St. Paul agrees to underwrite a company's electronic risks, it determines whether management makes security a top priority and whether necessary policies and procedures are in place.

To thwart hackers, a company's information-technology system must have fire walls and anti-virus safeguards in place, she said. St. Paul gets a true snapshot of what a company has going by visiting its Web site, which Lovaas noted is "the best underwriting tool in the world. Those are put up by the company's marketing department. They want to brag, so it's a better place to go."

Other things to look for when underwriting e-risks are whether employees are required to sign a statement prohibiting the selling of trade secrets; a policy against using text, photos or music unless the company owns the copyright; agreements with consultants or vendors to ensure that they publish appropriate materials; and a policy outlining a company's computer security procedures.

Another major land mine awaiting insurers is the legal ramifications involved in many of the new Internet programs and features. Because the technology field is so new, Lovaas said it's best to apply traditional ethical standards. She cited the example of the lawsuits over MP3, an online program that allows Internet users to download music. "I can go on the Internet and download music," Lovaas said. "The point is, is it stealing and is it wrong?"

Insurers can take another page from the book of traditional business practices by realizing that current exposures are exposures from the past manifesting themselves differently.

"Copyright, trademark and patent infringement are not new, but it applies to the Internet now," she said. For example, companies using a logo from another Web site without approval could face legal action, as could those downloading text or photos from the Internet without permission and using a competitor's name as a metatag in HTML to get traffic to a site.

Defense costs pertaining to legal actions such as patent lawsuits can add up for a company, Lovaas noted.

St. Paul is one of a growing number of companies that offers Internet business-interruption insurance--an important coverage, considering that when Amazon.com was hacked into and crashed for 24 hours, it lost $4.5 million. Dell Computers lost $35 million, and Yahoo lost $1.6 million in similar hacker attacks.

Despite having underwriting standards and checklists in place, Lovaas cautioned that "it's not possible to eliminate losses that result from doing business on the Internet, so you need to make sure to give them the right risk-management techniques," she said.