stored in separately secured areas would be difficult. It would also
be difficult for the bad actor to figure out who the trade CCID
account owner was without access to the CAIS. Overall, the bad actor
would need to access the trade data, analyze the data for
algorithmic trading, and determine who the CCID account owner is in
order make the threat real. Next, they would have to credibly
threaten that firm that their trades would be released or sold to
someone that could reverse engineer their algorithms, which is a
complex and difficult task. We think that, at worst, the threatened
firm might pay a moderate ransom to prevent its trades from being in
unknown hands. Thus, we believe this scenario would be very
difficult to implement, will occur infrequently, and have high to
extreme severity if successful.
---------------------------------------------------------------------------

    \54\ We can envision that a bad actor might be able to deduce
who the trade data was associated with based on certain
characteristics of quantity, size, or through other means.

---------------------------------------------------------------------------
(d) Threaten to make short position data public

    If a bad actor were able to use the CAT trading and CAIS data to
successfully determine that an investor holds a significant short
position in a particular stock, in theory, that hacker could try to
threaten that investor that their position information would be made
public. We deem this scenario as improbable and unlikely. First, as
discussed above, determining both the investor identity and the
position held by that investor would be difficult. Second, there is
a significant risk to the hacker that the investor would not care
that their short position was made public. Thus, we believe this
scenario would be of average difficulty to implement, will occur
infrequently, and have medium severity if successful.

(2) Identity Theft

    We believe that one of the most likely goals of wrong-doers
seeking to hack the CAT would be to attempt to steal Customer and
Account Attribute data (within the CAIS database) for the millions
of account holders in the system. We note that significant effort
has been made in designing the CAT to reduce this risk. This
includes encrypting of the Customer and Account Attribute data and
limiting the underlying PII to less sensitive information: Name,
address and birth year (no PFI data--no social security numbers, no
account numbers, and no dates of birth). Importantly, there are
strict limitations on access to the CAIS database. Access to the
CAIS is on a ``need to know'' and ``least privileged'' basis and
cannot be obtained from public internet connectivity.\55\
---------------------------------------------------------------------------

    \55\ See SEC, March 17, 2020 Order, pp. 12 and 20 and SEC, Order
Approving CAT, The Limited Liability Company Agreement of CAT LLC,
Appendix D-14.
---------------------------------------------------------------------------

    An example of how a hacker could take advantage of less
sensitive PII data (name, contact information, and a reservation)
can be seen in the recent breach at the Ritz Carlton's London hotel.
In August of 2020, the hotel suffered a cyber breach of its food and
beverage system. The bad actor used the customer information in this
system to pose as a Ritz employee to confirm the reservation and
payment card details with individuals with the upcoming
reservations. The card details received based on these calls were
used to spend thousands of pounds of victims' money.\56\ If a hacker
were able to get CAT Customer and Account Attribute data and
determine the brokerage firm at which a particular investor held
their account, the hacker could call that investor posing as an
employee of the broker and seek to ``confirm account information.''
This could lead to substantial investor losses. This scheme could
then be repeated on large numbers of investors.
---------------------------------------------------------------------------

    \56\ See Julian Hayes, ``Double extortion: An emerging trend in
ransomware attacks,'' Advisen Front Page News, August 21, 2020,
https://www.advisen.com/tools/fpnproc/fpns/articles_new_35/P/375350842.html?rid=375350842&list_id=35 accessed August 2020.
---------------------------------------------------------------------------

    Had the CAT Customer and Account Attribute data included social
security numbers and birth dates, this information could be even
more easily monetized by either identity/credit theft or selling the
data in bulk on the dark web. William Hardin, VP and leader of
Charles River Associates Cybersecurity Incident Response Practice
stated, ``the most readily available easily monetized form of hacked
data on the dark web is PII.'' \57\
---------------------------------------------------------------------------

    \57\ Interview with William Hardin, VP, Charles River
Associates, August 11, 2020.
---------------------------------------------------------------------------

