Gowling WLG Focus

The past two years have seen cyber attacks and cybersecurity move from the business section to the front page, with high-level breaches affecting everything from the sanctity of democratic elections to the privacy of individuals as consumers and even as patients. Recent hacks have borne out industry predictions of an increasing shift from opportunistic attacks on unsophisticated individuals, to continued attacks on gatekeepers of consumer information (e.g. the recent Equifax breach), to breaches of targets holding higher value financial information (see the Deloitte breach and, more troubling still, the attack exploiting the U.S. Securities and Exchange Commission's EDGAR filing system²). As holders of high-value financial information become prime targets for cyber attacks, investment dealers must be more vigilant and prepared than ever before.

Increasing Recognition but Anemic Response

A cyber attack in the Canadian marketplace could severely threaten market integrity and undermine investor confidence; and investment dealers have clearly given thought to the repercussions of such attacks on their business. A number of regulators have canvassed market participants to assess the scope of these threats.

In early 2015, the Investment Industry Regulatory Organization of Canada (IIROC) conducted a survey of dealer members' preparedness to deal with cyber attacks. It noted that it was using the information gathered during these assessments to develop best practice recommendations, as well as an incident response guide. The survey found that:

• 83% of respondents to the survey viewed cyber issues as a threat. 
• 98% of respondents had adopted information security measures, including 69% of respondents having specific cybersecurity policies in place.
• 7% of respondents reported a service outage within 12 months of the study due to malicious acts of third parties.³

In the past year, Canadian securities regulators have reported the results of a review of the recent annual filings of 240 companies listed on the S&P/TSX Composite Index. The review focused on the quality of the disclosure relating to cybersecurity issues in the companies' respective risk disclosures. Some of the key findings included:

• 39% of issuers did not address cybersecurity issues in their risk factor disclosure.
• While a majority of issuers reviewed did address cybersecurity issues as a material risk to their business, all but a few did so in general terms, discussing only that their dependence on information technology rendered them at risk for cybersecurity breaches — very few issuers talked about the particular vulnerability to cybersecurity incidents specific to their business and their industry.
• Some potential impacts of a cybersecurity incident that were common to companies across different industries included, among others, the following:
  • Unauthorized access to proprietary or sensitive information
  • Compromising of confidential customer or employee information
  • Destruction or corruption of data
  • Lost revenue due to disruption of activities
  • Reputational harm affecting customer and investor confidence
• Of the subset of issuers who did address cybersecurity threats in their disclosure (61%), only 1/5 identified a person, group or committee that was responsible for dealing with such threats (and most of those identified their respective audit committees).

In sum, while some companies have turned their minds to cybersecurity threats in their disclosure, there is still a lot of room for improvement. As discussed below, Canadian securities regulators have also published a number of important recommendations to assist companies in this regard.

The most recent notice from Canadian securities regulators sets out the results of a survey related to cybersecurity and social media practices from 2011-2016 by investment fund managers, portfolio managers and exempt market dealers¹. The results provide an interesting and possibly troubling snapshot of the industry. Among the troubling results:

• 51% of firms experienced cybersecurity incidents in a given year (43% of firms identified phishing incidents, 18% reported malware incidents, and an alarming 15% reported attempts to impersonate clients for the purpose of initiating transactions).
• Most firms have cybersecurity policies and procedures, but only 57% of firms have procedures in place to allow for continued operation during a cybersecurity incident (the others, presumably, would have to shut down business indefinitely to deal with these incidents).
• Only 56% of firms have policies and procedures in place for cybersecurity training for employees.
• Most firms (59%) do not have specific cyber insurance policies.

Among the positive results:

• Most firms perform cyber risk assessments, at least annually (only 14% do not).
• Most firms (66%) have incident response plans in place that are tested at least annually.
• Most firms (68%) that use third-party vendors / consultants conduct due diligence on their cybersecurity practices.

