A US federal judge dismissed much of the Securities and Exchange Commission\u2019s lawsuit against SolarWinds that alleged the software provider misled investors about its cybersecurity practices and the significance of a major data breach that spilled into the US government.<\/p>\n
Thursday\u2019s ruling was seen as a blow to the SEC\u2019s aggressive efforts to regulate the cybersecurity practices of publicly traded companies, actions that had created significant angst among the private sector and from security practitioners.<\/p>\n
But the agency\u2019s case wasn\u2019t entirely dismissed. US District Judge Paul Engelmayer of the Southern District of New York allowed the SEC to move forward with a claim that SolarWinds committed securities fraud with a statement about the Austin-based company\u2019s cyber preparedness.<\/p>\n
However, in his decision Thursday, Engelmayer threw out the SEC\u2019s allegations that other statements and filings were misleading, and its claims that the company had mininized the scope and severity of a major hack that was disclosed in December 2020.<\/p>\n
Judge Engelmayer also dismissed at least some claims against SolarWinds\u2019 Chief Information Officer Timothy Brown, whom the SEC accused of intentionally failing to disclose the company\u2019s expansive security vulnerabilities in From 8-K filings during the months leading up to and after the Russian intrusion.<\/p>\n
But Engelmayer found that SolarWinds\u2019 executives and Brown\u2019s bosses were ultimately the parties responsible for crafting and signing the disclosures, not Brown himself.<\/p>\n
The SEC\u2019s complaint failed to claim that \u201cthe officers who approved the cybersecurity risk disclosure understood it was misleading,\u201d he said.<\/p>\n
\u201cThese executives, not Brown, appear to have had ultimate authority over the company\u2019s risk disclosure.\u201d<\/p>\n
Engelmayer upheld claims over Brown\u2019s role in the company\u2019s allegedly misleading security statement about SolarWinds\u2019 practices before the hacking disclosures.<\/p>\n
The rest of the claims against Brown over his public statements in company-approved press releases, blog posts, podcasts and the disclosures made in the Forms S-1 and 8-Ks were dismissed.<\/p>\n
\u201cI think the SolarWinds case is a bellwether action,\u201d said Jennifer Lee, a partner at Jenner & Block and a former SEC official.<\/p>\n
\u201cI absolutely think that the SEC will be looking at this decision, thinking about how it might want to refine its theories, and also consider just how it wants to move forward in terms of enforcement actions.\u201d<\/p>\n
Michael Borgia, a partner at Davis Wright Tremaine LLP, said, \u201cI think it\u2019s a bit of a slap down certainly.\u201d<\/p>\n
\u201cI do not think this spells a more sort of reticent, timid SEC in the cyber enforcement space,\u201d he said. \u201cI think they\u2019ll dust themselves off and keep going because clearly they think this is a significant priority.\u201d<\/p>\n
Gerry Stegmaier, a partner at Reed Smith LLP, said any sighs of relief over the decision may be premature.<\/p>\n
\u201cThe SEC continues to remain very active in looking for cybersecurity generally and companies\u2019 incident response generally,\u201d he said, in a statement.<\/p>\n
Russian hackers breached SolarWinds by inserting malicious code into a software update that was sent to its customers.<\/p>\n
The hackers then used the malware as a backdoor for further intrusions on a relatively small number of them, including dozens of companies and at least nine government agencies. The breach was revealed in December 2020.<\/p>\n
\u201cWe are pleased that Judge Engelmayer has largely granted our motion to dismiss the SEC\u2019s claims.<\/p>\n
We look forward to the next stage, where we will have the opportunity for the first time to present our own evidence and to demonstrate why the remaining claim is factually inaccurate,\u201d a SolarWinds spokesperson said in a statement.<\/p>\n
\u201cWe are also grateful for the support we have received thus far across the industry, from our customers, from cybersecurity professionals, and from veteran government officials who echoed our concerns, with which the court agreed.\u201d<\/p>\n
An SEC spokesperson declined to comment.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Securities and Exchange Commission alleged the software provider misled investors about its cybersecurity practices and the significance of a major data breach that spilled into the US government.<\/p>\n","protected":false},"author":341034,"featured_media":545185,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[15227,26872,96159,54019,60593],"class_list":["post-545183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cybersecurity","tag-data-breach","tag-paul-engelmayer","tag-securities-and-exchange-commission-sec","tag-solarwinds"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/545183"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341034"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=545183"}],"version-history":[{"count":0,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/545183\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/545185"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=545183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=545183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=545183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}