Martin Hinton (00:05)
Welcome to Cyber Insurance News and Information Podcast. I'm your host and the executive editor of Cyber Insurance News, Martin Hinton. And joining me today, a repeat guest, Dustin Carlson, president of SRA 831(b  Admin. And Dustin, welcome back. Thanks to ha thanks for joining us.

Dustin Carlson (00:22)
Yeah, good to be back, Martin. Thanks for having me on again.

Martin Hinton (00:25)
Our pleasure. So I I know we've got a court case that's really interesting to to discuss that's relevant to you, cyber insurance and the the gap that exists between that and coverage. But for the audience joining us that doesn't know yet, take me through what 831(b)   is. Wha w what is what is that in in the elevator pitch world?

Dustin Carlson (00:44)
Yeah, so 831(b thirty , B, I always liken it to another section of the tax code here in the US, 401k. You know, every everyone knows what a 401k is for the most part. It is an account you get to save up for retirement and it builds a little quicker because it's not being taxed. You know, it you're you're taking tax deferred proportion of your income, growing it in that account. 831(b) much of the same the same way that

But it allows for a business to defer taxes on its revenue to save up for a rainy day. Things like a cyber event that your business might suffer, that your traditional insurance doesn't cover adequately. it's really just an alternative way to finance risk with tax deferred dollars using a section of the tax code.

Martin Hinton (01:30)
So it's like a business version of the healthcare savings plan that exists, right? Is that

Dustin Carlson (01:35)
Yep, that that's a great comparison. Yeah. you know, health health savings accounts let you use that money to you know, for certain health expenses, works much in the same way. Absolutely.

Martin Hinton (01:49)
So jive diving into the recent news, you were involved in a suit down in Texas, if I'm not mistaken, in federal court.

Dustin Carlson (01:55)
That's right.

Martin Hinton (01:56)
Drake Plastic versus SRA 831(b . Admin. Tell me about that case and how it came to be and and the outcome of it.

Dustin Carlson (02:06)
Yeah, you know, so like a lot of tax deferral programs, you know, they they g they have been abused in the past by promoters that you know, use these to game the system, right? you know, that's kind of how the people in the US work. They always find ways to try to game game the system a bit. And so in the you know, late two thousands, early twenty tens,

A one was being used to avoid estate taxes. So we had estate attorney estate tax attorneys that were using 831(b) to, you know, magically transfer a business owner's estate to their to their heirs, to their grandkids, to their to their children. and that was blatant abuse of the tax the tax code. we we agree at SRA that that's not how 831(b) one should be used.

and so the IRS has a bad taste in its mouth over 831(b and in those specific abuses that went on. And so in 2025, they issued some final regulations related to 831(b, kind of in the final days of the Biden administration, right before you know the second Trump administration began.  and  of many government agencies that issued regulations at that time, just to be clear on that. and so

We felt that those regulations were not you know, within the IRS's authority to to issue. And so we we sued the IRS in last year in twenty twenty five. and in April of this year, a actually on tax day, ironically, the judge issued an opinion in that case and threw out a portion of those regulations. and I I can go into more detail of what those regulations were and

I if you'd like.

Martin Hinton (04:00)
So yeah, well well let's start with the the if you will, the rub that created your need to to go to court. Wha what what was it that that the th that administration or the pro policy change at the end of the Biden administration, w how did it impact your business to the point where you needed to take legal action?

Dustin Carlson (04:17)
Yeah, so the regulations that were issued created reporting requirements for for our clients and then anyone else in the 831(b thirty-one  space using 831(b thirty-one . and and what the regulations basically said was you're either a transaction of interest, and what that is is the IRS basically saying, We've identified this transaction and we think it might have the potential for abuses, and so we want to learn more about it. We're interested to learn more about it. So a transaction of interest.

and and the second part was a it created a listed transaction designation. listed transaction that is the IRS effectively saying we have all the information we need. We determined that if all of these factors exist, then this is an abusive transaction in in all instances. and we had a problem with that because

that that would that affected a portion of our clients, the listed transaction part, but then broadly speaking, the transaction of interest part captured a lot of our clients because of the the the tests that they had, you know, the factors they had that created those reporting requirements were very broad and frankly not backed by evidence that that the IRS would have gathered over time related to these transactions. And so

we we made those arguments in in the fifth district of Texas and the judge found that at least for the listed transaction part of it, where the IRS was saying, Hey, we have enough evidence, and because of that, this is an abusive transaction, the judge found that they actually were severely lacking in evidence to to make that determination. And so the judge she threw that portion out of the regulations. She retained the transaction of interest portion.

of the regulations, which, you know, th those are the the the lesser of of the two designations, you know, it's being, hey, we need to determine if this is an abusive transaction versus you are abusive. big difference there when it comes to the IRS in terms of penalties, in terms of you know, C certain CPA firms won't even prepare your tax return if you have that listed transaction designation.

