[Federal Register Volume 86, Number 3 (Wednesday, January 6, 2021)]
[Notices]
[Pages 591-624]
[FR Doc No: 2020-29216]

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-90826; File No. 4-698]

Joint Industry Plan; Notice of Filing of Amendment to the
National Market System Plan Governing the Consolidated Audit Trail by
BOX Exchange LLC; Cboe BYX Exchange, Inc., Cboe BZX Exchange, Inc.,
Cboe EDGA Exchange, Inc., Cboe EDGX Exchange, Inc., Cboe C2 Exchange,
Inc. and Cboe Exchange, Inc., Financial Industry Regulatory Authority,
Inc., Investors Exchange LLC, Long-Term Stock Exchange, Inc., Miami
International Securities Exchange LLC, MEMX, LLC, MIAX Emerald, LLC,
MIAX PEARL, LLC, Nasdaq BX, Inc., Nasdaq GEMX, LLC, Nasdaq ISE, LLC,
Nasdaq MRX, LLC, Nasdaq PHLX LLC, The NASDAQ Stock Market LLC; and New
York Stock Exchange LLC, NYSE American LLC, NYSE Arca, Inc., NYSE
Chicago, Inc., and NYSE National, Inc.

December 30, 2020.

I. Introduction

    On December 18, 2020, the Operating Committee for Consolidated
Audit Trail, LLC (``CAT LLC''), on behalf of the following parties to
the National Market System Plan Governing the Consolidated Audit Trail
(the ``CAT NMS Plan'' or ``Plan''): \1\ BOX Exchange LLC; Cboe BYX
Exchange, Inc., Cboe BZX Exchange, Inc., Cboe EDGA Exchange, Inc., Cboe
EDGX Exchange, Inc., Cboe C2 Exchange, Inc. and Cboe Exchange, Inc.,
Financial Industry Regulatory Authority, Inc., Investors Exchange LLC,
Long-Term Stock Exchange, Inc., Miami International Securities Exchange
LLC, MEMX, LLC, MIAX Emerald, LLC, MIAX PEARL, LLC, Nasdaq BX, Inc.,
Nasdaq GEMX, LLC, Nasdaq ISE, LLC, Nasdaq MRX, LLC, Nasdaq PHLX LLC,
The NASDAQ Stock Market LLC; and New York Stock Exchange LLC, NYSE
American LLC, NYSE Arca, Inc., NYSE Chicago, Inc., and NYSE National,
Inc. (collectively, the ``Participants,'' ``self-regulatory
organizations,'' or ``SROs'') filed with the Securities and Exchange
Commission (``SEC'' or ``Commission'') pursuant to Section 11A(a)(3) of
the Securities Exchange Act of 1934 (``Exchange Act''),\2\ and Rule 608

thereunder,\3\ a proposed amendment to the CAT NMS Plan that would
authorize CAT LLC to revise the Consolidated Audit Trail Reporter
Agreement (the ``Reporter Agreement'') and the Consolidated Audit Trail
Reporting Agent Agreement (the ``Reporting Agent Agreement'') to insert
the limitation of liability provisions (the ``Limitation of Liability
Provisions''), as contained in Appendix A, attached hereto.\4\ The
Commission is publishing this notice to solicit comments from
interested persons on the amendment.\5\
---------------------------------------------------------------------------

    \1\ The CAT NMS Plan is a national market system plan approved
by the Commission pursuant to Section 11A of the Exchange Act and
the rules and regulations thereunder. See Securities Exchange Act
Release No. 79318 (November 15, 2016), 81 FR 84696 (November 23,
2016).
    \2\ 15 U.S.C 78k-1(a)(3).
    \3\ 17 CFR 242.608.
    \4\ See Letter from Michael Simon, Chair, CAT NMS Plan Operating
Committee, to Ms. Vanessa Countryman, Secretary, Commission, dated
December 18, 2020. The Participants state that these provisions
would address the liability of CAT LLC and the Participants in the
event of a CAT data breach. The Participants further state that in
conjunction with this proposed amendment (the ``Proposed
Amendment'') to the CAT NMS Plan, each Participant intends to file
with the Commission corresponding proposed changes to its individual
CAT Compliance Rules.
    \5\ 17 CFR 242.608.
---------------------------------------------------------------------------

II. Description of the Plan

    Set forth in this Section II is the statement of the purpose and
summary of the amendment, along with information required by Rule
608(a)(4) and (5) under the Exchange Act,\6\ substantially as prepared
and submitted by the Participants to the Commission.\7\
---------------------------------------------------------------------------

    \6\ See 17 CFR 242.608(a)(4) and (a)(5).
    \7\ See supra note 4. Unless otherwise defined herein,
capitalized terms used herein are defined as set forth in the CAT
NMS Plan.
---------------------------------------------------------------------------

A. Statement of Purpose of the Amendment to the CAT NMS Plan

    The Proposed Amendment adds industry-standard Limitation of
Liability Provisions to the Reporter Agreement and Reporting Agent
Agreement.\8\ The Limitation of Liability Provisions are appropriately
tailored, consistent with longstanding principles regarding allocation
of liability between self-regulatory organizations (``SROs'') and
Industry Members, and have been agreed to in substance by virtually all
Industry Members in connection with Order Audit Trail System (``OATS'')
reporting.
---------------------------------------------------------------------------

    \8\ The Participants believe that the CAT NMS Plan and certain
individual self-regulatory organization rules already authorize the
inclusion of the Limitation of Liability Provisions in the Reporter
Agreement and the Reporting Agent Agreement. See generally, May 6,
2020 CAT LLC Memo of Law in Opposition to SIFMA'S Motion to Stay,
Admin. Proc. File No. 3-19766. The Participants nonetheless submit
this Proposed Amendment to provide industry members (``Industry
Members'') and other interested constituencies with an opportunity
to comment on the Limitation of Liability Provisions.
---------------------------------------------------------------------------

    Moreover, CAT LLC has retained Charles River Associates (``Charles
River'') to conduct a comprehensive economic analysis of the liability
issues presented by a potential CAT data breach. That analysis,
attached to this Proposed Amendment as Appendix B, concludes that
combining ongoing Commission oversight with a limitation on liability
is the most efficient manner of addressing the complex issues presented
by such potential breaches. Although Industry Members have advocated
for an approach that would allow them (and their clients) to sue CAT
LLC and the Participants in the event of a breach, the Charles River
analysis demonstrates that this approach would significantly increase
CAT LLC's costs--potentially without bounds--without any corresponding
benefit to the Commission, investors, or other stakeholders, and
likewise would not materially improve the security of the data
transmitted to and stored within the CAT. Charles River also concludes
that in light of the CAT's extensive cybersecurity (among other
reasons), most potential breach scenarios, including the possibility of
reverse engineering of Industry Members' trading algorithms, are
relatively low-frequency events. For those reasons, and as discussed in
detail below, there is no economic basis to deviate from industry norms
by shifting liability from Industry Members to the Participants.
1. Background
    On July 11, 2012, the Commission adopted Rule 613 of Regulation NMS
to enhance regulatory oversight of the U.S. securities markets. The
rule directed the Participants to create a ``Consolidated Audit Trail''
(also referred to herein as the ``CAT'') that would strengthen the
ability of regulators--including the Commission and the SROs--to
surveil the securities markets.\9\ Following the adoption of Rule 613,
the Participants prepared and proposed the CAT NMS Plan and then
implemented the Plan's extensive requirements, including its
cybersecurity requirements. The Commission approved that Plan in
November 2016, concluding that it incorporates ``robust security
requirements'' that ``provide appropriate, adequate protection for the
CAT Data.'' \10\
---------------------------------------------------------------------------

    \9\ See 17 CFR 242.613 (2012).
    \10\ SEC, Joint Industry Plan; Order Approving the National
Market System Plan Governing the Consolidated Audit Trail, Release
No. 34-79318; File No. 4-698, at 715 (Nov. 15, 2016), https://www.sec.gov/rules/sro/nms/2016/34-79318.pdf.
---------------------------------------------------------------------------

    In preparation for the launch of initial CAT equities reporting, in
August 2019 the Participants shared with CAT LLC's Advisory Committee a
draft Reporter Agreement.\11\ Among other provisions, the draft
Reporter Agreement contained an industry-standard limitation of
liability provision that provided:
---------------------------------------------------------------------------

    \11\ The Advisory Committee is comprised of broker-dealers of
varying sizes and types of business, a clearing firm, an individual
who maintains a securities account, an academic, institutional
investors, an individual with significant and reputable regulatory
expertise, and a service bureau that provides reporting services to
one or more CAT Reporters. See CAT NMS Plan, Section 4.13(b). The
Advisory Committee provides a forum for Industry Members (among
other constituencies) to stay informed about, and to provide
feedback to the Participants and the Operating Committee regarding,
the operation and administration of the CAT. See CAT NMS Plan,
Section 4.13(d)-(e).

TO THE EXTENT PERMITTED BY LAW, UNDER NO CIRCUMSTANCES SHALL THE
TOTAL LIABILITY OF CAT LLC OR ANY OF ITS REPRESENTATIVES TO CAT
REPORTER UNDER THIS AGREEMENT FOR ANY CALENDAR YEAR EXCEED THE
LESSER OF THE TOTAL OF THE FEES ACTUALLY PAID BY CAT REPORTER TO CAT
LLC FOR THE CALENDAR YEAR IN WHICH THE CLAIM AROSE OR FIVE HUNDRED
---------------------------------------------------------------------------
DOLLARS ($500.00). See id. Sec.  5.5.

    On August 29, 2019, CAT LLC's Operating Committee approved the
then-draft Reporter Agreement--including the limitation of liability--
by unanimous written consent.\12\
---------------------------------------------------------------------------

    \12\ ``[T]he Operating Committee shall make all policy decisions
on behalf of the Company in furtherance of the functions and
objectives of the Company under the Exchange Act, any rules
thereunder, including SEC Rule 613, and under this Agreement.'' CAT
NMS Plan, Section 4.1.
---------------------------------------------------------------------------

    Following the approval process, the Securities Industry and
Financial Markets Association (``SIFMA'') objected on behalf of certain
Industry Members to the Reporter Agreement's limitation of liability
provisions, particularly in relation to a potential CAT data breach.
The Participants attempted to engage in a constructive dialogue with
SIFMA and offered several proposed revisions to the limitation of
liability provisions to address SIFMA's concerns. Among other
proposals, the Participants offered: (1) To create a reserve (funded
jointly by Industry Members and the Participants) to cover damages in
the event of a data breach and (2) to revise the limitation of
liability provision to conform with analogous provisions in the
agreements that Industry Members require their retail customers to
execute. Throughout those discussions, the Participants repeatedly
stated that they were willing to consider any proposals offered by
Industry Members whereby a limitation of liability provision would
remain in the Reporter Agreement. SIFMA did not offer any substantive
counterproposals; instead, it maintained its wholesale objection to any
limitation of liability.

    Notwithstanding SIFMA's objections, between September 2019 and May
5, 2020, over 1,300 Industry Members executed the then-operative
Reporter Agreement containing the limitation of liability provision. In
advance of the initial equities reporting deadline, all CAT Reporters
were required to test their ability to upload data to the CAT database
and then complete a certification form. To enable the approximately 60
Industry Members who did not execute the Reporter Agreement to complete
the testing and certification process, CAT LLC permitted them to test
with obfuscated data pursuant to a ``Limited Testing Acknowledgment
Form.''
    In March and April 2020, 10 of those 60 Industry Members rescinded
their execution of the Limited Testing Acknowledgement Forms and
attempted to report production data to the CAT. Because those Industry
Members had not executed the Reporter Agreement, FINRA CAT (i.e., the
Plan Processor) refused to permit them to submit production data. On
April 22, 2020, SIFMA filed an application for review of actions taken
by CAT LLC and the Participants pursuant to Sections 19(d) and 19(f) of
the Exchange Act (the ``Administrative Proceeding''). SIFMA's
application alleged that the Participants improperly required Industry
Members to execute a Reporter Agreement as a prerequisite to submitting
data to the CAT and that the agreement's limitation of liability
provision was ``unfair, inappropriate, and bad policy.'' \13\
Contemporaneously with the filing of the Administrative Proceeding,
SIFMA moved for a stay of the requirement that Industry Members sign a
Reporter Agreement, or in the alternative, asked the Commission to
further delay the launch of CAT reporting on June 22, 2020. On May 13,
SIFMA and the Participants informed the Commission that the parties
reached a settlement of the Administrative Proceeding and requested
that the Commission dismiss SIFMA's application. On May 14, the
Commission granted the parties' dismissal request.
---------------------------------------------------------------------------

    \13\ SIFMA also challenged the Reporter Agreement's provision
that required Industry Members to indemnify CAT LLC and the
Participants from third party claims arising from an Industry
Member's unlawful acts and omissions including a failure: (1) By an
Industry Member to protect and secure PII under its control, (2) of
an Industry Member to protect its own systems from misuse, or (3) of
an Industry Member to comply with its obligations under the Reporter
Agreement. All CAT Reporters and CAT Reporting Agents (as defined in
each of the Reporter Agreement and the Reporting Agent Agreement)
eventually signed an Agreement that contained these industry
standard indemnification provisions.
---------------------------------------------------------------------------

    The settlement between SIFMA and the Participants did not resolve
the underlying disagreement regarding the proper allocation of
liability in the event of a loss due to a breach of the CAT. Rather,
the settlement provided a path for the minority of Industry Members
that had not signed the original Reporter Agreement to test data and,
subsequently, report live production data to the CAT. In particular,
the settlement permitted Industry Members to report data to the CAT
pursuant to a revised Reporter Agreement that does not contain a
limitation of liability provision, while the Participants prepared a
filing with the Commission to resolve the parties' underlying
disagreement regarding the proper allocation of liability. CAT LLC's
and the Participants' decision to resolve the Administrative Proceeding
was animated by a desire to progress unimpeded toward the CAT's June 22
compliance date.
    Initial equities reporting commenced as planned on June 22, 2020.
Since that time, Industry Members have been transmitting data to the
CAT pursuant to the revised Reporter Agreement, which does not contain
any limitation of liability provision.
2. The Limitation of Liability Provisions
    The Limitation of Liability Provisions in this Proposed Amendment,
each of which was included (in substance) in the original Reporter
Agreement and Reporting Agent Agreement, are contained in Appendix A to
this Proposed Amendment.\14\ In sum and substance, the Limitation of
Liability Provisions:
---------------------------------------------------------------------------