    Verizon reported that the compromise of personal data occurs in
77% of the Finance and Insurance industry cyber breaches and that
cyber-attacks are mostly carried out by external actors who are
financially motivated to get easily monetized data.\58\ According to
the data in the Advisen database, personal information is the most
common type of data compromised in a cyber breach. The Advisen
database shows that Finance and Insurance companies with $1 billion
or greater in revenue that had a PII breach had an average of 3.4
breaches (a median of 1) over the past 10 years.\59\ The frequency
and severity of PII breaches is much lower than PFI breaches. Thus,
based upon this history, we believe the CAT substantially reduced
its relative exposure to the frequency and severity of breaches
related to personal information by not including PFI data in the
CAT. While this design feature is appropriate, CAT remains a
tempting target for cybercriminals as it will have one of the
largest accumulations of personal data ever assembled. The
possibility of an extreme event should not be ignored.
---------------------------------------------------------------------------

    \58\ Verizon, 2020 Data Breach Investigations Report, p. 52.
    \59\ See Advisen Cyber OverVue, insite20twenty.advisen.com.
---------------------------------------------------------------------------

    We reviewed the top 10 PII cyber breaches underlying these
figures and summarized them in the table below. We found the lowest
loss was $9.1 million while the highest was $21.6 million. While an
imperfect measure, generally the more records exposed,\60\ the

higher the loss amount. We note that Equifax is not included in the
PII breach data because that breach included access to PFI (social
security numbers). The Equifax loss was $2.5 billion and is the
largest publicly disclosed PFI breach. It has been reported that
this loss resulted from Equifax leaving itself significantly exposed
to hacking because it failed to implement various software security
patches in a timely manner. In relation to the Equifax breach, the
number of records potentially exposed at the CAT could be even
larger. But since the CAT will only include less sensitive PII
(name, address, birth year) and not PFI (social security number,
account numbers), we believe the Equifax loss of $2.5 billion can be
seen as an upward bound of the exposure a Customer and Account
Attribute data breach at the CAT could generate.
---------------------------------------------------------------------------

    \60\ The firms working in the cyber risk industry typically use
the number of records exposed/stolen as a metric to describe the
relative size and seriousness of a breach. While there is some
correlation between the number of records exposed and the ultimate
cost of the breach, this metric is imperfect as it does not consider
the relative value of the records exposed or how they might be used.
However, as long as one recognizes those limitations, we believe the
number of records exposed can be a useful descriptor. We note that
the CAT will contain massive amounts of data, including information
on hundreds of millions of accounts, making it much bigger than some
companies we review for comparison.
---------------------------------------------------------------------------

    Based on the descriptions provided by Advisen, the most similar
PII breach to what CAT might experience in the list below is the
E*TRADE hack, where a bad actor accessed their customer database and
exported stolen customer data including names, residential
addresses, phone numbers, and email addresses. These addresses were
allegedly taken so the bad actors could start their own securities
brokerage. Overall, the hackers compromised customer databases
containing the personal information of more than 5 million
customers, leading to a $12.9 million loss.\61\ While there will be
fewer elements of PII stored at the CAT (name, address, and birth
year) than at E*TRADE (name, address, phone number, and email
address), we again note there will be orders of magnitude more
individuals' records at the CAT.
---------------------------------------------------------------------------

    \61\ See the PII Top 10 cyber loss events as of September 11,
2019 as obtained from Advisen Cyber OverVue,
insite20twenty.advisen.com.
[GRAPHIC] [TIFF OMITTED] TN06JA21.008

    As noted  above, the Advisen database showed that for Finance
and Insurance companies with $1B in revenue or more that had a PII
breach, these breaches occurred with a frequency of 3.4 times on
average over a 10-year period (median of 1). The range for the top
10 PII breaches was $21.6 million to $9.1 million.
---------------------------------------------------------------------------

