In this issue of our monthly Securities Enforcement Roundup, we highlight top securities enforcement developments and cases from last month.
In July 2024:
In October 2023, the US Securities and Exchange Commission (SEC) charged SolarWinds Corp., a publicly traded software company, and its chief information security officer (CISO) with alleged violations of the federal securities laws stemming from a 2020 cyberattack. [1] The SEC alleged, among other things, that SolarWinds and its CISO made materially misleading statements and omissions about the company’s cybersecurity practices and risks in certain public disclosures. [2] This action marks the first time the SEC had sought to hold a CISO personally liable for statements made in a company’s SEC filings.
On July 18, 2024, Judge Paul A. Engelmayer of the US District Court of the Southern District of New York dismissed nearly all of the claims against SolarWinds and its CISO, allowing only a limited subset of the SEC’s claims to proceed. [3] The court dismissed the SEC’s claims regarding public statements in press releases and blog posts prior to the December 2020 cyberattack, categorizing them as “non-actionable corporate puffery.” [4]
The court also dismissed the SEC’s claims regarding the company’s SEC filings and disclosure controls prior to and after the cyberattack. The court found that, at the time SolarWinds disclosed the cyberattack, the company could not have known that the attack was related to prior incidents because its “understanding of the attack was evolving.” [5] Notably, the court also dismissed the SEC’s claim that SolarWinds failed to maintain internal accounting controls, finding that the requirement is “properly read to require [an] issuer to accurately report, record, and reconcile financial transactions and events,” and that a cybersecurity control is not included within this definition. [6]
The court allowed the SEC’s claims related to SolarWinds’s “Security Statement” concerning its cybersecurity practices to proceed, finding that, as pled, the statements may have misled investors regarding access controls and password protections. [7] The court highlighted the importance of accurate disclosures on cybersecurity given their significance to SolarWinds’s business. [8] Many view the court’s dismissal of several of the SEC’s claims as a significant win for CISOs and a blow to the SEC’s authority to regulate cybersecurity matters.
On June 27, 2024, the US Supreme Court in Securities and Exchange Commission v. Jarkesy held that the Seventh Amendment entitles a defendant to a jury trial when the SEC seeks civil penalties for securities fraud, and thus that the SEC may not seek such penalties through its own “in-house” administrative enforcement proceedings, which lack juries. [9] Instead, the SEC may pursue such penalties only in federal court. For more information on the Jarkesy decision, see our full LawFlash on this topic: US Supreme Court Curtails Availability of SEC In-House Proceedings.
Following the Jarkesy ruling, a securities broker registered with the Financial Industry Regulatory Authority (FINRA) filed a complaint in the US District Court for the Eastern District of Pennsylvania, asking the court to enjoin an action filed against him by FINRA because he claims that in light of Jarkesy, FINRA’s disciplinary proceeding against him was unconstitutional. [10] FINRA’s complaint against the broker includes claims that he engaged in unsuitable mutual fund trading and took steps to intentionally evade detection by his firm. [11]
The broker’s complaint argues that the Jarkesy decision forces FINRA to litigate enforcement actions in federal court and not in administrative proceedings. [12] He alleges that FINRA’s action is “a common law fraud [case,] disguised under regulatory language,” which should not shield FINRA from the obligation to provide the broker with a jury trial. [13] He asserts that FINRA’s charges are no different than SEC Rule 10b-5 fraud charges. [14] He also claims that the relief sought in the FINRA action mirrors the relief sought in common law fraud cases: disgorgement and restitution. [15]
On July 15, 2024, the broker moved for a preliminary injunction against FINRA. The US District Court for the Eastern District of Pennsylvania will hear arguments on August 21, 2024.
On July 26, 2024, the SEC charged an activist short seller and his firm for allegedly engaging in a scheme to defraud their followers by publishing false and misleading statements regarding his stock trading recommendations on his online platform and related social media platforms. [16]
The SEC alleges that the short seller made public recommendations to take long or short positions in several different companies, which ultimately moved the stock price of those companies on average, more than 12%. [17] The short seller produced research reports from his firm to support the recommendations. [18] The SEC alleges, however, that almost immediately after telling his readers to sell stock, the short seller would buy it back. Similarly, the short seller sold stock almost immediately after telling his readers to buy. According to the SEC, “[t]his fraudulent practice deceived investors and allowed [the short seller] to use his [firm’s] reports and tweets as catalysts from which he could derive short-term profits.” [19]
The SEC further alleges that the short seller made a number of misleading statements, both personally and through his firm, which left investors with the false pretense that his firm was independent, did not receive compensation for the information it published, and that the short seller and his firm’s investment objectives aligned with the statements. [20] In a parallel criminal action, the US Department of Justice charged the short seller with engaging in a securities fraud scheme, securities fraud, and making false statements to federal investigators.[21]
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following:
[1] Press Release, Securities and Exchange Commission, SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures (Oct. 30, 2023); SEC v. SolarWinds Corp. and T. Brown, 1:23-cv-09518-PAE (S.D.N.Y. Oct. 30, 2023), Dkt. No. 1.
[2] Id.
[3] SolarWinds, 1:23-cv-09518-PAE (S.D.N.Y. July 18, 2024), Dkt. No. 125.
[4] Id. at 67-68.
[5] Id. at 86.
[6] Id. at 98 (emphasis in original).
[7] Id. at 52.
[8] Id. at 56.
[9] Sec. & Exch. Comm’n v. Jarkesy, No. 22-859, 2024 WL 3187811, at *5 (U.S. June 27, 2024).
[10] Blankenship v. Financial Industry Regulatory Authority, 2:24-cv-03003-JFM (E.D. Pa. July 7, 2024), Dkt. No. 1 (Blankenship Complaint).
[11] Id.
[12] US Supreme Court Curtails Availability of Sec In-House Proceedings, Morgan Lewis Bockius LLP (June 28, 2024).
[13] Blankenship Complaint at 5-6.
[14] Id.
[15] Id. at 6-7.
[16] Press Release, Securities and Exchange Commission, SEC Charges Andrew Left and Citron Capital for $20 Million Fraud Scheme (July 26, 2024); S.E.C. v. A. Left, 2:24-cv-06311 (C.D. Cal. July 26, 2024), Dkt. No. 1 (Left Complaint).
[17] See Left Complaint at 2-3.
[18] Id.
[19] Id. at 3.
[20] Id. at 7-8.
[21] Press Release, Department of Justice, Activist Short Seller Charged for $16M Stock Market Manipulation Scheme (July 26, 2024); U.S.A. v. A. Left, 2:24-cr-00456-TJH (C.D. Cal. July 25, 2024), Dkt. No. 1.