    \14\ The modifications in this Proposed Amendment are not
intended to and do not affect the limitations of liability set forth
in the agreements between individual Participants and Industry
Members or SEC-approved rules regarding limitations of liability, or
those limitations or immunities that bar claims for damages against
the Participants and CAT LLC as a matter of law.
---------------------------------------------------------------------------

     Provide that CAT Reporters and CAT Reporting Agents accept
sole responsibility for their access to and use of the CAT System, and
that CAT LLC makes no representations or warranties regarding the CAT
system or any other matter;
     Limit the liability of CAT LLC, the Participants, and
their respective representatives to any individual CAT Reporter or CAT
Reporting Agent to the lesser of the fees actually paid to CAT for the
calendar year or $500;
     Exclude all direct and indirect damages; and
     Provide that CAT LLC, the Participants, and their
respective representatives shall not be liable for the loss or
corruption of any data submitted by a CAT Reporter or CAT Reporting
Agent to the CAT System.\15\
---------------------------------------------------------------------------

    \15\ Appendix A also contains language clarifying the entities
to which the Limitation of Liability Provisions apply. See Appendix
A at Sec.  5.5.
---------------------------------------------------------------------------

2. The Limitation of Liability Provisions Reflect Longstanding
Principles of Allocation of Liability Between Industry Members and
Self-Regulatory Organizations
    Limitations of liability are ubiquitous within the securities
industry and have long governed the economic relationships between
self-regulatory organizations and the entities that they regulate. The
Limitation of Liability Provisions at issue here fall squarely within
industry norms.
    For over half of a century, U.S. securities exchanges have adopted
rules to limit their liability for losses that Industry Members incur
through their use of exchange facilities.\16\ These rules broadly
disclaim all liability to exchange members. By way of example, NASDAQ
Equities Rule 4626 provides that the exchange ``shall not be liable for
any losses, damages, or other claims arising out of the NASDAQ Market
Center or its use.'' \17\ Every other securities exchange has a similar
rule, each of which was approved by the Commission as consistent with
the Exchange Act.\18\
---------------------------------------------------------------------------

    \16\ See, e.g., Securities Exchange Act Release No. 14777 (May
17, 1978) (SR-CBOE-78-14) (noting that an exchange ``cannot proceed
with innovative systems and procedures for the execution, clearance,
and settlement of Exchange transactions . . . unless it is protected
against losses which might be incurred by members as a result of
their use of such systems,'' and further that ``[t]o the extent [a
limitation of liability rule] enables the Exchange to proceed with
innovative systems, competition should be enhanced.''); Securities
Exchange Act Release No. 58137 (July 10, 2008), 73 FR 41145 (July
17, 2008) (SR-NYSE-2008-55) (explaining that exchange's limitation
of liability rule encourages vendors to provide services to the
exchange, which results in faster and more innovative products for
order entry, execution, and dissemination of market information).
    \17\ See Nasdaq Equities Rule 4626 (Limitation of Liability)
(emphasis added).
    \18\ New York Stock Exchange LLC Rule 17, BOX Exchange LLC, Rule
7230; Cboe Exchange, Inc., Rule 1.10; Investors Exchange LLC, Rule
11.260; Long-Term Stock Exchange, Rule 11.260; Miami International
Securities Exchange, LLC, Rule 527; MEMX Rule 11.14. Although FINRA
does not operate a securities exchange, the Commission has
recognized that limiting FINRA's liability to Industry Members is
consistent with the Exchange Act. See FINRA Rule 14108.
---------------------------------------------------------------------------

    These Commission-approved limitations of liability support a
foundational aspect of The Exchange Act: The self-regulatory framework.
This bedrock principle of securities regulation dates back to 1934,
when Congress initially codified the legal

status of self-regulatory organizations.\19\ The essence of this
framework is that the Commission regulates the SROs, and, in turn, each
SRO regulates its members.\20\ To empower the self-regulatory
organizations to regulate Industry Members, Congress granted the
securities exchanges with the authority--and the responsibility--to
enforce compliance with the securities laws among exchange members.\21\
It is in this context that the Commission has concluded that rules
requiring Industry Members to limit the liability of the Participants
are consistent with the Exchange Act.
---------------------------------------------------------------------------

    \19\ See Exchange Act Section 6(d).
    \20\ Section 6 of Exchange Act requires the SROs to enact rules
subject to SEC approval and enforce those rules against members. The
Commission oversees the SROs through its examination authority under
Section 17 and its enforcement authority pursuant to Sections
19(h)(1) and 21C.
    \21\ See Exchange Act Section 6(b) (original version) (providing
that exchanges must have provisions for expelling, suspending, or
otherwise disciplining members for conduct that is inconsistent with
just and equitable principles of trade and willful violations of the
Exchange Act).
---------------------------------------------------------------------------

    Likewise, the Commission has concluded that it is appropriate for
self-regulatory organizations to adopt agreements with terms of use in
connection with regulatory reporting facilities. The Commission has
approved rules requiring Industry Members to agree to terms of use that
customarily limit the liability of various regulatory reporting
facilities--and the individual participants that comprise or operate
those facilities--in connection with the reporting of order and
execution data. And as with the CAT, those reporting facilities ingest
substantial volumes of sensitive transaction data. For example, from
1998 through the present, the OATS has functioned as an integrated
audit trail of order, quote, and trade data for equity securities. And
to comply with their OATS reporting requirements, FINRA members must
acknowledge an agreement that includes a limitation of liability
provision that is similar in scope to the Limitation of Liability
Provisions that are the subject of this Proposed Amendment.\22\
---------------------------------------------------------------------------

    \22\ FINRA Rule 1013(a)(1)(R) requires all applicants for FINRA
Membership to acknowledge the FINRA Entitlement Program Agreement
and Terms of Use, which applies to OATS. Industry Members click to
indicate that they agree to its terms--including its limitation of
liability provision--every time they access FINRA's OATS system to
report trade information (i.e., repeatedly over the course of a
trading day for many Industry Members).
---------------------------------------------------------------------------

    Congress and the Commission have recognized that these principles
also apply to National Market System facilities comprised of self-
regulatory organizations. In 1975, Congress enacted the Securities Act
Amendments of 1975, which reinforced the importance of the self-
regulatory framework. The 1975 legislation also tasked the exchanges
with certain responsibilities for the creation of a ``national market
system'' including the development and maintenance of a consolidated
market data stream.\23\
---------------------------------------------------------------------------

    \23\ See Exchange Act Section 11A.
---------------------------------------------------------------------------

    Following the adoption of the market data rules of Regulation NMS
in 2007, various NMS facilities have been formed to execute the
regulation's mandates. There too, the Commission has concluded that
limitations of liability are consistent with the Exchange Act.
Accordingly, NMS facilities that receive transaction and customer data
uniformly contain broad limitations of liability protecting both the
actual facility and its constituent self-regulatory organizations. For
example, the Consolidated Quotation Plan vendor and subscriber
agreements--approved by the Commission--provide that no disseminating
party will:

be liable in any way to [Customer/Subscriber] or to any other person
for (a) any inaccuracy, error or delay in, or omission of, (i) any
such data, information or message, or (ii) the transmission or
delivery of any such data, information or message, or (b) any loss
or damage arising from or occasioned by (i) any such inaccuracy,
error, delay or omission, (ii) non-performance, or (iii)
interruption in any such data, information or message, due either to
any negligent act or omission by any Disseminating Party or to any
``Force Majeure'' (i.e., any flood, extraordinary weather
conditions, earthquake or other act of God, fire, war, insurrection,
riot, labor dispute, accident, action of government, communications
or power failure, or equipment or software malfunction) or any other
cause beyond the reasonable control of any Disseminating Party.\24\
---------------------------------------------------------------------------

    \24\ See Consolidated Tape Association/Consolidated Quotation
Plan, July 1978, as restated December 1995 available at https://www.ctaplan.com/publicdocs/ctaplan/notifications/trader-update/CQ_Plan-9.17.2020.pdf. Other NMS facilities and regulatory reporting
systems likewise require Industry Members to agree to limit the
liability of SROs. The Commission has approved multiple NMS Plans
and rules regarding reporting facilities that condition use of the
facility on the execution of an agreement. See, e.g., Nasdaq
Unlisted Trading Privileges Plan, available at http://www.utpplan.com/DOC/Nasdaq-UTPPlan_Composite_as_of_September_17_2020.pdf; Options Price
Reporting Authority Plan, available at https://assets.website-files.com/5ba40927ac854d8c970;bc92d7/
5d0bd57d87d3ccca102102d7_OPRA%20Plan%20with%20Updated%20Exhibit%20A%2
0-%2006-19-2019.pdf. All such agreements limit liability. See, e.g.,
UTP Plan Subscriber Agreement, available at http://www.utpplan.com/DOC/subagreement.pdf.; Options Price Reporting Authority Vendor
Agreement, available at https://assets.website-files.com/5ba40927ac854d8c97bc92d7/5c6f058889c3684b7571a552_OPRA%20Vendor%20Agreement%20100118.pdf;
Options Price Reporting Authority Subscriber Agreement, available at
https://assets.website-files.com/5ba40927ac854d8c97bc92d7/5bf421d078a39dec23185180_hardcopy_subscriber_agreement.pdf.

    As the Commission has recognized by approving limitations of
liability in the rules of every self-regulatory organization and in the
context of regulatory and NMS reporting facilities, limiting the
liability of self-regulatory organizations to Industry Members is
consistent with the Exchange Act. There is no reason to depart from the
principles that served the securities markets well for over half of a
century and create a different framework for CAT reporting. Indeed, to
comply with the Administrative Procedure Act, the Commission may not
depart from this longstanding approach without: (1) Acknowledging the
change in course and (2) providing a reasoned justification for the
new, conflicting policy. See F.C.C. v. Fox Television Stations, Inc.,
556 U.S. 502, 514-15 (2009). And because the Participants have invested
substantial resources into the CAT in reliance on the agency's repeated
approval of limitations on SRO liability, the Commission must provide
an even more detailed justification if it opts to depart from that
longstanding principle of liability here. See Smiley v. Citibank (South
Dakota) N.A., 517 U.S. 735, 742 (1996) (explaining that ``change that
does not take account of legitimate reliance on prior interpretation .
. . may be `arbitrary, capricious, or an abuse of discretion'') (citing
5 U.S.C. 706(2)(A)); Fox Television Stations, Inc., 556 U.S. at 516
(``[A] reasoned explanation is needed for disregarding facts and
circumstances that underlay or were engendered by the prior policy.'').
    The case for a limitation of liability is particularly compelling
where, as here, the Participants and CAT LLC are implementing the
requirements of the CAT NMS Plan in their regulatory capacities. Rule
613 of Regulation NMS tasked the SROs with creating the CAT to achieve
a core regulatory function--i.e., to ``oversee our securities markets
on a consolidated basis--and in so doing, better protect these markets
and investors.'' \25\ During Rule 613's adoption, the Commission made
clear that the rule imposed regulatory obligations on the
Participants.\26\ And SIFMA recognized the important

regulatory function of the CAT, expressing its ``belie[f] that a
centralized and comprehensive audit trail would enable the SEC and
securities self-regulatory organizations (``SROs'') to perform their
monitoring, enforcement, and regulatory activities more effectively.''
\27\
---------------------------------------------------------------------------

    \25\ Chairman Jay Clayton, SEC, Statement on the Status of the
Consolidated Audit Trail, Nov. 14, 2017, available at https://www.sec.gov/news/public-statement/statement-status-consolidated-audit-trail-chairman-jay-clayton.
    \26\ SEC Release No. 34-67457; File No. S7-11-10, at 4 (Oct. 1,
2012) (noting lack of key information in prior audit trails needed
for regulatory oversight) and 20 (noting that prior to the CAT, SROs
and the Commission must use a variety of data sources to fulfill
their regulatory obligations).
    \27\ August 17, 2010 SIFMA Letter at 1-2, available at https://www.sec.gov/comments/s7-11-10/s71110-63.pdf.
---------------------------------------------------------------------------

    Notwithstanding the Commission's repeated conclusion that limiting
the liability of the Participants and their facilities is consistent
with the Exchange Act, during prior negotiations and during the
Administrative Proceeding, SIFMA objected to any limitation of
liability provision in the Reporter Agreement based on a purported
``guiding principle'' that the party that controls the data should bear
the risk. But this ``principle'' is inapplicable to a regulatory
program with Commission-mandated reporting.\28\ It is also inconsistent
with how SIFMA members treat their own customers. Despite controlling
sensitive data that would harm customers if compromised via data
breach, Industry Members routinely disclaim such liability.\29\ At
bottom, the Participants are not aware of any context in which
liability that is usually borne by Industry Members is shifted to their
regulators, and there is no compelling reason to do so here.
---------------------------------------------------------------------------

    \28\ See, e.g., supra at 7, n. 21 (limitations of liability in
regulatory reporting facilities).
    \29\ See, e.g., Vanguard Electronic Services Agreement
(effective Sep. 5, 2017), available at https://personal.vanguard.com/pdf/v718.pdf; E*TRADE Customer Agreement
(effective June 30, 2020), available at https://us.etrade.com/e/t/estation/contexthelp?id=1209031000); Bank of America Electronic
Trading Terms and Conditions (Nov. 2020), available at https://www.bofaml.com/content/dam/boamlimages/documents/PDFs/baml_electronic_trading_platform_terms_final_12_03_2015.pdf).
---------------------------------------------------------------------------

