BreachExchange mailing list archives
Re: time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost)
From: "Marjorie Simmons" <lawyer () carpereslegalis com>
Date: Fri, 6 Jun 2008 16:13:35 -0700
< Friday muse on a shipper's duty > | Even if you go with a conservative estimate that one | 'identity' is worth less than 20 bucks (recently stated | in a paper) . . . First, the worth of an identity is not the market value of the identity, because the market is illegitimate. : if a package's worth is more than insurance will : cover the carrier can refuse to carry the package Second, many carriers will not refuse such shipments but will limit their liability instead. The focus of the liability for losses needs to remain on the shipper rather than the carrier. It may be helpful to view these losses through a legal "damages" lens. First tho, a simple cost-benefit analysis. Last time I read the standard contract of carriage for a FedEx overnight item it limited damages to the extent of the insurance, which was itself limited to a specific amount. For example, an item with a liquid value of $3000 (a negotiable instrument) could have a maximum insurance of $500, and so carrier loss of the item limits the carrier's liability to $500. The risk of loss beyond the $500 cap is upon the shipper, not the carrier. In commercial contracts (B2B) involving carriers the loss limits can be higher but still have a cap, thus claims are similarly limited to no more than the pre-arranged damages cap, no matter how much the actual value of the incurred loss. The calculation businesses often use in determining the benefit of a low-cost (low insurance) shipping rate involves the statistical loss rate of the carrier. The value of the shipper's benefit in using a specific carrier can be (simplistically) derived from the cost of carriage plus the statistical likelihood of loss, minus the benefit derived from the carrier's actual delivery of the shipped item(s). One accounting method for a cost-benefit analysis is: 1. Identify a risk [ here, carrier loss ] 2. Estimate the potential loss from the risk. Multiply the loss by its likelihood to get the risk exposure. 3. Determine a control procedure that, if implemented, reduces the risk. 4. Determine the reduction in risk exposure resulting from the control procedure. This is the quantitative benefit. 5. Identify incremental costs of the control procedure. 6. Compare the incremental costs with the reduction in risk exposure. 7. Consider qualitative benefits (those difficult to state in financial terms) and the accuracy of your estimates. (http://www.mhhe.com/business/accounting/boockholdt/cost.html) The question thus becomes whether the shipper (not the carrier) has a duty to insure beyond the limits of the contract of carriage. A shipper's duty does not pass to a carrier because the shipper's relationship with regard to the item shipped is with the shipper's intended recipient. Such a duty cannot be contracted to a carrier without the consent of the recipient. Most carriers limit absolutely the insurance available to items of "extraordinary value" (negotiable instruments, works of art, jewelry, etc.) because such items have value beyond their face value which is often speculative. For example, let's say a lawyer FedEx's a legal document to a court, knowing that document must be received by a date certain, but FedEx loses the shipment. What are the losses flowing from that event? FedEx loses $100 unless the lawyer declared a higher value and paid the fee, but still stands to lose no more than $500. The lawyer's clients may stand to lose millions if the court where the document was to be filed does not excuse the lawyer's FedEx loss. The loss of data which can be used in identity theft and is normally considered private also has a speculative value (as far as most carriers are concerned), and thus is something that most carriers class like the above items of "extraordinary value". Such data has intrinsic value but is not currently measured with an absolute value. </ Friday muse on a shipper's duty > ### _______________________________________________ Dataloss Mailing List (dataloss () attrition org) http://attrition.org/dataloss Tenable Network Security offers data leakage and compliance monitoring solutions for large and small networks. Scan your network and monitor your traffic to find the data needing protection before it leaks out! http://www.tenablesecurity.com/products/compliance.shtml
Current thread:
- Re: time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost) Marjorie Simmons (Jun 06)
- <Possible follow-ups>
- Fw: time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost) Mitch Tanenbaum - MC (Jun 06)
- Re: Fw: time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost) Chris Walsh (Jun 06)