And so to have that piece thrown out was a big win for us. We have gone down the road since then to appeal that the decision to go after the full regulation. Because, you know, if if they were lacking evidence on this side, then they're, you know, lacking the same evidence to do this over here as well, to the list, the transaction of interest part. And and why we we sued in the first place, you know, it creates a heavy burden for our our clients that use 831(b.

you know, you have to file a separate form with your tax returns. You have to fully explain, fully disclose the transaction. So, you know, it's it's the form, but then also attachment upon attachment and and attachment, where you need to really get in the weeds with the IRS and explain, fully explained. And and down the road, if the IRS says, well, hey, you didn't disclose this  little piece as part of that, they can levy penalties against you and fines. So

burden to to our clients and and a burden to sra at the end of day because we're the ones having to administrate these plans and prepare all of that for our clients. And you know it's it's it's a battle that's been going on for about a decade now with the IRS related to 831(b) because they were abused in the early you know late 2000s, early twenty tens. And you know, we feel that the IRS with these enforcement actions that they've taken

haven't really addressed the issues that existed back then, and and are kind of throwing the baby out with the bathwater a little bit. And so it was a fight that we feel was it it was time for us to get involved, and kind of enough is enough and and fight back and and and try to try to get some better clarity. So

Martin Hinton (08:27)
It it it sounds to me like they were punishing everyone in the class because  person was chewing gum.

Dustin Carlson (08:34)
That's exactly right. Yeah, that's a great analogy. Yeah.

Martin Hinton (08:38)
am I right? Just to just to to break it down for for for me, the the the listed transaction part sounds like like almost having an indictment, right? Like that's like the grand jury process where they've they've in their administrative way that the IRS can and does, they've determined, at least from their own perspective, that you are guilty of something. Is that too much to say?

Dustin Carlson (08:59)
No, you're you're exactly right. And the judge basically says that in her in her you know, in her opinion that you know, you can't say that someone's abusive or or someone's guilty of something with no evidence. And and that's effectively what the IRS did by creating that listed transaction designation. and

Martin Hinton (09:17)
Well they so

w they were basically working under the assumption flawed or otherwise motivated that if you engage in the 831(b pro program plan, you are attempting to evade taxes, in this case perhaps estate taxes, in a way that's illegal, right?

Dustin Carlson (09:36)
That's right.

Yep. They they they're basically slapping that label on you, regardless of what you know the specific facts are of your a of your certain 831(b plan. They were just, you know, painting with a very broad brush. And you know, it it it's it's again, it goes back to abuses from over a decade ago. That ironically, Congress has addressed most of these issues in twenty fifteen when they passed, you know, clarifying language around 831(b thirty . B. They've cleaned up a lot of the estate.

Tax issues that the IRS had with it, but they continue to go after it. And you know, not to go too far into the weeds here, but you know, 831(b is a subsection of 831 of the US tax code. And 831 formalized what's known as captive insurance. And captive insurance, all that means is it's a wholly owned subsidiary company that you are self-insuring with.

So it's a captive insurance company that you own and operate for your business. And under section 831, you have 831A and you have 831(b. And and for a long time, the IRS went after Section 831A captives. And those are larger companies. So, you know, companies like UPS, Best Buy, you know, UPS, if you if you go and get their shipping insurance when you ship a package.

They're putting that into their captive insurance company. They're they're using that to cover those losses there. if you go to Best Buy and buy the extended warranty on your television, they're putting that inside their captive. and so for a long time, the IRS was going after these larger companies with larger, with large 831A captives. and eventually, after some wins in tax court, eventually they lost cases kind of around 2012. They started to lose and

And that's where you see the IRS then shift their their magnifying glass to 831(b at that time. And and that's been going on for over a decade, where they've been you know saying, well, we lost the fight over here, now let's take the fight over here. And and the encouraging thing is we're starting to see some signs that we might be approaching a time where the IRS might start to lose 831(b thirty-one  cases and maybe we start to gain more clarity in this space as well.

Martin Hinton (11:55)
Was there during the trial, and I apologize for not knowing this in advance, was there any testimony that might help understand beyond if your job is to enforce tax code, you find a way to enforce tax code? Was there any indication of the motivation or or however flawed you might see it? Their logic behind coming after, say, the the the way you administer these for the purposes of you know gaps in say insurance coverage for a cyber breach?

