SEC ANNOUNCES MORGAN STANLEY TO PAY $1 MILLION PENALTY TO SETTLE CHARGES OF FAILING TO SAFEGUARD CUSTOMER INFORMATION

FROM:  U.S. SECURITIES AND EXCHANGE COMMISSION 

SEC: Morgan Stanley Failed to Safeguard Customer Data

FOR IMMEDIATE RELEASE

2016-112

Washington D.C., June 8, 2016 — The Securities and Exchange Commission today announced that Morgan Stanley Smith Barney LLC has agreed to pay a $1 million penalty to settle charges related to its failures to protect customer information, some of which was hacked and offered for sale online.

The SEC issued an order finding that Morgan Stanley failed to adopt written policies and procedures reasonably designed to protect customer data.  As a result of these failures, from 2011 to 2014, a then-employee impermissibly accessed and transferred the data regarding approximately 730,000 accounts to his personal server, which was ultimately hacked by third parties.

“Given the dangers and impact of cyber breaches, data security is a critically important aspect of investor protection.  We expect SEC registrants of all sizes to have policies and procedures that are reasonably designed to protect customer information,” said Andrew Ceresney, Director of the SEC Enforcement Division.

According to the SEC’s order instituting a settled administrative proceeding:

The federal securities laws require registered broker-dealers and investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.
Morgan Stanley’s policies and procedures were not reasonable, however, for two internal web applications or “portals” that allowed its employees to access customers’ confidential account information.
For these portals, Morgan Stanley did not have effective authorization modules for more than 10 years to restrict employees’ access to customer data based on each employee’s legitimate business need.
Morgan Stanley also did not audit or test the relevant authorization modules, nor did it monitor or analyze employees’ access to and use of the portals.
Consequently, then-employee Galen J. Marsh downloaded and transferred confidential data to his personal server at home between 2011 and 2014.
A likely third-party hack of Marsh’s personal server resulted in portions of the confidential data being posted on the Internet with offers to sell larger quantities.

The SEC’s order finds that Morgan Stanley violated Rule 30(a) of Regulation S-P, also known as the “Safeguards Rule.”  Morgan Stanley agreed to settle the charges without admitting or denying the findings.  In a separate order, Marsh agreed to an industry and penny stock bar with the right to apply for reentry after five years.  He was criminally convicted for his actions last year and received 36 months of probation and a $600,000 restitution order.

The SEC’s investigation was conducted by William Martin and Simona Suh of the Enforcement Division’s Market Abuse Unit and supervised by Joseph G. Sansone, Co-Chief of the unit.  The SEC appreciates the assistance of the New York Field Office of the Federal Bureau of Investigation and the U.S. Attorney’s Office for the Southern District of New York.

SEC CHAIR WHITE'S OPENING STATEMENT AT ROUNDTABLE MEETING ON CYBERSECURITY

FROM:  U.S. SECURITIES AND EXCHANGE COMMISSION 
PUBLIC STATEMENT
 Opening Statement at SEC Roundtable on Cybersecurity
 SEC Chair Mary Jo White
March 26, 2014

Good morning.  Welcome to today’s roundtable on cybersecurity.

Cybersecurity threats come from many sources: criminal and hired hackers, terrorists, state-sponsored intruders, and even misguided computer experts to see what they are able to penetrate.

Cyber threats also pose non-discriminating risks across our economy to all of our critical infrastructures, our financial markets, banks, intellectual property, and, as recent events have emphasized, the private data of the American consumer.

This is a global threat.  Cyber threats are of extraordinary and long-term seriousness.  They are first on the Division of Intelligence’s list of global threats, even surpassing terrorism. And Jim Comey, director of the FBI, has testified that resources devoted to cyber-based threats are expected “to eclipse” resources devoted to terrorism.[1]

What emerges from this arresting view of the cybersecurity landscape is that the public and private sectors must be riveted, in lockstep, in addressing these threats.

The President’s 2013 Cybersecurity Executive Order and the Cybersecurity Framework issued in 2014 by the National Institute of Standards and Technology are reflective of the compelling need for stronger partnerships between the government and the private sector.

The SEC’s formal jurisdiction over cybersecurity is directly focused on the integrity of our market systems, customer data protection, and disclosure of material information.  But it is incumbent on every government agency to be informed on the full range of cybersecurity risks and actively engage to combat those risks in our respective spheres of responsibility.

This roundtable is one aspect of the SEC’s efforts to better inform ourselves, the marketplace, our fellow agencies, and the private sector as to what the risks are and how best to combat them.

As you know, we at the SEC have been focused on cybersecurity-related issues for some time.  In connection with public company disclosures, in October 2011, our  Division of Corporation Finance issued guidance on existing disclosure obligations related to cybersecurity risks and incidents to assist public companies in framing disclosures of cybersecurity issues.  That guidance makes clear that material information regarding cybersecurity risks and cyber incidents is required to be disclosed.

Since we issued that guidance, our staff has continued to study the important and challenging issues that cybersecurity presents to public companies, market participants, and investors, including the intersection of our investor-focused disclosure requirements and the types of information those with national security responsibility need in order to better protect our critical infrastructure.  I am looking forward to hearing the views on this.

Cybersecurity for SROs and large alternative trading systems also is a very important area of focus for our staff.  Part of this focus involves the Commission’s proposed rule on Regulation Systems, Compliance and Integrity, which would require an entity covered by the rule to test its automated systems for vulnerabilities, test its business continuity and disaster recovery plans, notify the Commission of cyber intrusions, and recover its clearing and trading operations within specified time frames.  I expect the Commission to move ahead with Regulation SCI this year.

We also have focused on cybersecurity risk issues for registered investment advisers, broker-dealers, and funds, including, for example, data protection and identity theft vulnerabilities.

In this area, the Commission last year adopted Regulation S-ID, which requires certain regulated financial institutions and creditors to adopt and implement identity theft programs.[2]  Regulation S-ID builds upon the SEC’s existing rules for protecting customer data, in particular Regulation S-P.[3]

I want to thank all of our panelists for participating today and sharing their views on these critical issues.  There is no better way to proceed than by assembling the right people in the same room to discuss and share information, points of view, and best practices.

Each panel consists of a very impressive group of professionals who bring a great deal of expertise and a range of relevant perspectives.

In addition to our panelists, we are joined today by many others who are here in person or watching online. And, of course, we welcome your views as well.  We have set up a comment file on our website for the public to submit views on cybersecurity issues or respond to the questions addressed and the views expressed by our panelists. And I especially look forward to hearing the public’s ideas and input.  Your views are important to us. We and the others here today will benefit immensely from hearing them as we study these issues.

Thank you and enjoy the roundtable.


[1] Homeland Threats and Agency Responses, The Honorable James B. Comey, Jr., Statement of the Federal Bureau of Investigation Before the Committee on Homeland Security and Governmental Affairs, United States Senate (November 14, 2013).

[2] See Identity Theft Red Flags Rules, Release No. 34-69359 (April 10, 2013), available at http://www.sec.gov/rules/final/2013/34-69359.pdf.

[3] See Final Rule: Privacy of Consumer Financial Information (Regulation S-P) (November 13, 2000), available at http://www.sec.gov/rules/final/34-42974.htm