Hindsight Is Not Wisdom: Timeliness of SEC Cyber Disclosures

Posted by Paul Stafford

The U.S. Securities and Exchange Commission (“Commission”) states as its mission the protection of investors; the maintenance of fair, orderly, and efficient markets; and the facilitation of capital formation. In furtherance of this mission, the Commission requires public companies to timely disclose information about the security of the public company’s cyber infrastructure and data, as well as information about material incidents and breaches that may affect shareholders’ investment decisions in those companies. Consequently, the Commission has promulgated a series of cyber security pronouncements and documents, including the CF Disclosure Guidance: Topic No. 2 – Cybersecurity (“2011 Guidance”, Oct. 13, 2011) issued by the Commission’s Division of Corporation Finance (the “Division”), and the Commission Statement and Guidance on Public Company Cybersecurity Disclosures (“2018 Guidance”, February 26, 2018). The 2018 Guidance reinforces and expands upon the 2011 Guidance by providing “interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents”.

When there is a “material cybersecurity risk or incident”, the Commission considers public companies to have a duty to disclose the material cybersecurity risk(s) or incident(s) to the Commission, and therefore to the public and the company’s investors and potential investors. The Commission encourages companies to “take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion, including those companies that are subject to material cybersecurity risks but may not yet have been the target of a cyber-attack” (2018 Guidance, p.4), and believes that public companies should disclose “the most significant factors that make investments in the company’s securities speculative or risky” (2018 Guidance, p.13). But what constitutes “timeliness” for purposes of cyber incident, breach, or risk disclosures to the Commission? Although not a public company, can guidance as to the interpretation of “timeliness” be gleaned by examining was has occurred in most recent years in instances in which the government itself has been the subject of a cyber incident, breach, or risk? Are these incidents instructive as to how the Commission may interpret timeliness within the cybersecurity context?

For instance, in June 2015, the U.S. Office of Personnel Management announced a data breach involving approximately 21.5 million records and approximately 4 million people, including Social Security numbers and detailed security-clearance-related background information. The “data breach” involved two incidents. The first incident was purportedly discovered on March 20, 2014 - over fifteen months before the announcement. The second incident was purportedly discovered on April 15, 2015 - two months before the announcement.

In January 2016, the National Aeronautical and Space Administration (NASA) acknowledged a cyber breach of over 2000 NASA personnel, as well as flight logs and videos recorded by NASA aircraft. In addition, the hackers were able to alter the flight path of a $222M NASA drone before the ground crew was able to restore the flight path by accessing the drone using satellites. According to NASA, the hackers had been inside of NASA’s systems since 2013 – approximately three years before the announcement.

In February 2016, the Internal Revenue Service acknowledged a cyber breach of over 700,000 Social Security Numbers and other sensitive information occurring over a number of years through an online portal that permitted users to view their tax history. The U.S. Justice Department also was breached in February 2016 with the publication of personal information for 20,000 FBI employees. More recently, the FBI and Custom and Border Agents were among thousands of law enforcement personnel impacted by a breach involving the Advanced Law Enforcement Rapid Response Training (reported in June 2018).

It is undisputed that these public agencies are not subject to the regulatory and disclosure requirements of public companies. It is also certainly arguable that these cyber incidents and breaches involving government entities and agencies may not have been widely publicized, and perhaps not announced in what some would consider a timely manner; however, in contrast, the Equifax breach became widely publicized on September 7, 2017 when Equifax announced that hackers had accessed data including Social Security Numbers and drivers license numbers and addresses for approximately 145 million Americans. The cyber attack purportedly began in May 2017 and was detected in July 2017 – and was announced approximately two months later. In the wake of Equifax’s disclosure, on September 20, 2017, the Commission issued a statement emphasizing the importance of cybersecurity and detailing the SEC’s approach to cybersecurity … as well as confirming a 2016 intrusion (purportedly discovered in August 2017) involving unauthorized access to the EDGAR test filing system, which is the system used by companies to make their legally required filings to the SEC – this after a July 2017 report released by the Government Accountability Office that found deficiencies in the SEC’s information systems. Would the SEC’s cyber breach have become apparent and been announced but for the Equifax breach?

