When buildings go offline: Cyber risk in the modern office

The growing dependence of commercial buildings on interconnected technology is creating a new category of property risk. For landlords, operators and occupiers, the question is no longer simply whether a building’s systems are secure, but who bears the legal and financial consequences when they fail.

Modern office buildings are no longer simply bricks and mortar. Increasingly, they rely on a complex ecosystem of shared technology, from internet connectivity and access-control systems to CCTV, visitor management platforms and sophisticated building management systems. In many cases, particularly in the serviced office sector, technology has become as important to occupiers as electricity and water.

As a result, IT failures and cyber security incidents can have significant consequences for both landlords and occupiers. A failure affecting a shared network or building system may disrupt multiple businesses simultaneously, while a cyber attack affecting one occupier can potentially impact others within the same building. The legal question that inevitably follows is: who is responsible?

When a third-party supplier fails

Many technology services within office buildings are provided by third-party suppliers rather than the landlord itself. Internet connectivity, access-control systems, CCTV platforms and smart building technologies are often outsourced to specialist providers.

If one of these suppliers suffers a service outage, tenants may find themselves unable to connect to the internet or carry out routine business operations, and in some cases may even be unable to access the premises. While the commercial impact can be substantial, establishing legal responsibility is not always straightforward.

In a traditionally leased office building, landlords will often have limited responsibility for interruptions to services. Most commercial leases do not guarantee uninterrupted service provision, and modern leases commonly include provisions allowing for temporary interruptions due to maintenance, repairs, failures outside the landlord’s control or the actions of third-party suppliers.

As a result, a tenant whose business is disrupted by an internet outage may have little recourse against the landlord unless the landlord has itself contributed to the problem. Liability is more likely to arise where the landlord has failed to maintain infrastructure properly, ignored known deficiencies, or acted negligently in selecting or managing critical suppliers.

The position can be quite different in a serviced office environment. Landlords, or their appointed serviced office operators, often promote high-speed connectivity, integrated technology solutions and managed IT support as core features of their offering. Where technology services form a key part of the package being sold, occupiers may have stronger arguments that prolonged service failures amount to a breach of contract.

This does not necessarily mean the landlord or operator will be liable for every outage. Most serviced office agreements still contain extensive exclusions of liability. However, occupiers may benefit from service level commitments, service credits or other contractual remedies that would rarely be found in a conventional lease.

The growing risk of “smart building” failures

The trend towards smart buildings has created additional legal and operational risks.

Building management systems are increasingly used to control heating, ventilation, lighting, security and energy consumption. These systems can improve efficiency and enhance the occupier experience, but they also create new points of vulnerability.

A cyber attack directed at a building management system could potentially disable access controls, impact environmental controls or interfere with critical building operations. Even where the attack does not target a tenant directly, the resulting disruption can have significant consequences for occupiers.

Responsibility in these situations can be difficult to determine because multiple parties are often involved. A landlord may own the infrastructure, whilst a managing agent oversees its operation and a specialist technology provider maintains the system. Determining who failed to implement appropriate security measures and who should bear the resulting losses is often one of the most contentious aspects of any dispute.

What if one tenant causes a problem for everyone else?

Perhaps the most difficult scenario arises where the actions of one occupier affect others within the building.

Historically, tenants operated largely independent technology environments. Today, however, many buildings contain shared infrastructure that creates a degree of interdependence between occupiers. This is particularly true in serviced offices, where shared networks, printers, meeting room technology and access systems are common.

Consider a scenario in which a tenant’s compromised device introduces malware into a shared network, or a tenant’s employee gains unauthorised access to a building management system. If that incident causes disruption to other occupiers, significant questions arise regarding liability.

In a conventional leased building, the affected parties would first look to the lease and any related documentation. Many leases require tenants not to interfere with building systems, to comply with applicable laws and to avoid causing nuisance or disruption to neighbouring occupiers. If a tenant has breached those obligations, the landlord may have a contractual claim against that breaching tenant, but leases rarely place obligations on landlords to recover losses on behalf of other affected occupiers.

