Speaker 1: When the Security Is and Exchange Commission created the system
Speaker 1: known as EDGAR in the nineteen nineties to make corporate
Speaker 1: key corporate filings publicly available. It was hailed as a
Speaker 1: victory for transparency that would help level the playing field
Speaker 1: for investors, and the system is many years later now
Speaker 1: very heavily used. According to the SEC, it gets more
Speaker 1: than one point seven million filings per year and more
Speaker 1: than fifty million pages of documents are accessed on Edgar
Speaker 1: every day. But the SEC recently revealed that it learned
Speaker 1: last year about a hack into the system that may
Speaker 1: have allowed hackers to obtain and profit from corporate confidential
Speaker 1: corporate information before that information became public. Here to talk
Speaker 1: with us about this hack into the EDGAR system are
Speaker 1: Peter Henning, a professor at Wayne State University Law School,
Speaker 1: and Robert Hockett, a professor at Cornell University Law School. Peter,
Speaker 1: the you know, most of the EDGAR system is publicly
Speaker 1: available information. That's kind of the point, but there is
Speaker 1: part of it that has some confidential information that apparently
Speaker 1: is the subject of this hack. Explain exactly what it
Speaker 1: is that got hacked into here. Well, the security breach
Speaker 1: came through a portal that the SEC has so that
Speaker 1: newer companies companies that recently went public could essentially take
Speaker 1: it for a test drive and past materials on EDGAR.
Speaker 1: The requirement is that whenever a company makes its disclosure UM,
Speaker 1: say quarterly or annual earnings, it has to do that
Speaker 1: UM immediately and make it available to all investors at
Speaker 1: the same time. So it was a way for them
Speaker 1: to test it UM. But there are companies that will
Speaker 1: make filings UH. For example, I p O s Now
Speaker 1: you can make what's essentially a dark filing. You can
Speaker 1: put information in there that isn't available to the public
Speaker 1: that might have been available to the hackers and would
Speaker 1: give them maybe some insight information about what was going
Speaker 1: to happen at those companies and perhaps others if they
Speaker 1: rummaged around through the system. You just don't know what
Speaker 1: you're going to find, Bob, the attack occurred last year.
Speaker 1: The SEC just disclosed it on Wednesday. Is that against
Speaker 1: its own advice to companies to announce cyber attacks promptly? Well,
Speaker 1: it's it's it's hard to tell to tell you the trition.
Speaker 1: I mean, the problem is, UM, you know that the
Speaker 1: SEC is sort of forced start faced with a dilemma
Speaker 1: on the one hand, if it reveals information that turns
Speaker 1: out not to be really that important in the longer term,
Speaker 1: but sort of stokes a panic or stokes sort of
Speaker 1: excess concern in the short term, uh than it might well,
Speaker 1: you know, sort of think better about having disclosed something
Speaker 1: too quickly. So it's not sure whether to tell anybody
Speaker 1: right away because it doesn't want to cause more panic
Speaker 1: than might be warranted. On the other hand, that being said,
Speaker 1: if it does indeed turn out to be a significant problem,
Speaker 1: then of course the SEC looks to have egg on
Speaker 1: its face when it turns out that it knew the
Speaker 1: information even sooner. In this particular case, I think what's
Speaker 1: particularly important or maybe worth noting, is that it didn't
Speaker 1: reveal the information until it determines that somebody might actually
Speaker 1: have used some still gotten information in order to engage
Speaker 1: in some form of insider trading. And that's something the
Speaker 1: SEC apparently only just learned. Well, Peter, if the idea
Speaker 1: of this part of the system, you know, the confidential information,
Speaker 1: is to encourage new companies to get to put things up,
Speaker 1: for folks to get things in early and test out
Speaker 1: the system, what's if this ends up deterring that from happening.
Speaker 1: If this kind of hack deterurns that from happening, what
Speaker 1: are the likely consequences in terms of companies ability to
Speaker 1: get their information out the right way? Well, I don't
Speaker 1: I'm not sure if it will be a detern. It
Speaker 1: certainly will make companies hesitant, and indeed, even the SEC
Speaker 1: said for those using this portal, you know, be careful
Speaker 1: about the information you put here. UM. But you know,
Speaker 1: just like any warning label, I'm not sure how many
Speaker 1: people might have actually read it. Um. Really the message
Speaker 1: here is the broader one, and of course it's coming
Speaker 1: just a couple of weeks after the disclosure of the
Speaker 1: Equifax league is that really no computer system is completely secure.