Dustin Carlson (12:23)
Yeah, you know, they they paint with such a broad brush that it it's hard to get them to drill down to specific scenarios and and you know, hey, we we operate this way, is is this appropriate? Do you do you do you think that's within the bounds or or that qualifies for tax purposes? you know, the IRS has never been willing to sit down with the industry to even have that conversation. They they prefer to you know, paint with a broad brush, you know, we

We have our own theories for why they do that. One of them being that, you know, scare taxpayers out of even wanting to use 831(b, because who wants to draw the ire of the IRS at the end of the day? and so it it I think I think there is a little bit of strategy to keep things unclear for American taxpayers that might want to use 831(b. so yeah, no, unfortunately we have never been able to kind of drill down and say, hey, we do things this way, is that

Okay in your eyes. that's that's never been an opinion the IRS has wanted to give.

Martin Hinton (13:25)
Conversely, did the did they have any specifics about how or what taxes were being evaded? With did they put any dollar amounts on it or the apparatus or the structure of it that that in their view was a violation of tax code?

Dustin Carlson (13:40)
You so the two factors that they had inside of the regulations were related to loss ratios that you had within your 831(b . So the the amount of claims you were paying out relative to the premiums going in. and they had an issue with so the transaction of interest designation, if in any given year, if you had a loss ratio less than sixty percent, they wanted you to file the the additional ex disclosure with your tax return.

and you know, there are many insurance companies that pay less than even a 10% loss ratio. You you look at things like surplus lines coverage, you know, these these special types of insurance that you know it that you need to go to a specialty company for, a lot of those are paying less than 10% loss ratios. And so does the IRS think that those are real insurance companies? you know, you'd have to ask them, I guess.

and then on the listed transaction designation, it was a loss ratio of less than 30% over a 10-year period. and the the the thing we always like to talk about in the insurance in when we are talking to the IRS or commenting about these is you know, you you look at the terrorism program that the US government created following 9-11, that has never had a claim under it in the 25 years now.

that it's existed and so is that real insurance because it has a zero percent loss ratio over twenty five years. so there's just a lot of you know, I I think what it boils down to is the IRS does not understand insurance. you know, so you you have people trying to you know, apply their their own kind of thinking to it. you know, it to to look and feel like an insurance company, they think you need to pay out all your premiums and claims every year.

You know, if if if if you were to apply that personally, if I'm paying home insurance premiums, that you could theorize that the IRS wants to see my house burned down sixty percent of the time, to to be in sh to be true insurance. And as we know, that's not the case. that's you're you you pay your homeowners and you pray to God that you don't ever have to use it, right? and so the the other factor was a financing factor. and and this was

If you were an owner of an 831(b and then you borrowed the money out of the 831(b, that it it created that designation as well. we we kind of see the logic there a little bit. we we don't we we disagree with them to an extent on that. We we we think that these insurance companies, these 831Bs, need to be able to pay claims at the end of the day. So it's a bad look if the shareholder is

paying premiums to the 831(b thirty  B and then borrowing the borrowing those out the next day. You know, is are you really operating like an insurance company at that point? So yeah, go ahead.

Martin Hinton (16:45)
No, no, I was gonna say trying to to you I mean you've done a good job of saying they didn't really explain the logic, but that that example there makes me think that there could be within the IRS some view of this as a mechanism for laundering money, right? Moving it through an apparatus and then loaning yourself

Dustin Carlson (17:03)
Yeah, or or or or a way to

Martin Hinton (17:04)
I'm just I'm just speculating now.

Dustin Carlson (17:06)
or or a way to, you know, get get like a tax free loan from this company or

and and avoid taxes. I mean, and these are these are the types of types of abuses that do go on, but you know, by and large, the people the the companies like SRA, like our competitors in this space, you know, really since twenty twelve, twenty fifteen.

A lot of a lot of the folks, you know, the industry has matured in that time and and is is truly operating with within, you know, I think what the IRS would call it within the bounds of of how it should be operated. And so they they continue to paint with these broad brushes and and that's really the issue. And you know, I I always tell folks that again, with any tax deferral program, there's abuses and and you can go Google right now 401k abuses and and you can find

abuses that went on last year with with 401k. So, you know, it again, the the issue is we're not saying there aren't abuses under 831(b. We would like to see the IRS be more specific, you know, maybe use a scalpel in s instead of a you know, again, painting with that broad brush. and and we would love, you know, we've been saying this for over 10 years, we would love to come to the table with the IRS and

And you know, maybe show them some of the things we've seen you know, from other other people in this space that that they're doing. They might not may not may not even be aware of some of the other abuses that are that go on in this space that we've seen. And and we would love to come to the table and and come to a real solution. you know, SRA, our our ten year target, our ten year goal is we want 831(b to be ubiquitous with 401k. We we think every business owner should know what it is.