3. The Commission's Exemptive Relief Regarding PII Reduces the Risk of
a Serious Data Breach
    During negotiations regarding liability issues prior to the
Administrative Proceeding, SIFMA focused on the allocation of liability
between CAT LLC and Industry Members in the event of a data breach
involving investors' personally identifiable information (``PII''). For
example, SIFMA expressed concerns in correspondence dated November 11,
2019 that focused on inclusion of PII in the CAT, and in a similar
letter dated January 8, 2020 expressed concerns about bulk downloading
of data and PII.\30\ The Participants appreciate those concerns and
remain vigilant in taking all appropriate cybersecurity measures to
protect customer information (and all CAT data). Further, the
Commission subsequently granted the Participants' requested relief to
no longer require that Industry Members report social security numbers,
dates of birth, and full account numbers for individual retail
customers.\31\
---------------------------------------------------------------------------

    \30\ In February 2020, SIFMA clarified that, in addition to PII
concerns, a minority of Industry Members had refused to sign the
Reporter Agreement due to concerns regarding the ability of third
parties to reverse engineer their proprietary trading strategies.
    \31\ Order Granting Conditional Exemptive Relief, Pursuant to
Section 36 and Rule 608(e) of the Securities Exchange Act of 1934,
from Section 6.4(d)(ii)(C) and Appendix D Sections 4.1.6, 6.2,
8.1.1, 8.2, 9.1, 9.2, 9.4, 10.1, and 10.3 of the National Market
System Plan Governing the Consolidated Audit Trail, SEC Release No.
34-88393 (Mar. 17, 2020).
---------------------------------------------------------------------------

    This plan amendment ``minimizes the risk of theft of SSNs--the most
sensitive piece of PII--by allowing the elimination of SSNs from the
CAT, while still facilitating the creation of a reliable and accurate
Customer-ID.'' \32\ As discussed in detail by Charles River, and as the
Commission has recognized, the exemptive relief limiting customer
information to phonebook data (i.e., name, address, and birth year)
substantially minimizes the risk of a data breach involving sensitive
customer data.\33\ Due to this exemptive relief, the customer data
stored in the CAT is comparable to the data reported to other
regulatory reporting facilities, for which the Commission has
previously approved limitations of liability.
---------------------------------------------------------------------------

    \32\ Id. at 19.
    \33\ Id. at 20 (``Reduction of these additional sensitive PII
data elements in the CAT is expected to further reduce both the
attractiveness of the database as a target for hackers and reduce
the impact on retail investors in the event of an incident of
unauthorized access and use.''); Appendix B at 19, 21.
---------------------------------------------------------------------------

4. The Proposed Limitation of Liability Provisions Are Necessary To
Ensure the Financial Stability of the CAT
    Limiting CAT LLC's and the Participants' liability in the event of
a potential data breach is critical to ensuring a secure financial
foundation for the CAT. In approving the CAT NMS Plan, the Commission
mandated that the Operating Committee ``shall seek . . . to build
financial stability to support [CAT LLC] as a going concern.'' \34\ To
that end, CAT LLC has obtained the maximum extent of cyber-breach
insurance coverage available and has implemented a full cybersecurity
program to safeguard data stored in the CAT, as required by Rule 613
and the Plan. Nevertheless, considering the potential for substantial
losses that may result from certain categories of low probability
cyberbreaches,\35\ it is difficult to imagine how CAT LLC could ensure
its solvency--as required by the CAT NMS Plan--without limiting its
liability to Industry Members. Additionally, because the Commission has
approved joint funding of CAT LLC by Industry Members and the
Participants,\36\ the Limitation of Liability Provisions also protect
the financial industry (and, in turn, the investing public) from the
possibility of funding catastrophic losses.\37\
---------------------------------------------------------------------------

    \34\ CAT NMS Plan Sec.  11.2(f).
    \35\ See infra at 13; See generally Appendix B.
    \36\ See CAT NMS Plan at Sec. Sec.  11.1-11.2. The Commission
recently reiterated its support for the CAT NMS Plan's joint-funding
model, and explicitly rejected the industry's argument that the
Participants should not be permitted to recover fees, costs, and
expenses from Industry Members. See May 15, 2020 Amendments to the
National Market System Plan Governing the Consolidated Audit Trail,
SEC Release No. 34-88890; File No. S7-13-19, at 39-40.
    \37\ The CAT NMS Plan also mandates that the individual
Participants shall not have any liability for any debts,
liabilities, commitments, or any other obligations of CAT LLC or for
any losses of CAT LLC. See CAT NMS Plan Sec.  3.8(b). Accordingly,
the Commission has authorized the substance of the Limitation of
Liability Provisions as to self-regulatory organizations. Notably,
SIFMA and its constituent Industry Members did not object to this
provision of the CAT NMS Plan during the extensive notice and
comment period for the CAT NMS Plan.
---------------------------------------------------------------------------

5. An Economic Analysis Highlights the Importance of Limiting CAT LLC's
and the Participants' Liability
    CAT LLC retained Charles River to conduct an economic analysis of
liability issues in relation to a theoretical CAT data breach.\38\
There are two principal components to this analysis. First, Charles
River identified specific potential breach scenarios that could impact
the CAT, and quantified the likelihood and potential financial
magnitude of each scenario.\39\ Second, Charles River applied economic
principles regarding the costs and benefits of litigation to the
question of whether a limitation of liability should appropriately be
included in the Reporter Agreement.\40\
---------------------------------------------------------------------------

    \38\ In the Administrative Proceeding, SIFMA asserted that
``[t]he public has a significant interest in the allocation of risk
(and resulting incentives) relating to a potential CAT data breach
to ensure that data is not misused, misappropriated or lost.'' SIFMA
Br. at 15. The Participants agree and asked Charles River to
specifically assess whether a limitation of liability provision
properly incentivizes all economic actors to take appropriate
precautions against cyber incidents. See Appendix B at 1.
    \39\ Appendix B at Section II.
    \40\ Appendix B at Section III.
---------------------------------------------------------------------------

    Charles River's extensive economic analysis supports CAT LLC's and
the Participants' decision to limit their liability to Industry
Members. As

detailed in the Charles River white paper (the ``White Paper''),
society can create incentives for economic actors--in this case, CAT
LLC, the Participants, and FINRA CAT--to take precautions to minimize
the costs of accidents and misconduct. These incentives can take
various forms, including: (1) Enacting a regulatory regime that
dictates specific ex ante rules that individuals and entities must
follow, (2) asking courts to determine the appropriate standard of care
ex post through litigation, or (3) a combination of both the regulatory
and litigation approaches.\41\ From an economic perspective, the choice
between these methods is informed by the goal of maximizing social
welfare--i.e., ``the benefits [each] party derives from engaging in
their activities, less the sum of the costs of precautions, the harms
done, and the administrative expenses associated with the means of
social control.'' \42\ Charles River applied the well-settled body of
economic literature regarding the respective benefits and costs of
regulation and litigation, and concluded that allowing Industry Members
to litigate against CAT LLC, the Participants, and FINRA CAT would
provide minimal benefits while imposing substantial costs for all
participants in the U.S. securities markets, including the Commission,
Industry Members, the Participants, and the investing public. Under
these circumstances, the economic analysis weighs heavily against
permitting litigation and in favor of the Limitation of Liability
Provisions.\43\
---------------------------------------------------------------------------

    \41\ Appendix B at 3.
    \42\ Appendix B at 33 (citing Steven Shavell, ``Liability for
Harm Versus Regulation of Safety,'' The Journal of Legal Studies,
Vol. 13, No. 2 (June 1984), pp. 357-74).
    \43\ Appendix B at 53-54.
---------------------------------------------------------------------------

    As discussed in the White Paper, a critical component of potential
litigation benefits is the extent to which permitting Industry Members
to litigate against CAT LLC and the Participants would incentivize CAT
LLC and the Participants to appropriately invest in cybersecurity
precautions.\44\ Charles River addresses this question in the context
of an extensive regulatory regime that the Commission enacted to govern
CAT LLC's and the Plan Processor's cybersecurity policies, procedures,
systems, and controls.\45\ After reviewing those measures from an
economic perspective, Charles River concurs with the Commission's
assessment ``that the extensive, robust security requirements in the
adopted Plan . . . provide appropriate, adequate protection for the CAT
Data'' and concludes that private litigation would not result in
additional appropriate cybersecurity measures or produce other
benefits.\46\ In fact, as parties that use the CAT to carry out their
own regulatory functions, the Participants have a strong incentive
(beyond the obligation to comply with the Commission rules governing
the CAT) to ensure that the CAT is secure and operational.
---------------------------------------------------------------------------

    \44\ Appendix B at 38.
    \45\ Appendix B at 3.
    \46\ Order Approving the NMS Plan Governing the CAT, Section
V.F.4, p. 715; Appendix B at 3, 54.
---------------------------------------------------------------------------

    The Participants note that Charles River's analysis is borne out by
their extensive discussions with Industry Members regarding the
cybersecurity of the CAT and liability issues.\47\ During negotiations
with SIFMA prior to the launch of CAT reporting and the filing of the
Administrative Proceeding, the Participants repeatedly asked SIFMA to
identify specific deficiencies in the CAT's cybersecurity program.
SIFMA was unable to do so, which is not surprising in light of CAT's
robust cybersecurity.\48\ To the extent that Industry Members conclude
that CAT LLC should make adjustments to its policies, procedures,
systems, and controls, Industry Members (and other constituencies) have
extensive avenues to provide feedback including through the Advisory
Committee or by directly petitioning the Commission to amend the CAT
NMS Plan.\49\ Industry Members' inability to identify any meaningful
deficiencies underscores Charles River's conclusion that CAT LLC is
already properly incentivized to take necessary cyber precautions.
Allowing Industry Members to litigate against CAT LLC and the
Participants would not further improve the CAT's cybersecurity or
produce any other programmatic benefits.\50\
---------------------------------------------------------------------------

    \47\ As part of the Participants' efforts to give SIFMA and its
members further comfort as to the security of the CAT system, and as
suggested by the Commission, the Participants have offered to
facilitate a meeting with security officials from the SROs and the
Industry Members to discuss the CAT's extensive cybersecurity and
respond to questions that might constructively address SIFMA's
concerns. The Participants remain willing to facilitate this meeting
and look forward to opportunities to foster an open dialogue
regarding security issues with Industry Members.
    \48\ See, e.g., CAT NMS Plan, Section 6.6 (noting requirement
that CAT LLC evaluate its information security program ``to ensure
that the program is consistent with the highest industry standards
for the protection of data'').
    \49\ As Charles River highlights, the sufficiency of the
regulatory regime here is underscored by the ability of the
Commission--whether in response to concerns from Industry Members or
on its own initiative--to revise the applicable rules to impose
additional cybersecurity measures on CAT LLC, the Plan Processor,
and the Participants. See Appendix B at 43. The Commission has not
hesitated to propose revisions when necessary, including, most
recently in August 2020. See SEC Release No. 34-89632; File No. S7-
10-20, Proposed Amendments to the National Market System Plan
Governing the Consolidated Audit Trail to Enhance Data Security
(Aug. 21, 2020).
    \50\ Appendix B at 54.
---------------------------------------------------------------------------

    Charles River's analysis also highlights that, as heavily regulated
entities, CAT LLC and the Participants have a strong incentive to
comply with the Commission's rules--i.e., another advantage of the ex-
ante regulatory regime already in place.\51\ Moreover, as Charles River
notes, regulatory systems are particularly appropriate where, as here,
the regulator (i.e., the Commission) is enacting rules that are
designed to govern one entity (i.e., CAT LLC).\52\ As a result, ``the
regulatory system is tailored specifically on an ex-ante basis with
rules targeted to this particular firm.'' \53\ As part of the
regulatory regime, CAT LLC's cybersecurity policies, procedures,
systems, and controls are subject to examination by the Office of
Compliance Inspections and Examinations (on both a for-cause and
cyclical basis).\54\ And any cybersecurity deficiencies could, of
course, be referred to the Division of Enforcement for an investigation
and potential enforcement action.\55\ As Charles River notes, this
regulatory enforcement structure creates strong incentives for CAT LLC
and the Participants to comply with the Commission's extensive cyber
regulatory regime.\56\
---------------------------------------------------------------------------

    \51\ Appendix B at 39. It is also worth noting that the
Commission has recently reiterated that ``[t]he security and
confidentiality of CAT Data has been--and continues to be--a top
priority of the Commission.'' SEC Release No. 34-89632; File No. S7-
10-20, Proposed Amendments to the National Market System Plan
Governing the Consolidated Audit Trail to Enhance Data Security
(Aug. 21, 2020), at 9.
    \52\ Appendix B at 3-4, 43.
    \53\ Appendix B at 43.
    \54\ Appendix B at 43.
    \55\ Appendix B at 3, 37.
    \56\ Appendix B at 3-4, 43.
---------------------------------------------------------------------------

    In assessing the value of permitting Industry Members to sue CAT
LLC and the Participants, an economic analysis also must consider the
costs of litigation. Charles River's White Paper addresses this
question and concludes that the costs of litigating a potential CAT
data breach are likely to be both substantial and unquantifiable on an
ex-ante basis.\57\ Charles River also has identified ``several marginal
operating costs'' that would result from eliminating a limitation of
liability even in the absence of actual litigation, including costs
associated with ``extra-marginal defensive investments in cyber risk
protection, with reduced efficacy of the CAT system due to excess,
litigation-driven security measures, or a cash build-up scheme that
would be

borne by the Participants/SROs and Industry Members who would
ultimately pass those higher costs on to their customers, employees or
owners.'' \58\ Critically, these added costs--whether resulting from
litigation, investment in cybersecurity beyond optimal levels, or any
other source--ultimately would be passed along to investors (including
retail investors). These added costs will ``likely lead[ ] to reduced
trading levels, reduced participation in markets by investors, or
increased costs of raising capital.'' \59\ The White Paper also
explains that excess cybersecurity measures driven by third-party
litigation risk could reduce the CAT's effectiveness in serving the
Commission's and the SROs' regulatory missions, and likewise could
result in court-ordered security measures that conflict or interfere
with the security regime adopted by the Commission.\60\ The combination
here of no articulable benefit of allowing litigation coupled with
costs that are potentially ``substantial'' and ``unquantifiable''
present the quintessential economic case in favor of a limitation of
liability.
---------------------------------------------------------------------------

