Plaintiff-Appellant GTE Corporation ("GTE") seeks coverage for costs and expenses incurred in remediating its computer systems to avoid Year 2000(Y2K) related date recognition problems. GTE contends that it is entitled to such costs and expenses pursuant to insurance policies entered into with Defendant-Appellees Allendale Mutual Insurance Company ("Allendale"), Affiliated FM Insurance Company ("Affiliated"), Allianz Insurance Company ("Allianz"), Federal Insurance Company ("Federal"), and Industrial Risk Insurers ("IRI") (collectively "Insurers"). The District Court granted summary judgment in favor of the Insurers. Specifically, the District Court concluded that: (1) GTE's Y2K remediation falls under the design defect and inherent vice exclusions of the policies; (2) the exceptions to these exclusions were inapplicable; and (3) the Sue and Labor and Preservation of Property Clauses (hereinafter referred to collectively as the "Sue and Labor Provisions") of the policies did not entitle GTE to coverage for costs incurred to prevent an excluded loss. For the reasons stated below, we will affirm the District Court's grant of summary judgment.

The approach of the year 2000 evoked fears of various millenarian catastrophes. One such fear was the "Y2K problem," and it arose from the entirely predictable fact that the passing of the year 1999 resulted in a change in all four digits of the written representation of the succeeding years.

Historically, software was routinely programmed omitting the first two digits in year dates. See, e.g., Steve Lohr, Technology and 2000-Momentous Relief: Computers Prevail in First Hours of '00, N.Y. Times, January 1, 2000, at A1. There were a number of reasons for this traditional use of two-digit years as an ingredient of software programing. "The two-digit shortcut originally was taken to conserve space that a four-digit entry would have occupied in a computer's memory." Bruce W. Foudree, The Year 2000 Problem and the Courts, 9 Kan. J.L. & Pub. Pol'y 515, 517 (2000). Particularly in light of the high cost of storing information in the early days of computers, this shortcut provided numerous benefits, including "allow[ing] substantial cost savings," enabling "[m]anufacturers ... to make chips available to consumers at more affordable prices," and "shortening the production time for chips and software." Id.

With the approach of the year 2000, however, experts voiced dire predictions that the four-digit changeover could utterly upset computer programs. This problem, commonly referred to as the "Y2K problem," is essentially summarized as follows:

[C]omputers have trouble distinguishing between years in the 1900s and years in the 2000s. Until comparatively recently, date-sensitive computer programs identified years by their last two digits. For example, using the standard format of mm/dd/yy, 1988 was entered as "88" by programers. Thus, on January 1, 2000, many computers and equipment which contain computer chips ("embedded chips") may not be able to recognize the difference between 1900 and 2000 since both are abbreviated as "00."

Foudree, supra, at 516-17; see also Jeffrey W. Stempel, A Mixed Bag for Chicken Little: Analyzing Year 2000 Claims and Insurance Coverage, 48 Emory L.J. 169, 177 (1999).

Commentators acknowledged that while "[n]o one can accurately predict the scope, severity, or duration of Y2K disruptions..., Y2K-related failures have the potential to touch every sector of society and cause widespread and systemic economic failures and public panic." Foudree, supra, at 517-18. A likely scenario of the consequences of the Y2K problem was described as follows:

The most common scenario for a Y2K problem involves a computer reading two-digit dates of "00" or "01" and either being stymied (if an inanimate object can be stymied) or reading the dates erroneously as "1900" or "1901," a misreading that in the estimation of many has "potentially devastating results."

For example, information systems may lock or freeze, causing interruptions and emergency repairs or perhaps even requiring the discarding of old equipment and its replacement with new. Misread dates could lead to lost funds, improperly administered medicine, or failure to replenish inventory. For example, an insurance policy could be canceled, a lease terminated, or astounding late fees assessed when a computer mistakenly reads the date "2000" as "1900."

Stempel, supra, at 177 (internal citations omitted).

These fears prompted the undertaking of extensive Y2K remediation efforts. Corporations and governments invested more than $250 billion worldwide in addressing the Y2K program, with the United States government alone spending $8.4 billion. Lohr, supra, at A1.

In retrospect, we now know that catastrophe did not materialize, perhaps in part because of the success of remediation efforts. See, e.g., Lohr, supra, at A1. Nevertheless, the benefit of hindsight should not cloud our appreciation of the widespread perception, in the years leading up to 2000, that failure to correct the Y2K problem could result in disastrous consequences. Moreover, even those who did not predict "catastrophic" consequences cautioned that the Y2K problem was "serious enough to require correction if contemporary business is to continue to function in the twenty-first century." Stempel, supra, at 172.

Because this is an appeal from a grant of summary judgment, we must view the evidence in the light most favorable to the nonmoving party GTE. See Marino v. Indus., Crating Co., 358 F.3d 241, 247 (3d Cir.2004).

GTE is a worldwide leader in telecommunications services, including local telephone, wireless, and internet services. GTE operated a substantial number of computer based systems and networks which employed the common practice of two-digit date recognition. As the new millennium approached, GTE identified several Y2K-related threats. Such harms included the prospect that GTE's computer programs and external programs interacting with GTE's systems would crash immediately, make erroneous calculations while continuing to process, endlessly churn before taking a "time out" or shutting down, or process data correctly to no avail. GTE's Rule 56.1 Statement of Material Facts ¶ 38, J.A. at 3118 (citing GTE 2000 President's Operations Review, p. CORP PMO 1893938 (Exhibit 35)).