You know, if if you have built your business to a level that you're now sitting back and worrying, you know, I've I've grown this business, it's it's beyond my wildest dreams, the success that it's had. How do I protect it now? And and that's that's the importance of 831(b . You can take some of that risk off the table and protect what you've built. And we think it's important that every business owner is aware of it at least as an option.

Martin Hinton (19:18)
Yeah, I mean I Lil, I mean I y to hear you talk about it and to to have spoken to you more than once before and read your op eds and on our site, there is this rain rainy day fund is not a complex idea. And the idea that you should be able to do that in a way that, you know, doesn't allow for cheating, if you will. Even on a personal level, it would be kind of an interesting idea that you could, you know, have money set aside that can be used for very specific things and and to help you, you know

Be resilient, right? That's the magic word. So so

Dustin Carlson (19:48)
Yeah. That's cool.

Martin Hinton (19:50)
let me let me make let me make sure I understand things. You've got the the listed transaction element of this, the more serious of the two issues you had was vacated by the the judge. But the transaction of interest, meaning it's something that, if you will, puts up a red flag for the IRS and they're like, well, we should take a closer look at that to make sure it's all hunky dory, that lingers. So what's the next phase of this? Is there an appeal of that transaction of interest c ongoing?

Dustin Carlson (20:17)
Yeah, so we we appealed the decision be go to go after the transaction of interest part of it. And and really what it I our argument is gonna boil down to is, you know, if if it was determined they lacked enough evidence to say it was a listed transaction, then you know, they they lacked the evidence over here as well, to to make it a transaction of interest. so we we've appealed that part of it. We we still have not filed our appeals brief. that that will come in the next month or so.

and then the IRS also did a cross up a cross-appeal, which we expected them to appeal that decision. so they they are also gonna go and challenge the listed transaction finding of the judge. and so we'll we'll that process will play out. There are also other two other competitors of ours in the industry that have ongoing cases. CIC services in Tennessee in the sixth.

district there. They have they lost their case entirely in the 6th district. That was decided before our case. They've since appealed that decision. So that's going through the appeals process. And then Ryan LLC, also in Texas, has appealed or sorry, has an ongoing case, so that has still not been decided in the 5th district there. So that that that awaits. So

We could be set it setting ourselves up for you know, going all the way to the Supreme Court potentially if if that district split continues there between the sixth and the fifth, it we could see this potentially go to the Supreme Court and you know, that that'll be that'll be a interesting you know, process to go through. So, you know.

Martin Hinton (22:04)
You you you said you would love to sit at the table with the IRS. I I dare say you might mean the word like. I don't know about love, but I

Dustin Carlson (22:11)
Yeah.

Martin Hinton (22:11)
I joke. I joke. so i this is you know, in the in the continuum of life, right? The the Sisyphian reality of life where we're just pushing rocks up hills. This is a a bit of a win for you guys. This is you know, celebratory moment. What is it what as you sort of plan into the future, as you look into the future the much as as much as any of us can.

What do you think this'll do for the landscape of you know making this more appealing to companies that may be a little more reticent? You mentioned, you know, p no  wants to have the IRS call them, right? No  wants to be on their list, ev whatever it is. And and I and obviously reducing the chance of that is something that makes, you know, for a more risk free from a tax point of view reality. Have you seen any change in that? Or have you have you been, you mentioning this as you seek new business? Or w wha what's what's what's changed since April?

Dustin Carlson (23:03)
You know, hav having that listed transaction designation gone definitely helps conversations. you know, particularly with the the CPA community that we work with. you know, CPAs, they they they're maybe even more sensitive to dealing with the IRS. You know, they they they don't want to draw that because they know they're they're gonna have to help their clients through that audit process and and be there for them. And you know, that's that's more time that takes away from them doing their normal tax work and and all of that type of stuff. And so

you know, having that listed transaction designation gone, CPAs are definitely more feeling more comfortable with it. you know, that was definitely a roadblock in in years past, really, I guess in 2025 when this was in effect, for CPAs because they they see that and they they see that as a higher audit risk, penalty risk, and and then they also have put their own potential liability as t the tax preparer signing off on that return as well.