Increased Guidance and Heightened Reporting Expectations

Canada

Cybersecurity has been identified as one of the top enforcement priorities of Canadian and American securities regulators. Canadian securities regulators have called on dealers to "be aware of the challenges of cyber-crime and [should] take the appropriate protective and security hygiene measures necessary to safeguard themselves and their clients or stakeholders."⁴ The Ontario Securities Commission (OSC) has noted that "[r]obust cybersecurity measures are an important element of the controls of issuers, registrants and regulated entities in ensuring the reliability of operations and the protection of confidential information."⁵ The OSC has also indicated it will evaluate these controls in its oversight of registrants and regulated entities in Ontario.⁶

The importance of cybersecurity was also raised in IIROC's Annual Compliance Report for 2014/2015⁷ and on December 21, 2015, following their aforementioned survey of IIROC-regulated firms regarding cybersecurity, IIROC published two resources to help firms protect themselves and their clients against cyber threats and attacks: the Cybersecurity Best Practices Guide⁸ (the "Best Practices Guide") and the Cyber Incident Management Planning Guide⁹ (the "Incident Guide").

The Best Practices Guide, described as a "living document",¹⁰ is intended to provide a voluntary set of industry standards and best practices to help IIROC Dealer Members manage cybersecurity risks¹¹.

Some of its key points include:

• Appropriate Governance and Risk Management Frameworks: Firms should establish and maintain appropriate governance and risk management frameworks to identify and address risks for communications networks and services. This requires board-level and senior management-level engagement.
• Employee Training: Employees should be aware of the danger posed by cybersecurity threats and should be trained to become a first line of defence against such.
• Insurance: Dealer Members should carefully review existing company and D&O insurance policy provisions as they relate to data breach and privacy claims, and ensure that such claims are not excluded.

The Incident Guide is intended to assist IIROC members in preparing an internal cyber-incident response plan, setting out voluntary cybersecurity strategies, guidelines, and tools for small and mid-sized IIROC Dealer Members.

As with the Best Practices Guide, IIROC notes that the Incident Guide "is not intended to create new legal or regulatory obligations or modify existing ones."¹² Instead, it lists five steps in preparing for and responding to cybersecurity incidents. These include:

• Developing an incident response team and breach response plan
• Implementing a monitoring program to detect cybersecurity incidents
• Assessing whether a cybersecurity event is truly an incident indicating a significant probability of compromising business operations
• Containing, recovering from and forensically analyzing the incident
• Developing lessons learned

The Best Practices Guide and the Incident Guide set forth a voluntary risk-based cybersecurity framework and are not intended to create new legal or regulatory obligations or modify existing ones.  However, given the vulnerabilities that investment dealers can face,¹³  dealer firms would do well to review the content of these resources and to, at the very least, consider whether they are compliant.¹⁴

IIROC has followed up on these initiatives by providing dealers with individualized, confidential 'report cards' comparing their practices and processes to firms of similar sizes and with similar business models.¹⁵ And, in its announcement of strategic priorities for 2018, IIROC has reaffirmed its commitment to helping dealers improve their cybersecurity preparedness.¹⁶

For their part, Canadian securities regulators published a number of key recommendations in their 2017 notices. At the beginning of the year, they provided guidance on risk factor disclosure and incident reporting. Among the key highlights, they recommended¹:

Risk Factor Disclosure

• Companies should avoid boilerplate language that describes cybersecurity risks that generally apply to all businesses. Instead, the focus should be on entity-specific and industry-specific threats. Companies should always keep in mind that the purpose of risk factor disclosure is to allow investors to distinguish one company from another, both within and across certain industries.
• One example provided by Canadian securities regulators was the difference between the kinds of threats to a consumer-facing business (e.g. breach of confidential customer information) and a company owning strategic intellectual property (e.g. theft of trade secret).
• Materiality with respect to cybersecurity risk disclosure turns on the probability a breach will occur and the anticipated magnitude of its effect.

Incident Reporting

• A company must of course assess the materiality of the breach.
• There is no bright-line test and the threshold for when an incident becomes material will differ from industry to industry and company to company.
• While a relatively minor incident may not be material, a series of frequent minor incidents may become material depending on the level of disruption.
• A cybersecurity remediation plan should deal with how materiality of an attack will be assessed to determine whether, when and how an incident will be disclosed.

