News about cyberattacks and data breaches that compromise personal and private information has begun to feel like a daily occurrence. The trend has affected not only the private sector; increasingly, government is also a target. Recently, the Securities and Exchange Commission disclosed that its EDGAR database, which functions as its online repository for periodic reports and registration statements filed by public companies and mutual funds, had been breached last year, and that it only recently discovered that non-public information, including corporate information and personal data, had been accessed. The disclosure of the cyberattack on the SEC coincides with the cybersecurity initiatives and directives that SEC Chairman Jay Clayton has made a priority, including the creation of a new Cyber Unit within the SEC's Enforcement Division. As the SEC presses on with its various initiatives, some have expressed concerns that the SEC is not fully equipped to handle the host of cybersecurity issues that will continue to come its way. Nonetheless, the SEC appears focused on the mission of increasing cybersecurity and determined to address the growing threat to markets.

EDGAR Breach and SEC's New Efforts

On Sept. 20, 2017, the SEC published a statement by Chairman Clayton containing an overview of the SEC's approach to cybersecurity, after having initiated an assessment of the SEC's internal cybersecurity risk profile and approach to cybersecurity from a regulatory and oversight perspective in May 2017. Chairman Clayton noted that in today's environment, cyberattacks are perpetrated by a host of bad actors, including “identity thieves, unscrupulous contractors and vendors, malicious employees, business competitors, prospective insider trades and market manipulators, so-called 'hacktivists,' terrorists, [and] state-sponsored actors” that “create significant risks to the operational performance of market participants and of markets as a whole.” Statement on Cybersecurity, Chairman Jay Clayton (Sept. 20, 2017). He also recognized that “even the most diligent cybersecurity efforts will not address all cyber risks that enterprises risk.”

The most important revelation in the statement—that the SEC itself had been hacked—was buried midway through the report. Scant details of the intrusion were provided; instead, the statement merely reported that the SEC learned that the test filing component of EDGAR had been compromised and may have resulted in access by the hackers to non-public information:

In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading. Specifically, a software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to non-public information. We believe the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk. Our investigation of this matter is ongoing, however, and we are coordinating with appropriate authorities.

Id.

Public companies typically perform a test filing of their quarterly earnings on EDGAR the night before they plan to release that information. Since the hackers had access to that component of EDGAR, they were able to see earnings information the night before it was made public and potentially trade on it. This is just one example of the type of material, non-public information the hackers had access to.

Chairman Clayton was scheduled to testify on Sept. 25, 2017, before the Senate Committee on Banking, Housing, and Urban Development, his first such appearance since being confirmed. In written testimony, he provided a few additional details about the EDGAR hack:

We believe the 2016 intrusion involved the exploitation of a defect in custom software in the EDGAR system. When it was originally discovered, the SEC Office of Information Technology (OIT) staff took steps to remediate the defect in custom software code and reported the incident to the Department of Homeland Security's United Computer Emergency Readiness Team (US-CERT). Based on the investigation to date, OIT staff believes that the prior remediation effort was successful.

Testimony on “Oversight of the U.S. Securities and Exchange Commission” by Jay Clayton, Chairman, U.S. Securities and Exchange Commission, before the Committee on Banking, Housing and Urban Development, United States Senate, Sept. 26, 2017.

At the time, Chairman Clayton reiterated that the SEC did not believe that the intrusion resulted in unauthorized access to confidential personal or corporate information, but he emphasized that an investigation into the extent and impact of the “intrusion and related illicit activity” was ongoing. Just a few weeks later, additional details came to light. It appears that as a result of the breach, the names, dates of birth, and Social Security numbers of two individuals had been accessed by third parties. The individuals were being notified by the SEC that their personal information had been compromised. Chairman Clayton said, “The 2016 intrusion and its ramifications concern me deeply. I am focused on getting to the bottom of the matter, and, importantly, lifting our cybersecurity efforts moving forward.”

Around the same time, on Sept. 25, 2017, the SEC also announced the creation of a Cyber Unit within the Enforcement Division, as one of two new initiatives to build on the Enforcement Division's “ongoing efforts to address cyber-based threats and to protect retail investors.” SEC Announces Enforcement Initiatives to Combat Cyber-Based Threats and Protect Retail Investors (Sept. 25, 2017). The Cyber Unit will focus on targeting cyber-related misconduct such as market manipulation schemes involving false information spread through electronic social means; hacking to obtain material non-public information or access to retail brokerage accounts; violations involving distributed ledger (i.e., blockchain) technology and initial coin offerings; and cyber threats to trading platforms and other critical market infrastructure. The announcement noted that the Cyber Unit “complements the Chairman's initiatives to implement an internal cybersecurity risk profile and create a cybersecurity working group to coordinate information sharing, risk monitoring, and incident response efforts throughout the agency.” Stephanie Avakian, co-director of the SEC's Enforcement Division, added: “The Cyber Unit will enhance our ability to detect and investigate cyber threats through increasing expertise in an area of critical national importance.” Id.

