SEC Case Against SolarWinds Overview - The Rant You Have Been Waiting For

The Security and Exchange Commission's case against SolarWinds and its CEO has the cybersecurity industry in a tailspin. Discussions have developed into diametrically opposed positions and clarity is really needed. So let's break it down in straightforward terms what the actual complaint is about and what the SEC's role really is, then you can decide where you sit on this prickly topic. Now, the SEC was founded as an independent federal administrative agency in 1934, right after the Wall Street crash of 1929, and it works to protect the market from manipulation. The SEC's mission is to protect investors and their rights. This is done so there is fairness in the public investment sector. They enforce rules for public companies, prosecute for insider trading, and oversee required disclosures to investors so they're properly informed. In essence, they set the rules and oversee, investigate, and prosecute potential offenders. Now, the SEC complaint against SolarWinds and its CISO is a heated topic, causing professionals to be wrapped around the axle from twisted narratives. And some of them are becoming irrationally emotional and some are even becoming offended. What I hear the most is that this is a case about having to oversee perfect security or it's an unfair attack on the CISO community to deal with unreasonable ambiguity of what to report. No, no, that's not it. If that's what you think, you really need to read the complaint paragraph by paragraph. This case is actually about fraud. Yes, fraud. And there's a good definition of fraud. You can find it in the Uniform Penal Code. It's Section PC 532, and specifically the subsection PC 532 talks about corporate fraud, about misrepresentation, about misinformation, about deceit. On public documents intended for shareholders. So in this case, the complaint is claiming that intentional deceit on official and required forms that basically educate or inform investors. And if that is true, that constitutes fraud. And you can look it up in the piece in the penal code, right? It's very, very clear. It is not— this case is not about having specific security controls in place, but rather if the company and its officers were truthful to investors about important risks, risks that investors need to know about in order to properly manage their money. In fact, it's a right of theirs. And if that doesn't happen, basically you end up getting a small group which would unfairly retain insider information that puts regular investors at a disadvantage and denies them the ability to properly manage the risks of their investment. And that's why there's rules in place that you're required to. So think about this, right? For example, if a manufacturing company's overseas factory was destroyed by a hurricane and not able to produce products for the next 6 months. Well, it's actually required to inform shareholders so they can make good decisions about the investments or potential future investments in the company. If the company hides or intentionally downplays that kind of event and risks, then they're violating the law. This is why there are formal requirements for publicly traded companies to publish quarterly reports, to disclose specific information when they're seeking new funding, and to report material incidents in a timely manner. These are the long-standing rules of running a public company, and everybody must obey them. When a company or officers intentionally deceive investors, that is a crime. And the SEC is the oversight agency to both investigate and prosecute. Now, if facts warrant a case, then the SEC should prosecute and let a judge or jury decide whether the parties are innocent or guilty., and it's really important to understand that all accused are innocent until proven guilty in our justice system. And the SEC, when they bring a case like this, they essentially have the burden of proof. They must prove to that judge or jury that a crime has been committed. Okay? But until then, until a judge or jury decides, right, all people and companies, they're innocent until proven guilty. And this, from a taxpayer's perspective, this is what we expect the SEC to do, to identify situations of fraud, investigate, and prosecute them if there is evidence that shows a crime has happened. Okay, so let's talk about the specific case here regarding SolarWinds and the, uh, CISO. And SEC has called both of them out in their formal complaint. Complaint. Now, the SEC requires that public companies on a quarterly basis, when they're seeking funding and when a material incident occurs, they are required to file forms with the SEC. And these are forms that information goes to the shareholders. These are forms S-1, S-8, and 8-K, for example. And that is to formally attest aspects that investors or prospective investors need to decide if they want to put their money into the company or maybe take their money out of the company. This is about disclosure. That's what these forms are about, formal disclosure, so investors are making informed decisions. If you tell the truth on these forms, you're fine. If you intentionally deceive investors in these forms, then the SEC can come after you. Okay, so let's specifically talk about, uh, this case where the SEC complaint is against the SolarWinds company and its CISO, and we're talking about paragraphs 14 through 17. So if you go to the complaint, each of the paragraphs are numbered so you can take a look exactly what we're talking about