And most recently, Canadian securities regulators weighed in with further guidance on how registrants can better protect their firms from cyber attacks.  Some of the key highlights include:

• Policies and Procedures: These should address:
  • The use of electronic communications, and these should cover the types of information firms may collect / send via email
  • The use of firm-issued devices and the use of public devices or internet connections to access the firm's network and data
  • Oversight of third-party vendors and service providers that have access to the firm's network or data
• Training: Employees should receive training on:
  • Recognizing risks
  • Handling confidential information
  • Security of "all electronic devices"
• Risk Assessment: Firms should conduct at least annual risk assessments, which should include:
  • An inventory of "critical assets and confidential data" and identification of "what is most important to protect"
  • Areas of potential vulnerability to cyber threats, internal (employees) and external (hackers, third-party providers)
  • An evaluation of the adequacy of the firm's incident response plan
• Incident Response Plan: Plans should include:
  • The identification of people who should be part of the response to the incident
  • Procedures to neutralize the threat and halt ongoing damage
  • Plans for the recovery of data, investigation of incident causes and improvement / adaptation to prevent similar incidents
• Due Diligence: Firms should:
  • Limit third-party access to their data
  • Ensure their agreements with third-party vendors / services providers address how the vendors / providers will address incidents involving the firm's data
  • Have a contingency plan in the event that firm data stored in the "cloud" becomes inaccessible
• Data Protection: Firms should also:
  • Use encryption "for all computers and electronic devices
  • Ensure the security of client data accessible via online portals
  • Back up their data to secure off-site servers
• Insurance: Firms should review their existing coverage and consider additional insurance if existing coverage does not cover cybersecurity incidents.

Canadian securities regulators also offered guidance on cyber-threats related to social media being used as a vehicle to carry out attacks against registrants, suggesting that firms have guidelines on appropriate use and content of social media, and should monitor authorized and unauthorized use of social media by firm employees.

UNITED STATES

Cybersecurity has been on the radar of the U.S. Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA) since at least 2007.¹⁷ In fact, it was referred to by President Obama, early on in his first term, as "one of the most serious economic and national security challenges" the country faced¹⁸.

In January 2014, FINRA initiated a sweep to better understand the types of threats to which member firms were subject, as well as their response to those threats.¹⁹ The subsequent Report on Cybersecurity²⁰ identified the top three threats facing firms as:

• Hackers penetrating firm systems
• Insiders compromising firm or client data
• Operational risks.²¹

On January 11, 2016, the SEC announced its 2016 Examination Priorities. For the third straight year, among them was a focus on broker dealers' and investment advisers' cybersecurity compliance and controls^.22

While Canadian securities regulators' current focus seems to be on establishing a culture of awareness of the risks of cyber attacks and the importance of proactive management,²³ the SEC has already begun prosecuting firms for failure to adopt written policies and procedures designed to protect customer data.  In a September 2015 case, RT Jones,²⁴ the SEC found that the investment adviser failed to establish the required cybersecurity policies and procedures in advance of a breach (hacker attack) that compromised the personal information of approximately 100,000 individuals — many of them clients of the firm. Though there was no evidence of any financial harm, the investment adviser was fined $75,000 and was required to adopt a written information security policy to comply with the cybersecurity regulations.²⁵

What Types of Threats Do Investment Dealers Face?

Because of their continued and increasing reliance on technology, the interconnectedness of the financial sector, and their access to sensitive/confidential information and world markets, investment dealers are subject to a variety of potential cyber threats. The three greatest threats, in order of importance, are:

As with the RT Jones case cited above, investment dealers face regulatory action for failure to adequately protect confidential information. Other than regulatory action, however, dealers could also be subject to other forms of liability, including financial penalties, reputational loss, and civil claims for negligence, statutory breach, and breach of contract.  Class action lawsuits against investment dealers are also possible.

What Actions Can Investment Dealers Take to Protect Themselves?

There is no "one-size-fits-all" model for a cybersecurity infrastructure, but a consensus has emerged on the importance of the following measures:

The Goal Posts Will Keep Shifting

While relatively little Canadian case law exists, emerging U.S. decisions will doubtlessly inform the expectations of Canadian judges and regulators in assessing whether dealers and advisers who fall prey to attacks did enough to protect their clients. These cases contribute to a growing laundry-list of expectations that companies and firms should expect to face in the future.  For instance, a recent settlement proposal submitted for court approval in a massive U.S. consumer data breach case adds the following expectations³⁵ to this growing list:

1. Partnering with a dark web mining service to search for stolen data
2. Periodic "table top cyber exercises" to test the breached firm's cyber response processes and procedures
3. Membership in "at least one Information Sharing and Analysis Center (ISAC) or Information Sharing and Analysis Organization (ISAO)"—note that Canada now has its own such exchange (the Canadian Cyber Threat Exchange)