In an effort to protect its expansive network, GTE undertook an extensive Y2K Program at a cost of about $350 million to protect data, records, and to ensure continued business operations. In a December 1998, corporate disclosure document, GTE explained its activities as follows:

GTE's Year 2000 program is focused on both information technology (IT) and non-IT systems....

. . . .

GTE's Year 2000 program has been organized into five phases as follows: Awareness: program definition and general education; Assessment: analysis and prioritization of systems supporting the core business; Renovation: rectifying Year 2000 issues; Validation: testing the Year 2000 solutions; Implementation: placing the tested systems into production.

GTE Corp. 10-K for 12/31/98, J.A. at 3979-80.

Notably, GTE appears to have been aware of the potential threat posed by the Y2K problem as early as 1994. In December of that year, GTE Service Corporation published a report entitled Algorithmic Anarchy: Chaos in the Year 2000, identifying the potential impact of the Y2K problem on GTE, and outlining preliminary strategies for addressing the problem. See J.A. at 1395-1428. In 1995, GTE established a Program Management Office (PMO) "to oversee the planning and execution of a corporate-wide Year 2000 initiative," as well as a "Master Schedule for GTE's Year 2000 Program." GTE Millennium 2000 Program-Year 2000 Year End Report-1996 (December 10, 1996), J.A. at 1598, 1602 ("1996 Year End Report"). Moreover, in 1996 GTE completed the Proposed Criteria for "Century Compliance", "provid[ing] information regarding the scope of the ... (Y2K) challenge and ... identif[ying] and discuss[ing] four suggested criteria for consideration in assessing century compliance." J.A. at 1477. From the inception of its Y2K program, GTE exhibited an awareness of the tremendous resources required to address the date-recognition problem. For example, the 1996 Year End Report reported that the "cost of the Year 2000 Program is currently estimated to be $361 [million]." J.A. at 1598.1

GTE contends that in an effort "[t]o protect its expansive network from damage and destruction, [it] ... contracted for extensive insurance protection." Appellant Br. at 11. The insurance policies to which GTE refers were sold in 1996 and 1997. As the District Court explained, GTE was actually insured by a "panel of insurers" who provided different percentages of coverage on the primary layer and excess layer of coverage.2 Although the policies at issue in this litigation are actually five distinct policies, because the terms of the relevant policy provisions are identical, the District Court and the parties did not analyze the provisions separately. Therefore, we do not differentiate among the policies.3

The primary layer policies outline the scope of the coverage. In pertinent part, the provisions read:

Except as hereinafter excluded, this policy covers:

a. Real and Personal Property

(1) The interest of the Insured in all real and personal property (including improvements and betterments) owned, used, or under contract to be purchased or leased by the Insured, or hereafter constructed, erected, installed, or acquired including while in course of construction, erection, installation, and assembly.

. . . .

b. Business Interruption-Gross Earning

Coverage shall apply under this section unless there is a loss of profits policy in force covering the location where loss is incurred.

(1) Loss resulting from necessary interruption of business conducted by the Insured and caused by loss, damage, or destruction by any of the perils covered herein during the term of this policy to real and personal property ... not otherwise excluded.

Affiliated FM Insurance Policy No. AE016 [hereinafter "Affiliated Policy"], J.A. at 241; IRI Policy No. 31-3-64676 [hereinafter "IRI Policy"], J.A. at 425; Allianz Policy No. CLP 1025660 [hereinafter "Allianz Policy"], J.A. at 643; Federal Policy No. 648-22-99 [hereinafter "Federal Policy"], J.A. at 712.

The policies also specifically outline included perils:

This policy insures against all risks of physical loss of or damage to property described herein including general average, salvage, and all other charges on shipments covered hereunder, except as hereinafter excluded.

Physical loss or damage shall include any destruction, distortion or corruption of any computer data, coding, program or software except as hereinafter excluded.

Affiliated Policy, J.A. at 252; IRI Policy, J.A. at 437; Allianz Policy, J.A. at 655; Federal Policy, J.A. at 724 (emphasis added).

Certain perils, however, are explicitly excluded:

. . . .

c. against the cost of making good defective design or specifications, faulty material, or faulty workmanship. This exclusion shall not apply to loss or damage resulting from such defective design or specifications, faulty material, or faulty workmanship; however any such resulting damage will be subject to all other exclusions in this Policy.

. . . .

k. against unexplained loss, mysterious disappearance, loss or shortage disclosed on taking inventory, inherent vice or latent defect unless loss or damage from a peril insured herein ensues and then this policy shall cover for such ensuing loss or damage.

Affiliated Policy, J.A. at 252-55; IRI Policy, J.A. 438-40; Allianz Policy, J.A. at 656-58; Federal Policy, J.A. at 725-27.

The excess layer policies similarly provide, in pertinent part:

. . . .

. . . .

3. faulty workmanship, material, construction or design from any cause; all unless physical damage not excluded by this Policy results, in which event, this Policy will cover only such resulting damage;

. . . .