    \57\ Appendix B at 46.
    \58\ Appendix B at 46.
    \59\ Appendix B at 47. The Commission has a statutory obligation
to consider efficiency, competition, and effects on capital
formation when engaging in rulemaking. See 15 U.S.C. 77b(b); 15
U.S.C. 78c(f); 15 U.S.C. 80a-2(c).
    \60\ Appendix B at 45.
---------------------------------------------------------------------------

    Charles River's analysis of potential breach scenarios further
supports the need for CAT LLC, the Participants, and FINRA CAT to limit
their liability to Industry Members. Charles River identified eight
potential scenarios in which a bad actor could unlawfully obtain,
utilize, and monetize CAT data.\61\ The analysis indicates that, in
light of the CAT's extensive cybersecurity (among other reasons), most
potential breaches are relatively low-frequency events because they are
either difficult to implement, unlikely to be meaningfully profitable,
or both.\62\ Charles River's review supports the Commission's
conclusion that CAT LLC's cybersecurity program provides ``appropriate,
adequate protection for the CAT Data.'' \63\ The Participants know of
no valid basis for challenging that Commission finding.
---------------------------------------------------------------------------

    \61\ Appendix B at 2, 18-32.
    \62\ Appendix B at 18-32.
    \63\ Order Approving the NMS Plan Governing the CAT, Section
V.F.4, p. 715.
---------------------------------------------------------------------------

    During the negotiations prior to the Administrative Proceeding,
SIFMA focused extensively on the possibility of a hacker reverse
engineering certain Industry Members' proprietary trading strategies.
In that regard, Charles River's scenario analysis indicates that
reverse engineering of trading algorithms--and two other potential
breach scenarios--could result in ``extremely'' severe economic
consequences (i.e., potentially greater than $100 million in
damages).\64\ In light of CAT LLC's cybersecurity and the attendant
difficulties that a bad actor would face in monetizing these scenarios,
Charles River concluded that all three of these potential categories of
breaches (including reverse engineering of trading algorithms) are
relatively low-frequency events.\65\
---------------------------------------------------------------------------

    \64\ Appendix B at 2.
    \65\ Appendix B at 25. As Charles River explains, while ``[w]e
ultimately deem it unlikely that a bad actor would seek to use CAT
data in this way because of the difficulty in both achieving the
hack as well as the effort to reverse engineer an algorithm, . . .
[g]iven the potential value (severity) of this type of information,
however, bad actors could be so motivated.''
---------------------------------------------------------------------------

    Even if these low probability scenarios occurred, there is no
economic basis for shifting liability for potential catastrophic losses
to CAT LLC or the Participants.\66\ Indeed, if CAT LLC or the
Participants could be required to fund such substantial losses, it
would need to be reflected in the funding structure for the CAT, and
the portion of the losses that is funded by the Participants would
effectively be passed on to all market participants, including retail
investors. Shifting liability to CAT LLC or the Participants is
fundamentally inconsistent with the Commission's longstanding views on
allocation of liability between self-regulatory organizations and
Industry Members memorialized in the Commission-approved rules of every
securities exchange, and in agreements for NMS facilities, as well as
regulatory reporting facilities.\67\
---------------------------------------------------------------------------

    \66\ Appendix B at 50.
    \67\ See supra at Section A3.
---------------------------------------------------------------------------

B. Governing or Constituent Documents

    Not applicable.

C. Implementation of Amendment

    The Participants propose to implement the Limitation of Liability
Provisions by requiring all CAT Reporters and CAT Reporting Agents to
execute revised agreements that contain the amended provisions.

D. Development and Implementation Phases

    The Participants propose to require CAT Reporters and CAT Reporting
Agents to execute the revised agreements upon Commission approval of
this Proposed Amendment.

E. Analysis of Impact on Competition

    The Participants do not believe the Proposed Amendment will have
any impact on competition. The Proposed Amendment would require all CAT
Reporters and CAT Reporting Agents to execute revised agreements that
contain the amended provisions. Adopting the Proposed Amendment would,
however, avoid the increased costs that would otherwise arise, and
therefore would promote efficiency and capital formation in the U.S.
securities markets. Indeed, the White Paper provides an extensive
analysis indicating that the Proposed Amendment is the most efficient
manner of addressing the allocation of liability in the event of a CAT
data breach, and that other approaches (such as allowing third-party
litigation) would generate few, if any, benefits while imposing
significant costs.\68\
---------------------------------------------------------------------------

    \68\ See Appendix B at Sections III(A)-(D).
---------------------------------------------------------------------------

F. Written Understanding or Agreements Relating to Interpretation of,
or Participation in, Plan

    Not applicable.

G. Approval by Plan Sponsors in Accordance With Plan

    Section 12.3 of the CAT NMS Plan states that, subject to certain
exceptions, the Plan may be amended from time to time only by a written
amendment, authorized by the affirmative vote of not less than two-
thirds of all of the Participants, that has been approved by the SEC
pursuant to Rule 608 or has otherwise become effective under Rule 608.
The Participants, by a vote of the Operating Committee taken on
December 15, 2020 have authorized the filing of this Proposed Amendment
with the SEC in accordance with the Plan.\69\
---------------------------------------------------------------------------

    \69\ The Participants remain willing to work with SIFMA in good
faith to resolve any remaining differing perspectives on liability.
Although we believe that the Limitation of Liability Provisions in
Appendix A are appropriate, we look forward to constructively
engaging with SIFMA during the comment process to address any
concerns that Industry Members may have.
---------------------------------------------------------------------------

H. Description of Operation of Facility Contemplated by the Proposed
Amendment and Any Fees or Charges in Connection Thereto

    Not applicable.

I. Terms and Conditions of Access

    Any CAT Reporter or CAT Reporting Agent that fails to execute a
revised agreement with the Limitation of Liability Provisions will not
be permitted to transmit data to the CAT. Pursuant to the court's
decision in NASDAQ Stock Market, LLC v. SEC, 961 F.3d 421 (D.C. Cir.
2020), this restriction will not constitute a denial of access to
services within the meaning of Section 19(d) of the Exchange Act.

J. Method and Frequency of Processor Evaluation

    Not applicable.

K. Dispute Resolution

    Not applicable.

III. Solicitation of Comments

    Interested persons are invited to submit written data, views and
arguments concerning the foregoing, including whether the amendment is
consistent with the Exchange Act. Comments may be submitted by any of
the following methods:

Electronic Comments

     Use the Commission's internet comment form (http://www.sec.gov/rules/sro.shtml); or
     Send an email to<EMAIL_ADDRESS>Please include
File Number 4-698 on the subject line.

Paper Comments

     Send paper comments to Secretary, Securities and Exchange
Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number 4-698. This file number
should be included on the subject line if email is used. To help the
Commission process and review your comments more efficiently, please
use only one method. The Commission will post all comments on the
Commission's internet website (http://www.sec.gov/rules/sro.shtml).
Copies of the submission, all subsequent amendments, all written
statements with respect to the proposed plan amendment that are filed
with the Commission, and all written communications relating to the
amendment between the Commission and any person, other than those that
may be withheld from the public in accordance with the provisions of 5
U.S.C. 552, will be available for website viewing and printing in the
Commission's Public Reference Room, 100 F Street NE, Washington, DC
20549, on official business days between the hours of 10:00 a.m. and
3:00 p.m. Copies of such filing also will be available for inspection
and copying at the Participants' offices. All comments received will be
posted without change. Persons submitting comments are cautioned that
we do not redact or edit personal identifying information from comment
submissions. You should submit only information that you wish to make
available publicly. All submissions should refer to File Number 4-698
and should be submitted on or before January 27, 2021.

    For the Commission, by the Division of Trading and Markets,
pursuant to delegated authority.\70\
---------------------------------------------------------------------------

    \70\ 17 CFR 200.30-3(a)(85).
---------------------------------------------------------------------------

J. Matthew DeLesDernier,
Assistant Secretary.

APPENDIX A

Limited Liability Company Agreement of Consolidated Audit Trail, LLC

* * * * *

Article XII

[proposed additions]

* * * * *
    Section 12.15. Limitation of Liability. Each CAT Reporter shall
be required to execute an amended Consolidated Audit Trail Reporter
Agreement containing, in substance, the limitation of liability
provisions in Appendix E to this Agreement. Each Person engaged by a
CAT Reporter to report CAT Data to the Central Repository on behalf
of such CAT Reporter shall be required to execute an amended
Consolidated Audit Trail Reporting Agent Agreement containing, in
substance, the limitation of liability provisions in Appendix F to
this Agreement. The Operating Committee shall have authority in its
sole discretion to make non-substantive amendments to the limitation
of liability provisions in the Consolidated Audit Trail Reporter
Agreement and the Consolidated Audit Trail Reporting Agent
Agreement.
* * * * *

Appendix E

[proposed additions]

* * * * *

Limitation of Liability Provisions in the CAT Reporter Agreement

    5.4. Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN SECTION 5.1 OF
THIS AGREEMENT, CATLLC MAKES NO REPRESENTATIONS OR WARRANTIES, ORAL
OR WRITTEN, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, QUALITY, FITNESS FOR A PARTICULAR PURPOSE,
COMPLIANCE WITH APPLICABLE LAWS, NON-INFRINGEMENT OR TITLE,
SEQUENCING, TIMELINESS, ACCURACY OR COMPLETENESS OF INFORMATION, OR
THOSE ARISING BY STATUTE OR OTHERWISE IN LAW, OR FROM A COURSE OF
DEALING OR USAGE OF TRADE, REGARDING THE CAT SYSTEM OR ANY OTHER
MATTER PERTAINING TO THIS AGREEMENT. CAT REPORTER ACCEPTS SOLE
RESPONSIBILITY FOR ITS ACCESS TO AND USE OF THE CAT SYSTEM.
    5.5. Limitation of Liability. TO THE EXTENT PERMITTED BY LAW,
UNDER NO CIRCUMSTANCES SHALL THE TOTAL LIABILITY OF CATLLC OR ANY OF
ITS REPRESENTATIVES TO CAT REPORTER UNDER THIS AGREEMENT FOR ANY
CALENDAR YEAR EXCEED THE LESSER OF THE TOTAL OF THE FEES ACTUALLY
PAID BY CAT REPORTER TO CATLLC FOR THE CALENDAR YEAR IN WHICH THE
CLAIM AROSE OR FIVE HUNDRED DOLLARS ($500.00). FOR AVOIDANCE OF
DOUBT, THE TERM ``REPRESENTATIVES'' IN SECTION 5 AND THROUGHOUT THIS
AGREEMENT SHALL INCLUDE EACH OF THE PARTICIPANTS, THE PLAN PROCESSOR
AND ANY OTHER SUBCONTRACTORS OF THE PLAN PROCESSOR OR CATLLC
PROVIDING SOFTWARE OR SERVICES IN CONNECTION WITH THE CAT SYSTEM,
AND ANY OF THEIR RESPECTIVE AFFILIATES AND ALL OF THEIR DIRECTORS,
MANAGERS, OFFICERS, EMPLOYEES, CONTRACTORS, SUBCONTRACTORS, ADVISORS
AND AGENTS.
    5.6. Damage Exclusion. TO THE EXTENT PERMITTED BY LAW, UNDER NO
CIRCUMSTANCES SHALL CATLLC OR ANY OF ITS REPRESENTATIVES BE LIABLE
TO CAT REPORTER OR ANY OTHER PERSON FOR LOST REVENUES, LOST PROFITS,
LOSS OF BUSINESS, OR ANY INCIDENTAL, CONSEQUENTIAL, SPECIAL,
EXEMPLARY, PUNITIVE OR OTHER DIRECT OR INDIRECT DAMAGES OF ANY KIND
OR NATURE, INCLUDING, SUCH DAMAGES ARISING FROM ANY BREACH OF THIS
AGREEMENT, OR ANY TERMINATION OF THIS AGREEMENT, WHETHER SUCH
LIABILITY IS ASSERTED ON THE BASIS OF CONTRACT, TORT OR OTHERWISE,
WHETHER OR NOT FORESEEABLE, EVEN IF CAT REPORTER OR ANY OTHER PERSON
HAS BEEN ADVISED OR WAS AWARE OF THE POSSIBILITY OF SUCH LOSS OR
DAMAGES.
    5.7. Data Exclusion. TO THE EXTENT PERMITTED BY LAW, UNDER NO
CIRCUMSTANCES SHALL CATLLC OR ANY OF ITS REPRESENTATIVES BE LIABLE
FOR ANY INCONVENIENCE CAUSED BY THE LOSS OF ANY DATA, FOR THE LOSS
OR CORRUPTION OF ANY CAT REPORTER DATA OR FOR ANY DELAYS OR
INTERRUPTIONS IN THE OPERATION OF THE CAT SYSTEM FROM ANY CAUSE.
* * * * *

Appendix F

[proposed additions]

* * * * *

Limitation of Liability Provisions in the CAT Reporting Agent Agreement

    5.4 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN SECTION 5.1 OF
THIS AGREEMENT, CATLLC MAKES NO REPRESENTATIONS OR WARRANTIES, ORAL
OR WRITTEN, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, QUALITY, FITNESS FOR A PARTICULAR PURPOSE,
COMPLIANCE WITH APPLICABLE LAWS, NON-INFRINGEMENT OR TITLE,
SEQUENCING, TIMELINESS, ACCURACY OR COMPLETENESS OF INFORMATION, OR
THOSE ARISING BY STATUTE OR OTHERWISE IN LAW, OR FROM A COURSE OF
DEALING OR USAGE OF TRADE, REGARDING THE CAT SYSTEM OR ANY OTHER
MATTER PERTAINING TO THIS AGREEMENT. CAT REPORTING AGENT ACCEPTS
SOLE RESPONSIBILITY FOR ITS ACCESS TO AND USE OF THE CAT SYSTEM.