Conclusion

When announcing the publication of the Best Practices Guide and Incident Guide, IIROC President Andrew Kreigler stated that "[a]ctive management of cyber risk is critical to the stability of IIROC-regulated firms, the integrity of Canadian capital markets and protection of investors."³⁶ 

The continued and increasing reliance on technology, the interconnectedness of the financial sector, as well as the critical role that financial institutions play in the overall economy puts investment dealers and advisers at the forefront of those who should be vigilant and ensure preparedness. They are uniquely positioned to be both victims of, and leaders in, this sphere; and regulators in both Canada and the U.S. have given clear indications that they expect dealers and advisers to be pro-active in their approach to cybersecurity.

Again, while there is no "one-size-fits-all" model, at a minimum, investment dealers and advisers should ensure that their Boards and upper management are aware of the cybersecurity risks faced by their firm and have in place a proper policy to be able to detect, prevent, and remediate a potential security breach.

Footnotes

1 Cyber Security and Social Media, CSA Staff Notice 33-321 (October 19, 2017), online: http://www.osc.gov.on.ca/documents/en/Securities-Category3/csa_20171019_33-321_cyber-security-and-social-media.pdf.

2 Peter J. Henning, "S.E.C. Hacking Response Provides Road Map for Compromised Companies," New York Times (September 26, 2017), online: https://www.nytimes.com/2017/09/26/business/dealbook/sec-hack.html?mcubz=0&_r=0.

3 Dealer Member Cyber-security, IIROC Notice 15-0294 (December 21, 2015), online: http://www.iiroc.ca/Documents/2015/c2bdf778-b972-45ec-9bf0-bb1fa8c83706_en.pdf.

4 Cyber Security, CSA Staff Notice 11-326 (September 26, 2013), online: https://www.lautorite.qc.ca/files//pdf/reglementation/valeurs-mobilieres/0-avis-acvm-staff/2013/2013sept26-11-326-avis-acvm-en.pdf. The CSA also requires registered firms to establish, maintain and apply policies and procedures that establish a system of controls and supervision – see Registration Requirements, Exemptions and Ongoing Registrant Obligations, National Instrument 31-103 (July 17, 2009), (online): http://www.osc.gov.on.ca/documents/en/Securities-Category3/rule_20090717_31-103_notice-ni.pdf.

5 Annual Report 2014, OSC (undated), online: https://www.osc.gov.on.ca/documents/en/About/rpt_2014_osc-annual-rpt_en.pdf at 22.

6 Annual Report 2014, OSC (undated), online: https://www.osc.gov.on.ca/documents/en/About/rpt_2014_osc-annual-rpt_en.pdf at 22. The OSC has also stated that it expects to find, as part of a firm's system of controls, procedures to protect confidentiality of client information, including cybersecurity – see Elements of an Effective Compliance System, Exhibit 2: Expectations for Content of Policies and Procedures Manual, OSC online: http://www.osc.gov.on.ca/documents/en/Dealers/ro_20150623_exhibit2-expectations-content.pdf.

7 Annual Consolidated Compliance Report, IIROC (January 27, 2015), online: http://www.iiroc.ca/Documents/2015/0bdb279a-eb58-484e-a164-4748e96c478b_en.pdf.

8 Best Practices Guide, IIROC (December 21, 2015), online: http://www.iiroc.ca/industry/Documents/CybersecurityBestPracticesGuide_en.pdf. 

9 Cyber Incident Management Planning Guide: For IIROC Dealer Members (Incident Guide), IIROC (December 21, 2015), online: http://www.iiroc.ca/industry/Documents/CyberIncidentManagementPlanningGuide_en.pdf. 

10 Best Practices Guide, supra note 8 at 4.

11 Best Practices Guide, supra note 8 at 3.

12 Incident Guide, supra note 9 at 3.

13 For example, the value and sensitivity of data held by these firms, the interconnectedness of the systems and common service providers.  See Investment Industry Association of Canada, "IIAC Seeks Member Firm Volunteers for Cyber Security Working Group" (November 25, 2014), online:  http://iiac.ca/iiac-seeks-member-firm-volunteers-for-cyber-security-working-group/. 