5. deterioration, depletion, rust, corrosion, erosion, wear and tear, inherent vice or latent defect; all unless physical damage not excluded by this Policy results, in which event, this Policy shall cover only such resulting damage....

Allendale Policy, J.A. at 297-99; IRI Policy, J.A. at 454-56; Allianz Policy, J.A. at 676-78.

Moreover, the excess layer policies contain a "Business Interruption Endorsement" which provides, in pertinent part:

In consideration of additional premium, this Policy is extended to cover the Actual Loss Sustained by the Insured during a Period of Interruption directly resulting from physical loss or damage of the type insured against by this Policy, to property not otherwise excluded by this Policy, utilized by the insured and located as described elsewhere in this Policy.

Allendale Policy, J.A. at 306; IRI Policy, J.A. at 463; Allianz Policy, J.A. at 685.

In addition to the above coverage and exclusion provisions, both the primary and excess policies contain clauses that permit GTE to recover for certain preventative measures.

The primary policies contain Sue and Labor Clauses providing, in pertinent part:

In the case of actual or imminent loss or damage by a peril insured against, it shall, without prejudice to this insurance, be lawful and necessary for the Insured, their factors, servants, or assigns to sue, labor, and travel for, in, and about the defense, the safeguard, and the recovery of the property or any part of the property insured hereunder, nor, in the event of loss or damage, shall the acts of the Insured or of this Company in recovering, saving, and preserving the insured property be considered a waiver or an acceptance of abandonment. This Company shall contribute to the expenses so incurred according to the rate and quantity of the sum herein insured. This provision does not increase any amounts or limits of insurance....

Affilliated Policy, J.A. at 265; IRI Policy, J.A. at 450; Federal Policy, J.A. at 737.

Similarly, the excess layer policies contain Preservation and Protection of Property Clauses providing, in pertinent part:

In case of actual or imminent physical loss or damage of the type insured against by this Policy, the expenses incurred by the Insured in taking reasonable and necessary actions for the temporary protection and preservation of property insured hereunder shall be added to the total physical loss or damage otherwise recoverable under this Policy....

Allendale Policy, J.A. at 301; IRI Policy, J.A. at 458; Allianz Policy, J.A. at 680.

D. Procedural History and Standard of Review

On June 18, 1999, GTE filed a declaratory judgment action seeking coverage for costs and expenses incurred remediating its computer systems to avoid Y2K problems: Count One sought a declaratory judgment that the costs were covered by the policies' Sue and Labor Provisions; Count Two alleged breach of contract; and Count Three sought damages from Allendale for bad faith. The Appellees each answered the complaint, and Appellee Federal counterclaimed seeking a declaration denying coverage. To facilitate the ease of the litigation, on August 31, 2000, the U.S. Magistrate Judge entered an order dividing the litigation into phases. In Phase I, the parties were instructed to address whether insurance coverage existed under the insurance policies. Following discovery on Phase I issues, the parties filed motions for summary judgment on October 16, 2002.

The District Court properly exercised jurisdiction under 28 U.S.C. § 1332.4 On March 26, 2003, the District Court granted the Insurers' joint motion for summary judgment in its entirety. As an initial matter, the District Court noted that the Sue and Labor Provisions only permit GTE to recover for costs incurred to prevent a loss that is covered under the policies. The District Court went on to conclude that the Y2K problem was not covered because it fell within the design defect and inherent vice exclusions. Moreover, the exceptions to these exclusions-the ensuing and resulting loss provisions-did not permit GTE to recover. In light of this finding of non-coverage, the District Court also granted Allendale's motion for summary judgment on the third count claim of bad faith (that is, there being no coverage, GTE cannot claim bad faith denial of coverage). The District Court also granted IRI and Federal's supplementary summary judgment motions, alleging that GTE's Y2K costs were not incurred to avoid loss or damage that occurred during those Insurers' policy periods.5

Notice of appeal was timely filed on April 17, 2003. This Court has jurisdiction pursuant to 28 U.S.C. § 1291. We conduct plenary review over a district court's order granting summary judgment. Morton Int'l, Inc. v. A.E. Staley Mfg. Co., 343 F.3d 669, 679 (3d Cir.2003). Summary judgment will be granted if the record establishes "there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Fed.R.Civ.P. 56(c); see also Celotex Corp. v. Catrett, 477 U.S. 317, 106 S. Ct. 2548, 91 L. Ed. 2d 265 (1986); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 106 S. Ct. 2505, 91 L. Ed. 2d 202 (1986); Matsushita Elec. Indus. v. Zenith Radio Corp., 475 U.S. 574, 106 S. Ct. 1348, 89 L. Ed. 2d 538 (1986).6 For the reasons elaborated below, we agree with the District Court.

As a preliminary matter, GTE argues that consideration of the exclusionary provisions was premature because "factual issues regarding design defect are reserved for later stages of the litigation." See GTE Corp. v. Allendale Mut. Ins. Co., 258 F. Supp. 2d 364, 377 (D.N.J.2003). GTE argues that there is a disputed factual issue, which cannot be resolved on summary judgment, about whether two-digit software programming is a design defect or inherent vice. Furthermore, GTE argues that these issues of fact fall within the province of a jury. We are unpersuaded.

