Who can I sue? Who can sue me?
Many companies ground to a halt on 19 July 2024 following a worldwide IT outage, with a few still feeling the effects days later from its fallout. Whilst the lucky among us might view IT issues as a good reason to avoid working on a Friday, others in the commercial world will, no doubt, be frustrated at the inability to access documents, make payments, or even turn on their computers.
And what about those who even though their systems were not directly affected, but still lost out because people they were relying on were? And what about the no-doubt large bills for IT team overtime across the globe? Who foots the bill for that?
Who (other than CrowdStrike, the tech firm from who the outage inadvertently originated when an update went wrong) is to blame for failures to perform any contractual obligations as a result of the global IT outage? Can such an event constitute Force Majeure?
It is events like these - with the Covid pandemic still being a not-too-distant memory, that prompt us to review and re-consider the contractual provisions that cater for just such specific scenarios.
Generally, where a contract exists between two or more parties, the failure by one party to fulfil its obligations under that contract gives the other party the opportunity for a claim for loss. And, generally, a claim under contract is the "best" type of claim because it is self-contained, and the underlying agreement governs the relationship and sets out each party's expectation.
However, it is expected that, if something happens which is unforeseen and beyond the control of anyone involved in the contract, leading to a failure to do something under that contract, there can be no cause of action. Typically, we refer to these events as "force majeure".
In this article, we look at what this means in the context of the CrowdStrike outage. There is no one-size-fits-all approach to these issues. All contracts are different and the authors of this note are English lawyers, but the below should serve a good starting point to consider issues and assess options. If you would like more information on force majeure or the implications of the current IT outage, please get in touch and we would be happy to help.
What is a force majeure clause?
A force majeure clause varies the obligations of a party under a contract generally upon the occurrence of a specific event beyond its reasonable control, thus preventing the contract from being performed. Its underlying principle is that, on the occurrence of one such event, neither party should be liable to the other for their failure to perform their obligations under a given contract.
What constitutes a force majeure event?
Force majeure events are generally acts or circumstances that are specifically labelled as such within the body of the agreement and may typically be set out in the form of a list, which will have been heavily negotiated and agreed upon between the parties. Common examples include natural disasters, war, actions or laws implemented by government authorities, fire, non-performance by third-party suppliers, and, in particular following Covid-19, epidemics and pandemics.
Importantly, in order to successfully rely on a force majeure clause, parties must show that the relevant force majeure event was (i) outside of that party's reasonable control, and (ii) the only event responsible for the non-performance of the agreement by the party (i.e., that there was not another non-force majeure event that additionally affected performance in any way).
What is the effect of a force majeure clause?
The effect will depend heavily on the clause's drafting. For example, a force majeure clause may excuse a party in the event of a delay, grant extensions to carry out the contract, or call for the contract to be suspended until the force majeure event is resolved, following which the contract may resume as previously contemplated. In some case, it may also allow the parties to terminate the agreement altogether.
Could a global IT outage constitute a force majeure?
Unfortunately, this is one of those times where the typical lawyer response of "it depends" is the most accurate. However, because force majeure is a form of contractual relief rather than common law relief, parties to a contract are much more in control of their position than they would be if they were subject to the whims of the law.
It is common to include the interruption or failure of technology or utility services as a force majeure event. A significant IT failure, if it causes so much disruption that it fundamentally prevents performance of the contract, could fall under this category.
What can I do about it?
If you have been affected by the CrowdStrike outage, the first place to start is to give your contracts a cold read through. Are you exposed? Do you have a cause of action?
A poorly or loosely worded force majeure clause that does not go far enough to specify the exact circumstances that are to be treated as force majeure events will be unlikely to do much good. When negotiating a force majeure clause, parties seeking to be adequately protected by it should:
- be extremely specific when preparing the list of events to be classified as "force majeure events";
- clearly state what will happen to each party's obligations when the force majeure event comes to pass (e.g. suspended until the force majeure event ends; give parties the right to terminate; etc.);
- decide whether performance must be "prevented", "hindered", "delayed", or otherwise affected by the stated force majeure event in order for the clause to become triggered; and
- determine whether they wish to qualify whether events are foreseeable or not, depending on the facts of their specific circumstances and the commercial area the parties operate in.
Even if you have not been affected by the CrowdStrike outage, this major event is a good wake-up call to remind you to double check your contractual arrangements. Do they say what you think they do? Are they effective for you and your business?
When seeking to rely on a force majeure clause, remember to:
- comply with any notification requirements, i.e. give notice of the event within the stated timeframe, and provide all of the necessary details required by the clause;
- ensure that you have taken all reasonable steps to mitigate the force majeure event; and
- make sure you have checked what the impact of the force majeure event should be (i.e. "prevented", "hindered", "delayed") before attempting to rely on the clause.