14 Privacy legislation should be considered as well, such as the Personal Information Protection and Electronic Document Act (PIPEDA), which may place additional obligations on the dealer.  PIPEDA was amended in June 2015 to include specific requirements on organizations to notify the Privacy Commissioner of any breach of security safeguards.

15 IIROC issues cybersecurity report cards for dealer firms, IIROC (October 3, 2016), online: http://www.iiroc.ca/Documents/2016/8272fe2a-a1a5-4319-9b0c-7739d04ff097_en.pdf. 

16 IIROC Priorities for 2018, IIROC (June 1, 2017) at 10, online: http://www.iiroc.ca/Documents/2017/f582e091-0e07-459b-bddb-d951da44b771_en.pdf. 

17 In 2011, the Division of Corporation Finance of the SEC issued guidance on existing disclosure obligations related to cybersecurity risks and incidents to assist public companies in framing disclosures of cybersecurity issues. That guidance makes clear that material information regarding cybersecurity risks and cyber incidents is required to be disclosed. (October, 13, 2011), online: https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm. See also Report on Cybersecurity Practices, A Report from the Financial Industry Regulatory Authority (February 2015), online: http://www.finra.org/industry/2015-cybersecurity-report at 3.

18 The Comprehensive National Cybersecurity Initiative, online: https://www.whitehouse.gov/issues/foreign-policy/cybersecurity/national-initiative. 

19 2015 Regulatory and Examination Priorities Letter, Financial Industry Regulatory Authority (January 6, 2015), online: http://www.finra.org/industry/2015-exam-priorities-letter. 

20Report on Cybersecurity Practices (FINRA Report), A Report from the Financial Industry Regulatory Authority (February 2015), online: http://www.finra.org/industry/2015-cybersecurity-report. 

21 FINRA Report, supra at 4.

22 Office of Compliance Inspections and Examinations, Examination Priorities for 2016 (January 2016), online: https://www.sec.gov/about/offices/ocie/national-examination-program-priorities-2016.pdf. 

23 Dealer Member Cyber-security, IIROC Notice 15-0294 (December 21, 2015), online: http://www.iiroc.ca/Documents/2015/c2bdf778-b972-45ec-9bf0-bb1fa8c83706_en.pdf. 

24 In the Manner of RT Jones Capital Equities Management Inc, Exchange Act Release No 4204, Admin Proc No 3-16827 (September 22, 2015).

25 The SEC rules at issue are similar to those found in NI 31-103.  Canadian regulatory bodies may, in the near future, follow the SEC's lead and change their focus to enforcement of the cybersecurity policy requirement.  Other than regulatory action, an investment dealer could also be subject to other forms of liability, including financial penalties, reputational loss, and civil claims for negligence, statutory breach, and breach of contract.  Class action lawsuits against investment dealers are also possible.

26 See for example, FINRA Report, supra note 20 at 5.

27 See for example, Best Practices Guide, supra note 8 at 20, 42.

28 See for example, Best Practices Guide, supra note 8 at 8.

29 See for example, FINRA Report, supra note 20 at 11.

30 Best Practices Guide, supra note 8 at 12.

31 National Exam Program Risk Alert Program, Office of Compliance Inspections and Examinations, SEC, Volume IV, Issue 8 (September 15, 2015), online: https://www.sec.gov/ocie/announcement/ocie-2015-cybersecurity-examination-initiative.pdflert. 

32 National Exam Program Risk Alert Program, Office of Compliance Inspections and Examinations, SEC, Volume IV, Issue 8 (September 15, 2015), online: https://www.sec.gov/ocie/announcement/ocie-2015-cybersecurity-examination-initiative.pdflert at 2-3.

33 FINRA Report, supra note 20 at 31.

34 FINRA Report, supra note 20 at 23. See also Best Practices Guide, supra note 8 at 32.

35 Plaintiffs' Unopposed Motion for Preliminary Approval of Shareholder Derivative Settlement and Memorandum of Law in Support, online: http://www.dandodiary.com/wp-content/uploads/sites/265/2017/05/home-depot-settlement.pdf, at pp.2 and 7-8.

36 IIROC Publishes Resources to Help Dealers Increase Cybersecurity Preparedness, News Release (December 21, 2015), online: http://www.iiroc.ca/Documents/2015/bf69013d-6525-4096-8164-ec5bdcccf5e3_en.pdf. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.