Concerns Following Breach

As the gatekeeper of troves of non-public market data, and the protector of market integrity, the SEC has faced criticisms and concerns from many sides stemming from the revelation of the hack.

One of the most basic concerns is that the SEC itself does not appear to follow the same (or similar) cyber- and data-security measures that it demands from the entities and investors that it regulates. For instance, under guidance issued in 2011 by the SEC's Division of Corporation Finance, companies may be obligated to timely disclose material information regarding cyber incidents as well as cyber risks. The SEC's delay in disclosing the 2016 hack as well as the initial lack of details it provided mirror the dilemmas many companies face about the disclosure of the “who, what, when, and how” of cyberattacks. Most troubling of all, Chairman Clayton suggested that the Commissioners and senior-level SEC staff were not informed about the 2016 hack until it was discovered by his recent review. Amidst all this news, one lawmaker went so far as to urge the SEC to delay its planned November 2017 launch of the Consolidated Audit Trail, which would track and collect all trading activity in equities and options across all U.S. markets, citing the recent disclosure of the EDGAR hack and the SEC's cybersecurity risks. Hearing entitled “Examining the SEC's Agenda, Operations, and Budget” before Members of the Committee on Financial Services, United States House of Representatives, Oct. 4, 2017. Similarly, the Investment Company Institute, a global investor group, called for an independent investigation into the EDGAR hack and urged the SEC to delay new data-gathering rules set to take effect at the end of the year that require funds to file monthly statements with their portfolio holdings confidentially with the SEC. Since the EDGAR hack was made public, reports have emerged that the U.S. Government Accountability Office (GAO) criticized and warned the SEC in July 2017 that it had not fully implemented an intrusion-detection capability and other security measures that the GAO previously recommended. Michelle Price, “Investor group seeks probe into SEC hack, urges data rules delay,” Reuters, Sept. 22, 2017. And it is still not known whether illegal trading on the basis of hacked information actually occurred.

Notwithstanding these concerns, it is clear that the SEC is focusing on cybersecurity at all levels of its operations, making cybersecurity readiness a key element of the examinations it conducts, and studying cyber-based threats against itself and the entities and persons it regulates. Given the stakes to the public and to our securities markets, this should certainly be among the agency's highest priorities.

Margaret A. Dale and Mark D. Harris are partners at Proskauer Rose. Massiel Pedreira, an associate, assisted in the preparation of this article.

News about cyberattacks and data breaches that compromise personal and private information has begun to feel like a daily occurrence. The trend has affected not only the private sector; increasingly, government is also a target. Recently, the Securities and Exchange Commission disclosed that its EDGAR database, which functions as its online repository for periodic reports and registration statements filed by public companies and mutual funds, had been breached last year, and that it only recently discovered that non-public information, including corporate information and personal data, had been accessed. The disclosure of the cyberattack on the SEC coincides with the cybersecurity initiatives and directives that SEC Chairman Jay Clayton has made a priority, including the creation of a new Cyber Unit within the SEC's Enforcement Division. As the SEC presses on with its various initiatives, some have expressed concerns that the SEC is not fully equipped to handle the host of cybersecurity issues that will continue to come its way. Nonetheless, the SEC appears focused on the mission of increasing cybersecurity and determined to address the growing threat to markets.

EDGAR Breach and SEC's New Efforts

On Sept. 20, 2017, the SEC published a statement by Chairman Clayton containing an overview of the SEC's approach to cybersecurity, after having initiated an assessment of the SEC's internal cybersecurity risk profile and approach to cybersecurity from a regulatory and oversight perspective in May 2017. Chairman Clayton noted that in today's environment, cyberattacks are perpetrated by a host of bad actors, including “identity thieves, unscrupulous contractors and vendors, malicious employees, business competitors, prospective insider trades and market manipulators, so-called 'hacktivists,' terrorists, [and] state-sponsored actors” that “create significant risks to the operational performance of market participants and of markets as a whole.” Statement on Cybersecurity, Chairman Jay Clayton (Sept. 20, 2017). He also recognized that “even the most diligent cybersecurity efforts will not address all cyber risks that enterprises risk.”

The most important revelation in the statement—that the SEC itself had been hacked—was buried midway through the report. Scant details of the intrusion were provided; instead, the statement merely reported that the SEC learned that the test filing component of EDGAR had been compromised and may have resulted in access by the hackers to non-public information:

In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading. Specifically, a software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to non-public information. We believe the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk. Our investigation of this matter is ongoing, however, and we are coordinating with appropriate authorities.

Id.

Public companies typically perform a test filing of their quarterly earnings on EDGAR the night before they plan to release that information. Since the hackers had access to that component of EDGAR, they were able to see earnings information the night before it was made public and potentially trade on it. This is just one example of the type of material, non-public information the hackers had access to.