And so it it's definitely helped that conversation. you know, I'd I'd say by and large for us, you know, the conversations have continued even throughout you know, the this this becoming regulations in 2025. Where really since COVID, we have just seen the business community be much more aware of the risk that they have that isn't covered by their traditional insurance. And so

the conversations we're having all revolve around I have this risk, how do I save up for it? you know, the there I always say our tax code is structured for incentives. You know, the they give you a child tax credit because they want you to have kids and and grow and you know grow the economy that way, grow the tax base that way. You know, those some some cynical ways to look at it, but I I think that's true.

and you know, I I I feel like they have Congress passed 831(b because they do want small businesses to be resilient. They they want you to be able to save up for these events so you can stay a going concern into the future and and save up and you know, keep keep the payroll taxes going, keep the income taxes going. and and so that's the importance of 831(b thirty  B as far as I see it.

Martin Hinton (25:27)
I mean you you you make a a a very I mean I guess let me see if I understand this. If you tap into your 831(b thirty  B to deal with an unforeseen issue, a an interruption of business as a result of cyber attack to keep it in our our lane. That money then gets spent in a potentially taxable environment, right?

Dustin Carlson (25:49)
That's right. Yeah. You know, a a lot of the the events that we see our clients use their A thirty  B for are business interruption type events and and you know that's covering a loss of income for them, loss of revenue to their business. so that that right there is taxable as as revenue back to their business. and then also additional expenses. So, you know, going and hiring a a firm that's gonna help them mitigate the a cyber breach or or to help you know bring in

you know, identity protection for their customers. They're they're spending that money, absolutely to to help mitigate these types of events.

Martin Hinton (26:28)
So you're you're proceeding with others in in your field through the court system. I I you touched on Congress. Is there a less a legislative fix for this? And is there anyone in the House or in the Senate who's, you know, looking at this or is this maybe not sexy enough for this day and age?

Dustin Carlson (26:47)
You know, we've we've been a member of a lobby group for about four years now, minicap lobby group. and I've I've been to DC myself and and met with members of Congress. you know, they're they're all very receptive to this idea. They they understand it. you know, particularly with when you give them the HSA comparison, and you know, the the great talk track is back to COVID where

You if if every business owner had had an 831(b thirty  B plan in place to protect from that type of loss, would we have had to print trillions of dollars in you know, PPP programs and you know, ERC credits and all of that? you know, ca this this helps a business owner be self reliant, be resilient through those types of things. So they they understand that absolutely. And with our lobby group, you know, we we I

I'm probably talking out of class a little bit, but we we will be bringing some legislative proposals to Congress this year to, you know, hopefully be part of a reconciliation bill that might happen later this year or or into in sometime in the future.

Martin Hinton (27:56)
It does strike me politically as a as something that you know you could see someone who comes from the, you know, stand on your own two feet, be responsible for yourself, you know, mind your own Ps and Q's. Th there is a real, you know, feature to this that that f that falls into that category. And and I mean even ev and again, I mean you you you touch on the small business po point of this where, you know, we're talking about ninety percent of the economy is in in that category, that the providing these businesses

I mean and the wake COVID is a perfect example, right? I mean, if if they have what they printed or it been organized in a way that was designed to deal with the bad day when the bad day comes, 'cause the bad days do come, that that that mindset is is . well, you know, I I as I think I told you, I was born in London. Even when it's not raining, you take an umbrella with you, right? Like that's that that idea. Maybe not now 'cause

Dustin Carlson (28:47)
Yeah.

Martin Hinton (28:48)
it's blazing hot over there, but but point be made.

Dustin Carlson (28:49)
Absolutely. Greg.

Martin Hinton (28:51)
so is there any more you'd like to say about this? 'Cause I I  of the other topics I

I I'd love to ask you about it t is is sort of more broadly into the sort of AI gap that exists now with with all all the things that are going on in that space in insurance and whether you're seeing anything in the A  one  world there. But before we jump off that, is there is there anything more you want to say about the the the case and what's going on and you know what small business owners should be maybe asking their CPA?

Dustin Carlson (29:18)
Yeah, you know, I d I would just say, you know, if if if you're listening to this and you're you're maybe dismissing 831(b because you d you don't want to have the IRS's IR. You know, the IRS themselves have conceded that if when done properly, 831(b Bs are are absolutely appropriate for businesses. And so that that that's the important part is that you administrate your 831(b properly and and that's where SRA we have a job. And you know, j just like you have a a four  K administrator to make sure you're

you know, dotting your I's, crossing your T's there. that that's our job is is to make sure you're staying within the guardrails and doing things the right way. And so again, if if you're doing things the right way, the IRS is it has agreed that this is an appropriate way to do business.

