On September 26, 2018, the US Securities and Exchange Commission (“SEC”) brought and settled charges against a registered broker-dealer/investment adviser (the “Registrant”) for allegedly violating the Gramm-Leach-Bliley Act Safeguards Rule (Regulation S-P) and the Identity Theft Red Flags Rule (Regulation S-ID).1 The Registrant allegedly violated the SEC’s rules by failing to implement appropriately designed policies and procedures to safeguard customer information, respond to identity theft red flags, and update or train employees and contractors on its identity theft prevention program. These alleged violations (the Registrant settled without admitting or denying the SEC’s findings) appear to have been identified by SEC examination staff during a routine exam and relate to a 2016 cybersecurity incident that involved unauthorized access to the personal information of 5,600 customers of the Registrant. This is the first SEC enforcement action under the Identity Theft Red Flags Rule since it was adopted by the agency in 2013.2
The SEC brought the action for violations of (i) the Safeguards Rule’s requirement that every broker-dealer or investment adviser registered with the SEC adopt “written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information” and (ii) the Identity Theft Red Flags Rule’s requirement that every broker-dealer or investment adviser registered with the SEC “develop and implement a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.”3
General Requirements Under the Safeguards and Identity Theft Red Flags Rules
The Safeguards Rule requires that written policies and procedures must be reasonably designed to:
- Ensure the security and confidentiality of customer records and information;
- Protect against any anticipated threats of hazards to the security or integrity of customer records and information; and
- Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.4
The Identity Theft Red Flags Rule requires that an Identity Theft Prevention Program include reasonable policies and procedures to:
- Identify relevant red flags for the covered accounts and incorporate them into the Identity Theft Prevention Program;
- Detect the red flags that have been incorporated into the Identity Theft Prevention Program;
- Respond appropriately to any red flags that are detected pursuant to the Identity Theft Prevention Program; and
- Ensure that the Identity Theft Prevention Program is updated periodically to reflect changes in risks to customers from identity theft.5
Summary of SEC Concerns with the Alleged Practices of the Registrant
In this action, the SEC concluded that, although the Registrant adopted certain policies and procedures, it failed to (i) ensure the reasonable design and proper operation of its policies and procedures for safeguarding confidential customer information, (ii) respond to identity theft red flags and (iii) update and train employees and contractors on its Identity Theft Prevention Program.
As alleged in the order, the Registrant maintained a web portal for independent contractors to access customer information and process transactions. The Registrant’s parent company maintained call centers that responded to contractor requests regarding access to the portal. Contractors accessed the portal by entering a unique username and password combination and, according to the Registrant’s written policies and procedures, access to the portal was subject to numerous systems and behavioral controls.
The SEC alleged that the access controls that the Registrant set were insufficient and that the Registrant failed to implement several of the access controls or allowed them to operate in a flawed manner that defeated their purpose. For example, the Registrant required contractors to establish security questions as a form of multi-factor authentication. However, the portal wiped, or deleted, previously setup questions when a call center performed a password reset and provided a temporary password to a contractor by phone. This allowed a bad actor to defeat the multi-factor authentication by having the call center perform a password reset on the targeted account. Similarly, while the Registrant kept a list of phone numbers that were suspected of having been used in connection with fraudulent activity, it did not have a written policy or procedure requiring call center employees to refer to the list when responding to contractor calls, and an informal, unwritten procedure for doing so was not consistently applied.
The SEC also alleged that the Registrant failed to reasonably design its Identity Theft Prevention Program to prevent unauthorized access. For example, while the Registrant’s program required IT security staff to disable potentially compromised accounts, the Registrant had not trained its IT security staff to understand that changing or resetting a user’s password would not terminate existing sessions. After the compromise had been identified, this weakness allowed unknown intruders to continue to access the Registrant’s systems by simply staying logged into the system.
The SEC alleged that the Registrant had not substantively updated its Identity Theft Prevention Program since its adoption in 2009, and its board of directors and senior management had failed to administer or oversee the program. Further, the Registrant failed to conduct training specific to the Identity Theft Prevention Program, with the SEC noting that the identity theft training that the registrant did conduct was sparsely attended by employees and contractors.
As a result of these weaknesses, unknown intruders impersonating contractors were able to gain access to three contractors’ accounts, which they used to access personally identifiable information of approximately 5,600 customers, including full Social Security/government identification numbers for at least 2,000 customers. The unknown intruders also used the access to change customers’ email addresses and phone numbers in the Registrant’s systems to disposable email addresses and other numbers and changed the delivery method for statements and account information to online and by email rather than by mail. Although the unknown intruders accessed to this personal information, there is no indication that any transfers of funds or securities from customer accounts occurred as a result of the incident.
Actions Taken by the Registrant
The Registrant subsequently blocked the unknown intruders’ IP addresses, revised its policies to prohibit providing temporary passwords by phone, provided breach notices and free credit monitoring to affected customers and implemented effective multi-factor authentication for the portal. The Registrant also agreed to retain an independent compliance consultant to review its policies and procedures and recommend any necessary enhancements to them or their implementation. Finally, the Registrant agreed to refrain from future violations of Regulations S-P or S-ID (a “cease and desist” order), accept a censure for its conduct and pay a civil money penalty of $1 million.
Lessons Learned from the Action
This action highlights the SEC’s expectation that any organization must both adopt and implement effective policies and procedures to ensure compliance with the Safeguards Rule and Identity Theft Red Flags Rule. Having a well-drafted policy sitting on the shelf is not an effective compliance program. Adopting procedures to implement the policy is a required step. Furthermore, organizations need to frequently update their policies and train employees (and independent contractors, if applicable) to ensure that security controls set forth in their information security program and Identity Theft Prevention Program are operating as expected. Often the first line of defense against cybersecurity attacks, employees need training to ensure that they are prepared to properly identify incidents and respond. Finally, while this is the SEC’s first enforcement action alleging violations of Regulation S-ID, it is part of a growing trend of initiatives by the SEC and the Financial Industry Regulatory Authority that focus on cybersecurity issues in examinations of registered securities entities.6