[ by Melanie Gretchen ]

Inappropriate Downloads, Personal Use, Unsecured Data.

The SEC Watchdog - Interim Inspector General Jon Rymer - issued a scathing 43-page detailing numerous abuses of government resources by an office of the Agency's Trading & Marketing Division. 

Apparently, these staff members left sensitive stock exchange and other data exposed to potential cyber attacks by not encrypting their computers and connecting to public wireless networks during exchange inspections.  While recommending to Exchange personnel that they secure their own computer hardware and files, the SEC staffers were extremely lax with securing their own computers and data, and they used extremely poor judgment in using these computers for numerous personal transmissions and applications.

SEC Inspector General's Findings.   The 43-page investigative report provided specific circumstances in which Trading and Markets staffers misused their government-issued computers, such as:

• the office spent $1.8 million on unnecessary technology, after misleading the SEC about the office's need to buy Apple Inc products
• staffers took iPads and laptops home and used them primarily for (i) personal banking, (ii) surfing the web, and (iii) downloading music and movies

Exposure but no Security Breaches.  While it was fortunate that there were no security breaches, it was most unfortunate that the staffers' indiscretion did not stop there.  They failed to protect their computers and devices from hackers, despite encouraging exchanges and clearing agencies to do just that.

• staffers left sensitive stock exchange data exposed to potential cyber attacks because they failed to encrypt the devices or even install basic virus protection programs. 

[Note:  For more detailed information about SEC encryption problems, go to our Behind The News posting for Monday, 11/12.]

• they may have brought the unprotected laptops to a Black Hat convention, where hacking experts discuss the latest trends
• staff tapped into public wireless networks with unprotected laptops, which they brought to exchange inspections

• Case in point: a staffer admitted to using his personal e-mail to send his work e-mail sensitive data about the Depository Trust & Clearing Corp., the U.S. equities market's clearing agency.  He called his activity "a mistake" and "bad judgment" on his part.

For further details, go to [Reuters, 11/9/12].