    \62\ ``Advisen has developed a proprietary loss amount model to
help users make more informed decisions on cyber risk by enhancing
how it is being quantified. The resulting analytics, when viewed in
tandem with our benchmarking analyses, will provide a comprehensive
picture of an organization's potential cyber loss exposure, as well
as better guidance on the type and amount of cyber insurance to
purchase. The model looks at a combination of more than 70 different
variables across more than 100,000 cyber events in Advisen's
proprietary cyber loss data to calculate simulated financial loss
amounts by incorporating quantile regression analyses that look at
data relationships across different quantiles to establish a range
of potential impacts. The model is recalibrated on an ongoing basis
to account for changes in data relationships as Advisen's cyber loss
database continues to grow.'' See Advisen's Cyber OverVue User
Guide, January 2020, p. 22. See also the PII Top 10 cyber loss
events as of September 11, 2019 as obtained from Advisen Cyber
OverVue, insite20twenty.advisen.com.
---------------------------------------------------------------------------

    The second highest PFI breach, after Equifax, is the $188.7
million loss suffered by Wells Fargo & Co. (Wells Fargo), which
resulted from the bank allowing its employees to access customers'
personal information, and in some cases forging data, to subscribe
them to products, such as credit cards. Lawyers representing
aggrieved customers have said the bank may have opened about 3.5
million unauthorized accounts.\63\
---------------------------------------------------------------------------

    \63\ See the PFI Top 10 cyber loss events as of September 11,
2019 as obtained from Advisen Cyber OverVue,
insite20twenty.advisen.com.
---------------------------------------------------------------------------

    If the CAT stored social security numbers and account numbers
(as was originally planned before the amendments), the exposure on a
successful hack would be extreme. But, because the CAT Customer and
Account Attribute data is limited to name, address and birth year,
we believe that risk is mitigated to some degree. In summary, we
suggest CAT Customer and Account Attribute data will be of medium
interest to hackers and conclude this scenario would be relatively
less difficult to implement, will occur with moderate frequency, and
likely have medium to high severity if successful. An extreme event
cannot be ruled out primarily because of the quantity of Customer
and Account Attribute data being held at the CAT.

(3) Algorithm Reverse Engineering

    Algorithmic trading uses a computer program that follows a
defined set of instructions (an algorithm) to execute a trade. The
trades can be executed at a speed and frequency that is impossible
for a human trader. The algorithmic trading market size was $11.1
billion in 2019 and expected to grow to $18.8 billion by
2024.64 65 Algorithmic trading is responsible for
approximately 60-73% of all U.S. equity

trading.\66\ The two largest firms, Virtu Financial, Inc.
(``Virtu'') and Citadel ``account for around 40 percent of daily
U.S. trading flow.'' \67\ Virtu is the largest public algorithmic
trading firm, with a market cap of $4.56 billion.68 69
Furthermore, Citadel, the nation's biggest equity and options market
maker, is responsible for one in every five stock trades in America
and 40% of the retail volume.\70\
---------------------------------------------------------------------------

    \64\ Research and Markets, Algorithmic Trading Market by Trading
Type, Component, Deployment Mode, Enterprise Size, and Region--
Global Forecast to 2024, https://www.researchandmarkets.com/reports/4770543/algorithmic-trading-market-by-trading-type#rela0-4833448
accessed November 2020.
    \65\ We note that high frequency trading (HFT), a major subset
of algorithmic trading, has experienced higher costs and lower
profitability in the past few years. See Gregory Meyer, Nicole
Bullock and Joe Rennison, ``How high-frequency trading hit a speed
bump,'' Financial Times, January 1, 2018, https://www.ft.com/content/d81f96ea-d43c-11e7-a303-9060cb1e5f44 accessed August 2020.
    \66\ Research and Markets, Algorithmic Trading market--Growth,
Trends, and Forecast (2020-2025), https://www.researchandmarkets.com/reports/4833448/algorithmic-trading-market-growth-trends-and#rela4-5125563 accessed August 2020.
    \67\ AllAboutAlpha, ``High-Frequency-Trading Firms: Fast,
Faster, Fastest,'' April 2, 2019, https://www.allaboutalpha.com/blog/2019/04/02/high-frequency-trading-firms-fast-faster-fastest/
accessed November 2020.
    \68\ See Capital IQ website, https://www.capitaliq.com/CIQDotNet/Financial/Capitalization.aspx?CompanyId=133624510 accessed
November 6, 2020.
    \69\ Interestingly, Virtu was the victim of a recent social
engineering hack. A hacker seized control of the email account of
one of its executives. The email account was used to send two
fraudulent wire transfers totaling $10.8 million to bank accounts in
China. See Alexander Osipovich, ``High Speed Trader Virtu Discloses
$6.9 Million Hacking Loss,'' Dow Jones News Service, August 11, 2020
accessed December 2020.
    \70\ Nathan Vardi, ``Finance Billionaire Ken Griffin's Citadel
Securities Trading Firm Is On A Silicon Valley Hiring Binge,'' June
3, 2019, Forbes, https://www.forbes.com/sites/nathanvardi/2019/06/03/finance-billionaire-ken-griffins-citadel-securities-trading-firm-is-on-a-silicon-valley-hiring-binge/#34f23c9c6b36 accessed August
2020.
---------------------------------------------------------------------------