What to look out for in a force majeure clause
- Is performance "prevented",
"hindered", "delayed", or otherwise
affected?
When will the force majeure provision be triggered? If a force majeure clause states that the specified force majeure event must "prevent" the performance of the agreement, then anything short of a legal or physical impossibility will not trigger it. It will not be enough that it simply becomes difficult or unprofitable to perform the relevant obligation. In the case of a hindrance or a delay, the threshold is, naturally, lower.
- Giving notice of a force majeure event
It is common to include provisions requiring a party relying on a force majeure clause to give the other party notice of the occurrence of a specific force majeure event (for example: "as soon as reasonably practicable after the occurrence of the force majeure event"; or "no later than within [x] days after the occurrence of the force majeure event"). The notice requirement may also carry with it further obligations, such as the requirement to notify the other party of time on which the force majeure event started, the potential duration of the event, or its effect on the performance of the agreement. Parties should familiarise themselves with this requirement. Non-compliance may significantly impact their ability to successfully rely on the clause altogether.
- Obligation to mitigate?
The parties may also agree that the benefit of a force majeure clause should only be available to a party seeking to rely on it once it has taken all possible steps to avoid the event, or the impact of its consequences. Parties must, therefore, be careful not to simply rely on a given circumstance triggering a force majeure clause and must show that they have taken all reasonable steps to avoid the circumstance, or mitigate its results. However, even where this is not expressly set out in the agreement, the obligation to mitigate can frequently be implied. The reason for this is that the party relying on a force majeure clause should be able to show that, on the facts, the relevant event was not reasonably preventable and did not arise simply due to that party's inadequate response to it.
- How specific should one be when listing force majeure
events?
When thinking about the list of events to include in a force majeure clause, a drafter should be wary of two Latin principles applicable under common law: (i) expressio unius est exclusio alterius ("the expression of one thing excludes others"); and (ii) ejusdem generis ("of the same kind")
- Expressio unius est exclusio alterius
If a clause lists specific force majeure events, for example "floods, droughts, or earthquakes", without including any wording that could widen the scope of the clause (e.g. "including but not limited to"), then there is no flexibility and any circumstance not included in that list would not trigger the clause.
- Ejusdem generis
If, on the other hand, a list of events states, for example, that "floods, droughts, or any other cause beyond the Seller's reasonable control" shall constitute a force majeure event, it may be implied that other similar events falling into the same category of natural disasters beyond the Seller's reasonable control would also constitute a force majeure event. However, note that this principle cannot be used to widen the clause's scope - "catch-all" provisions will only go as far as the context of the clause permits. For example, in the case of Tandrin Aviation -v- Aero Toy Store, it was argued that the economic collapse of financial markets triggered prevented a party from completing an aircraft purchase. It was noted that, whilst the force majeure clause contained "catch-all" language, the circumstances in that case did not trigger it, as none of the force majeure events listed in the clause were at all connected with economic downturn and scope of the clause could not be widened to include financial collapse.
- Expressio unius est exclusio alterius
- Foreseen or unforeseen?
Look out for force majeure clauses that refer to "unforeseeable events" - it is not necessary that the event should be unforeseeable at the time the contract was made and it is much more important that the event is not in the reasonable control of the parties. Furthermore, whether an event is foreseeable or not will usually be determined by the court by reference to the specific facts of the matter, which could risk taking the decision outside the control of the parties in the event of a dispute.
What if the event is not covered by a force majeure clause?
If the event falls outside the force majeure clause, or the contract does not contain such a clause altogether, then the doctrine of frustration may be of some assistance.
A contract may be frustrated, or rendered impossible to perform, where an event occurs that renders the circumstances radically different, rendering performance impossible. The frustrating event must not be anticipated in the contract or caused by a party seeking to rely on it. Frustration is available in much more limited circumstances than force majeure and a party's ability to rely on the doctrine will depend heavily on the particular facts of the case, making it a much less certain tool. For example, it will not be possible to claim that a contract is frustrated because the performance has been delayed or has become more difficult. Most contracts will include provisions for delay or technical issues, so it is always better to look to these in the first instance.
Conclusion
The recent IT outage has served as an important reminder for businesses consider the emergency provisions in their contracts. It is impossible to prepare for extraordinary events, but it would be wise for businesses to think about how to satisfy the proviso that parties should use "reasonable endeavours" to avoid the effects of a force majeure event. This could be as simple as making a contingency plan for an IT outage by storing documents on an independent cloud system, or providing employees with information on how to provide services manually. This way, businesses will increase their chances of successfully relying on a force majeure clause, should the worst happen.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.