SEC charges SolarWinds and CISO with securities fraud and control failures
You remember the 2020 SolarWinds hack, perhaps one of the worst cyberattacks in history? As NPR described it in 2021, we all regularly receive routine software updates like this one:
“‘This release includes bug fixes, increased stability and performance improvements’…. Last spring, a Texas-based company called SolarWinds made one such software update available to its customers. It was supposed to provide the regular fare—bug fixes, performance enhancements—to the company’s popular network management system, a software program called Orion that keeps a watchful eye on all the various components in a company’s network. Customers simply had to log into the company’s software development website, type a password and then wait for the update to land seamlessly onto their servers. The routine update, it turns out, is no longer so routine. Hackers believed to be directed by the Russian intelligence service, the SVR, used that routine software update to slip malicious code into Orion’s software and then used it as a vehicle for a massive cyberattack against America. ‘Eighteen thousand [customers] was our best estimate of who may have downloaded the code between March and June of 2020,’”
according to the Company’s CEO. And not just any customers—the Company determined that many very well-known companies and about a dozen government agencies were compromised, including the Treasury, Justice and Energy departments, the Pentagon and, ironically, the Cybersecurity and Infrastructure Security Agency, part of the Department of Homeland Security. On Monday, the SEC announced that it had filed a complaint against SolarWinds and its Chief Information Security Officer, Timothy G. Brown, charging ‘fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities.” In the complaint, the SEC charges that “SolarWinds’ public statements about its cybersecurity practices and risks painted a starkly different picture from internal discussions and assessments about the Company’s cybersecurity policy violations, vulnerabilities, and cyberattacks.” According to Gurbir S. Grewal, Director of the SEC’s Division of Enforcement, the SEC’s enforcement action “underscores our message to issuers: implement strong controls calibrated to your risk environments and level with investors about known concerns.”
Gensler talks climate with the Chamber
In his introduction to a conversation late last week with SEC Chair Gary Gensler on “Climate Disclosure Developments: The SEC, California, and EU Extraterritoriality,” the President and CEO of the U.S. Chamber of Commerce’s Center for Capital Markets, observed that, although companies have voluntarily responded to investors by increasingly disclosing information on climate, now policymakers in different states and across the globe are working to impose a plethora of mandatory reporting requirements for climate disclosure. The thing is, they’re not consistent. While the Chamber supported disclosure of material climate information, he cautioned that the actions by these policymakers have created a real risk that companies will face duplicate, differing, overlapping and even conflicting requirements. The SEC’s proposal to enhance standardization of climate disclosure might offer some real relief on that score, and that makes it all the more important, he said, for the SEC to act within its authority. The potential for public companies to become ensnared in this labyrinth of overlapping and conflicting regulation was the apparent subject of this conversation. In the end, however, Gensler’s steady focus was on the remit of the SEC under U.S. law. Risks to issuers arising out of inconsistency with California and the EU—well, not so much.
It’s not over till it’s over: Petition filed for rehearing en banc on Nasdaq board diversity rule
As discussed in this PubCo post, on October 18, a three-judge panel of the Fifth Circuit denied the petitions filed by the Alliance for Fair Board Recruitment and the National Center for Public Policy Research challenging the SEC’s final order approving the Nasdaq listing rules regarding board diversity and disclosure. The new listing rules adopted a “comply or explain” mandate for board diversity for most listed companies and required companies listed on Nasdaq’s U.S. exchange to publicly disclose “consistent, transparent diversity statistics” regarding the composition of their boards. (See this PubCo post.) Given that, by repute, the Fifth Circuit is the circuit of choice for advocates of conservative causes, the decision to deny the petition may have taken some by surprise—unless, that is, they were aware, as discussed in the WSJ and Reuters, that the three judges on this panel happened to all be appointed by Democrats. Yesterday, the Petitioners filed a petition requesting a rehearing en banc by the Fifth Circuit, where Republican presidents have appointed 12 of the 16 active judges. Not that politics has anything to do with it, of course.
Is there an alternative to Scope 3?