    Algorithmic trading plays an important role in making the U.S.
markets more efficient. Academic research has shown that algorithmic
trading significantly reduces bid-ask spreads and speeds price
discovery.\71\
---------------------------------------------------------------------------

    \71\ Terrance Hendershott, Charles M. Jones, and Albert J.
Menkveld, Does Algorithmic Trading Improve Liquidity?, The Journal
of Finance, Volume 66, No. 1, February 2011, http://faculty.haas.berkeley.edu/hender/Algo.pdf.
---------------------------------------------------------------------------

    Assuming the trading data of the CAT LLC was breached and
decrypted, we assess that, while difficult, that data could be used
to reverse engineer the proprietary trading algorithms of
algorithmic trading firms. The loss to a firm whose algorithm was
compromised in this way would be the cost of developing the
algorithm plus any forgone profits that could have been expected to
accrue to the firm over a reasonable period of time.
    For example, as of January 2020, Citadel is suing a rival for
allegedly taking details of a key Citadel trading strategy which
Citadel has stated cost more than $100 million to develop and which
generates many millions of dollars each year.\72\
---------------------------------------------------------------------------

    \72\ Jane Croft, ``Citadel Securities sues rival over alleged
trading strategy leak,'' Financial Times, January 10, 2020, https://www.ft.com/content/2cbf1738-33cd-11ea-9703-eea0cae3f0de accessed
December 2020.
---------------------------------------------------------------------------

    Although we assess that using the CAT data to reverse engineer a
trading algorithm would take significant expertise and time, the
trading strategies that use these algorithms are highly valuable. In
addition, the concentration of profitability among a small number of
players in this space could increase the attractiveness of
attempting this type of scheme. We ultimately deem it unlikely that
a bad actor would seek to use CAT data in this way because of the
difficulty in both achieving the hack as well as the effort to
reverse engineer an algorithm. The separation and encryption of the
Customer and Account Attribute data (in the CAIS database) and trade
data (in the MDS database), the fact that the trade data is
anonymized, and the limitations on ways in which one can get this
data (CAT data can only be accessed by the SEC and SROs via private
line access; there is no public internet access and access to the
CAIS is on a ``need to know'' and ``least privileged'' basis) would
make this scenario very difficult to achieve. The hacker would need
to successfully access all this data, decrypt it, and reverse
engineer the algorithms under which the trades were made. Given the
potential value (severity) of this type of information, however, bad
actors could be so motivated. In particular, a state sponsored
hacker could have the resources to attempt to reverse engineer
successful algorithms and steal intellectual property in this way.
The bad actor could also seek to ransom the algorithm to the
algorithmic trading firm as discussed above or seek to sell the data
to a sophisticated trading firm that was able to do the reverse
engineering.
    An example of a parallel type of scenario can be seen in the
breach of newswire services by a group of Ukrainian hackers during
2015. The hackers gained access to corporate earnings releases for
dozens of companies as much as 12 hours prior to their being made
public. The hackers knew the information was valuable but did not
know how to trade based on it. They therefore set up a network of
traders to whom they fed the data and either sold them the releases
outright or struck a deal to share in the profits.\73\ More than
$100 million was allegedly earned on the wrongful trades.\74\
---------------------------------------------------------------------------