Chairman Clayton was scheduled to testify on Sept. 25, 2017, before the Senate Committee on Banking, Housing, and Urban Development, his first such appearance since being confirmed. In written testimony, he provided a few additional details about the EDGAR hack:

We believe the 2016 intrusion involved the exploitation of a defect in custom software in the EDGAR system. When it was originally discovered, the SEC Office of Information Technology (OIT) staff took steps to remediate the defect in custom software code and reported the incident to the Department of Homeland Security's United Computer Emergency Readiness Team (US-CERT). Based on the investigation to date, OIT staff believes that the prior remediation effort was successful.

Testimony on “Oversight of the U.S. Securities and Exchange Commission” by Jay Clayton, Chairman, U.S. Securities and Exchange Commission, before the Committee on Banking, Housing and Urban Development, United States Senate, Sept. 26, 2017.

At the time, Chairman Clayton reiterated that the SEC did not believe that the intrusion resulted in unauthorized access to confidential personal or corporate information, but he emphasized that an investigation into the extent and impact of the “intrusion and related illicit activity” was ongoing. Just a few weeks later, additional details came to light. It appears that as a result of the breach, the names, dates of birth, and Social Security numbers of two individuals had been accessed by third parties. The individuals were being notified by the SEC that their personal information had been compromised. Chairman Clayton said, “The 2016 intrusion and its ramifications concern me deeply. I am focused on getting to the bottom of the matter, and, importantly, lifting our cybersecurity efforts moving forward.”

Around the same time, on Sept. 25, 2017, the SEC also announced the creation of a Cyber Unit within the Enforcement Division, as one of two new initiatives to build on the Enforcement Division's “ongoing efforts to address cyber-based threats and to protect retail investors.” SEC Announces Enforcement Initiatives to Combat Cyber-Based Threats and Protect Retail Investors (Sept. 25, 2017). The Cyber Unit will focus on targeting cyber-related misconduct such as market manipulation schemes involving false information spread through electronic social means; hacking to obtain material non-public information or access to retail brokerage accounts; violations involving distributed ledger (i.e., blockchain) technology and initial coin offerings; and cyber threats to trading platforms and other critical market infrastructure. The announcement noted that the Cyber Unit “complements the Chairman's initiatives to implement an internal cybersecurity risk profile and create a cybersecurity working group to coordinate information sharing, risk monitoring, and incident response efforts throughout the agency.” Stephanie Avakian, co-director of the SEC's Enforcement Division, added: “The Cyber Unit will enhance our ability to detect and investigate cyber threats through increasing expertise in an area of critical national importance.” Id.

Concerns Following Breach

As the gatekeeper of troves of non-public market data, and the protector of market integrity, the SEC has faced criticisms and concerns from many sides stemming from the revelation of the hack.

One of the most basic concerns is that the SEC itself does not appear to follow the same (or similar) cyber- and data-security measures that it demands from the entities and investors that it regulates. For instance, under guidance issued in 2011 by the SEC's Division of Corporation Finance, companies may be obligated to timely disclose material information regarding cyber incidents as well as cyber risks. The SEC's delay in disclosing the 2016 hack as well as the initial lack of details it provided mirror the dilemmas many companies face about the disclosure of the “who, what, when, and how” of cyberattacks. Most troubling of all, Chairman Clayton suggested that the Commissioners and senior-level SEC staff were not informed about the 2016 hack until it was discovered by his recent review. Amidst all this news, one lawmaker went so far as to urge the SEC to delay its planned November 2017 launch of the Consolidated Audit Trail, which would track and collect all trading activity in equities and options across all U.S. markets, citing the recent disclosure of the EDGAR hack and the SEC's cybersecurity risks. Hearing entitled “Examining the SEC's Agenda, Operations, and Budget” before Members of the Committee on Financial Services, United States House of Representatives, Oct. 4, 2017. Similarly, the Investment Company Institute, a global investor group, called for an independent investigation into the EDGAR hack and urged the SEC to delay new data-gathering rules set to take effect at the end of the year that require funds to file monthly statements with their portfolio holdings confidentially with the SEC. Since the EDGAR hack was made public, reports have emerged that the U.S. Government Accountability Office (GAO) criticized and warned the SEC in July 2017 that it had not fully implemented an intrusion-detection capability and other security measures that the GAO previously recommended. Michelle Price, “Investor group seeks probe into SEC hack, urges data rules delay,” Reuters, Sept. 22, 2017. And it is still not known whether illegal trading on the basis of hacked information actually occurred.

Notwithstanding these concerns, it is clear that the SEC is focusing on cybersecurity at all levels of its operations, making cybersecurity readiness a key element of the examinations it conducts, and studying cyber-based threats against itself and the entities and persons it regulates. Given the stakes to the public and to our securities markets, this should certainly be among the agency's highest priorities.

Margaret A. Dale and Mark D. Harris are partners at Proskauer Rose. Massiel Pedreira, an associate, assisted in the preparation of this article.