As you know, the SEC has proposed a sweeping set of regulations for disclosure on climate (see this PubCo post, this PubCo post and this PubCo post), and we anxiously wait to see what the final rules have in store (obviously not happening in October as the SEC had previously targeted). One controversial part of that proposal draws on the Greenhouse Gas Protocol, requiring disclosure of a company’s Scopes 1 and 2 greenhouse gas emissions, and, for larger companies, Scope 3 GHG emissions if material (or included in the company’s emissions reduction target), with a phased-in attestation requirement for Scopes 1 and 2 data for large accelerated filers and accelerated filers. There haven’t been many complaints about the Scope 1 and Scope 2 requirements, but Scope 3 is another matter. According to the SEC, some commenters indicated that, for many companies, Scope 3 emissions represent a large proportion of overall GHG emissions, and therefore, could be material. However, those emissions result from the activities of third parties in the company’s “value chain,” making collection of the data much more difficult and much less reliable. In two articles published in the Harvard Business Review—“Accounting for Climate Change” and “We Need Better Carbon Accounting. Here’s How to Get There”—Robert Kaplan and Karthik Ramanna from Harvard Business School and the University of Oxford, respectively, propose another idea—the E-liability accounting system. The GHG protocol is, at this point, deeply embedded. Would the E-liability system work? Should the SEC or other regulators make room for a different concept?
Relentless Inc. v. Dept. of Commerce: SCOTUS grants cert. to another case about Atlantic herring—and Chevron deference
On October 13, SCOTUS granted cert. in the case of Relentless, Inc. v. Dept of Commerce, a case about whether the National Marine Fisheries Service has the authority to require herring fishing vessels to pay some of the costs for onboard federal observers who are required to monitor regulatory compliance. Does that ring a bell? Probably, because it’s exactly the same issue on which SCOTUS has already granted cert. in Loper Bright Enterprises v. Raimondo. (See this PubCo post.) Why grant cert. in this case too? It’s been widely reported that the reason was to allow Justice Kenji Brown Jackson, who had recused herself on Loper Bright, to participate in what will likely be a very important decision: whether the Court should continue the decades-long deference of courts, under Chevron U.S.A., Inc. v. Nat. Res. Def. Council, to the reasonable interpretations of statutes by agencies (such as the National Marine Fisheries Service or, as has happened fairly often, the SEC, see this Cooley News Brief). The question presented is “ [w]hether the Court should overrule Chevron or at least clarify that statutory silence concerning controversial powers expressly but narrowly granted elsewhere in the statute does not constitute an ambiguity requiring deference to the agency.” The decision could narrow, or even completely undo, that deference. The grant of cert provided that the two cases will be argued in tandem in the January 2024 argument session. Mark your calendars.
Fifth Circuit denies petition challenging Nasdaq’s board diversity rule
On Friday, August 6, 2021, the SEC approved a Nasdaq proposal for new listing rules regarding board diversity and disclosure, accompanied by a proposal to provide free access to a board recruiting service. The new listing rules adopted a “comply or explain” mandate for board diversity for most listed companies and required companies listed on Nasdaq’s U.S. exchange to publicly disclose “consistent, transparent diversity statistics” regarding the composition of their boards. (See this PubCo post.) As anticipated, a court challenge to these rules didn’t take long to materialize. On Monday, August 9, the Alliance for Fair Board Recruitment filed a slim petition under Section 25(a) of the Exchange Act in the Fifth Circuit Court of Appeals—the Alliance has its principal place of business in Texas—for review of the SEC’s final order approving the Nasdaq rule. (See this PubCo post.) That petition was soon followed by a new petition challenging the rules filed by the National Center for Public Policy Research and subsequently transferred to the Fifth Circuit where the earlier filed petition was pending. (See this PubCo post.) Yesterday, a three-judge panel of the Fifth Circuit—by repute, the Circuit of choice for advocates of conservative causes—denied those petitions, in effect upholding Nasdaq’s board diversity listing rules. According to the unanimous decision, “AFBR and NCPPR have given us no reason to conclude that the SEC’s Approval Order violates the Exchange Act or the APA.” The case is Alliance for Fair Board Recruitment, National Center for Public Policy Research v. SEC.