    5.5 Limitation of Liability. TO THE EXTENT PERMITTED BY LAW,
UNDER NO CIRCUMSTANCES SHALL THE TOTAL LIABILITY OF CATLLC OR ANY OF
ITS REPRESENTATIVES TO CAT REPORTING AGENT UNDER THIS AGREEMENT FOR
ANY CALENDAR YEAR EXCEED THE LESSER OF THE TOTAL OF THE FEES
ACTUALLY PAID TO CATLLC BY THE CAT REPORTER THAT ENGAGED CAT
REPORTING AGENT FOR THE CALENDAR YEAR IN WHICH THE CLAIM AROSE OR
FIVE HUNDRED DOLLARS ($500.00). FOR AVOIDANCE OF DOUBT, THE TERM
``REPRESENTATIVES'' IN SECTION 5 AND THROUGHOUT THIS AGREEMENT SHALL
INCLUDE EACH OF THE PARTICIPANTS, THE PLAN PROCESSOR AND ANY OTHER
SUBCONTRACTORS OF THE PLAN PROCESSOR OR CATLLC PROVIDING SOFTWARE OR
SERVICES IN CONNECTION WITH THE CAT SYSTEM, AND ANY OF THEIR
RESPECTIVE AFFILIATES AND ALL OF THEIR DIRECTORS, MANAGERS,
OFFICERS, EMPLOYEES, CONTRACTORS, SUBCONTRACTORS, ADVISORS AND
AGENTS.
    5.6 Damage Exclusion. TO THE EXTENT PERMITTED BY LAW, UNDER NO
CIRCUMSTANCES SHALL CATLLC OR ANY OF ITS REPRESENTATIVES BE LIABLE
TO CAT REPORTING AGENT OR ANY OTHER PERSON FOR LOST REVENUES, LOST
PROFITS, LOSS OF BUSINESS, OR ANY INCIDENTAL, CONSEQUENTIAL,
SPECIAL, EXEMPLARY, PUNITIVE OR OTHER DIRECT OR INDIRECT DAMAGES OF
ANY KIND OR NATURE, INCLUDING, SUCH DAMAGES ARISING FROM ANY BREACH
OF THIS AGREEMENT, OR ANY TERMINATION OF THIS AGREEMENT, WHETHER
SUCH LIABILITY IS ASSERTED ON THE BASIS OF CONTRACT, TORT OR
OTHERWISE, WHETHER OR NOT FORESEEABLE, EVEN IF CAT REPORTING AGENT
OR ANY OTHER PERSON HAS BEEN ADVISED OR WAS AWARE OF THE POSSIBILITY
OF SUCH LOSS OR DAMAGES.
    5.7 Data Exclusion. TO THE EXTENT PERMITTED BY LAW, UNDER NO
CIRCUMSTANCES SHALL CATLLC OR ANY OF ITS REPRESENTATIVES BE LIABLE
FOR ANY INCONVENIENCE CAUSED BY THE LOSS OF ANY DATA, FOR THE LOSS
OR CORRUPTION OF ANY DATA SUBMITTED BY CAT REPORTING AGENT OR FOR
ANY DELAYS OR INTERRUPTIONS IN THE OPERATION OF THE CAT SYSTEM FROM
ANY CAUSE.
* * * * *

Appendix B

White Paper: Analysis of Economic Issues Attending the Cyber Security
of the Consolidated Audit Trail

Date: December 18, 2020

Table of Contents

I. Introduction
II. Cyber Security Risk Analysis
    A. Overall Cost of Cybercrime
    B. Parties Harmed by Cybercrime
    C. Types of Bad Actors, Motivations, and Methods
    D. Cyber Breaches Relevant to CAT, LLC Including Frequency,
Severity, and Relative Difficulty of Implementation
    1. Summary Level Data
    2. Breach Data Specifically Relevant to CAT, LLC
    E. Summary
III. Economic and Public Policy Analysis of Cyber Security for CAT
LLC
    A. The Choice Between Regulation and Litigation
    B. Economic Determinants of the Relative Attractiveness of
Regulation or Litigation To Control Risk
    C. Special Considerations Arising for the CAT's Cyber Security
    D. Assessment of Regulation and Litigation Approaches as Applied
to a Potential CAT LLC Cyber Breach
    1. Recapitulation of CAT's Risks, Standards, Policies, and
Practices
    2. Alignment of Incentives
    3. Additional Costs of Litigation
    4. Examples of Existing Limitation on Liability Provisions
    E. Initial Thoughts on Funding Compensation Mechanisms
IV. Conclusion
V. Qualifications of Authors/Investigators
VI. Research Program and Bibliography

I. Introduction

    Charles River Associates (``CRA'') \1\ has been asked by a group
of national securities exchanges \2\ and the Financial Industry
Regulatory Authority, Inc. (``FINRA'') (collectively
``Participants'' or ``SROs'') to assess the economic aspects of a
potential cyber breach as a result of the operation of the
Consolidated Audit Trail (``CAT''). The CAT is being implemented by
the Participants in response to Rule 613, which the SEC adopted in
2012. Rule 613 was adopted to improve the regulation of U.S. equity
and option markets by requiring the collection, storage, and access
to a wide range of equity and option transactions and orders. The
CAT exists so that the SEC and the SROs can more effectively monitor
and regulate the subject securities markets to improve their
transparency, robustness, and efficiency for the benefit of the
investing public and capital markets as a whole.
---------------------------------------------------------------------------

    \1\ The identification and qualifications of CRA's authors/
principal investigators for this White Paper are presented in
Section V below.
    \2\ As of January 2020, these consisted of: (1) BOX Exchange
LLC, (2) Cboe BYX Exchange, Inc., (3) Cboe BZX Exchange, Inc., (4)
Cboe EDGA Exchange, Inc., (5) Cboe EDGX Exchange, Inc., (6) Cboe C2
Exchange, Inc., (7) Cboe Exchange, Inc., (8) Investors Exchange LLC,
(9) Long Term Stock Exchange, Inc., (10) Miami International
Securities Exchange LLC, (11) MIAX Emerald, LLC, (12) MIAX PEARL,
LLC, (13) NASDAQ BX, Inc., (14) Nasdaq GEMX, LLC, (15) Nasdaq ISE,
LLC, (16) Nasdaq MRX, LLC, (17) NASDAQ PHLX LLC, (18) The NASDAQ
Stock Market LLC, (19) New York Stock Exchange LLC, (20) NYSE
American LLC, (21) NYSE Arca, Inc., (22) NYSE Chicago, Inc., and
(23) NYSE National, Inc. In addition, a new member-owned equities
trading platform, Members Exchange (``MEMX LLC'') launched in
September 2020. These entities plus FINRA have been designated as
``Participants'' of the CAT NMS Plan and are self-regulatory
organizations (``SROs'') under the Securities Exchange Act of 1934.
See Securities and Exchange Commission, Order Granting Conditional
Exemptive Relief, Pursuant to Section 36 and Rule 608(e) of the
Securities Exchange Act of 1934, from Section 6.4(d)(ii)(C) and
Appendix D Sections 4.1.6, 6.2, 8.1.1, 8.2, 9.1, 9.2, 9.4, 10.1, and
10.3 of the National Market System Plan Governing the Consolidated
Audit Trail, Release No. 34-88393, March 17, 2020, p. 1, hereafter
``SEC, March 17, 2020 Order.''
---------------------------------------------------------------------------

    The Participants and the securities industry agree that the CAT
database contains sensitive information and the SEC has mandated
extensive security requirements be implemented to protect the data
from a wide range of cyber breaches. After considering the overall
costs and benefits of the CAT, the SEC already has concluded that
the cyber security requirements it imposed on the CAT sufficiently
serve the public interest.\3\
---------------------------------------------------------------------------

    \3\ Securities and Exchange Commission, Joint Industry Plan;
Order Approving the National Market System Plan Governing the
Consolidated Audit Trail, Release No. 34-79318, November 15, 2016,
hereafter ``SEC, Order Approving CAT,'' Section IV. Discussion and
Commission Findings, pp. 126-127.
---------------------------------------------------------------------------

    The analyses presented in this paper support the Participants'
proposal to adopt a limitation of liability provision in the CAT
Reporter Agreement. Based on (1) an examination of specific
potential breach scenarios and (2) a consideration of the economic
and public policy elements of various regulatory and litigation
approaches to mitigate cyber risk for the CAT, this paper concludes
that a limitation on liability provision would serve the public
interest in several ways. First, such a provision would facilitate
the regulation of the U.S. equity and option markets at lower
overall costs and higher economic efficacy than other approaches,
such as allowing Industry Members \4\ to litigate against CAT LLC.
Second, the proposed limitation on liability would not undermine CAT
LLC's existing and significant incentives to protect the data stored
in the CAT system.
---------------------------------------------------------------------------

    \4\ ``Industry Member'' is defined as, ``a member of a national
securities exchange or a member of a national securities
association'' in the ``Limited Liability Company Agreement of CAT
NMS, LLC,'' p.5. The Securities Industry and Financial Markets
Association (``SIFMA'') has represented their interests in this SEC
rule-making endeavor.
---------------------------------------------------------------------------

    Summary: Cyber Breach Analysis. The first analysis we present is
to identify specific potential breach scenarios and assess the
relative difficulty of implementation, relative frequency, and
conditional severity of each. As part of this assessment, we
identified eight potential scenarios in which bad actors could
attempt to unlawfully obtain, utilize, and monetize CAT data. Of
course, we recognize that cyber-attacks on the CAT could vary from
the scenarios we hypothesize, but we offer them to provide a
framework to assess the economic exposures that flow from the
gathering, storage, and use of CAT data. Our risk analysis indicates
that most of these scenarios are relatively low frequency events
because they are either difficult to implement, unlikely to be
meaningfully profitable for a bad actor, or both.
    The scenario analysis also indicates that three types of
breaches--reverse engineering of trading algorithms, inserting fake
data to

wrongfully incriminate individuals or entities, and removing data to
conceal misconduct--could result in ``extremely'' severe economic
consequences (which we define as potentially greater than $100
million in damages). We conclude that all three of these types of
breaches are relatively low frequency events.
    Summary: Regulation vs. Litigation to Mitigate Cyber Risk for
the CAT. The second analysis we present focuses on whether the cyber
risk posed by CAT should be addressed through ex-ante regulation, ex
post litigation, or a combination of both approaches. In a prior
version of the CAT Reporter Agreement, CAT LLC included a limitation
of liability provision, which memorialized the Participants' view
that Industry Members should not be able to litigate against CAT LLC
or the Participants to recover damages sustained as a result of a
cyber breach. Although the current operative version of the Reporter
Agreement does not contain a limitation of liability, we understand
that CAT LLC is submitting this White Paper in connection with CAT
LLC's request that the SEC amend the CAT NMS Plan to authorize such
a provision. We understand that the Industry Members have opposed
any limitation of liability provision and contend that CAT LLC, as
the party holding the CAT data, should be subject to litigation by
the Industry Members in the event of a cyber breach.
    In deciding whether to approve Participants' proposed plan
amendment, an important question for the SEC to address is whether,
in light of the extensive cyber requirements already imposed on CAT
LLC through regulation, the SEC-mandated nature of the CAT, and the
ability of the SEC to bring enforcement actions to compel
compliance, it is appropriate to also allow Industry Members to sue
CAT LLC and the Participants. As part of our analysis, we
specifically assess whether including a limitation of liability
provision in the CAT Reporter Agreement is appropriate from the
perspective of economic theory as applied to the specifics of this
situation.
    By applying the economic principles of liability and regulation
as a means of motivating risk-minimizing behavior and considering
the crucial role of the SEC's mandates regarding cyber security for
the CAT (which already incorporate the concerns of entities involved
in the National Market System as a whole), we conclude that the
regulatory approach leads to the socially desirable level of
investment in cyber security and protection of CAT data. We further
conclude that SIFMA's position, which advocates allowing Industry
Members to litigate against CAT LLC and the Participants in the
event of a cyber breach, would result in increased costs for various
economic actors--including CAT LLC, the Participants, Industry
Members, and retail investors--without any meaningful benefit to the
CAT's cyber security. At a high level (and as discussed in extensive
detail below), we therefore conclude that CAT LLC's proposal to
limit its liability and the liability of the Participants is well
supported by applicable economic principles in the framework of the
SEC's mission and its mandates regarding the CAT.
    As a general matter, economic theory provides that society can
motivate economic actors to take appropriate precautions to minimize
the likelihood and consequences of accidents and misconduct through:
(a) A regulatory approach (i.e., dictating specific precautions,
requirements, and standards in advance), (b) a litigation approach
(i.e., civil liability for damages caused by failing to adhere to a
general standard of care), or (c) a combination of (a) and (b). At
the outset, we note that we do not address this question in a
vacuum. Rather, we conduct our examination in the context of an
extensive regulatory program that the SEC has enacted mandating
specific cyber standards, policies, procedures, systems, and
controls that CAT LLC and the Plan Processor must implement. This
regulatory regime was developed with extensive feedback from the
securities industry (e.g., through the Development Advisory Group
and the Advisory Committee) and is subject to ongoing review and
modification through a public review and comment process. Moreover,
CAT LLC's compliance with the requirements of this regulatory regime
can be policed by the SEC's Enforcement Division. We also note that
in adopting the CAT NMS Plan, the SEC concluded that the regulatory
approach to cyber security was sufficient when it stated that ``the
extensive, robust security requirements in the adopted [CAT NMS]
Plan . . . provide appropriate, adequate protection for the CAT
Data.'' \5\
---------------------------------------------------------------------------