The motions for summary judgment were brought following discovery in Phase I of the litigation, pertaining to whether insurance coverage existed for GTE's claims. As the District Court noted, any factual issues pertaining to whether the Y2K problem constitutes a design defect are "inextricably tied to the Phase I issue of coverage." Id. In fact, perhaps the most quintessential coverage issue is the applicability of policy exclusions. Moreover, there is no indication that GTE was prohibited by order or otherwise from taking any discovery relevant to the coverage issue.7 If GTE felt that additional evidence, including expert testimony, was required, GTE was free to conduct such discovery and present such evidence to the District Court. To the extent GTE's argument constitutes a challenge to the District Court's discovery orders, this Court will not disturb those discovery decisions because there has been no showing of an abuse of discretion. See Arnold Pontiac-GMC, Inc. v. General Motors Corp., 786 F.2d 564, 568 (3d Cir.1986). Thus, the exclusionary provisions were properly within the consideration of the District Court in considering the motions for summary judgment in Phase I of the litigation.

In addition, the design defect issue did not need to be resolved by a jury. We agree with the District Court that in arguing that the issue falls within the province of the jury, GTE erroneously looks to products liability cases for the standards applicable to this insurance contract dispute. See Motter v. Everest & Jennings, Inc., 883 F.2d 1223 (3d Cir.1989) (cited before the District Court) (holding issues of whether product was defectively designed and whether defective design was proximate cause of injury were jury questions); Rooney v. Federal Press Co., 751 F.2d 140, 144 (3d Cir.1985) (Hunter, III, J., dissenting in part and concurring in part) (internal quotations and citations omitted) (cited in Appellant Br.) ("The question whether a design defect exists, that is, whether the product left the supplier's control lacking an element necessary to make it safe for its intended use, remains within the province of the jury."). This case does not involve a question of whether a product was defectively designed for purposes of a tort action. GTE cites no case concluding that (and offers no explanation as to why) product liability cases and concepts, which concern the balance between "the risk of a product versus its social utility," Motter, 883 F.2d at 1227, are relevant to insurance contract disputes that involve agreements between specific parties. The issue of whether the defective design and inherent vice exclusions bar recovery were questions of contract interpretation properly within the province of the District Court at the summary judgment stage of the litigation.

Generally, under New Jersey law,8 "the interpretation of insurance contracts requires generous readings of coverage provisions, narrow readings of exclusionary provisions, resolution of ambiguities in favor of the insured, and construction consistent with the insured's reasonable expectations." Cobra Prods., Inc. v. Fed. Ins. Co., 317 N.J.Super. 392, 722 A.2d 545, 549 (App.Div.1998); see also Elizabethtown Water Co. v. Hartford Cas. Ins. Co., 998 F. Supp. 447, 452 (D.N.J.1998). Insurers contend this rule is inapplicable where the insured is a large sophisticated corporation, such as GTE. See Pittston Co. v. Allianz Ins. Co., 905 F. Supp. 1279, 1320 (D.N.J.1995), rev'd in part 124 F.3d 508, 521 (3d Cir.1997). However, we need not address this issue because we conclude that the contract is not ambiguous; rather, the exclusions clearly bar coverage. Because the contract in this case is "clear and unambiguous ... [,][it] must be enforced as written." Cobra, 722 A.2d at 549.

We agree with the District Court that coverage for GTE's remediation measures is barred by the plain language of both the defective design and inherent vice exclusions, and disagree with GTE's contention that its claim is not subject to these exclusions because the threats were external.

The policy provisions outlining excluded perils specifically preclude coverage for "the cost of making good defective design or specifications." The District Court concluded that "any efforts taken to correct a date recognition problem within the computer systems, in order to ensure that the computer systems continue to process dates as expected and required, are efforts undertaken to correct a problem with the design or specification of the system." 258 F. Supp. 2d at 375. We agree.

The Y2K problem squarely falls within the defective design or specification exclusion. The essence of the Y2K problem is that the two-digit date design precludes the system from functioning properly on or after January 1, 2000. The problem in this case was not that a program or system malfunctioned, or some external threat caused damage to GTE's systems. Rather, the system performed in exactly the manner it was designed to operate-the problem is that the system as designed and specified did not permit recognition of dates in the 21st century.9

GTE argues that the two-date designation system cannot be a "defective" design because, at the time of its implementation, such a design conformed with industry standard (either as a widespread practice or "best practice"), complied with government regulation, and was required for GTE's systems to be able to interface with other systems. Even assuming all these factors are true, we still conclude that GTE's claim is barred by the defective design exclusion. Industry standards and the existence of alternative feasible designs may be relevant standards in determining whether there is a "design defect" for the purpose of tort liability. See, e.g., Restatement (Third) of Torts: Prod. Liab. § 16, cmt. b (1998). The fact that something was designed in accordance with "best practice" or industry standard does not, however, mean that GTE's insurance policy provides coverage for necessary changes and upgrades to that system.