Martin Hinton (30:07)
Lovely. All right. So the A31B is for when your cyber insurance policy doesn't meet the financial need you have as a result of something going wrong, whether it be a technical problem or a malicious breach. One of the areas that we're seeing a lot of conversation now is in the AI liability space. And there's the conversation is big because it's so relatively new. Does it need its own insurance? Is it the same as cyber? Is it

Is it just normal business insurance? Then you throw into that bucket the issues with agentic AI, where you know an AI may be given tasks where it can act and influence the world outside. I I've had this experience. I I had a flight canceled and I received an email from the airline. I won't name them because I I do like them. And it said, Hey, we've rebooked you on this flight. No worries. So the next day I was casually going about my business and I had the flight same flight later that day, same time.

And I jumped on the app just to download my boarding pass. And lo and behold, in the app, I was booked on an earlier flight. Frantically called the airline and said, What's going on? And I was told, well, no, AI generates those emails. So that's that's not that's not our fault. And I was like, I'm not it's

Dustin Carlson (31:21)
That's not our fault.

Martin Hinton (31:22)
it but it's it's it's it's certainly your fault. It's got it's got your

Dustin Carlson (31:25)
Right.

Martin Hinton (31:25)
airline letterhead. So that's Martin's example of I guess it at least the claimed agentic AI creating a real

I don't know about liability, but palpitation made the flight. But that's a microscopic example of the kinds of things that can happen as as these companies embrace things. And and whether or not they have insurance to pay for the extra cab I had to take and all that sort of thing, I don't know. But that's an example of how these things can influence our lives in a very small way, my life in this case. And I wonder whether or not you have any experience or whether you're having any conversations about, you know, or maybe it's part of the sales pitch. Listen, you you know, you your cyber policy may have exclusions, you don't

nowhere there. It may not even have an exclusion for AI, but but but the insurance company's gonna view this as something that's not coverable because of whatever reason. So I'm wondering about AI in this space. What what are you seeing right now?

Dustin Carlson (32:15)
Yeah, so beginning around February of this year, the insurance standards office, ISO, started to issue some new forms. These ISO, these are standard forms that about 86% of insurance companies use to build their policies on. so they they came out with endorsements to your general liability policy to cover AI liability. And what that means is

Insurance companies are going to start excluding AI liability on your liability policies. And you'll need to buy an endorsement to have that coverage. and you know, this this kind of gets back to I I've been comparing it to the advent of the internet and and the cyber liability as well, where you know insurance companies, because it is so new.

They're gonna start to avoid this risk. And they're gonna that means they're gonna start writing exclusions into it. They're gonna start selling separate policies for it. and and try to avoid this risk altogether because it's it's an unknown quantity. So when they go to insure it, they an insurance company truly can't understand what is my total risk here because they they lack the the claims history, they lack the lost data to really determine the right price for this insurance.

And you know, this this also gets back to why 831(b even exists in the first place. And it is for these emerging types of risk where traditional insurance companies are avoiding it because they can't understand it. They can't wrap their heads around it. in 831(b was first passed in nineteen eighty six. you know, that was around the time of, you know, Star Wars and Reagan and and all of that. And so, you know, you had the advent of the internet and and all of that going on and

Technological advances, a lot of emerging risk back then. And so this is exactly the type of thing A31B is can be used for is to begin to address AI liability. Because you can rest assured when the AI liability policy or the endorsement comes out for for you from your insurance company, there's going to be a lot of exclusions in there. There's going to be a lot of potentially sublimation for certain type of losses related to AI.

and they're gonna do their best to make sure that they're gonna be protected on it and and you know making money on it at the end of the day.

Martin Hinton (34:45)
You you you I mean you touch on I mean the the the the range of potential liability. I I I think I was talking to someone the other day about a I think it was an Alibaba AI that was being tested and it for a variety of reasons that are as not as exciting as you would make them if you were writing a movie, it wound up I I think it was sandboxed, but it was buying crypto. And I think that the engineers were like

The joke I've made is why this room so hot? How come the GPUs are all are all melting, right? It had hijacked extra c processing power to mine crypto as a result of that it was getting a better score on its test. It wasn't it wasn't trying to buy missiles to blow up something or anything like that, you know. But but this idea

Dustin Carlson (35:27)
Not yet.

Martin Hinton (35:28)
so and I you know, I thought, that's a cute story and it's funny, you know, it's got like terminator vibes. But someone I was talking to in the legal world says, well, who owns that crypto if if it bought it?

And and where do you put that on your balance sheet? And if you failed to put it on your balance sheet 'cause you didn't know you had this possession in your corporation, these are complex tax problems and they have real

Dustin Carlson (35:46)
Very much. Yeah.