Speaker 1: That we are living, um in an era and this
Speaker 1: may go on. Um as far as the eye can see,
Speaker 1: we're living in an era in which there is going
Speaker 1: to be cyber attacks and confidential information can get exposed.
Speaker 1: So you know, it's um, maybe physician heled iself. The
Speaker 1: SEC has to take stronger measures here to protect what
Speaker 1: may be crucial information about companies. Otherwise they're going to
Speaker 1: be more careful about what they file and may try
Speaker 1: to puzz things a little bit to try to ratchet
Speaker 1: down how much they end up disclosing in their public filings.
Speaker 1: Bob Edgar is tracked carefully by traders who use super
Speaker 1: fast computers. How much information does Edgar have that can
Speaker 1: actually move the more kit, Well, it's had a great
Speaker 1: deal of such information. And then in a way, that's
Speaker 1: sort of part of the point, right, I mean, the
Speaker 1: original impetus behind Edgar is essentially just sort of a
Speaker 1: race or to sort of diminish, nearly to the vanishing point,
Speaker 1: any kind of time advantage that one trader might have
Speaker 1: relative to another when it comes to trading uninformation that
Speaker 1: is disclosed once it is disclosed, and has some sort
Speaker 1: of significance, a price relevant significance to the shares of
Speaker 1: the firm that are traded. Right. So the irony here,
Speaker 1: of course is that you know Edgar is is established
Speaker 1: in order to level that that playing field. But if
Speaker 1: some people are able to hack it and others are not,
Speaker 1: you might end up with the sort of paradoxyl the
Speaker 1: paradoxical situation wherein Edgar ends up facilitating certain kinds of
Speaker 1: insider trading by essentially gipping off right, some people much more,
Speaker 1: much sooner than it tips off others simply by by
Speaker 1: into those first people's capacity to hack it. So that
Speaker 1: makes Peter's point of all the more important that you know,
Speaker 1: in order for even to sort of fulfill its function,
Speaker 1: it really has to be more or less hack proof,
Speaker 1: or at least it has to be proofed against hacking
Speaker 1: of the kind that can facilitate insider trading. We've been
Speaker 1: talking about the hack of the sec and its implications
Speaker 1: with Peter Henning, professor at Wayne State University Law School,
Speaker 1: and Robert hocket, a professor at Cornell University Law School. Peter,
Speaker 1: this isn't the first time that the SECS Edgar system
Speaker 1: has been compromised. Now they are going to put in
Speaker 1: the consult what's been called the Consolidated Audit Trail, So
Speaker 1: would you explain that and whether they're going to be
Speaker 1: concerns about that in light of this new hack. Consolidated
Speaker 1: Audit Trail has actually been a dream of the SECS
Speaker 1: for about the last thirty to forty years, where it
Speaker 1: would give them a real time look at who is
Speaker 1: trading um across all of the markets, so that they
Speaker 1: could see if there's any kind of market disruption or
Speaker 1: if the order flow is somehow affected by an event
Speaker 1: or perhaps even a technological glitch. So this is what
Speaker 1: they've wanted. What that is, though, is incredibly valuable information. Uh.
Speaker 1: If I know that, say Fidelity or Vanguard is selling
Speaker 1: out a position or accumulating a position, um, I can
Speaker 1: trade ahead of that or trade along with it before
Speaker 1: the stock price is affected. I can make a great
Speaker 1: deal of money. So what the heck is saying is
Speaker 1: that as the SEC accumulates more and more valuable information, uh,
Speaker 1: it's going to become a target even more. And so
Speaker 1: it's really going to have to protect that information. And
Speaker 1: of course the firms are worried that their information could
Speaker 1: be stolen and used either against them or by someone
Speaker 1: to profit. And that's going to cost other investors money.
Speaker 1: I expected, given this hack, and you know, we don't
Speaker 1: know that much about it yet, but given this hack, uh,
Speaker 1: a lot of banks and other investors would be very
Speaker 1: concerned about what might happen when the consolidated art show
Speaker 1: finally gets up. Can we expect that this is just
Speaker 1: going to delay that project, you know, by measures we
Speaker 1: can't even figure out yet. Yeah, I don't know, I
Speaker 1: really don't know whether we should expect this to sort
Speaker 1: of delay that project or not. I mean, it might
Speaker 1: do that. It might in fact instead hasten the project
Speaker 1: of of beefing up internet security or cybersecurity or the like.