    \73\ See SEC website, ``SEC Reaches Settlements with Traders in
Newswire Hacking and Trading Scheme,'' Litigation Release No. 24833,
June 10, 2020, https://www.sec.gov/litigation/litreleases/2020/lr24833.htm accessed November 2020. Also see SEC website, ``SEC
Charges 32 Defendants in Scheme to Trade on Hacked News Releases,''
August 11, 2015, https://www.sec.gov/news/pressrelease/2015-163.html
accessed November 2020.
    \74\ See SEC website, ``SEC Reaches Settlements with Traders in
Newswire Hacking and Trading Scheme,'' Litigation Release No. 24833,
June 10, 2020, https://www.sec.gov/litigation/litreleases/2020/lr24833.htm accessed November 2020. Also see SEC website, ``SEC
Charges 32 Defendants in Scheme to Trade on Hacked News Releases,''
August 11, 2015, https://www.sec.gov/news/pressrelease/2015-163.html
accessed November 2020.
---------------------------------------------------------------------------

    In summary, we believe that while the implementing this type of
breach would be difficult and the frequency likely low, the severity
of a breach leading to the reverse engineering of an algorithmic
trading firm's strategy could be high. An estimate of exposure of at
least $100 million per incident (based on the cost to develop a
successful strategy at Citadel) seems reasonable. Given the role
that algorithmic trading firms play in adding liquidity to the
markets, we deem this scenario to pose both a risk to algorithmic
trading firms themselves, as well as to the efficient operation of
U.S. markets. Therefore, we believe this scenario would be very
difficult to implement, will occur infrequently, but have extreme
severity if successful.

(4) Fake Data Insertion To Wrongfully Incriminate

    We posit that if a hacker were able to successfully insert false
data into the CAT, they could use that ability to wrongfully
incriminate an individual or company. For example, assume that a
hacker inserts data into the CAT making it appear that the CEO of a
company was wrongfully engaging in insider trading of its company's
stock. Further assume that this data triggered an investigation at
the SEC into the CEO's trading and that investigation led to a
preliminary injunction hearing to prevent the CEO from further
accessing his or her account. This SEC action would be public, and
both the CEO's and company's reputation and value could be harmed.
    According to a 2010 study, when the SEC announced an
investigation on a company, the average abnormal return based on
that announcement was at least negative 8%.\75\ This would equate to
a reduction in market value of $1.8 billion for the median company
in the S&P 500.\76\
---------------------------------------------------------------------------

    \75\ Journal of Forensic & Investigative Accounting, ``Market
Efficiency and Investor Reactions to SEC Fraud Investigations,''
Vol. 2, Issue 3, Special Issue, 2010, p. 3.
    \76\ Using the total market value of the S&P 500, $30.24
trillion, a negative 8% return would be a reduction in market value
of $1.8 billion for the median company in the S&P 500 (median market
value of $22.1 billion). See Refinitiv website, a company that
provides financial data, https://www.refinitiv.com/en/about-us
accessed October 21, 2020.
---------------------------------------------------------------------------

    The negative return can be significantly larger than 8%. In
November 2019, the Wall Street Journal announced that the SEC was
investigating Under Armour. On the day of the announcement, Under
Armour's stock fell 19%.\77\ Correspondingly, the market
capitalization of Under Armour fell from $9.04 billion to $7.35
billion, a drop of $1.69 billion.\78\
---------------------------------------------------------------------------

    \77\ Wharton University of Pennsylvania, ``How Undisclosed SEC
Investigations Lead to Insider Trading,'' March 2, 2020, https://knowledge.wharton.upenn.edu/article/undisclosed-sec-investigations-lead-insider-trading/ accessed September 2020.
    \78\ This market value drop may not be fully attributable to the
announcement and would require an event study to test that
conclusion. See Refinitiv website, https://www.refinitiv.com/en/about-us.
---------------------------------------------------------------------------

