I recently wrote about the WannaCry ransomware attack that crippled companies around the globe and recommended that cyberattacks be addressed in the force majeure provision of a construction contract.
Last week, there was another global cyberattack that was first believed to be another form of ransomware known as Petya, but it turned out that the attack was something more sinister.
Instead of being ransomware, which (usually) results in the victim getting their files and information back at a later date, experts have concluded that last week’s attack was actually malware that was a “wiper,” which prevents the user from ever accessing their files. In other words, a hacker that unleashes a “wiper” on a system is not trying to make money by demanding some type of ransom payment for the information – they just want to damage and destroy.
In addition to adding cyberattacks to the force majeure provision, you should also consider including a contractual provision addressing other potential remedies in the event of a cyberattack. For instance, parties may want to consider a termination provision that is triggered by a cyberattack.
Every project is different, so there is no “one size fits all” approach for addressing a cyberattack in a contractual provision, but here is a framework that you may be able to customize for your project:
Cyberattacks. The term “cyberattack” in this Contract shall mean, “an attempt by hackers to damage or destroy a Party’s computer network or system.” In addition to any other remedy available under the Contract (including any extension of time under Section _____), either Party may terminate the Contract upon _____ days written notice if either Owner or Contractor is the victim of a cyberattack that: (i) substantially deletes or destroys Owner’s or Contractor’s electronic files related to the Project such that Owner or Contractor are unable to continue performing their obligations under the Contract; or (ii) prevents Owner or Contractor from being able to access their electronic files related to the Project for more than _______ days. If Owner terminates the Contract under this Section _____, Contractor shall be entitled to recover (insert remedies, i.e., treated as termination for convenience, or payment to Contractor of a termination fee). If Contractor terminates the Contract under this Section _____, then Contractor shall (insert remedies, i.e., limited to payment for properly performed work, or payment to Owner of a termination fee).
Cybersecurity is an issue that is not going away. Whether you use a provision similar to the one above or draft your own provision, make sure you address the issue in your construction contracts.