[ by Melanie Gretchen ]

Failure to encrypt computers - just one example of how SEC Policies and Procedures were violated.

A 43-page report by SEC Interim Inspector General Jon Rymer revealed extreme poor judgment by certain SEC Trading & Marketing staffers when it came to securing their government-assigned computers and hardware.  The Inspector General found that SEC staffers frequently left their computers without unprotected while out of their SEC offices on official business, such as exchange investigations. 

Some failed to encrypt their computers, as is required by the Agency.  Others connected their computers to unsecured public wireless networks.  Each instance of indiscretion exposed sensitive exchange data vulnerable to cyber attacks - though, fortunately, no evidence was found indicating that such hacking or spying on SEC data ever took place.

Risky Business? The computers and other electronic devices belonged to a handful of employees in an office within the SEC's Trading and Markets Division.  Ironically, that office is responsible for making sure exchanges follow certain guidelines to protect the markets from potential cyber threats and systems problems, one of those people said.  What happened:

• Some of the staffers brought the unprotected devices to a Black Hat convention, where computer hacking experts gather to discuss the latest trends.

Damage Control. Since then, the SEC has notified all of the exchanges about the incident; prior to re-opening, all of the U.S. stock market operators took part in coordinated testing for trading on NYSE's backup system.  What the incident cost the agency:

• the agency spent at least $200,000 and hired a third-party firm to conduct a thorough analysis to make sure none of the data was compromised, according to one of the people familiar with the SEC's security lapse
• the initiated disciplinary actions against the people involved, one of the people familiar with the matter said
• the SEC initiated disciplinary actions against the people involved, one of the people familiar with the matter said

Going forward, SEC Chairman Mary Schapiro recently said the agency is working to convert the voluntary ARP guidelines into enforceable rules after a software error at Knight Capital Group nearly bankrupt the brokerage and led to a $440 million trading loss.

Industry Response. Rich Adamonis, a NYSE spokesman was extremely disappointed by the SEC staff lapses and said the NYSE is seeking clarification on the issues and potential exposures:  From the moment we were informed, we have been actively seeking clarity from the SEC to understand the full extent of the use of improperly secured devices and the information involved, as well as the actions taken by the SEC to ensure that there is proper remediation and a complete audit trail for the information."

[C-I Note:  For additional coverage of SEC security abuses, refer to our Who's News posting for Monday, 11/12/12.]

For further details, go to [Reuters, 11/9/12].