    \5\ SEC, Order Approving CAT, Section V.F.4. Economic Analysis,
Expected Costs of Security Breaches, p. 715.
---------------------------------------------------------------------------

    In light of this existing regulatory regime, the relevant
question is whether the benefits of allowing Industry Members to
litigate against their regulators in the event of a CAT data breach
outweigh the costs. An application of economic principles indicates
that they do not. As heavily regulated entities, the Participants
are obligated to comply with all SEC requirements and maintain an
effective cyber security program. And to the extent that CAT LLC and
the Participants fail to comply with the SEC's regulatory regime,
the SEC could compel compliance by bringing enforcement actions.
Moreover, regulatory systems are particularly appropriate where, as
here, the regulator (i.e., the Commission) is enacting rules that
are designed to govern one entity (i.e., CAT LLC). Further, the
SEC's regulatory process for the CAT permits parties affected by the
operation of the CAT to stay informed of the operation of the CAT's
cyber risk program and to advocate for and incorporate any broader
security concerns that may arise. Indeed, there already exist
examples where Industry Members have exercised these rights and
successfully sought changes in the CAT's cyber security program.
Under these circumstances, allowing Industry Members to further
litigate against the Participants for damages resulting from cyber
breaches would not better align the incentives or meaningfully
increase the motivation of CAT LLC, the Plan Processor, or the
Participants to pursue additional economically appropriate measures
to reduce the frequency and severity of cyber breaches. Allowing
these lawsuits would, however, increase costs to the Participants
and Industry Members, much of which would be passed on to underlying
investors. Where, as here, the costs of adding a litigation regime
to an existing regulatory regime are high, and the expected benefits
are low, there is no economic justification for allowing additional
litigation.
    It is also important to note that the CAT has no paying
customers and is fully funded by Participants and Industry Members
who, ultimately, pass those costs on to the investing public. CAT
LLC's funding is designed to cover costs only, and its balance sheet
is not intended to develop and hold assets available to compensate
Industry Members or others who may be harmed in the event of a cyber
breach.
    We conclude, therefore, that the risk presented by a cyber
breach of the CAT should be addressed through the regulatory
approach that the SEC has already adopted. The limitation of
liability provision in CAT LLC's proposed amended Reporter Agreement
is therefore appropriate. In this regard, we note that limitations
of liability are ubiquitous in the securities industry and have
effectively governed the economic relationships between the
Participants and Industry Members for decades. We also observe that
although SIFMA has objected to a limitation of liability on behalf
of Industry Members, Industry Members generally require their
respective customers--many of whom are retail investors--to agree to
analogous limitation of liability provisions.
    An unfortunate fact of the cyber world is that the best
standards, policies, and procedures all executed with perfection may
not thwart every conceivable breach attempt. A successful cyber-
attack on the CAT could result in injury to Industry Members. Even
in a purely regulated regime, it is appropriate to consider
mechanisms that provide compensation to parties injured by a cyber-
attack on the regulated activity. It is worth noting that CAT LLC
and the Plan Processer purchase insurance designed to provide
compensation to harmed parties, up to pre-defined economically
feasible limits. The cyber insurance program also provides the
benefit of engaging additional third parties (i.e., the insurance
carriers) who have incentives and abilities to monitor cyber
security hygiene at the CAT and the Plan Processor.
    CAT LLC, the Participants, and the SEC could consider additional
mechanisms beyond cyber insurance to compensate potentially harmed
parties, including mechanisms similar to those used by federal
vaccine programs or insolvency protections for pension funds or
financial institutions. However, a careful evaluation of the costs,
benefits, and incentives among the various parties associated with
the CAT would need to be conducted to ensure that any new
arrangement enhances economic welfare before any decision to further
extend the current compensation scheme (i.e., CAT LLC's insurance)
is made.
    Section II below examines a list of potential cyber threats,
identifies those that may apply to the CAT, and provides an initial
quantification of the harms that may

befall the CAT and others should a cyber threat be successful.
Section III addresses the economic theory behind liability
assignment and the roles that markets, contracts, litigation, and
regulation play. It highlights the duplicative and overall cost-
raising nature of the Industry Members' litigation proposal. It
explains how the SEC's regulatory approach along with the efforts of
the CAT, the Plan Processor, and the Advisory Committee, work to
align the incentives of the CAT and the Plan Processor to mitigate
the cyber risks and ensure the fairness of the Participants'
proposed limitation on liability. Section IV contains some
concluding comments. Section V presents the qualifications of the
authors/principal investigators of this White Paper. Section VI
summarizes the research undertaken for this White Paper and contains
the bibliography.

II. Cyber Security Risk Analysis

    In this section we discuss the economic risk associated with bad
actors wrongfully accessing the CAT system to monetize the data or
to disrupt market surveillance. The CAT will store massive
quantities of data that is unavailable anywhere else on a single
system, which as Commissioner Pierce recently recognized, will
``undoubtedly'' be a target for hackers.\6\ The CAT is the only data
repository that collects and holds Customer and Customer Account
Information \7\ along with all trading data from the participating
U.S. securities exchanges.\8\ The compromise of this data, as
discussed in further detail below, could harm broker/dealers, and
exchanges, or undermine investor confidence in the markets
themselves.
---------------------------------------------------------------------------

    \6\ Commissioner Pierce Statement on Proposed Amendments to the
National Market System Plan Governing the Consolidated Audit Trail
to Enhance Data Security, Aug. 21, 2020, https://www.sec.gov/news/public-statement/peirce-nms-cat-2020-08-21 accessed September 2020.
    \7\ The SEC proposes to ``delete the term ``PII'' from the CAT
NMS Plan and replace that term with ``Customer and Account
Attributes'' as that would more accurately describe the attributes
that must be reported to the CAT, now that ITINs/SSNs, dates of
birth and account numbers would no longer be required to be reported
to the CAT pursuant to the amendments being proposed by the
Commission.'' Additionally, the SEC proposes to delete the defined
term ``PII'' from the CAT NMS Plan given the reporting of the most
sensitive PII will no longer be required. The SEC proposes that
``Customer and Account Attributes'' refer collectively to all the
attributes in ``Customer Attributes'' and ``Account Attributes.''
The SEC proposes that ``Customer Attributes'' would include name,
address, year of birth, the individual's role in the account or if a
legal entity, the name, address, and Employer Identification Number
and Legal Entity Identifier. The SEC proposes that ``Account
Attributes'' would include account type, customer type, date account
opened, and large trader identifier (if applicable). Securities and
Exchange Commission, Amendments to the National Market System Plan
Governing the Consolidated Audit Trail to Enhance Data Security, RIN
3235-AM62, Release No. 34-89632, File No. S7-10-20, August 21, 2020,
pp. 103-106.
    \8\ See SEC website, ``Rule 613 (Consolidated Audit Trail),''
https://www.sec.gov/divisions/marketreg/rule613-info.htm accessed
September 2020.
---------------------------------------------------------------------------

    Given the importance of the CAT data, there are a variety of
cyber security breach scenarios that, hypothetically, could occur
and harm the CAT, the Plan Processor, the Participants, Industry
Members, the investing public, the SEC's ability to surveil activity
in the markets, and (conceivably) the functioning of U.S. securities
markets.
    Below, we posit a range of potential cyber risk scenarios
attendant to the CAT and derive estimated ranges of potential
financial consequences arising from these exposures. We recognize
cyber attacks on the CAT could vary from the scenarios we
hypothesize, but we offer them to provide a framework to assess the
economic exposures that flow from the gathering of a massive amount
of sensitive trading, financial, and identifying data. Some of the
scenarios present relatively small economic risk, while others
present significant risk in terms of both financial consequence and
the potential to undermine faith in the efficiency and fairness of
U.S. markets.
    Overall, this section is organized as follows:

A. Overall Cost of Cybercrime
B. Parties Harmed by Cybercrime
C. Types of Bad Actors, Motivations, and Methods
D. Cyber Breaches Relevant to CAT, LLC Including Relative Difficulty
of Implementation, Frequency and Severity
E. Summary

A. Overall Cost of Cybercrime

    ``Cybercrime is a growth industry'' and ``produces high returns
at low risk and (relatively) low cost for the hackers.'' \9\
---------------------------------------------------------------------------

    \9\ The Center for Strategic and International Studies, ``Net
Losses: Estimating the Global Cost of Cybercrime,'' June 2014, pp. 2
and 4.
---------------------------------------------------------------------------

    Estimates of the worldwide cost of cybercrime are in the
trillions of dollars per year and continuing to grow.
    (a) $3 trillion per year in 2015 and $6 trillion annually by
2021 according to Cybersecurity Ventures.\10\
---------------------------------------------------------------------------

    \10\ Cybersecurity Ventures, ``Global Cybercrime Damages
Predicted to Reach $6 Trillion Annually By 2021,'' Copyright 2020,
https://cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021/ accessed August 2020.
---------------------------------------------------------------------------

    (b) $3 trillion per year in 2019 to $5 trillion by 2024
according to Juniper Research.\11\
---------------------------------------------------------------------------

    \11\ Juniper Research, ``Business Losses to Cybercrime Data
Breaches to Exceed $5 Trillion By 2024,'' August 27, 2019, https://www.juniperresearch.com/press/press-releases/business-losses-cybercrime-data-breaches.
---------------------------------------------------------------------------

    In the United States, according to the Council of Economic
Advisers, malicious cybercrime cost the U.S. economy between $57
billion and $109 billion in 2016.\12\
---------------------------------------------------------------------------

    \12\ The Council of Economic Advisers, ``The Cost of Malicious
Cyber Activity to the U.S. Economy, February 2018, p. 1, https://www.whitehouse.gov/wp-content/uploads/2018/03/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf.
---------------------------------------------------------------------------

    The size of the premiums paid for cyber insurance also provides
a sense of the size of the cybercrime market. A recent report stated
that $4.85 billion in cyber risk premiums were paid in 2018 and
projected that figure to reach $28.6 billion by 2026.\13\ A recent
report from the A.M. Best insurance credit rating agency found that
``U.S. cyber insurance premiums grew again in 2019, up by 11% . .
.'' ``Cyber insurance premiums will likely continue to rise . . .
due to both rising claims costs and heightened risks . . . Over the
past three years the number of cyber claims has doubled to 18,000 in
2019, from 9,000 in 2017.'' \14\
---------------------------------------------------------------------------

    \13\ Allied Market Research website, Cyber Insurance Market by
Company Size and Industry Vertical: Global Opportunity Analysis and
Industry Forecast, 2019-2026, March 2020, https://www.alliedmarketresearch.com/cyber-insurance-market accessed August
2020.
    \14\ Erin Ayers, ``US cyber market keeps growing, but pace
slowed: AM Best,'' Advisen Front Page News, July 22, 2020 accessed
August 2020.
---------------------------------------------------------------------------

B. Parties Harmed by Cybercrime

    Generally, we think of parties harmed by cybercrime falling into
two groups. The first group are the parties whose system was
breached, and the second are the other parties affected by the
breach--the clients, customers, and vendors of the parties directly
suffering the breach.\15\ CAT LLC and the Plan Processor, FINRA CAT,
clearly fall in the first group as they collect and store the
information subject to cyber breach risk. It is their system that is
subject to the cyber risk. Industry Members (and their investor
clients) fall into the second group of affected parties as it is
information about them and their activities that is supplied to the
CAT.
---------------------------------------------------------------------------

    \15\ See, for example, Camico website, ``Understanding First-
Party and Third-Party Cyber Exposures,'' https://www.camico.com/blog/understanding-cyber-exposures accessed September 2020.
---------------------------------------------------------------------------

    But that simple delineation does not cover all significant
parties involved with supplying or accessing information from the
CAT. The SROs also provide information to the CAT (some of the same
information that is supplied by the Industry Members). As suppliers
of information to the CAT, the interests of the SROs in cyber
security at the CAT align with those of the Industry Members--a
successful breach would compromise information on the CAT no matter
if the original source were the Industry Members or the SROs. The
SROs also, however, own and (through the CAT LLC Operating
Committee) run the CAT. The SROs, therefore, face two risks arising
from a cyber breach at the CAT: (1) Directly from the breach of the
CAT as owners of CAT LLC; and (2) indirectly from the exposure of
information they supplied to the CAT (similar to the Industry
Members).
    The SEC is also a major user of the CAT in its efforts to
regulate U.S. equity and option markets. The SEC's access to and use
of CAT data is similar to that of the SROs and constitutes another
source of cyber risk to CAT LLC. While the SEC does not own or
directly operate the CAT, the CAT would not exist or operate absent
the SEC's regulatory authority and associated oversight. The CAT,
therefore, serves the regulatory needs of both the SROs and the SEC
with the same functionality. In other words, the SEC's access to the
CAT is every bit as broad as the SROs, who own and operate CAT LLC.
    In the context of the CAT, therefore, a simple delineation of
two types of affected parties is not adequate to describe and
understand the parties potentially affected by a cyber breach at the
CAT. In addition, there are some important atypical economic
relations and regulatory considerations that

affect the liability decisions associated with the CAT and its
operations.
    First, given that CAT and its activities are a regulatory
mandate of the SEC, standard liability and indemnity approaches
regarding the CAT's and the Plan Processor's scope and scale for
decision-making cannot be straightforwardly applied. The CAT and the
Plan Processor are substantially constrained in their cyber security
program by mandates from the SEC that, in turn, involve significant
input and advocacy on the part of other parties, including Industry
Members.
    Second, related parties include the Participants/SROs. While
these parties are legally distinct from CAT and the Plan Processor,
their involvement and economic linkage is substantial. For example,
the Participants have ownership interests in CAT LLC and the
Operating Committee of CAT LLC, on which the Participants are all
members, chooses the Plan Processor. In addition, operational
funding for the CAT (and therefore, the Plan Processor) comes
entirely from Participants and Industry Members. Although there are
regulatory users who access CAT, there are no ``customers'' for
CAT's services in a conventional sense.
    Third, CAT related decisions and actions of Industry Members are
also mandated by the SEC and constrained by the SEC's oversight.
There is a level of participation and information flow from and to
the Industry Members (and other potentially interested groups)
through the Advisory Committee, and previously the Development
Advisory Group, and an attendant ability to influence the business
operation and cyber security investments and practices that is not
typically found in conventional business relationships.
    The typical economic distinctions between harms to parties with
standard commercial relationships are much more amorphous with
respect to the parties involved in the CAT. Any comprehensive
analysis, therefore, requires careful distinctions and delineations
between standard commercial relationships and parties involved in
the CAT to understand the CAT's economic considerations of cyber
security.