and follow along. Okay. And again, everybody is innocent until proven guilty. Super important to keep that in mind. But the SEC in their complaint has indicated in claims that the CISO knew of attacks against 3 different customers in May 2020, in October 2020, and in December 2020, respectively. Now, after the last attack in December, they filed a Form 8-K disclosure to the SEC. This is the one where you have to, to let them know if something material is going on, basically. And in that, they failed to disclose that the vulnerability at issue had been exploited previously over the prior 6 months. To at least two other customers, one of them being a government agency. Now investors would probably want to know that. That omission is really huge, right? And if you want to think about it from different perspectives, if you were a CISO, would you fill out that 8-K SEC form and choose to omit and say, hey, yeah, there was a hack but choose to omit the fact that you had seen it all the way going back 6 months with other customers? Or would you just say, oh no, we were just hacked, it was just this time. It's really important. Now I think most of my colleagues out there would not withhold that very important fact. It's a fact of timing. Right, very important. Okay, let's think about it from the shareholders' position. You own shares in this company. When you get this declaration, would you want to know that the management of your investment has known about active attacks for 6 months? I'm thinking, yeah, that would probably be reflective of that management, your confidence in that management, and you may have some serious questions to ask about, wait a second, you knew that your product was being abused and your customers were being hacked and we're only finding out about it now? Okay, third perspective. If you were actually a SolarWinds customer, that means you had their product in your environment, right? The product that was hacked, allowing external attackers to then breach your company. So if you were a customer, Would you want to know from your vendor, from SolarWinds, that their product had been hacked for at least several months, 6 months, and at least 3 customers were victimized going back that period of time? The simple fact is, according to the claim, the company knew this, the CISO knew this, and they chose to omit that Even though the shareholders— it's material to the shareholders, it's material to their customers, and in good faith you should be explaining this as part of the declaration. Okay, now again, this case is not about a lack of security controls, as many have come out and said, but rather for the legal requirements to inform investors. So let's take a different example, a theoretical example, right, to really see how this plays. Because many CISOs are again wrapped around the axle. Wait a second, I have to disclose something? I have to tell them everything? I have to give them all this information? No, that's, that's really not the case. It really isn't. Okay, so theoretical example. Company A Right? Let's say it has the worst possible security out there, worst possible, but the company and the CISO are honest in the SEC filings. There's no fraud, there's no criminal case. The SEC isn't requiring you to have a certain standard of, uh, security controls or manage risk in a certain way. The requirement is only that you're honest about it when it's material to your investors. Okay, other scenario, Company B, and Company B has some security. Nothing's perfect. And in this example, it really doesn't matter how little or how much they have in place. It's irrelevant. But in this scenario, the company and/or the CISO intentionally deceive investors on the SEC filings. That's fraud. That's a criminal case, right? This is exactly what the SEC case against SolarWinds and their CISO is about. It's about fraud. So I will put a link in the description to the actual SEC complaint so you can read what was submitted to the court. It's 60-some-odd pages, but you'll probably get through the first few pages and realize, I get what they're talking about. Everything after that is, is talking about evidence to show that they knew, evidence to show that, um, there was intent, that they were intending to deceive. They had all the information. Um, there's a lot of different defenses for this type of crime that are typical, uh, one of which is, well, hey, we really didn't know, right? And so a lot of what the complaint in the SEC is listing is laying down facts that they're gonna, they're gonna, you know, try and prove in court to show No, they really did know. They were talking about it. They understood this. And yet they still filed the forms. They didn't do it just once. They did it several times. Right. So, but I will put a link in so you can read it. And I encourage everyone to read that document before jumping to conclusions of unfair attacks on CISOs by the SEC or some requirement that CISOs have to maintain some level of security or risk. And that's impossible. These are all, in my opinion, uninformed narratives that really don't have anything to do with this case. This case is about fraud. And as always, I welcome your constructive feedback and, and logical disagreements. We don't all have to agree. Our community is stronger when we debate and discuss new issues like this and challenges across our industry. So feel free. To use the comment section to share your insights and if you agree or disagree with the SEC bringing this case against SolarWinds for adjudication.