What the Delta-Crowdstrike lawsuit may mean for IT contracts

Contract lessons in the Delta-CrowdStrike dispute

Contributory negligence, gross negligence and willful misconduct fall under tort law, which covers the harm a company would suffer from the unreasonable acts of another. Proving guilt under those legal terms is complicated and can cost hundreds of thousands of dollars, if not millions, in legal fees, lawyers said.

Losses as huge as Delta's justify spending the money to pursue those claims as well as those centered on breach of contract. Delta has not provided details on how CrowdStrike violated its agreement with the airline.

Nevertheless, enterprises should be aware of several elements of a contract that would be critical in most disputes between organizations and IT vendors, including the Delta-CloudStrike squabble, lawyers said.

First and foremost, the contract must clearly define what the vendor has agreed to do, when it will do it, and how much it will cost, said Brad Frazer, a partner at Hawley Troxell, based in Boise, Idaho. The statement of work clause is the first thing he asks for when a client comes to him with a problem.

"It's much easier to sue somebody if you've got a statement of work," Frazer said. "Because now we have a clear standard to measure the [vendor's] performance against when we sue."

Negotiating the highest liability limit possible with a vendor is critical. However, it's unlikely ever to cover damages as severe as Delta's. That's because the amount a vendor is willing to pay depends on the size of the contract. A $100,000 agreement, for example, wouldn't make sense if the potential liability were $20 million.

Often, an enterprise is stuck with the liability limit if there were no extenuating circumstances that would force the vendor to pay more. Morvareed Salehpour, head of the law firm Salehpour Legal in Los Angeles, described hitting that ceiling while trying to get more money for a client whose software vendor had suffered a security breach.

"They had been disrupted, their data had been breached, but I felt like I was negotiating with my hands tied behind my back," Salehpour said.

Another crucial contract negotiation is indemnification, which makes the vendor responsible for lawsuits filed against the customer because of a vendor-caused outage or security breach, lawyers said. Delta faces a federal class-action suit seeking refunds for travelers affected by the airline's cancellation of 7,000 flights over five days.

Indemnification also includes protecting the customer from expensive lawsuits accusing the IT vendor of violating another IT provider's intellectual property rights.

"If they don't give me [indemnification], then I might walk away," Frazer said.

Antone Gonsalves is an editor at large for TechTarget Editorial, reporting on industry trends critical to enterprise tech buyers. He has worked in tech journalism for 25 years and is based in San Francisco. Have a news tip? Please drop him an email.