Federal Judge Rejects SEC Oversight of Corporate Cybersecurity Controls in SolarWinds Case

Federal Judge Rejects SEC Bid to Oversee Corporate Cybersecurity Controls in SolarWinds Case

In a significant ruling stemming from one of the worst known cyberattacks, a federal judge has rejected the Securities and Exchange Commission’s (SEC) attempt to regulate corporate cybersecurity controls. The decision, made in a case brought against SolarWinds, a victim of a 2020 hacking incident, has relieved companies concerned about potential penalties from regulators following breaches by well-resourced hackers.

U.S. District Judge Paul A. Engelmayer granted most of SolarWinds’ motion to dismiss the SEC’s claims, stating that current laws only give the SEC authority over financial controls, not all internal controls. In a 107-page decision, Engelmayer expressed concerns about the sweeping ramifications of the SEC’s rationale, which could potentially lead to extensive regulatory oversight beyond financial controls.

The judge also dismissed SEC allegations that SolarWinds’ post-breach disclosures downplayed the severity of the attack, which involved Russian intelligence agents infiltrating SolarWinds software to access multiple federal agencies and tech companies. The repercussions of the breach, disclosed in December 2020, continue to impact the government and industry.

The ruling has garnered support from business leaders, security executives, and former government officials who argued that holding hacking victims liable for misstatements could deter them from sharing crucial information with stakeholders. SolarWinds expressed gratitude for the industry’s support and emphasized the importance of cybersecurity professionals and government officials echoing their concerns.

While the case was not entirely dismissed, the SEC has the opportunity to pursue claims of securities fraud against SolarWinds and its top security executive, Timothy Brown, for allegedly making false statements about the company’s security measures. Engelmayer acknowledged the SEC’s argument that SolarWinds’ misrepresentations in its security statements were material given the company’s focus on cybersecurity in its product offerings.

The judge cited internal messages and presentations criticizing SolarWinds’ access controls and password policies as evidence supporting the SEC’s claims. Notably, an outside researcher had alerted the company in 2019 about a server password being exposed as “solarwinds 123,” and an engineer’s warning about potential vulnerabilities in the company’s network was not relayed to senior management, leading to further exploitation by hackers.

The ruling underscores the complex legal and regulatory challenges surrounding cybersecurity in the digital age, highlighting the need for a balanced approach to addressing cyber threats while ensuring accountability and transparency in the aftermath of cyber incidents.