Speaker 1: Where it might that might do both. I mean a
Speaker 1: couple of other things worth noting in this connection. It
Speaker 1: seems to me as first of all, there is the
Speaker 1: Equifax matter that Peter had mentioned before. There's also another
Speaker 1: matter that we've sort of forgotten about but was pretty
Speaker 1: big news about a year ago, and that was when
Speaker 1: the New York bet was fooled by hackers into making
Speaker 1: a very large money transfer on behalf or supposedly on
Speaker 1: behalf of the Bangladesh Central Bank UH and that was
Speaker 1: done through hacking as well. And indeed the New York
Speaker 1: Fed sort of discovered the problem um only sort of
Speaker 1: by accident, only through a sort of a fortuity owing
Speaker 1: to a strange name that was used by one of
Speaker 1: the parties who was hacking it. And so people have
Speaker 1: since then, of course, has been a little bit concerned
Speaker 1: about the security of the swift money transfer system that
Speaker 1: the central banks and other banks used as well. So
Speaker 1: in a way, the problem is is quite pervasive throughout
Speaker 1: the the financial system, and I'm hoping therefore that the
Speaker 1: takeaway from this will be that we really have to
Speaker 1: get quite serious about cybersecurity across the entirety of the
Speaker 1: financial system and not let it delay um uh sort
Speaker 1: of beneficial actions that various regulars who are planning to
Speaker 1: take unless absolutely necessary, but instead it just sort of
Speaker 1: speed us up when it comes to really addressing all
Speaker 1: of the cyber vulnerabilities that appear to be pervasive out there.
Speaker 1: Peter SEC Chairman Jake Clayton is scheduled to testify before
Speaker 1: the Senate Banking com it Eating next week. What kind
Speaker 1: of questions do you expect him to be getting and
Speaker 1: will there be a grilling of sorts? There'll be a
Speaker 1: little bit of a grilling, although in a sense he
Speaker 1: gets a bit of a free pass because the hack
Speaker 1: took place under his predecessor, Mary Joe White, and you know,
Speaker 1: perhaps the delay and disclosing it um might be an
Speaker 1: issue brought up, But really I think he wants to
Speaker 1: use this as a way to highlight the need to
Speaker 1: enhance cybersecurity. And as Bob said, Bob's absolutely right that, um,
Speaker 1: this is not we can't just beat these as isolated incidents.
Speaker 1: That this is something that is going to be pervasive
Speaker 1: through the financial system, and so if you view one
Speaker 1: security patch as somehow a cure, it's at best of placebo.
Speaker 1: So I think Clayton is going to go on the
Speaker 1: offensive here and perhaps even use this as a way
Speaker 1: to ask Congress for more money for the SEC. Uh,
Speaker 1: don't free act. This is a political agency, Bob. You know,
Speaker 1: we we talk about the importance of cybersecurity, and it
Speaker 1: seems are there ways to actually stop this from happening
Speaker 1: because it seems like every everyone and every agency can
Speaker 1: be act. Yeah. So I mean if I were a
Speaker 1: computer security expert, um, I could answer you more different deplity,
Speaker 1: but I would probably also be a millionaire or a
Speaker 1: billionaire by now. It's I mean, in theory, we can
Speaker 1: do this, right, but but there's so many prerequisites that
Speaker 1: have to be met. One of them that maybe it's
Speaker 1: worth highlighting at the moment is that because so much
Speaker 1: of the transacting that goes on in the financial system
Speaker 1: now takes place across borders through multiple electronic systems, you
Speaker 1: need some kind of harmonization on the part of multiple
Speaker 1: jurisdictions when it comes to what forms of electronic communications
Speaker 1: are going to be used, what protocols or what security
Speaker 1: protocols are to be used, what specific technologies technologies are
Speaker 1: going to be used, and so forth, And it's thus
Speaker 1: far proved it would be difficult to get consensus even
Speaker 1: on that. You might have read even a couple of
Speaker 1: days ago that some of our partners in Europe and
Speaker 1: Asia are sort of suspicious of the protocols that were
Speaker 1: currently favoring because they think we might be favoring Member
Speaker 1: precisely because we're able to hack them. I'm going to
Speaker 1: have to stop you there. I thought all professors were
Speaker 1: millionaires thanks to two of them, Peter Henning, professor at
Speaker 1: Waynestad University Law School and Robert Hockett, professor at Cornell
Speaker 1: University Law School,