Martin Hinton (35:47)
and and I you know, it you know, you think about AI making me miss my flight, that's a minor thing. These are th there's a broad scale to this potential problem. Is i in in ch have you had people come to you and and ask about it, or is it still so relatively new given the February timeline that you just laid out?

that it's it's just starting to come on everyone's radar. I mean to to f as we know, tons of people don't use MFA and the very basic things that could make cyber breaches much, much more easier to defend against are not implemented by even significant corporations. Where where does it stand? Are we in you know, is it it's is it just a twinkle in our eye at this point or are you seeing any business from it?

Dustin Carlson (36:27)
You know, I I I think in the business owner community it I think it's definitely flying under the radar. You know, it it business owners I I I think the adopt the adoption for AI is still relatively low even. you know, a lot of it in when I say that I'm I'm speaking particularly about small businesses. and so I I think it is flying under the radar, but you know, the concerns there are

Do you have employees that are using it? And are they on their own personal AI or you know, own personal chat GPT account? And are they, you know, putting company information in there in into their free chat GPT instance? And so the there's a lot of questions even there, a lot of you know liability and concerns there as well. But you know, I I I think amongst business consultants and advisors, I I think it is definitely being talked about.

and and folks are are aware of you know the potential liability fallout from ai and and it's you're right it's so and it's another reason insurance companies are gonna avoid this risk is because they're it you know the their the tentacles on this are are crazy. you know, you have intellectual property risk for for you violating another person's IP but also yours getting you know hijacked by by a LLM.

and and you know it telling a customer that their flight is later than it is, you know, th these types of things. It it there's so many different ways that or areas of your business that AI can touch. it that they're it's it's wild. And so I I I think it is to in at least in the business community, consultant community, I I think it is kind of top of mind right now. But I think it is flying under the radar of your average small business owner for sure.

Martin Hinton (38:20)
And that sort of brings me to sort of the the the the last point. Well a lot of what we've been talking about sounds kind of mild. It's AI risk, tax code, federal courts. The truth of the matter is, and you just said it, small business owners, is it sixty percent after a breach go out of business in six months or something like that? I I I I I know that we've shared this number before, but the the risk if you suffer a a breach

And you're not prepared for it. I.e. you don't have insurance, or the insurance doesn't pay what you think it's going to, or you're not covered in the way you thought you were, or you don't have an 831(b)   that fills this void where you can't do business for weeks at in some cases. you know, I mean I I did a podcast recently and and y you think this sort of thing wouldn't happen, but a relatively large paper company in America had a breach, they had an incident response plan.

But it took them two weeks to find every phone number to implement the plan because it was all stored digitally and they couldn't get into their systems. Like that sort of thing is the kind of thing that happens to people who don't plan properly. And it it it's a lot to put on people, but there is a very real landscape here where this threat can wipe out your livelihood. am I overstating

Dustin Carlson (39:30)
Absolutely.

Martin Hinton (39:31)
that? And I I I ask that question a lot because this is sort of dry stuff. And it's also quite abstract for people, these digital threats and nation states and you know, some hacker pretending in

To be in Oregon, but he's actually in Pyongyang is gonna why would they come after my, you know,  dry cleaner, dry cleaning chain or whatever it is? And maybe they don't, but maybe that's a way into something else. There is a very real threat here. And I wonder whether you could just sort of illustrate for that for the audience, just how serious a problem this is currently. The the the scale of it from a financial point of view, and then there's the very personal reality of someone building a business.

Very passionate, very concerned as we know a lot of small business owners are, and then having all that hard work done away by something that in some respects is entirely preventable, maybe not entirely.

Dustin Carlson (40:20)
Yeah, you know, it it it's a a significant threat to a business. And you know, the the example I always use when talking about cyber, because it it it's sadly the most frequent claim that we see for people's 831(b thirty 's B's is at least under our under the cyber portion of it, are phishing attacks, where you have an employee, maybe the bookkeeper that gets fished and they get you know, erroneous payment instructions.

They ace you know wire money into a into a an account that was was fraudulent. you know, when when that sort of thing happens, let's say you're buying inventory for for your company and you know you're making a six-figure investment in inventory for you know whatever period of time, if if that money is gone, where where are you gonna make up for that to be able to  buy the inventory but also keep your business going because

You're gonna have to borrow that from cash flow now if if you haven't prepared for it. how are you gonna retain your employees? How are you gonna pay your lease that month? You know, all of this stuff happens when it takes it takes  event to for for things to go sideways, with especially when you're talking about you know, the scale of of some purchase orders that you might be doing in your business. and and so I I I think it's very important for businesses to be aware of it.

you know, us as humans we have a tendency to say, well, that that'll never happen to me. but, you know, it I I s we see it every day, thing events that happen to businesses that you know no  expects, but it does happen and you know, it's it's better to be prepared for those types of things.

