More than a decade ago, I expressed my concern when the Securities and Exchange Commission accused Koss Corporation and one of its CEOs, Mr. Koss, of filing materially false financial reports after the company discovered it had been the victim of employee embezzlement. In the post, I condemned the SEC’s decision to punish the crime victims:
The SEC’s decision to prosecute this case is troubling. Certainly neither the Koss Corporation nor Mr. Koss had any intention or desire to be the victim of criminal embezzlement. It is also difficult to see how shareholders benefited from the company incurring the legal costs of defending and settling the SEC investigation. Although the SEC has compelled the repayment of the bonuses, the injunction requiring the company and Mr. Koss not to do so again seems silly to me. Does it really make sense for the court to order a company not to be the victim of theft?
I was therefore encouraged by the recent statement by Commissioners Hester Peirce and Mark Uyeda on the SEC’s recent settlement in Administrative proceedings against RR Donnelly & Sons, Co.:
Also worrying is the Commission’s decision to extend the law to penalise a company that has been the victim of a cyber-attack. While an enforcement action may be justified in certain circumstances, distorting a legal provision as the basis for such an action disproportionately increases the damage caused to a company by a cyber-attack.
According to the SEC press release, RR Donnelly & Sons, Co. is “cooperated throughout the investigation, including by reporting the cybersecurity incident to employees prior to disclosure of the incident, providing meaningful cooperation that helped expedite the employee investigation, and voluntarily implementing new cybersecurity technologies and controls.” Nevertheless, the SEC found that a just resolution required the payment of a civil penalty of $2.125 million to be remitted to the U.S. Treasury. I remain unconvinced that dispossessing millions of dollars from a crime victim for the benefit of the U.S. Treasury protects or even helps RR Donnelly & Sons, Co. shareholders.
(View source code.)