C. Types of Bad Actors, Motivations, and Methods

    Cybercrimes are conducted by both internal and external threat
actors. According to a 2020 report by Verizon, approximately 70% of
breaches in 2019 were caused by external actors with the other 30%
being initiated by internal actors.\16\ The motivations of these
actors are often financial, but cyber breaches also happen for
ideological or personal reasons. Nation-states, for example, have
used cyber breaches to advance regime goals (often focusing on
impeding the efforts of their geopolitical rivals) and obtaining
information that might benefit them politically or economically.\17\
Cybercriminals steal information to sell or extort payments from
their targets. ``Hacktivists'' want to cause mayhem and influence
the public. Sometimes, individuals are out for revenge against an
entity or just want the bragging rights associated with a
particularly brazen attack. At times, the malicious actors have
multiple motivations--for example, ideology or revenge and financial
remuneration. The 2020 Verizon report estimated that 90% of cyber
breaches were motivated by financial considerations and 10% were
initiated for espionage.\18\ The bad actors were 55% organized
crime, with the next highest type being nation-state or state-
affiliated actors at around 10%. System administrators and end-users
also comprised around 10% each of the bad actors.\19\
---------------------------------------------------------------------------

    \16\ Verizon, 2020 Data Breach Investigations Report, p. 10,
Figure 7.
    \17\ See ScienceDirect website, ``Hacktivists,'' https://www.sciencedirect.com/topics/computer-science/hacktivists accessed
September 2020. Also see, Department of Homeland Security,
``Commodification of Cyber Capabilities: A Grand Cyber Bazaar,''
2019, p. 1 https://www.dhs.gov/sites/default/files/publications/ia/ia_geopolitical-impact-cyber-threats-nation-state-actors.pdf
accessed August 2020.
    \18\ Verizon, 2020 Data Breach Investigations Report, p. 10,
Figure 8.
    \19\ Verizon, 2020 Data Breach Investigations Report, p. 11,
Figure 10.
---------------------------------------------------------------------------

    The methods used by the bad actors to perpetrate cyber breaches
(alone or in combination) were around 45% hacking (use of stolen
credentials), 22% error (e.g., mis-delivery), 22% social (e.g.,
phishing), 17% malware (e.g., password dumper), 8% misuse (privilege
abuse), and 4% physical stealing (e.g., theft).\20\
---------------------------------------------------------------------------

    \20\ The total exceeds 100% because the bad actors could use one
or more methods for each breach. See Verizon, 2020 Data Breach
Investigations Report, p. 7, Figure 2.
---------------------------------------------------------------------------

D. Cyber Breaches Relevant to CAT, LLC Including Frequency,
Severity, and Relative Difficulty of Implementation

    There are several firms that provide summary level data on the
types of cybercrime events, along with information on how frequently
they occur and the associated severity of economic losses. One
entity, Advisen, maintains a database of over 90,000 cyber events,
and allows subscribers to perform customized searches.\21\ In this
paper, we have used the Advisen database to research frequency and
severity for breaches we deemed specifically relevant to the types
of data held on the CAT (Customer and Account Attributes and trade
data).\22\ We further refined the types of cyber events we believe
could potentially affect the CAT by using Advisen data, other
publicly available sources, and our own experience.
---------------------------------------------------------------------------

    \21\ See Advisen website, https://www.advisenltd.com/data/cyber-loss-data/ accessed August 2020.
    \22\ The PII that exists in the CAT is name, address, and birth
year. This PII data will be in a ``secure database physically
separated from the transactional database. . .'' See SEC, March 17,
2020 Order, pp. 12 and 20.
---------------------------------------------------------------------------

    We have posited scenarios where malicious actors could make use
of the CAT data should they successfully gain access to the data.
These scenarios, while not exhaustive of every type of potential
cyber breach, are the product of our understanding of the data
available in the CAT and how it might be used to generate wrongful
benefits for threat actors.\23\ Some of the scenarios we discuss are
more likely to be attempted, while others are more improbable. By
their nature, the scenarios are general and therefore it is
impossible to quantify the exact losses that could be generated by
an unauthorized attack. As a frame of reference, based on the breach
related losses experienced by Fortune 250 companies over the past
decade, the losses range from the thousands of dollars to several
billion.\24\ Therefore, our approach for each scenario is to
determine the relative ease of implementing the scenario, the
relative frequency of how often it could be successfully carried
out, and the conditional severity of the financial loss that could
stem from the event (assuming the scenario was carried out
successfully).
---------------------------------------------------------------------------

    \23\ We believe that the scenarios we have posited are a useful
way to characterize the economic risks facing the operation of the
CAT, but we also recognize that any real-world hack could differ
substantially from our scenarios in substantial ways.
    \24\ The distribution of breach losses for the Fortune 250
extends from less than $1,000 to above $1 billion. The ``Typical''
breach loss is $471,000 while the ``Extreme'' breach loss is $93
million. See Cyentia Institute, Information Risk Insights Study, A
Clearer Vision for Assessing the Risk of Cyber Incidents, p. 21,
Figure 15.
---------------------------------------------------------------------------

    Relative Difficulty of Implementation: With respect to our
assessment of the relative difficulty of implementation, we begin
with an assumption that threat actors could breach the system, but
then consider the number of databases the threat actors would need
to breach, the extent to which the data would need to be manipulated
for it to be useful, and the level of difficulty they would face in
making use of that ill-gotten data to implement the strategy in the
scenario.
    Relative Frequency: The frequency assessment is based on our
review of Advisen data for companies in the Fortune 250 for hacks
similar to the ones we posit. We do not directly opine on the
likelihood of successful hacks of the CAT, but instead use the
Advisen data on successful hacks at large corporations to provide a
subjective assessment of the relative frequency of a successful hack
for each scenario we posit the CAT could face. We also consider the
structural design of the CAT and the hurdles it presents to success
of the strategy, as well as the attractiveness of the strategy
because it could lead to a significant financial gain or achievement
of a disruptive goal.
    Conditional Severity: The severity of the financial loss (based
on our review of Advisen data) that could stem from the event
assuming the scenario was carried out successfully. We deem the loss
severity for a particular type of breach to be extreme if we
consider the exposure to be more than $100 million per event (95th
percentile loss in the Advisen data), high if we consider the
exposure to be approximately $5-50 million, medium if we consider
the exposure to be approximately $500,000, and low if we consider
the exposure to be approximately $50,000 or less.\25\
---------------------------------------------------------------------------

    \25\ These amounts are based on the distribution of breach
losses for the Fortune 250 over the past 10 years. See Cyentia
Institute, Information Risk Insights Study, A Clearer Vision for
Assessing the Risk of Cyber Incidents, 2020, p. 21, Figure 15.
---------------------------------------------------------------------------

    Below we first discuss summary descriptive statistics regarding
cyber

breaches and then the types of breaches we believe are specific
risks faced by the CAT.

1. Summary Level Data

    Our review of available information on various aspects of cyber
breaches led us to focus on periodic reports prepared by Ponemon
Institute/IBM Security, Verizon, and Cyentia. While these entities
do not report the same information in the same way, there appears to
be a consensus that malicious attacks are the primary reasons for
cyber breaches, and that the risk of a breach increases with firm
size. The Fortune 250 are particularly frequent targets.\26\
Furthermore, the costs \27\ associated with dealing with large,
mega, and extreme \28\ breaches, as shown in the table below, run
from $10 million to $100 million or more. The costs of a breach
include such items as detection and escalation costs, notification
costs, post-data-breach response costs, and lost business costs.\29\
---------------------------------------------------------------------------

    \26\ The top 250 firms of the Fortune 1000 are nearly five times
more likely to have a breach than the bottom 250. See Cyentia
Institute, Information Risk Insights Study, A Clearer Vision for
Assessing the Risk of Cyber Incidents, 2020, p. 8.
    \27\ The costs in the IBM Security report include both the
direct and indirect expenses incurred by the organization. Direct
expenses include engaging forensic experts, legal fees, outsourcing
hotline support and providing free credit monitoring subscriptions
and discounts for future products and services. Indirect costs
include in-house investigations and communication, as well as the
extrapolated value of customer loss resulting from turnover or
diminished customer acquisition rates. See Ponemon Institute and IBM
Security, Cost of a Data Breach Report 2020, p. 72. The costs in the
Cyentia/Advisen report include losses related to productivity,
response, replacement, competitive advantage, fines and judgments
(including legal fees), and reputation. See Cyentia Institute
Information Risk Insights Study, A Clearer Vision for Assessing the
Risk of Cyber Incidents, 2020, p. 16. Also see, Teresa Suarez, ``A
Crash Course on Capturing Loss Magnitude with the FAIR model,'' Fair
Institute website, October 20, 2017, https://www.fairinstitute.org/blog/a-crash-course-on-capturing-loss-magnitude-with-the-fair-model
accessed August 2020.
    \28\ The IBM Security report notes several levels of a mega
breach, the first is 1 million to 10 million records and the largest
is 50 million or more records. We refer to the first as a large
breach (1 million to 10 million records) and the other as a mega
breach (more than 50 million records). See Ponemon Institute and IBM
Security, Cost of a Data Breach Report 2020, pp. 10 and 67. The
Cyentia/Advisen report does not use the term ``mega breach'' but
does note the cost of a breach of 100 million records. We label this
as a ``mega breach'' to compare to the data in the IBM Security
report. In addition, the Cyentia/Advisen also provides an ``extreme
event'' figure on a cost basis alone, no records mentioned. Thus, we
provided this information in its own column. See Cyentia Institute
Information Risk Insights Study, A Clearer Vision for Assessing the
Risk of Cyber Incidents, 2020, p. 3.
    \29\ See Ponemon Institute and IBM Security, Cost of a Data
Breach Report 2020, p. 7.
    \30\ See Ponemon Institute and IBM Security, Cost of a Data
Breach Report 2020, pp. 3, 30, 66-67, Verizon 2020 Data Breach
Investigations Report, pp. 6-7, Figure 2, and Cyentia Institute
Information Risk Insights Study, A Clearer Vision for Assessing the
Risk of Cyber Incidents, 2020, pp. 3, 4, and 8.
[GRAPHIC] [TIFF OMITTED] TN06JA21.005

2. Breach Data Specifically Relevant to CAT, LLC

    The CAT data is unique and valuable because it is the only data
repository that collects and holds Customer and Account Attribute
data and all trading data from all the U.S. equity and option
exchanges.\31\ The compromise of this data, as discussed in further
detail below, could cause harm in the form of investor losses,
reputational harm, interference with market surveillance by the SROs
and the SEC, and loss of investor confidence in the markets
themselves. For the exchanges, the scale of potential liability
could significantly financially harm those entities that constitute
the national market system in the U.S. securities markets.\32\
---------------------------------------------------------------------------

    \31\ See SEC website, ``Rule 613 (Consolidated Audit Trail),''
https://www.sec.gov/divisions/marketreg/rule613-info.htm.
    \32\ The Securities Exchange Act of 1934 (Exchange Act) codified
the legal status of exchanges as self-regulatory entities (SROs)
under federal law. The Exchange Act vested exchanges with the
responsibility to oversee trading on their respective markets and to
regulate conduct of their members, including the responsibility to
enforce compliance by their members with the Exchange Act. Thus, the
Exchange Act reflected Congress' determination to rely upon self-
regulation as a fundamental component of the oversight and
supervision of U.S. securities markets and their members. See
Memorandum from SEC Division of Trading and Markets to SEC Market
Structure Advisory Committee dated October 20, 2015 with the subject
``Current Regulatory Model for Trading Venues and for Market Data
Dissemination,'' pp. 1-2, https://www.sec.gov/spotlight/emsac/memo-regulatory-model-for-trading-venues.pdf.
---------------------------------------------------------------------------

    More specifically, the CAT Customer and Account Attributes
database (the CAIS database) is the only database that exists that
aggregates, across all U.S. stock exchanges, elements of PII (name,
address, birth year) \33\ for the over 100 million people,
companies,

and trusts,\34\ that hold accounts trading U.S. equities and
options. The CAT trade database (the MDS database) \35\ is the only
database that aggregates, across all U.S. exchanges, all of the
exchange-based equity and option trades by customer ID for those
persons and entities. Further, the data in the CAT CAIS database is
stored and processed in a separate, independent system from the MDS
database. These systems are operated by different personnel. The
data in the CAIS and MDS databases are encrypted independently of
each other using different keys. The trade data (MDS database) is
anonymized; there is no PII data present. Customer and Account
Attributes data (CAIS database) is only accessible with limited
permission and no data extraction is allowed, only interactive
queries. Queries of any CAT data can only be done by the SEC and
SROs via private line access; no public internet access.\36\
---------------------------------------------------------------------------