Cooley Alert: California’s Voluntary Carbon Market Disclosures Act
In this piece in the New Yorker, the author describes the inception in the late 1980s of the carbon-offsetting market, which emerged from the notion that carbon was a fungible commodity, like coffee or cotton. A U.S. power company had “conceived a novel way to reduce emissions: it could surround its main coal-fired power station with a forest, to absorb the carbon billowing from its chimney. That plan turned out to be implausible. Scientists calculated that, to absorb the carbon the facility would pump out in its life span, the company needed to plant some fifty-two million trees—an impossibility in densely populated Connecticut.” But then an executive elsewhere “had an inspiration: since the atmosphere was a global commons, why not situate the forest elsewhere? The company eventually paid for forty thousand farmers to plant trees in the mountains of Guatemala. It cost just two million dollars—pennies per ton of carbon.” The idea caught on, and, a “decade later, the concept of carbon offsetting was enshrined in international law.”
ICYMI: column from Matt Levine on SEC Enforcement’s “silly season”
After all the PubCo posts on the avalanche of SEC enforcement cases muscled into the last couple of days before the SEC’s fiscal year end, I thought this column in Bloomberg from Matt Levine might be of particular interest. The relevant portion of the column, called the “SEC silly season,” discusses the apparent scramble by the SEC at the end of its fiscal year to bring as many enforcement actions as possible in response to “performance-reporting pressures,” that is, the pressures to make its stats to achieve optimal Congressional funding. According to academic research cited in the column, that scramble is not just “apparent,” it’s real, and it has practical implications for enforcement behavior. The research showed that the average number of cases filed in September “is almost double the average in other months,” and that the “spike is larger when case totals are behind pace to meet last year’s case total, which likely serves as a de facto performance benchmark.” The SEC achieves this fiscal-year-end increase, according to the research, “by changing its enforcement behavior related to substantive cases,” that is, through prioritization of less complex cases and imposition of more lenient penalties, including financial discounts, relative to other periods. For example, the September cases are “significantly more likely to reference defendant cooperation and to only name companies as defendants, and are less likely to include a fraud allegation and to reference parallel criminal proceedings.” Accordingly, the authors found that the “evidence is consistent with the SEC agreeing to more lenient settlement terms to increase case volume at fiscal year-end—an unintended consequence of performance reporting that undermines the SEC’s core values.” As the authors of the research suggest, might defendants familiar with this “regulatory inconsistency” be able to use it to their advantage?
SEC approves changes to modernize beneficial ownership reporting [updated]
[This post revises and updates my earlier post primarily to reflect the contents of the adopting release.]
Last week, without an open meeting, the SEC adopted rule amendments governing beneficial ownership reporting under Exchange Act Sections 13(d) and 13(g), updating Reg 13D-G to “require market participants to provide more timely information on their positions to meet the needs of investors in today’s financial markets.” Commissioner Hester Peirce dissented. In essence, the amendments accelerate the filing deadlines for Schedules 13D and 13G. The adopting release also clarifies the disclosure requirements of Schedule 13D with respect to derivative securities and provides guidance on the definition of “group” formation. In addition, the amendments require that these Schedules be filed in XBRL, and to that end, the SEC made a number of technical changes to Reg S-T. The adopting release also discusses the changes that had been proposed, but that, in response to comment, were not adopted, including proposed changes to the rules that would have deemed certain holders of cash-settled derivative securities to be beneficial owners of the reference covered class, and proposed rule amendments that would have addressed formation of a group and provided two new exemptions. Instead, the SEC is amending Schedule 13D to clarify that interests in derivative securities must be disclosed and, in the adopting release, provides guidance on those two topics. According to SEC Chair Gary Gensler, the “adoption updates rules that first went into effect more than 50 years ago. Frankly, these deadlines from half a century ago feel antiquated….In our fast-paced markets, it shouldn’t take 10 days for the public to learn about an attempt to change or influence control of a public company. I am pleased to support this adoption because it updates Schedules 13D and 13G reporting requirements for modern markets, ensures investors receive material information in a timely way, and reduces information asymmetries.”
You must be logged in to post a comment.