Martin Hinton (42:08)
I I mean I and I think it i it's an extremely important note, right? We we hear about car crashes and maybe that helps motivate people to drive a little safer, wear their seatbelts all the time. We hear about all sorts of things in in the news, and what we don't hear about to this to the degree it actually happens is cyber breaches that impact companies financially. I mean the the the figure

Dustin Carlson (42:27)
Mm-hmm.

Martin Hinton (42:29)
you hear is as much as ninety percent of these things that cost companies real money that interrupt business for long periods of time,

Are 90% of them we don't hear about. So you hear about the big hacks and you certainly hear about the big technical failures or technical hiccups. But the truth of the matter is when you talk to incident response people who are bound by confidentiality, so they can't discuss the click the specifics of the case, but no  ever hears about all these things. And that that creates this illusion that does, as you put it, leave people in a position where they can think, it'll never happen to me because I don't see it happening, right? And it does happen.

I mean, is that overstating it based on the the sort of things you're seeing?

Dustin Carlson (43:10)
No, not not at all. and you know, I I I think you know, the the SEC passed, I think, regulations several years ago where, you know, if you're publicly traded, you need to disclose these c cyber events. So so we do hear about it from the large companies, but you know, the the statistics are that over half of all cyber victims are small smaller companies. and I I think that's because they're easier targets. They aren't, you know, maybe paying attention to their cyber risk.

and they lack the resources to truly protect themselves from that. You know, if if you know, GM a couple of years ago had had that massive breach, you know, if if if they don't have the robust systems in place to protect themselves from that type of stuff, I mean, what what makes a small business think that they're immune to this stuff?

Martin Hinton (44:00)
Completely agree with you. And we we jump across the pond to the to Great Britain and the Lag Land Rover Jaguar hack, which required a government backstop, basically. And and the the number I've seen most recently is it cost them roughly two billion dollars and lost well, loss basically. And if the the the truth of the matter is, and this is down to human nature to agree, if someone had burned down a factory, and that's the reason this business had

been suffered and all their suppliers only supplied to  person and they didn't have anyone to sell things to anymore for periods of time. We it would have been on the cover of the paper for days and weeks and there would have been enormous follow-ups and there would have been mini series about it and made for TV movies. That's hard to do with something that's abstract and for most of us lives around us in we're swathed in the digital reality without being aware of it until it goes away. As I learned yesterday when my internet went out and the website for

didn't stop working and I was, you know, I basically had to take a flyer on the day and look at the grass grow. it's all good now. so

Dustin Carlson (45:01)
Yeah. And you know, ev everything

is so abstract now that it's it's important for businesses to wrap their heads around it because, you know, it it's only gonna get worse as AI starts to you know, AI adoption ticks up and gets more advanced. things are only gonna become more abstract into the future. and so it's important to understand it. You know, ev even our bank accounts are are somewhat abstract now. I you know, we're we're kind of in a cashless society now and

So ev even keeping track of that for folks is is is a little different. So

Martin Hinton (45:34)
Yeah.

Yeah. We as I like to say, we've put enormous amounts of things that we consider very, very valuable into digital spaces. We should be protecting them like they're sitting in our living room or or in the trunk of a car. We lock the car, you turn the alarm on. Very, very basic things that once you get them in in your habit, in your repertoire of activity, it just becomes the way you live. And more and more people need to do that for the benefit of the whole economy. Th it is almost a sort of you know, it it's everyone's responsibility 'cause it's costing all of us the way the way it gets

Gets done, yeah. Yeah. Justin, is there anything that we've discussed you'd like to say some more about, or is there anything we didn't get to, or anything you you'd like to to say before we wrap up?

Dustin Carlson (46:14)
No, I th I think we've covered a lot of ground today. I appreciate the time, Martin. It's good talking

to you.

Martin Hinton (46:19)
my pleasure. Always happy to take your contributions to the website. we've mentioned a few things, so there'll be some links in the show notes wherever you're listening to or watching this that that that'll help you find those resources. Dustin, again, thank you so very much for the time. and again, is this is part of me. Dustin Carlson, president of SRA 831(b Admin. there'll be links to that in the the show notes as well. You'll find all that. Dustin, again, thank you very much for your time today.

Everyone else, thanks very much for watching. I'm Martin Hinton the Executive Editor of Cyber Insurance News and Information. Enjoy the rest of your day.