Court Grants SolarWinds' Motion to Dismiss SEC Lawsuit "in Large Part"

Judge in SolarWinds case rejects SEC oversight of cybersecurity controls

A federal judge in a case stemming from one of the worst known cyberattacks has rejected the Securities and Exchange Commission’s bid to oversee corporate cybersecurity controls, relieving companies worried they would be penalized by regulators after breaches by well-resourced hackers.

In a closely watched case brought by the agency against 2020 hacking victim SolarWinds, U.S. District Judge Paul A. Engelmayer on Thursday granted most of the company’s motion to dismiss, holding that current laws give the SEC authority only over financial controls, not all internal controls.

“The SEC’s rationale, under which the statute must be construed to broadly cover all systems public companies use to safeguard their valuable assets, would have sweeping ramifications,” Engelmayer wrote in a 107-page decision.

“It could empower the agency to regulate background checks used in hiring nighttime security guards, the selection of padlocks for storage sheds, safety measures at water parks on whose reliability the asset of customer goodwill depended, and the lengths and configurations of passwords required to access company computers,” he wrote.

Jarkesy Decision Doesn’t Have to Mark End of Agency Adjudication

… The agency by regulation—or Congress by statute—could save administrative proceedings for civil monetary penalties by letting regulated parties choose whether to proceed in federal court or before the agency.

Regulated parties would answer the following question: Would you like to be sued in federal court or through administrative proceedings at the agency? You could call this, as we have done in a law review article, the right to remove in agency adjudication.

Some regulated parties will want their day in court, and the Supreme Court has ensured they can. But many will prefer administrative proceedings for several reasons.

Whistleblower Incentives Strengthen Corporate Compliance Programs

They incentivize internal whistleblowing. Exchange Act Rule 21F-6(a)(4) authorizes an increase in a whistleblower’s award percentage for reporting the securities violation through internal, legal, or compliance procedures before reporting it to the SEC.

Exchange Act Rule 21F-4(c)(3), meanwhile, enables a whistleblower to get an award for information disclosed by their employer to the SEC where the whistleblower’s internal disclosure prompted an internal investigation, the company provided information from that investigation to the SEC, and the whistleblower made a disclosure to the SEC within 120 days of reporting a violation to the company.

Data from the annual reports of the SEC Office of the Whistleblower reveals that around 80% of SEC whistleblower award recipients that disclosed violations committed by their current or former employers reported internally before notifying the Commission—contradicting the claim that such programs undermine internal compliance programs.

Whistleblower reward programs are an ingenious use of market forces to combat fraud and conserve limited enforcement resources. Companies that bemoan the success of these programs should stop blaming regulators and start strengthening their own compliance measures.

Law Firm’s SEC Suit Over Crypto Gets Skeptical 9th Cir. Panel

A law firm suing the US Securities and Exchange Commission to obtain a declaration that the firm’s use of the cryptocurrency Ethereum doesn’t violate securities laws faced a doubtful Ninth Circuit panel on Thursday.

Hodl Law PLLC, which focuses its practice on digital assets and cryptocurrencies, sought to revive its lawsuit brought under the Declaratory Judgment Act, arguing that it had no choice but to bring the suit against the SEC out of fear of prosecution over the firm’s transactions on the Ethereum network.

Legal Fee Tracker: Lawyers want $122.5 million in Apple securities case

Attorneys who reached a $490 million securities class action settlement with Apple earlier this year are hoping to walk away with a quarter of that amount in legal fees, arguing that the risks they took warrant a hefty reward.

Lawyers at Robbins Geller Rudman & Dowd and Labaton Keller Sucharow this week asked a federal judge, opens new tab in Oakland, California to award them $122.5 million, or about $3,100 an hour for the 65 lawyers and staffers who together devoted 39,500 hours to the case, according to the firms’ filings.