Would a Cyber Attack be construed as a Force majeure?                                       cyber@legis

By Er. Sandeep Suri, Advocate , BE.LLB, Chevening Scholar (London), partner cyber@legis

 

 

 

 

cyber@legis

Where law meets cyber.

Cyber@legis is a boutique law firm handled by experienced lawyers with wide experience in handling  cyber litigation and frauds. may be contacted at +91 9216884502

 

 

 

 

Bloomsbury Dictionary of Law defines “force majeure” /fɔs m|/ noun :   Something which happens which is out of the control of the parties who have signed a contract, such as a war or a storm, and which prevents the contract being fulfilled.  : act of God

 

This clause is included in contracts to remove liability for natural and unavoidable catastrophes that interrupt the expected course of events and restrict participants from fulfilling obligations.



Force majeure is normally related to the concept of an "act of God," (act of God /kt əv ɒd/ noun : a natural disaster which you do not expect to happen, and which cannot be avoided, e.g. a storm or a flood. ) meaning an event for which no party can be held accountable for. Force majeure also encompasses human actions, war, nuclear disasters, etc.

Generally speaking, for events to constitute force majeure, they must be unforeseeable, external to the parties of the contract, and unavoidable (irresistible). However what may classify as a Force majeure condition may not necessarily apply to another eg a war in a conflict-ridden zone might not be "unforeseeable"; nor might currency controls in struggling economy or a flood in a frequently-affected area. 

The International Chamber of Commerce has attempted to clarify the meaning of force majeure (though force majeure is not included in Incoterms) by applying a standard of "impracticability," meaning that it would be—if not necessarily impossible—unreasonably burdensome and expensive to carry out the terms of the contract. The event that brings this situation about must be external to both parties, unforeseeable and unavoidable. It can be very difficult to prove these conditions, however, and most force majeure defenses fail in international tribunals.

“ ......the doctrine of frustration cannot apply to a case where the fundamental basis of the contract remains unaltered.”

CYBER ATTACKS

We are developing new threats, and cyber attacks perhaps have the highest capability of causing a business stoppage.

Would a cyber attack classify as not "foreseeable" in a legal sense.  Would it considered as "external" or "acts of God," being controlled by a human agency. Is ransomware a Force majeure condition?

An enterprise, no matter how big or small, whether directly or indirectly connected with data, that suffers a successful attack of this nature may be liable to its customers for breach of contract for their failure to fulfil contractual obligations unrelated to cyber security. It is also possible that, in some businesses, the occurrence of the attack itself may be sufficient to be a breach of an express or implied term that customer data would be stored securely and with due care eg in a hospital maintaining client records.

Contractual obligations cannot easily be avoided, unless it can successfully be argued that a cyber attack has caused a contract to be frustrated because a material change in circumstances has rendered it physically or commercially impossible to perform . However courts have been reluctant to give a broad interpretation to the concept  of frustration of contract. Then the only other way for a party to avoid performing its contractual obligations without incurring liability would be to invoke a force majeure clause.
Accordingly, in the absence of a force majeure clause that specifically contemplates failure to perform as a consequence of cyber security issues, even relatively minor interruptions can result in liability for breach of contract. Whether or not a cyber attack amounts to an event of force majeure will depend on the actual wording of the relevant force majeure clause.



Normally cyber issues are considered as an exclusive domain of technology or data-sharing contracts.  Most commercial contracts (and moreso in India) pay scant attention to such issues.

Let us look at a following example:

  • CG has entered into for a supply of Electrical transformers with UY. The contractual obligations provide for a timely delivery schedule as UY is setting up a new unit. CGs repeat orders may be at stake. And delay for UY means project delays and costs overruns.  
  • CG was hit by a Ransomware attack leaving their entire systems encrypted.
  • UYs delivery is delayed.

Would a plea of force majeure (events outside of their reasonable control) be available to CG to escape liability under the contract (assuming standard force majeure clauses being inn place)?

UYs argument that the effects of the ransomware were entirely in CGs reasonable control,

-        Being a manufacturing unit using technology , such an attack on CGs systems was foreseeable.

-         If CG had applied the latest patches and updates which would avoided a disruption.

-        If Cg had failed to apply to take appropriate steps to ensure that their defences were appropriate,

-        If  necessary back-ups of important data had been maintained.

-        If they had a cyber-disaster recovery plan in place.

The argument would be simple; that they failed to mitigate their foreseeable risk.

In my view, cyber attacks like ransomware are a foreseeable risk.

International Data protection legislations require data controllers and processors to put in place ‘appropriate technological and organisational measures’ to protect against cyber risks. (similar  legislations are still not here in India but can be expected soon).

Applying the same tests in such a dispute , Where there is a known and published risk (as was the case with the WannaCry attack), together with patches and updates to prevent it, then it is hard to see an argument for force majeure being successful, especially where disaster recovery plans are insufficient or non-existent.