Understanding that the government is by the public and for the public but is not a “publicly held” company per se, it is evident that although the government may disclose cyber incidents, breaches, and risks when it deems appropriate after considerations of materiality, national security, and pragmatism, publicly-traded companies do not share this same deference in determining the timeliness of disclosures to regulatory or reporting bodies such as the Commission. Accordingly, the interpretation of “timeliness” should be examined within other legal contexts, as well as within the Commission’s 2018 Guidance itself.

For example, within the 14th Amendment constitutional desegregation context, timeliness is defined as “with all deliberate speed”, which was a purposefully vague and slow standard meant to ease the political and cultural ramifications of societal change. See Brown v. Board of Education II, 349 U.S. 294 (1955).

Within the context of the sale of previously occupied single-family residential real property, and pursuant to Section 5.008 of the Texas Property Code, the seller must timely disclose to the purchaser material facts and the condition of the property, known to the seller as of the date the notice (disclosure) is completed and signed by the seller. This “seller’s disclosure” is legally interpreted as a representation rather than a warranty, with serious penalties and potential liabilities for misrepresentations.

And, within an insurance context, “timeliness” is often characterized by the standard form insurance language “as soon as practicable”. In insurance cases alleging the breach of a material term by an insured, such as lack of notice in a policy, Texas courts have employed a “notice-prejudice” rule, which first examines whether notice was provided to the insurer, then examines when the insurer was provided notice, and finally examines whether a lack of what the insurer claims as “timely” notice in accordance with the “as soon as practicable” or other applicable standard form policy language resulted in prejudice to the insurer. See PAJ, Inc. v. Hanover Insurance Co., 243 S.W.3d 630 (Tex. 2008) and Prodigy Communications Corp. v. Agricultural Excess & Surplus Lines Ins. Co., 288 S.W.3d 374 (Tex. 2009). Unless the court answers in the affirmative (i.e. – a finding of prejudice to the insurer due to lack of timely notice) the insured is determined not to have violated a material term of the insurance contract. This creates an incentive on the part of the insured for timely notice (disclosure) of an occurrence (incident) to the insurer, but provides some protection to the insured from the subjectivity associated with an insurer’s unilateral determination of the term “timeliness” or the contractual phrase “as soon as practicable”.

In contrast to desegregation jurisprudence, real estate sales contracts, and the insurance law context, the Commission has no such mechanism for determination of “timeliness” in disclosures pertaining to cyber incidents, breaches, or risks, instead employing a standard based on “expectations” placed upon public companies to determine when disclosure should occur. So, as with “materiality”, a determination of the timing of disclosures to the Commission of cyber incidents, breaches, and risks is the responsibility of the public company, with the Commission and courts reserving the right to question the timing of disclosures as circumstances develop or additional facts and factors become known with the passage of time. The Commission’s authority to exercise retroactive determinations of “timeliness” could reasonable lead to the invocation of a phrase famously stated in President George W. Bush's 2006 State of the Union Address, “Hindsight alone is not wisdom, and second-guessing is not a strategy”.

In the years since President Bush’s assertion, lots has occurred in the realm of cybersecurity, and hindsight and second-guessing have been refined to a legal art form. For instance, the well-publicized cyber attacks (by Russian Federation hackers) on Yahoo included breaches in 2013 and in 2014. The 2014 breach, discovered in July 2016 and reported in September 2016, affected over 500 million Yahoo user accounts. The August 2013 breach, discovered in July 2016 and reported in December 2016, was originally believed to have affected approximately 1 billion accounts; however, Yahoo later affirmed in October 2017 that the breach affected every Yahoo account that existed at that time – which is 3 billion accounts. In 2018, as a result of the 2014 breach, Yahoo agreed to pay a $35 million fine to the Commission as part of a settlement in the first enforcement action by the Commission for failure to timely disclose a cyber incident, breach, or risk.

