
As I noted in a recent post, on June 8, 2016, the SEC, in what one commentator called “the most significant SEC cybersecurity-related action to date,” announced that Morgan Stanley Smith Barney LLC had agreed to pay a $1 million penalty to settle charges that as a result of its alleged failure to adopt written policies and procedures reasonably designed to protect customer data, some customer information was hacked and offered for sale online. In the following guest post, John Reed Stark, President of John Reed Stark Consulting and former Chief of the SEC’s Office of Internet Enforcement, takes a look at the circumstances at the company that led to this enforcement action and reviews the important lessons that can be learned from what happened. A version of this article originally appeared on CybersecurityDocket. I would like to thank John for his willingness to publish his article as a guest post on this site. I welcome guest post submissions from responsible authors on topics of interest to this site’s readers. Please contact me directly if you would like to submit a guest post. Here is John’s guest post.
Continue Reading Guest Post: Key Takeaways From the SEC Morgan Stanley Cybersecurity Case

Australia has long been in the vanguard when it comes to enforcement of duties of corporate directors. Australia was the first English-speaking jurisdiction to introduce statutory directors’ duties in 1896, and the first English-speaking jurisdiction to introduce criminal sanctions to enforce statutory directors’ duties in 1958. However, following the recent global financial crisis, questions were raised in Australia (as they were elsewhere) about the effectiveness of Australia’s enforcement regime for directors’ duties. These questions in turn raised the question about what was in fact being done by to enforce directors’ duties under Australian law. In a March 2016 paper entitled “An Empirical Analysis of Public Enforcement of Directors’ Duties in Australia: Preliminary Findings” (
In the D&O insurance world, private company liabilities, exposures, and insurance are viewed as categorically distinct from public company liabilities, exposures, and insurance. There are completely separate and distinct insurance policy forms for each of the two categories of companies. In this traditional view, one of the key distinctions between two kinds of companies is the potential liability of public companies and their directors and officers under the federal securities laws. However, it has recently become apparent to me that this perceived difference between the two categories of companies may be less distinct than I had perceived. For example, as I noted in a
Though the Insured vs. Insured exclusion is a standard D&O policy provision, it seems to generate a disproportionate number of D&O insurance-related coverage disputes. The exclusion precludes coverage for claims brought by one Insured Person against another Insured Person. Among the host of recurring issues are the questions surrounding the exclusion’s preclusive reach when the claimants suing an Insured include both individuals who are Insured Persons and other individuals who are not Insured Persons.
As a result of scandals, investigations, and even an environmental catastrophe, there has been a wave of securities lawsuit filings in the U.S. against Brazilian-domiciled companies whose securities are listed in the U.S. This filing trend began in late 2014 with the first lawsuit filing against Petrobras and certain of its directors and officers, which was in turn followed by lawsuits against other companies caught up in the corruption scandal. In recent weeks lawsuits related to a separate regulatory investigation in Brazil have emerged, bringing the total number of securities lawsuits pending in the U.S. against Brazilian companies to six. These developments, along with events in Brazil itself, have roiled the D&O insurance marketplace in Brazil, particularly for Brazilian companies with securities listed in the U.S.
Until now, the primary federal agency regulating data security has been the Federal Trade Commission. Indeed, in August 2015, the Third Circuit in the Wyndham Worldwide case
The SEC promulgated
On May 23, 2016, in an interesting development in one of the more high profile lawsuits to arise out of the financial crisis, the Second Circuit reversed the $1.27 billion civil penalty that Southern District of New York Judge Jed Rakoff 