The policies in this case explicitly exclude the "cost of making good defective design or specification." "Defective" is defined as "[a]n imperfection or shortcoming, esp. in a part that is essential to the operation or safety of a product." Black's Law Dictionary 429 (7th ed.1999).10 Here there was an "imperfection or shortcoming"-the inability of the system to properly read dates on or after the year 2000-in the system's design or specification. The District Court pointed to extensive testimony from GTE employees to buttress the conclusion that the remediation measures fall within the policies' exclusions. See 258 F.Supp.2d at 374-76. Admittedly, some of this testimony is confusing.11 Nevertheless, this testimony supports the view that GTE's remediation efforts were taken to correct an "imperfection or shortcoming" in the two-digit system, and thus fall within the policies' defective design exclusions. For example, in the context of explaining the relationship between Y2K and "legacy migration,"12 Michael Lawrence Brodie, who worked as a senior staff scientist and a senior technologist at GTE, testified:

The premise is you have a system that has something in it that you don't like, and you want to get into a state where that thing is no longer present. You migrate from one state to another state, whether it is Y2K ... or whether its an old database system, or a code that no longer is appropriate.... You're trying to change an existing system into a new form that no longer manifests the problem you're trying to get away from.

Deposition of Michael Lawrence Brodie at 194:20-195:6, J.A. at 2363-64. In other words, Y2K remediation, like other database and code upgrades, is targeted at changing an existing system because of a problem or limitation within that system.

The fact that GTE may have utilized the best available system, and subsequently faced the need to remedy a problem with that system, does not save GTE from the defective design exclusion. Taken to its logical conclusion, GTE's argument would render virtually every business upgrade an insurable risk. For example, GTE could argue that upgrades to its software or computers undertaken in the name of mitigating an insurable risk would be insurable as long as it used the best system at the time of initial installation.

GTE also suggests that a design cannot be faulty if it meets the specifications at the time of its design. That is unpersuasive. If, for example, an airplane is built pursuant to specifications and is unable to take-off, it is "defective" or contains an "imperfection or shortcoming" despite the fact that it conformed with the specifications. More important, GTE's very argument is undermined by the plain language of the policy provisions. The defective design provision expressly provides that the policy does not ensure "against the cost of making good defective design or specifications." (emphasis added).

There is an additional ground to reject GTE's coverage claim: the insurance policies explicitly do not insure against "inherent vice." The District Court concluded that, in addition to the defective design exclusion, the inherent vice provision barred GTE from recovering for Y2K remediation measures. In reaching this conclusion, the District Court relied heavily, as persuasive authority, on the Washington Court of Appeal's conclusion in Port of Seattle v. Lexington Ins. Co. that the Y2K problem was an inherent vice. 111 Wash.App. 901, 48 P.3d 334 (2002).

As noted by the District Court, the Port of Seattle Court began by surveying definitions of "inherent vice":

An inherent vice is defined by various courts as "`any existing defects, diseases, decay or the inherent nature of the commodity which will cause it to deteriorate with a lapse of time.'" It is also defined "as a cause of loss not covered by the policy, does not relate to an extraneous cause but to a loss entirely from internal decomposition or some quality which brings about its own injury or destruction. The vice must be inherent in the property for which recovery is sought."

48 P.3d at 338-39 (quoting Mo. Pac. R.R. Co. v. Elmore & Stahl, 377 U.S. 134, 136, 84 S. Ct. 1142, 12 L. Ed. 2d 194 (1964); Employers Cas. Co. v. Holm, 393 S.W.2d 363, 367 (Tex.App.1965)) (additional citations omitted). In other words, the question is whether the "insured property... contain[s] its own seeds of destruction ... [or whether it] was threatened by an outside natural force." American Home Assurance Co. v. J.F. Shea Co., Inc., 445 F. Supp. 365, 368 (D.D.C.1978).

Port of Seattle went on to conclude that the Y2K problem fell within the inherent vice exclusion: "[B]ut for the two-digit date field code programmed into the Port's software, the arrival of January 1, 2000, would not result in loss. Thus, the Port's Y2K problem is an excluded inherent vice because the date field is an internal quality that brought about its own problem." 48 P.3d at 339, quoted in 258 F.Supp.2d at 376.

The District Court found the Port of Seattle analysis persuasive, and concluded that the inherent vice exclusion is applicable. We agree. As the District Court explained, "[h]ere ... the insured property, GTE's computer systems, do contain their own `seeds of destruction'-that is, the two-digit date limitation." 258 F. Supp. 2d at 377. Furthermore, "GTE is not threatened by any external force; the threat is entirely internal." Id.

On appeal, GTE's principal objection to this conclusion, as elaborated below, is that the threats posed by Y2K were not exclusively internal.

In concluding that GTE's claims were barred by the defective design and inherent vice exclusions, the District Court rejected GTE's argument that its claim cannot be barred by these provisions because it faced risk from Y2K-related events caused by external systems. The District Court explained that while "[t]his argument gives the Court pause[,] ... [t]he record does not reflect that the program was intended to eliminate any external threats, as described by GTE." 258 F. Supp. 2d at 378-79.