Businesses should hence consider whether all significant commercial contracts , irrespective of whether they are technical or data sharing contracts, should have provisions in place regarding liability in the event of cyber-attacks, disaster-recovery obligations and perhaps even cyber insurance requirements.

Alternatively, if you want to rely on force majeure clauses, then you will need to make sure that you have taken all reasonable steps to mitigate any risk.

It has also been held that applying the doctrine of frustration must always be within narrow limits.

LAW IN ENGLAND

Indeed, in England, in the celebrated Sea Angel case, 2013 (1) Lloyds Law Report 569, the same view has been upheld:

“111. In my judgment, the application of the doctrine of frustration requires a multi-factorial approach. Among the factors which have to be considered are the terms of the contract itself, its matrix or context, the parties’ knowledge, expectations, assumptions and contemplations, in particular as to risk, as at the time of the contract, at any rate so far as these can be ascribed mutually and objectively, and then the nature of the supervening event, and the parties’ reasonable and objectively ascertainable calculations as to the possibilities of future performance in the new circumstances. Since the subject matter of the doctrine of frustration is contract, and contracts are about the allocation of risk, and since the allocation and assumption of risk is not simply a matter of express or implied provision but may also depend on less easily defined matters such as “the contemplation of the parties”, the application of the doctrine can often be a difficult one. In such circumstances, the test of “radically different” is important: it tells us that the doctrine is not to be lightly invoked; that mere incidence of expense or delay or onerousness is not sufficient; and that there has to be as it were a break in identity between the contract as provided for and contemplated and its performance in the new circumstances.”

In an instructive English judgment namely, Tsakiroglou & Co. Ltd. v. Noblee Thorl GmbH, 1961 (2) All ER 179, the court held that despite the closure of the Suez canal, and despite the fact that the customary route for shipping the goods was only through the Suez canal, it was held that the contract of sale of groundnuts in that case was not frustrated, even though it would have to be performed by an alternative mode of performance which was much more expensive, namely, that the ship would now have to go around the Cape of Good Hope, which is three times the distance from Hamburg to Port Sudan. The freight for such journey was also double. Despite this, the House of Lords held that even though the contract had become more onerous to perform, it was not fundamentally altered. Where performance is otherwise possible, it is clear that a mere rise in freight price would not allow one of the parties to say that the contract was discharged by impossibility of performance.

 

INDIAN CONTRACT ACT

“Force majeure” is governed by the Indian Contract Act, 1872. 

“32. Enforcement of Contracts contingent on an event happening - Contingent contracts to do or not to do anything if an uncertain future event happens, cannot be enforced by law unless and until that event has happened. If the event becomes impossible, such contracts become void.

56. Agreement to do impossible act - An agreement to do an act impossible in itself is void.

Contract to do act afterwards becoming impossible or unlawful. A contract to do an act which, after the contract made, becomes impossible or, by reason of some event which the promisor could not prevent, unlawful, becomes void when the act becomes impossible or unlawful.

Compensation for loss through non-performance of act known to be impossible or unlawful. Where one person has promised to do something which he knew or, with reasonable diligence, might have known, and which the promisee did not know, to be impossible or unlawful, such promisor must make compensation to such promise for any loss which such promisee sustains through the non-performance of the promise.”

The law in India has been laid down in the seminal decision of Satyabrata Ghose v. Mugneeram Bangur & Co., 1954 SCR 310. What was held was that the word “impossible” has not been used in the Section in the sense of physical or literal impossibility. The performance of an act may not be literally impossible but it may be impracticable and useless from the point of view of the object and purpose of the parties. If an untoward event or change of circumstance totally upsets the very foundation upon which the parties entered their agreement, it can be said that the promisor finds it impossible to do the act which he had promised to do. It was further held that where the Court finds that the contract itself either impliedly or expressly contains a term, according to which performance would stand discharged under certain circumstances, the dissolution of the contract would take place under the terms of the contract itself and such cases would be dealt with under Section 32 of the Act. If, however, frustration is to take place de hors the contract, it will be governed by Section 56.

In M/s Alopi Parshad & Sons Ltd. v. Union of India, 1960 (2) SCR 793, the apex court held that the Act does not enable a party to a contract to ignore the express covenants thereof. Parties to an executable contract are often faced, in the course of carrying it out, with a turn of events which they did not at all anticipate. This does not in itself get rid of the bargain they have made. It is only when a consideration of the terms of the contract, in the light of the circumstances existing when it was made, showed that they never agreed to be bound in a fundamentally different situation which had unexpectedly emerged, that the contract ceases to bind. It was further held that the performance of a contract is never discharged merely because it may become onerous to one of the parties.

In Naihati Jute Mills Ltd. v. Hyaliram Jagannath, 1968 (1) SCR 821, the Apex Court concluded that a contract is not frustrated merely because the circumstances in which it was made are altered. The Courts have no general power to absolve a party from the performance of its part of the contract merely because its performance has become onerous on account of an unforeseen turn of events.

It is clear from the above that the doctrine of frustration cannot apply to a case where the fundamental basis of the contract remains unaltered.

 

,