    Given the expected negative market reaction to an SEC
investigation, the hacker could position to benefit from a stock
price drop. This type of trading would arguably be akin to insider
trading (trading on material non-public information), where we have
seen cases that have generally generated illicit profits ranging in
the hundreds of thousands to tens of millions of dollars. The
largest insider trading matters to date were

Martoma/SAC \79\ and Galleon/Rajaratnam,\80\ with alleged wrongful
profits of $275 million and $95 million respectively.
---------------------------------------------------------------------------

    \79\ See Final Judgement as to Defendant CR Intrinsic Investors,
LLC, United States District Court, Southern District of New York, 12
Civ. 8466 (VM), filed June 18, 2014, p. 3.
    \80\ See Opinion and Order, SEC v. Raj Rajaratnam, et al.,
United States District Court, Southern District of New York, 09 Civ.
8811 (JSR), filed November 8, 2011, pp. 1-2.
---------------------------------------------------------------------------

    We recognize that this scenario seems attenuated and unlikely
because the hacker would need to know information from the
separately kept and encrypted CAIS and trade databases. The hacker
would need gain access to the CAIS to obtain which CCID went with
the person/company to be wrongfully incriminated. The hacker would
then be able to search the trade data for trades related to that
CCID. Other potential hacker impediments include CAT data only being
accessed by the SEC and SROs via private line access; there is no
public internet access and access to the CAIS is on a ``need to
know'' and ``least privileged'' basis. Additionally, we believe that
this false accusation would be relatively easy for the accused CEO
to disprove based on simply producing his own account statements.
However, this could potentially occur at or after the public
injunction hearing, and the associated initial effects on stock
price. We conclude that this scenario would be very difficult to
implement, will occur infrequently, but have high to extreme
severity if successful. The severity level is based on the potential
to profit from wrongful accusations about a company and/or its
management.

(5) Data Removal or Insertion To Hide Fraud

    The SROs and the SEC monitor the securities markets for a range
of wrongful activities, such as trading in a way that manipulates
the market prices of securities and trading on inside information
(material non-public information). If a hacker were to access the
CAT and remove data relating to wrongful acts (or insert data to
obfuscate their bad acts) and the wrongful acts were not detected by
SRO monitoring, the hacker could successfully hide illegal trading
activity from regulatory scrutiny. This has the potential to enable
illegal activity to continue (and its related profits) and
ultimately undermine the efficiency of the markets and public trust
therein. Ultimately the investing public is harmed as they may
overpay for a purchase or receive less for the sale of a security.
    If a bad actor can continue to make millions of dollars on
illegal activity due to the insertion of fake data or deletion of
data in the CAT, those activities essentially cause those millions
to come out of the accounts of investors who are following the
rules. To the extent the illegal activity becomes widespread,
investors could lose confidence in the market and ultimately take
out their money and potentially invest it in foreign markets. This
would essentially increase capital costs for all companies seeking
to raise funds to grow, translating into a smaller economy.\81\
---------------------------------------------------------------------------

    \81\ ``America's historical approach to our capital markets--an
approach focused on transparency, materiality, fairness and
accountability--has produced a remarkably deep pool of capital with
unprecedented participation. It is our Main Street investors and
their willingness to entrust their hard-earned money to our capital
markets for the long term that have provided the seeds for the
deepest, most dynamic and most liquid capital markets in the world.
Their capital provides businesses and municipalities with the
opportunity to invest, grow and create jobs with an organic dynamism
that stands apart both today and since the Commission was formed 85
years ago.'' See Chairman Jay Clayton, Testimony on ``Oversight of
the Securities and Exchange Commission'' Before the U.S. Senate
Committee on Banking, Housing, and Urban Affairs, December 10, 2019,
https://www.sec.gov/news/testimony/testimony-clayton-2019-12-10
accessed November 2020.
---------------------------------------------------------------------------