In support of its contention that it faced external threats, GTE provided numerous citations to the record in both its brief, see Appellant Br. at 49 & n. 12 (citing J.A. at 3881, 3884-96, 3871, 3877, 3840, 4789-90, 5053), and at argument, see Tr. of Argument at 15:21-22 (citing J.A. at 1598-1601, 1764, 1008-09, 1004, 4122-23, 1014). GTE provides minimal explanation for how these citations support its argument. Moreover, upon examination, we are not satisfied that the record supports the conclusion that GTE faced an "external threat" such that the defective design and inherent vice exclusions do not apply.13 At best, these citations appear to support the claim that the Y2K problem is particularly complex because of the manner in which GTE's systems interface with third party systems.14

We disagree with the suggestion that the Y2K threat is "external" merely because GTE's systems interacted with other systems or read data from outside sources. Such a conception of external would essentially allow all defective designs and inherent vices to be characterized as external problems. For example, if a car is defectively designed so that the tires come off when the car is driven at 10 miles per hour, the threat is not external merely because the "external" event of the road contacting the tire caused the tires to fly off. The road contacting the tire is an entirely predictable event that is inherent to the very function and purpose of the automobile-there is no problem independent of the automotive design. To take another example, if a dam whose very purpose is to hold water falls apart when the water rises to an entirely predictable level, the rising of the water is not an "external" problem-the problem is that the dam was not properly designed to allow it to perform precisely the function it was intended to perform, the holding of water.

By contrast, if as a consequence of a defective Y2K design the fire retardation system in a building does not function and the building goes up in flames, the fire would be an external event. The fire represents an independent problem external to the design of the computer system.

In this case, there was no unpredictable external threat posing a risk to GTE's system.15 The problem is that the systems were programmed only to recognize the last two digits of the date-the preface remaining a constant "19." The fact, however, that at the turn of the millennium, the preface would now be "20"' rather than "19," thereby requiring four-digit date recognition, was entirely predictable. The annual change in date, like the road impacting the tire and the water level rising, is within the scope of occurrences for which the system was purposely designed. The flaw-that the systems were limited to two-digit date recognition-is entirely endemic to the system. That is, the insured property-GTE's systems-"contain[s] its own seeds of destruction" and is not "threatened by an outside natural force." American Home Assurance Co., 445 F.Supp. at 368.16

GTE argues that the District Court failed to consider all relevant policy provisions in finding that GTE's claim fell within the defective design and inherent vice exclusions. In particular, GTE points out that the defective design and inherent vice provisions except from the exclusions "resulting damage" and "ensuing loss or damage."

Specifically, the primary layer policies state that the defective design or specifications exclusion "shall not apply to loss or damage resulting from such defective design or specifications...; however any such resulting damage will be subject to all other exclusions in this Policy." Additionally, inherent vices are not covered "unless loss or damage from a peril insured herein ensues and then this policy shall cover for such ensuing loss or damage." Similarly, the excess layer policies do not insure against faulty design or inherent vice "all unless physical damage not excluded by this Policy results, in which event, this Policy will cover only such resulting damage."

We are not persuaded that the ensuing and resulting loss provisions allow GTE to recover in this case. Several courts considering similar policy provisions have concluded that the cost of correcting design defects cannot be covered under an ensuing loss provision where it was incurred to correct an excluded peril. See Swire Pac. Holdings Inc. v. Zurich Ins. Co., 284 F.3d 1228, 1231 (11th Cir.2002) (hereinafter Swire II) (citing cases);17 see also Montefiore Med. Center v. Am. Protect. Ins., 226 F. Supp. 2d 470, 479 (S.D.N.Y.2002) ("An ensuing loss provision does not cover loss caused by the excluded peril, but rather covers loss caused to other property wholly separate from the defective property itself."); Prudential Property & Cas. Ins. Co., 2002 WL 31495830, at *19-*20 (D.Or.2002). That is, "an ensuing loss provision does not cover loss caused by the excluded peril, but rather covers loss caused to other property wholly separate from the defective property itself." Swire Pac. Holdings, Inc. v. Zurich Ins. Co., 139 F. Supp. 2d 1374, 1380 (S.D.Fla.2001) (hereinafter Swire I), certified on appeal 284 F.3d 1228 (11th Cir.2002) (emphasis in original). Moreover, in the factually analogous Port of Seattle case, the Washington Court of Appeals rejected the contention that even if the Port's Y2K problem was an excluded inherent vice, the Port could recover under the ensuing loss provision. 48 P.3d at 339-40.

An alternative reading of the ensuing and resulting loss provisions would render the policy exclusions virtually meaningless. That is, the "exception to [the] ... exclusion cannot be construed so broadly that the rule (the exclusion) is swallowed by the exception." Swire I, 139 F.Supp.2d at 1381. Rather, the ensuing loss provisions are best read as permitting recovery where a covered peril or damage results from the design defect or inherent vice.18 Thus we disagree that GTE is entitled to coverage because (1) data destruction and (2) business interruption are specifically covered perils.

The policies in this case ensure against "all risks of physical loss of or damage to property described herein." "Physical loss or damage" is defined to include "any destruction, distortion or corruption of any computer data, coding, program except as hereinafter excluded" (emphasis added).

