Skip to main content

Office Hours with Gary Gensler: Cybersecurity and Securities Laws

Jan. 25, 2022

This video can be viewed at the below link.[1]

Did you know the first cyber hack actually took place in 1834?

So, in 1834, the Blanc brothers in Bordeaux, France, bribed telegraph operators to tip them off as to the direction of the market. Therefore, they gained an information advantage over investors who waited for the information to arrive from Paris.

The brothers weren’t convicted for their actions, as France didn’t have a law against the misuse of data networks.

So, one could say the Blancs thus pocketed their francs, point-blank.

You may be wondering what all this has to do with the SEC. Well, I think it’s telling that the world’s first cybersecurity attack involved securities.

Nearly two hundred years ago, after the Blancs hacked a mechanical telegraph, our securities infrastructure remains an important part of the world’s, and America’s, critical infrastructure.

Non-state hackers might try to disrupt the economy or steal financial assets.

So when it comes to cybersecurity, a lot of folks from the public to the private sector, have important roles to play. The SEC just is one part of that.

First, we help oversee the capital markets.

This part of the financial sector—capital markets—is such an important piece of America’s critical infrastructure. Shoring up the cyber resiliency of the financial sector is squarely in the SEC’s remit.

I’ve also asked staff how we can broaden and deepen our existing requirements for this key component of the nation’s infrastructure.

I’ve also asked them how we can help ensure that funds and broker-dealers are protecting your data.

Secondly, the SEC has a role with regard to the disclosures made by public companies—the companies you invest in.

These companies have an obligation to disclose their risks to the public. That’s so you can make more informed investment decisions.

Cybersecurity is one such emerging risk. So, I’ve asked staff to consider the disclosures of companies’ cyber risk and, of course, any cyber incidents that you as an investor might need to know about.

Thus, at the SEC, we’re working on multiple policy projects related to the resiliency of the financial sector, your data privacy as it relates to the financial sector, and also those public company issuers’ cyber hygiene and incident reporting.

Nearly two centuries after that first cyber hack, we can think about how to better protect ourselves against the cybersecurity pitfalls of the ’30s—not the 1830s, not the 1930s, but the 2030s.

Return to Top