Opinion: If the SEC were a company, its hack disclosure would have to be reported to the SEC
Published: Sept 21, 2017 11:12 a.m. ET
By
STEVE
GOLDSTEIN
D.C. BUREAU CHIEF
For good reason, MarketWatch gives companies that try to obscure their corporate disclosures a hard time.
Made-up metrics, inconsistent disclosures, mixed-up tables — it’s the sort of thing that makes a mockery of public markets and frequently earns the offending companies some unfriendly correspondence from the Securities and Exchange Commission.
Read: Earnings season is still a headache and shareholders shouldn’t stand for it
About that.
So it turns out the SEC may have a bit of a disclosure problem of its own. The agency revealed Wednesday night that its hackers penetrated its electronic system for storing public-company filings and may have traded illegally on the information.
Now, the SEC didn’t just discover this hack — it occurred in 2016. And it knew about it then. It was only in August that the SEC discovered the hack may have provided the opportunity for insider trading.
With that in mind, let’s look at how the SEC disclosed it.
First of all, the SEC doesn’t typically issue releases at night. And certainly not at 7:36 p.m. Eastern. Yes, the SEC can argue that every major news service jumped on the story, and they did. But it’s not the hour of the day to capture the attention of investors — the victims here, if there was in fact insider trading — and the timing suggests the SEC was trying to minimize, not maximize, publicity.
The statement from SEC Chairman Jay Clayton was another thing. A “statement on cybersecurity” was the title, as if the issue was the Equifax hack or some new regulation.
He gets to the issue of the intrusion into the SEC’s Edgar filing system — in paragraph 22.
And there’s not all that much he disclosed in the 4,077-word statement. Why did it take what seems to be a year, for the SEC to realize the intrusion to the system was done in a way that could be exploited by someone with nefarious purposes? How long did the vulnerability exist?
What did the SEC do in August to figure this out?
Why has the SEC taken a month to tell the investing public, and do so outside of trading hours, and on a religious holiday celebrated by many investors? All a mystery.
The SEC would never have accepted an 8-K like this. Congress shouldn’t, either.
http://www.marketwatch.com/story/if-the-sec-w...2017-09-21
Published: Sept 21, 2017 11:12 a.m. ET
By
STEVE
GOLDSTEIN
D.C. BUREAU CHIEF
For good reason, MarketWatch gives companies that try to obscure their corporate disclosures a hard time.
Made-up metrics, inconsistent disclosures, mixed-up tables — it’s the sort of thing that makes a mockery of public markets and frequently earns the offending companies some unfriendly correspondence from the Securities and Exchange Commission.
Read: Earnings season is still a headache and shareholders shouldn’t stand for it
About that.
So it turns out the SEC may have a bit of a disclosure problem of its own. The agency revealed Wednesday night that its hackers penetrated its electronic system for storing public-company filings and may have traded illegally on the information.
Now, the SEC didn’t just discover this hack — it occurred in 2016. And it knew about it then. It was only in August that the SEC discovered the hack may have provided the opportunity for insider trading.
With that in mind, let’s look at how the SEC disclosed it.
First of all, the SEC doesn’t typically issue releases at night. And certainly not at 7:36 p.m. Eastern. Yes, the SEC can argue that every major news service jumped on the story, and they did. But it’s not the hour of the day to capture the attention of investors — the victims here, if there was in fact insider trading — and the timing suggests the SEC was trying to minimize, not maximize, publicity.
The statement from SEC Chairman Jay Clayton was another thing. A “statement on cybersecurity” was the title, as if the issue was the Equifax hack or some new regulation.
He gets to the issue of the intrusion into the SEC’s Edgar filing system — in paragraph 22.
And there’s not all that much he disclosed in the 4,077-word statement. Why did it take what seems to be a year, for the SEC to realize the intrusion to the system was done in a way that could be exploited by someone with nefarious purposes? How long did the vulnerability exist?
What did the SEC do in August to figure this out?
Why has the SEC taken a month to tell the investing public, and do so outside of trading hours, and on a religious holiday celebrated by many investors? All a mystery.
The SEC would never have accepted an 8-K like this. Congress shouldn’t, either.
http://www.marketwatch.com/story/if-the-sec-w...2017-09-21
1