GTE conceded at argument that "[t]here has to be a physical damage resulting from design defect or inherent vice." Tr. of Argument at 21:22-23. GTE agrees with the Court, for example, that if, as a consequence of a defective Y2K design, the fire retardation system in a building does not function and the building goes up in flames, "[t]his provision means that the building gets covered, because it is a physical damage to the building, but it doesn't mean that the redesign of the software gets covered." Id. at 5:15-18. This concession seriously undermines GTE's argument. In this case, GTE is essentially seeking recovery for measures taken to correct its systems, and not for some eventuating physical damage sustained to its property.

GTE argues that because the Y2K problem would inflict physical damage to the system and/or data, it can recover, under the Sue and Labor Provisions discussed more extensively below, for preventive measures taken to mitigate this "ensuing loss." The problem, however, is that GTE has failed to adequately demonstrate that it was threatened by "physical loss" in the form of "destruction, distortion or corruption of any computer data, coding, program," as distinct from the otherwise excluded defective design and inherent vice. That is, GTE has not illustrated that the consequences of failing to correct the two-digit date designation system, causing data to enter the system in an unrecognizable format, are a covered loss.

In response to this Court's inquiry at oral argument, GTE provided record citations on the issue of the "data destruction, distortion and corruption that GTE potentially faced as distinct from the impact on GTE's computers and/or software."19 GTE's strongest claim appears to be its allegation that absent remediation, "some of [its] ... systems might have generated incorrect data, thereby corrupting financial records and other databases." Letter from Raymond J. Alletto, GTE Director of Risk Management, to Ronald H. Davis et. al., Executive General Adjuster McLarens Toplis N.A., Inc. (Oct. 12, 1999), J.A. at 992-93. The record, however, does not appear to provide support for this allegation of data corruption. Moreover, at best this establishes that incorrect data may have been generated as a result of problems within GTE's own systems-it does not establish that data destruction or corruption would have ensued "to other property wholly separate from the defective property itself." Swire I, 139 F.Supp.2d at 1380. Here, the plain language of the policies provides coverage for data destruction or corruption "except as hereinafter excluded." As discussed above, the defective design and inherent vice exclusions bar recovery, and a reading of the ensuing loss provisions to provide coverage would essentially read these exclusions out of the policy.

GTE also points to the fact that "business interruption" is a specifically covered peril. The primary layer policies provide for coverage for "[l]oss resulting from necessary interruption of business conducted by the Insured and caused by loss, damage, or destruction by any of the perils covered herein...." (emphasis added). The "Business Interruption Endorsement" in the excess policies provides coverage for business interruption "resulting from physical loss or damage of the type insured against by this Policy, to property not otherwise excluded by this Policy." (emphasis added).

As the District Court explained, in this case, in contrast to the factually analogous Port of Seattle case, "GTE has done more than claim testing losses; GTE clearly claims that had it not remediated its computer system in preparation for Y2K, it would have faced separate business interruption losses of a great magnitude." 258 F. Supp. 2d at 380. Viewing the evidence in the light most favorable to GTE, the District Court concluded that GTE faced potential business interruption losses and its remediation efforts were taken to prevent such losses. Nevertheless, the District Court concluded that, pursuant to the terms of the policies, the alleged business interruption losses were not insurable. We agree.

The District Court explained that "[t]he ensuing loss provisions clearly only provide coverage for a covered loss ensuing from one of the excluded perils." 258 F. Supp. 2d at 381. Moreover, "[u]nder the plain language of the policies, the business interruption loss must be caused by a covered peril." Id. As a result, because design defects and inherent vices are not perils covered, "the business interruption loss ensuing from a design defect or inherent vice would not be a covered loss." Id. In other words, GTE cannot recover for just any ensuing or resulting business loss-the underlying peril resulting in business interruption must be covered. Returning to the fire example above, business interruption losses ensuing or resulting from any physical damage sustained by a fire would be covered because such physical damage is a covered peril. However, GTE cannot claim business interruption losses ensuing or resulting from the specifically excluded intrinsic design defect and inherent vice perils. Any other reading of the exclusionary provisions would render the provisions a virtual nullity. GTE could argue, for example, that any upgrade to or correction of a defective system is reimbursable because the ensuing loss from failing to correct the system would result in "business interruption."

In sum, we conclude that even when read in conjunction with the other terms of the policies-the ensuing loss, data destruction, and business interruption provisions-GTE's claim is still barred by the defective design and inherent vice exclusions.

C. Consideration of After-The-Fact Correspondence

Finally, GTE argues that the District Court, in interpreting the foregoing contract provisions, erred by failing to consider the Insurers' alleged after-the-fact efforts to amend the policies to exclude coverage for Y2K costs. To begin, GTE points out that the Insurers chose to extend GTE's insurance policies through the millennium without including a Y2K exclusion. Moreover, GTE alleges that, in 1998 and the spring of 1999, each Insurer asked GTE to accept a Y2K exclusion.20 GTE contends that Insurers should not now be permitted to obtain from the Court contract terms they were unsuccessful in negotiating, and suggests that the efforts to negotiate Y2K exclusions illustrate an awareness on the part of Insurers that under the existing language they were liable for GTE's Y2K remediation measures. We conclude that such alleged after-the-fact correspondence is not properly considered in interpreting this contract, and, moreover, that the correspondence in this case does not appear to support GTE's claim.

