Securities and Exchange Commission Chairman Jay Clayton faced questions on recent high-profile data breaches and the adequacy of current breach disclosure laws when he appeared in front of the Senate Banking, Housing and Urban Affairs Committee on Tuesday.<\/p>\n\n\n\n
Senators pressed Clayton for details about the 2016 cyberattack on the SEC, which was just disclosed last week, as well as the massive Equifax breach that was disclosed earlier this month.<\/p>\n\n\n\n
Both incidents, the SEC chairman and several senators noted, go to the broader issue of public trust in the SEC and its ability to regulate companies that gather personally identifiable information (PII) on millions of Americans.<\/p>\n\n\n\n
In his opening statement, Clayton outlined facts about the 2016 SEC breach, which happened under his predecessor, and the SEC\u2019s recent disclosure of that breach. The 2016 cyberattack did not come to Clayton\u2019s attention until August, he said. Clayton became chairman in May.<\/p>\n\n\n\n
The breach involved an intrusion into the so-called EDGAR (Electronic Data Gathering, Analysis and Retrieval) information filing system and \u201cmay have provided the basis for illicit gain through trading,\u201d Clayton told senators.<\/p>\n\n\n\n
Clayton said the SEC\u2019s Office of IT \u201cbelieves\u201d the intrusion involved exploiting a defect in the EDGAR system\u2019s custom software. The bug has since been patched, Clayton said, and investigators believe the intrusion did not provide threat actors with access to PII, did not jeopardize SEC operations and did not result in \u201csystemic risk.\u201d<\/p>\n\n\n\n
However, Clayton said the EDGAR incident \u201cconcerns me deeply.\u201d<\/p>\n\n\n\n
\u201cMany questions remain,\u201d Clayton told senators, noting the investigation is ongoing and may take \u201csubstantial time to complete.\u201d<\/p>\n\n\n\n
However, Clayton insisted that concerns about the breach and the SEC\u2019s ability to protect sensitive data must not derail the regulator\u2019s mission.<\/p>\n\n\n\n
\u201cThis is not the time for the SEC to pull back from our important market oversight role by limiting our access to sensitive information,\u201d Clayton said. He told senators that intrusions are inevitable and then highlighted the importance of resilience and recovery.<\/p>\n\n\n\n
Committee Chair Mike Crapo, R-Idaho, asked Clayton about additional details on the software vulnerability, which Clayton said he did not currently have.<\/p>\n\n\n\n
Clayton recounted his thinking and actions upon learning of the breach, telling the senators:<\/p>\n\n\n\n\n\n
In later questioning, Ranking Member Sherrod Brown, D-Ohio, continued pursuing the topic of disclosure in regards to the Equifax breach and broader breach disclosure requirements, particularly around the criterion of \u201cmateriality.\u201d<\/p>\n\n\n\n
Brown began his questioning by noting, \u201cEquifax waited six weeks to disclose its breach. Companies often say if a matter does not have a material impact on its financial results, they do not need to disclose. Is materiality the right standard when a company suffers a breach and Americans have PII stolen?\u201d<\/p>\n\n\n\n
Clayton responded, \u201cI believe materiality is the core of our disclosure system. I believe it\u2019s the touchstone. Going to your question about whether companies are making the right materiality assessment \u2013 I think that\u2019s a very good question.\u201d<\/p>\n\n\n\n
Brown continued, \u201cSo when it\u2019s left in the hands of the company \u2013 from just that response \u2013 [the SEC] doesn\u2019t seem as engaged maybe in this question and this issue as we might like. They may continue this kind of behavior.\u201d<\/p>\n\n\n\n
Clayton then began a pattern of evading direct questions about the Equifax incident. Clayton replied, \u201cCompanies should be disclosing more. I\u2019m not going to talk about a specific company or a specific set of circumstances. That\u2019s inappropriate in my position.\u201d<\/p>\n\n\n\n
Clayton continued by taking broadly about \u201cthe landscape of disclosure,\u201d adding that \u201cCompanies should be providing sooner disclosures about intrusions that may affect shareholders\u2019 investment decisions. And I also believe that across the landscape of our markets there should be better disclosure about the cyber risk we face.\u201d<\/p>\n\n\n\n
Brown pressed, \u201cSo you would totally disagree with Equifax\u2019s decision to withhold that information for those several weeks, citing materiality if they were?\u201d<\/p>\n\n\n\n
And, again, Clayton evaded the question, \u201cSenator, I\u2019m not going to get into a particular company\u2019s decision or non-decision \u2013\u201d<\/p>\n\n\n\n
Brown interrupted, \u201cSo you can\u2019t say to this committee that Equifax wasn\u2019t wrong withholding this information \u2013 irrespective of the executives that dumped their stock. Forget that for a moment. You can\u2019t say to this committee they were wrong in withholding that information?\u201d<\/p>\n\n\n\n
Clayton again refrained from answering, telling Brown, \u201cIt would be inappropriate for me to comment on that matter, that specific matter.\u201d<\/p>\n\n\n\n
\u201cWell, that\u2019s a pretty big concern,\u201d Brown said. \u201cIf a company did what [Equifax] did, and the chair of the SEC is not willing to be critical of that, that\u2019s a concern to a lot of us.\u201d<\/p>\n\n\n\n