    \33\ The PII that exists in the CAT is name, address, and birth
year. This PII data will be in a ``secure database physically
separated from the transactional database. . .'' See SEC, March 17,
2020 Order, pp. 12 and 20.
    \34\ There are approximately 330 million people in the United
States. See United States Census Bureau website, the U.S. and World
Population Clock, https://www.census.gov/popclock/ accessed
September 2020. According to a FINRA study, around 32% of the
national population have investments in non-retirement accounts (330
million times 32% = 105.6 million non-retirement accounts. See FINRA
Investor Education Foundation, ``Investors in the United States, A
Report of the National Financial Capability Study,'' FINRA Investor
Education Foundation, December, 2019, p. 3.
    \35\ See SEC, March 17, 2020 Order, p. 12. SEC., Order Approving
CAT, The Limited Liability Company Agreement of CAT LLC, Appendix C-
4 and Appendix D-14.
    \36\ All CAT Data must be encrypted at rest and in flight using
industry standard best practices. See SEC, Order Approving CAT, The
Limited Liability Company Agreement of CAT LLC, p. 62, Appendix D-
11, and D-14.
[GRAPHIC] [TIFF OMITTED] TN06JA21.006

    Given  the unique nature of the CAT data set, we are unable to
find cyber breach events that exactly mirror potential CAT data
breaches. However, we believe review of cyber breach events related
to Finance and Insurance companies with greater than $1 billion
revenue can serve as a helpful proxy. We used the Advisen database
and other public sources to search for information on cyber breach
events related to such companies.
---------------------------------------------------------------------------

    \37\ Please note this is based on the CAT NMS Plan and
amendments. See, SEC, Order Approving CAT, pp. 47-48, SEC, Order
Approving CAT, The Limited Liability Company Agreement of CAT LLC,
p. 62, Appendix C-7 to C-9, Appendix D-14, and D-33 to D-34, SEC,
March 17, 2020 Order, pp. 2, 4-5, 12, 15 and 20 and CAT Reporting
Technical Specifications for Industry Members, Version 3.1.0 r2,
April 21, 2020, p. 1 and 5-6.
---------------------------------------------------------------------------

    The summary chart below displays the results of filtering the
Advisen database to obtain cyber breach data over the past 10 years
associated with companies with $1 billion revenue or greater that
are classified as Finance and Insurance companies in the North
American Industry Classification system.\38\
---------------------------------------------------------------------------

    \38\ We deemed application of these filters to be reasonable
since the CAT will hold more records than most large (>$1 Billion)
corporations, and because the data the CAT stores is from companies
that fall into the Finance and Insurance classification.
    \39\ Data pulled from Advisen Cyber OverVue, https://insite20twenty.advisen.com, on September 11, 2020.
---------------------------------------------------------------------------

BILLING CODE 8011-01-P
[GRAPHIC] [TIFF OMITTED] TN06JA21.007

BILLING CODE 8011-01-C
    Malicious breaches are the most common and the most
expensive.\40\ Correspondingly, the Advisen data shows that for
Finance and Insurance companies with $1 billion or

greater in revenue that had a malicious cyber breach, those firms
had 8.8 malicious cyber breaches, on average (median of 2), over the
past 10 years.\41\ The average cost of these malicious breaches was
$23.0 million with a median of $3.2 million.\42\
---------------------------------------------------------------------------

    \40\ See Ponemon Institute and IBM Security, Cost of a Data
Breach Report 2020, pp. 29 and 31.
    \41\ The large difference between the median of 3 and average of
13.3 breaches for this data set is attributable to the large degree
of variance in the number of breaches by firm. In other words, a few
firms experienced a very large number of breaches, increasing the
average relative to the median.
    \42\ The large difference between the median cost of $3.2
million and average cost of $23.0 million for a malicious breach in
this data set is attributable to the large degree of variance in the
cost per breach by firm. In other words, a few firms experienced a
very large cost per breach, increasing the average relative to the
median.
---------------------------------------------------------------------------

    The asset most frequently compromised was personal financial
information (``PFI'').\43\ We examined the top 10 PFI loss breaches
from the Advisen database and found that the top 10 losses ranged
from $11.7 million to $2.5 billion (Equifax).\44\ The second highest
loss for PFI after Equifax was $188.7 million (Wells Fargo).\45\
---------------------------------------------------------------------------

    \43\ Advisen defines PFI or personal financial information as
credit/debit card details, social security numbers, banking
financial records (account numbers, routing numbers, etc.). Advisen
defines PII or personal identifiable information as data containing
identifying information, including name, address, email, date of
birth, gender, etc. See Advisen's Cyber OverVue User Guide, January
2020, p. 26. Also, ``The compromise of the Confidentiality of
Personal data leads the pack among attributes affected in
breaches,'' See Verizon 2020 Data Breach Investigations Report, p.
29. ``More than half of all cybercrime incidents investigated by
CyberScout involved financial fraud, one of the most common forms of
identity theft.'' See Advisen, Quarterly Cyber Risk Trends: Global
Fraud is Still on the Rise, sponsored by CyberScout, Q2 2019, p. 2.
    \44\ See the PFI Top 10 cyber loss events as of September 11,
2019 as obtained from Advisen Cyber OverVue,
insite20twenty.advisen.com. Equifax is coded under NAICS 56
Administrative and Support and Waste and Management Remediation
Services in Advisen's Cyber OverVue, but it is coded as NAICS
522320--Financial Transactions Processing, Reserve, and
Clearinghouse Activities in Advisen's MSCAd database (see Advisen
website, www.advisenltd.com). In speaking to Advisen's product
manager, he stated that in Cyber OverVue, the NAICS code is taken
directly from Advisen's company information provider, in this case
S&P. In MSCAd, which is Advisen's legacy system that they are moving
away from, the NAICS code is a translation of the SIC code. These
differences in industry classification between the two systems can
sometimes create misalignments, but rarely. CRA manually added
Equifax to the NAICS 52 Finance and Insurance peer group based on
its potential applicability in size and type of assets (PII or PFI)
compromised.
    \45\ See the PFI Top 10 cyber loss events as of September 11,
2019 as obtained from Advisen Cyber OverVue,
insite20twenty.advisen.com.
---------------------------------------------------------------------------

    The data in the table above also includes frequency and losses
from internal cyber related errors. These events typically include
things like software errors or a when a human mistake involving a
computer is made. For example, the top ten largest error-related
cyber loss events from the events underlying the table above (in the
corporate losses section) ranged from $472.0 million down to $7.3
million. The top two were $472.0 million for Knight Capital Group
and $373.5 million for TSB Bank. Both were caused by IT errors. For
Knight Capital Group, a glitch in new trading software caused Knight
Capital Group's order router to send more than four million orders
into the market when it was supposed to fill in just 212 customer
orders.\46\ For TSB Bank, customers lost access to their accounts or
saw information of accounts owned by others after TSB Bank
transferred the records and accounts of its 5.2 million customers
from one system to another. All of the top ten error-related cyber
loss events impacted a company's ability to conduct business and
generate revenues.\47\ While the CAT does not support a specific
company's ability to conduct business and generate revenues it does
affect the ability of the SEC and the SROs to oversee and regulate
market activities. However, it is our understanding that if the CAT
has appropriate backups that have not been maliciously encrypted,
this type of attack can be recovered from.\48\ While regulatory
oversight could be delayed by the error, the oversight activities
can be resumed after a relatively brief period devoted to bringing
up the backup systems. Overall, we note that internal cyber related
errors can lead to very large losses that represent additional
liability exposure to the CAT.
---------------------------------------------------------------------------

    \46\ See Corporate Business Income/Services Top 10 cyber event
losses as of September 11, 2019 as obtained from Advisen Cyber
OverVue, insite20twenty.advisen.com.
    \47\ See Corporate Business Income/Services Top 10 cyber event
losses as of September 11, 2020 as obtained from Advisen Cyber
OverVue, insite20twenty.advisen.com.
    \48\ Interview with William Hardin, VP, Charles River
Associates, August 11, 2020.
---------------------------------------------------------------------------

    To further refine the types of cyber breaches we believe could
potentially affect the CAT, we searched public sources and relied
upon our experience to posit scenarios we believe reflect how data
from possible cyber breach attacks/events could be misused.
    We believe threat actors could seek to breach the CAT to attempt
the following:

(1) Hold Data Hostage
(2) Identity Theft
(3) Algorithm Reverse Engineering
(4) Fake Data Insertion to Wrongfully Incriminate
(5) Data Removal or Insertion to Hide Fraud
(6) Trading on Non-Public Information
(7) Competitive Intelligence--Customer Lists
(8) Discovery of Regulatory Investigation that Could be Used to Harm
Someone's Reputation

    We address the scenarios below and describe our estimation of
the ease of implementation, frequency and severity risk of each.

(1) Hold Data Hostage

    A bad actor could seek to ransom CAT data in several ways. Many
of them are derivative of the other scenarios we posit later in this
report.

(a) Threaten to publicly release confidential Customer and Account
Attribute data or trade data to harm a firm's or investor's
reputation
(b) Threaten to keep data encrypted (denial of service) to prevent
its use by regulators
(c) Threaten to sell trading data regarding an account that could
allow reverse engineering a trading algorithm
(d) Threaten to make short position data public

    Each of these is discussed in further detail:

(a) Threaten to publicly release confidential Customer and Account
Attribute data or trade data to harm a firm's or investor's
reputation

    Under this scenario, if a bad actor obtained either Customer and
Account Attribute data or trade data from the CAT it would be
difficult for the bad actor to monetize the information without the
ability to associate the trade data with the Customer and Account
Attribute data to identify the parties involved in the trade as bad
actors historically have done.
    To limit the potential value of the information, the SEC
mandated that the CAT limit the identifying information it stores.
Information such as a social security number, brokerage account
number, and other high value PFI items are not stored by the CAT.
The CAT stores only less sensitive PII information including name,
address, and birth year within the CAT Customer and Account
Attributes database (CAIS).\49\ Also, the trade data stored by the
CAT does not disclose the name of the person or company behind the
trade. Rather, the account owner behind the trade is identified by a
CAT Customer ID (CCID) that is a globally unique CCID for each
account owner that is unknown to and not shared with the original
CAT Reporter Industry Member. This CCID is held within the CAT's
CCID and CAIS databases.\50\ To determine the account owner, one
would need access to the system that links the CCID to the Customer
and Account Attributes data, the CAT Customer and Account
Information System (CAIS). The trade data and the CAIS data are
stored on separate encrypted systems. Thus, a bad actor would need
access to the trade data and the CAIS data for each individual/
company in order to find out which trades related to which
individuals/companies and which brokers were used by these
individuals/companies. Therefore, we see limited possibility or
value in a hacker seeking to threaten a brokerage firm or other
investor with the release of Customer and Account Attributes.
---------------------------------------------------------------------------

    \49\ See SEC, March 17, 2020 Order, pp. 4-5 and SEC, Order
Approving CAT, The Limited Liability Company Agreement of CAT LLC,
p. 4, Appendix C-7 to C-9, Appendix D-14, and D-33 to D-34.
    \50\ See SEC, March 17, 2020 Order, pp. 2, 4-5.
---------------------------------------------------------------------------

    With respect to an attempt to hold hacked CAT trade data
hostage, we note that all the trade data is encrypted with the
client anonymized, making it unlikely that a hacker could
successfully identify who to threaten. The bad actor would need to
have the CAIS data and trade data to determine which clients and
client trades were associated with a broker or investor. Given that
the CAT keeps encrypted CAIS data and encrypted trade data in
separate databases, a data incident to obtain and exploit both sets
of data would be difficult. We recognize that

crime syndicates are publishing information to their blogs,\51\ and
if they released even partial information to the public, this could
damage the reputation of the CAT. The breach would show weaknesses
in the security of the CAT and translate into potential reputational
harm to not only the CAT, but also possibly the SEC and the SROs.
Overall, we believe this scenario would be of average difficulty to
implement, will occur infrequently (if at all), but have low to
medium loss severity if successful.
---------------------------------------------------------------------------

    \51\ Per William Hardin, VP Cybersecurity and Incident Response
Services, Charles River Associates, Inc.
---------------------------------------------------------------------------

(b) Threaten to keep data encrypted (denial of service) to prevent
its use by regulators

    If a hacker were able to disrupt the CAT and impose another
level of unauthorized and malicious data encryption in an attempt to
ransom its decryption, this could affect the SEC's ability to
conduct investigations as well as the SROs' ability to meet their
oversight obligations.\52\ A particular concern for a system held by
ransomware is the inability of the affected firms to access their
information and maintain operations for their customers. However, it
is our understanding that if the CAT has appropriate backups that
have not been maliciously encrypted, this type of attack can be
recovered from.\53\ While regulatory oversight could be delayed by a
ransomware attack, the oversight activities can be resumed after a
relatively brief period devoted to bringing up the backup systems.
We deem a successful ransomware scenario to be highly unlikely,
assuming adequate backup systems and protocols, as a hacker is
likely to perceive that collecting a ransom from the regulators has
a very low probability. We believe this scenario would be of average
difficulty to implement, will occur infrequently, and have low to
medium severity if successful.
---------------------------------------------------------------------------

    \52\ Under the Exchange Act, a variety of SROs, including
national securities exchanges and FINRA, exercise extensive
oversight over securities broker-dealers, stock exchange members and
listed companies, and other market intermediaries. Stock exchanges
were the original SROs that governed the trading of securities and
regulated their members well before the creation of the Securities
and Exchange Commission and the current statutory framework
formalizing their SRO status. See Commissioner Luis A. Aguilar, U.S.
Securities and Exchange Commission, ``The Need for Robust SEC
Oversight of SROs,'' May 8, 2013, footnote 2, https://www.sec.gov/news/public-statement/2013-spch050813laahtm accessed August 2020.
    \53\ Per William Hardin, VP Cybersecurity and Incident Response
Services, Charles River Associates, Inc.

(c) Threaten to sell trading data regarding an account that could
---------------------------------------------------------------------------
allow reverse engineering a trading algorithm

    This scenario would be difficult to implement given the bad
actor would need to access the trade data as well as the CAIS
(assuming the bad actor could not otherwise determine the who the
trade data was associated with \54\). Gaining access to multiple
encrypted CAT databases to retrieve multiple categories of data,