New Jersey courts consider the insurer's conduct in determining whether a policy's terms are ambiguous. See Fortunato v. Highlands Ins. Group, 345 N.J.Super. 529, 785 A.2d 963, 967 (Law Div.2001) ("The ambiguity of the umbrella policy here is also shown by the conduct of the insurer."). Moreover, courts do not "permi[t] insurance companies to seek refuge in the literal language of their policies when the company's conduct and actions ... causes [sic] the insured to act or to fail to act based on that conduct." Doto v. Russo, 140 N.J. 544, 659 A.2d 1371, 1377 (1995). We have already concluded, however, that the terms of the policy unambiguously exclude GTE's claim. Therefore, we find no reason to look to the Insurers' alleged conduct. In addition, GTE has failed to point to conduct by the Insurers that caused GTE to act or fail to act-this is not a case where GTE took some action, to its detriment, in reliance on the Insurers' statements or conduct.

In fact, the correspondence in this case does not even appear to support GTE's contention that the Insurers sought to amend the policies to exclude Y2K coverage. In a fax dated June 3, 1998, GTE's Counsel requested that Allendale include clarifying language that it would not add such a Y2K exclusion. The fax provides:

The letter received was incomplete in GTE and our estimation based on our meeting and Allendale's positive response. We would like the letter to read as follows:

Allendale will not add any additional exclusions, amendments or endorsements regarding Year 2000 issues (inability to recognize the correct data including Year 2000) to the currently in force GTE/ Allendale policies prior to the expiration of such policies (July 1, 2000).

J.A. at 4156 (emphasis added).

On June 15, 1998, Allendale appears to have transmitted to GTE's insurance broker proposed agreements between Allendale, Affiliated, and GTE. One of the stated objectives of the agreement was to "[e]liminat[e] uncertainty and achiev [e] mutual agreement as to how the policy responds to Y2K or other similar date or time recognition claims." Letter from Brian J. Krais, Vice President and Operations Manager of Allendale Insurance, to Adam Kagan, J & H Marsh & McLennan (June 15, 1998), J.A. at 4129. The proposed agreement provided that "Afilliated and GTE agree that Afilliated will not endorse onto the existing policy any restriction or clarification to the policy language specifically relating to Y2K." Id. The agreement went on to explain, however, that the parties would "agree that a proper construction and interpretation of the policy is as follows: 1) the policy does not pay for remediation, repair or assessment of any Y2K or similar date or time recognition problem in any electronic data processing equipment and media, whether preventative or remedial...." Id. at 4129-30. However, there is no indication in the record that the parties ever assented to the agreement.

The fact that agreements clarifying the scope of Y2K coverage were discussed, and that GTE may have sought to have Insurers clarify that no "additional exclusions" would be added in no way suggests that GTE believed, much less that Allendale represented, that the policies provided for Y2K coverage. In fact, GTE's attempts to ensure that no "additional exclusions" pertaining to Y2K would be added suggest that GTE anticipated that at least some Y2K measures were not covered under the policy.21

GTE contends that it is entitled to reimbursement under the Sue and Labor Provisions. GTE argues that these provisions require the company to avert certain losses22 and then obligate the Insurers to reimburse GTE for those expenses. We decided in Part III that, because of the policies' exclusions, GTE's actions were not aimed at averting a covered loss. Therefore, the only remaining question is whether the Sue and Labor Provisions provide an independent basis for recovery. They do not.

The Sue and Labor Provisions do not save GTE's claims from the policy exclusions. Rather, as the District Court explained,

[T]he purpose of the sue and labor clause is to reimburse the insured for costs incurred to satisfy the insured's duty to the insurer. If the insured acts to prevent a loss that is not covered by the policy, there is no duty or benefit to insurer; "[t]he obligation only exists when the action taken is to prevent a loss for which the underwriter would be liable."

258 F.Supp.2d at 373 (quoting Port of Seattle, 48 P.3d at 340). In Port of Seattle, the Washington Court of Appeals held that expenses incurred to prevent Y2K losses were not covered under the sue and labor clause because the Port sought to prevent a loss that would occur after the policies expired. 48 P.3d at 340. While Port of Seattle is arguably distinguishable on some grounds and is certainly not binding precedent, the underlying rationale of the court's decision is persuasive. The purpose of a sue and labor clause is to encourage the prevention of loss that is the subject of the policy; that is, the clause is designed to allow reimbursement for measures taken by the insured to mitigate damages in order to reduce the insurer's obligation under the policy. See Swire I, 139 F.Supp.2d at 1383. While there is some dispute as to whether the covered loss has to occur to invoke coverage, see Swire II, 284 F.3d at 1232 (citing cases), it seems undisputed that the actions must at least be aimed at a covered loss. An alternative view, construing the Sue and Labor Provisions as separate insuring agreements, would read the defective design and inherent vice exclusions out of the policy.

Thus, the Sue and Labor Provisions do not provide an independent basis for GTE's recovery. Such an interpretation of the Sue and Labor Provisions is necessary to avoid rendering the exclusionary provisions meaningless; an alternative interpretation would permit GTE to recover for improvements and measures taken to address a host of uninsured risks.

* * * * * *

For the foregoing reasons, we will affirm the District Court's grant of summary judgment.