In hindsight, it is easy to inquire as to why the Yahoo of just a few year ago did not disclose the full nature of its cyber breach in a more timely manner; however, it is worth noting within this “timeliness” context that in January 2018, the U.S. Department of Homeland Security disclosed a cyber breach it discovered in May of 2017 involving the personal information for approximately 240,000 employees employed by DHS in 2014, as well as “subjects, witnesses, and complainants” associated with DHS Office of Inspector General investigations between 2002 and 2014. DHS did not begin notifying affected employees until November 2017, with DHA stating that this delay was due to “a thorough privacy investigation, extensive forensic analysis of the compromised data, an in-depth assessment of the risk to affected individuals, and comprehensive technical evaluations of the data elements exposed.” “The investigation was complex given its close connection to an ongoing criminal investigation,” a notice posted on the DHS website read. “These steps required close collaboration with law enforcement investigating bodies to ensure the investigation was not compromised.”

In relying upon the Commission’s guidance of today, the Commission acknowledges (just as in the DHS example) that “some material facts may be not available at the time of the initial disclosure”, that a company “may require time to discern the implications of a cybersecurity incident”, and that the necessity of cooperating with law enforcement and any ongoing investigation of a cybersecurity incident may affect the scope of disclosure regarding the incident; however, the Commission states that “an ongoing internal or external investigation … would not on its own provide a basis for avoiding disclosures of a material cybersecurity incident”(2018 Guidance, p.11).

In addition, and more specifically, 2018 Guidance, Note 15 references the NYSE Listed Company Manual Rule 202.05, which requires listed companies to “release quickly to the public any news or information which might reasonably be expected to materially affect the market for its securities.” 2018 Guidance, Note 15 also references Nasdaq Listing Rule 5250(b)(1), which requires listed companies to “make prompt disclosures to the public of any material information that would reasonably be expected to affect the value of its securities or influence investors’ decisions.” 2018 Guidance, p.19 states that “A company’s disclosure controls and procedures should not be limited to disclosure specifically required, but should also ensure timely collection and evaluation of information potentially subject to required disclosure, or relevant to an assessment of the need to disclose developments and risks that pertain to the company’s businesses.” And 2018 Guidance, p.11 states that, in accordance with Section 7 and 10 of the Securities Act: Sections 10(b), 13(a) and 15(d) of the Exchange Act; and Rule 10b-5 under the Exchange Act [15 U.S.C. 78j(b); 15 U.S.C. 78o(d); 17 CFR 240. 10b-5], “Where a company has become aware of a cybersecurity incident or risk that would be material to its investors, we would expect it to make appropriate disclosure timely and sufficiently prior to the offer and sale of securities and to take steps to prevent directors and officers (and other corporate insiders who were aware of these matters) from trading its securities until investors have been appropriately informed about the incident or risk.”

The disclosure requirements in Commission Regulation S-K and Regulation S-X make no specific mention of cybersecurity risks and incidents; however, public companies must make every effort to adhere to the Commission’s reporting requirements, and may find guidance or specific instruction as to timeliness in the particular requirements for each category of report. Examples include: periodic reports, including Form 10-K annual reports, Form 10-Q quarterly reports (to be submitted every ninety days), and Form 20-F disclosures by foreign private issuers (within four to six months, depending on when the fiscal year ends); current reports, including Form 8-K (which require disclosure within four business days after discovery of a reportable condition) or Form 6-K reports (“promptly after the material contained in the report is made public”); and, Securities Act and Exchange Act obligations, including registration statements that (consistent with Section 11, 12, and 17 of the Securities Act, as well as Section 10(b) and Rule 10b-5 of the Exchange Act) must adequately and timely disclose all material facts required to be stated therein or necessary to make the statements therein not misleading.

Accordingly, given the Commission’s Guidance, and the realities of commerce in a digital world, public companies must make every effort to develop policies, procedures, and protocols designed to comply with the Commission’s expectation of timeliness in the disclosure of material information, incidents, breaches, or risks.