Other occupiers may also seek to pursue claims directly, although proving causation and recovering losses resulting from cyber incidents can be challenging in practice.

The risks are amplified in serviced office environments because occupiers are often more dependent upon common systems. Operators should therefore take particular care to ensure appropriate segregation of networks and robust cyber security controls so that a cyber incident affecting one occupier does not compromise the operations of every other occupier within the building.

Data protection: An often overlooked issue

Cyber incidents within multi-tenanted buildings frequently give rise to data protection concerns as well.

Access-control systems, visitor management platforms and CCTV networks routinely process personal data relating to employees, visitors and contractors. A security breach involving any of these systems may trigger obligations under UK data protection legislation.

Landlords are often surprised to discover that they retain significant responsibilities even where systems are administered by a managing agent or technology provider. Similarly, tenants may be unaware of the extent to which their employees’ data is being collected through building systems operated by third parties.

Where a cyber incident occurs, it is important to establish who acts as data controller, who acts as processor, and which party is responsible for investigating and responding to any personal data breach.

Insurance is not always the answer

Many parties assume that insurance will respond in the event of a major cyber incident. Unfortunately, the position is not always that simple.

Property insurance policies may not cover cyber-related losses, while cyber policies frequently contain limitations and exclusions that can leave gaps in protection. Particular difficulties can arise where a cyber event causes physical disruption to building operations, such as a ransomware attack that disables access systems or building controls.

Both landlords and occupiers should ensure that their insurance arrangements reflect the increasing integration of technology within commercial buildings and that there are no unexpected gaps between property and cyber coverages.

Practical steps for landlords and tenants

As technology becomes increasingly central to building operations, both landlords and tenants should treat cyber risk as a property issue as well as an IT issue.

Landlords and serviced office operators should consider reviewing:

• the cyber security obligations imposed on key technology suppliers and contractors;
• business continuity, disaster recovery and incident response arrangements;
• the allocation of risk and responsibility under leases, licences and occupier agreements;
• contractual service levels and remedies for technology failures;
• the extent to which shared systems and networks are segregated between occupiers;
• access controls and permissions for building management systems; and
• data protection responsibilities associated with CCTV, access-control and visitor management systems.

Tenants should similarly understand which technology services they depend upon, the extent of the landlord’s or operator’s contractual obligations, and what remedies are available if those services fail. They should also consider whether their own cyber security arrangements could expose them to contractual or other liability if an incident originating within their systems affects the landlord or other occupiers

Conclusion

The legal allocation of responsibility for IT failures and cyber incidents in multi-tenanted office buildings will depend heavily on the contractual arrangements in place and the nature of the building itself. In a traditional leased office environment, landlords will often have relatively limited liability for failures caused by third-party suppliers. In serviced offices, where technology services form a core part of the offering, occupiers may have greater contractual protections and remedies.

Equally, where one tenant causes a cyber security incident that affects others in the building, liability may arise through breach of lease obligations or licence terms, negligence or data protection failures.

Data protection obligations add a further layer of complexity where shared building systems process personal data. The respective roles of controllers and processors, together with the contractual and regulatory obligations applying to each, should be established before an incident occurs rather than during the response to one.

As commercial buildings become increasingly connected, landlords, operators and occupiers should review their contractual arrangements, cyber security measures, incident response procedures and insurance coverage accordingly. The objective should not simply be to determine who is liable after something goes wrong, but to allocate responsibility clearly and manage the risk before an incident occurs.

How Cripps can help

The legal risks arising from connected buildings rarely sit within a single contract or area of law. They can span technology supply agreements, leases and licences, data protection, cyber security, insurance and business continuity.

At Cripps our lawyers advise landlords, property managers, serviced office providers and tenants on these issues.

If your organisation owns, occupies, manages or supplies technology to a multi-tenanted building, our team can help you review your contractual arrangements and identify where responsibility for technology and cyber risk currently sits and can help adjust that position where required.