    To execute such a scheme, the bad actor would need to know how
to hack into the encrypted and anonymized CAT trade data or hire
someone to do so. The bad actor would also have to override or
bypass the existence of two separate data feeds into CAT (one from
the execution venue and one from the CAT Industry Member reporter)
to delete or add fake data or access the final corrected
database.\82\ Given the potential payoff (severity), such an
arrangement between a hacker and a bad actor could occur. For
example, and as mentioned above, the SEC charged 32 defendants
(primarily based in Ukraine) in a scheme where hackers obtained data
from press releases prior to their public release and conspired with
experienced traders to trade on earnings announcements based on the
hacked data. These acts allegedly occurred over a five-year period
and the information from the yet-to-be issued news releases was used
to generate more than $100 million in illegal profits.\83\ If the
trading data relating to these wrongful trades had been deleted, it
is likely this scheme would never have been detected and stopped.
---------------------------------------------------------------------------

    \82\ Data can be accessed by regulators via a query on day one
after initial data validation as well as on day 5 when all data has
been corrected. See SEC, Order Approving CAT, pp. 100 and 538.
    \83\ SEC website, ``SEC Charges 32 Defendants in Scheme to Trade
on Hacked News Releases,'' August 11, 2015, https://www.sec.gov/news/pressrelease/2015-163.html accessed November 2020.
---------------------------------------------------------------------------

    This type of criminal trading undermines both market efficiency
and public confidence in the markets. The effects may be pernicious
and, if left unchecked, could lead to catastrophic loss of investor
confidence.
    Given the nature of this scheme, including avoiding detection by
SRO monitoring, we believe this scenario would be very difficult to
implement, will occur infrequently, but have high to extreme
severity if successful.

(6) Trading on Non-Public Information

    We posit that the non-public trading data in the CAT could be
used to determine if a company or individual might be making large
multi-day purchases or sales of securities of various companies.
This information could indicate a potential takeover, or, in the
case of a high-profile investor, a significant new position is being
taken.
    For example, it is not unusual for Berkshire Hathaway
(``Berkshire'') to purchase large amounts of stock of a company, and
for the stock of that company to go up in value both because of
share demand increase based on the size of the purchases made by
Berkshire, as well as the perceived value of having Berkshire as an
investor once that position is public. Once the position exceeds 5%
of the target company, Berkshire (or any investor for that matter)
has ten days to report its holding to the SEC.\84\ If someone with
access to CAT trading data were to see that a significant position
was being bought in a particular stock, they could use that
information to take a long position in that stock in anticipation of
a stock price rise that would occur once that information was made
public.
---------------------------------------------------------------------------

    \84\ Fintel website, Berkshire Hathaway Inc--Warren Buffet--
Activist 13D/13G Filings, https://fintel.io/i13d/berkshire-hathaway.
This website contains a list of Berkshire Hathaway SEC 13D/13G
filings accessed November 2020.
---------------------------------------------------------------------------

    On November 14, 2016, Berkshire reported to the SEC, with the
SEC making it public at 4:05 p.m. ET, a new investment in American
Airlines \85\ amounting to 4.2% of the stock, or 21,770,555
shares.\86\ At this time, American Airlines' stock price was trading
around $43.40 per share \87\ making the position worth around $945
million. Hypothetically, if someone had been able to front run 10%
of these shares and net $1.36 per share (which represents the one
day increase in share price post the announcement), the gain would
have been $3.0 million.\88\
---------------------------------------------------------------------------

    \85\ Berkshire's SEC Form 13F filing shows that Berkshire
acquired 21,770,555 (13,355,099 plus 8,415,456) shares of American
Airlines stock. See SEC's Edgar website, Berkshire Hathaway Inc
filings, https://www.sec.gov/Archives/edgar/data/1067983/000095012316022377/0000950123-16-022377-index.htm, SEC's Edgar
website, Berkshire Hathaway Inc filings, https://www.sec.gov/Archives/edgar/data/1067983/000095012316022377/xslForm13F_X01/primary_doc.xml and SEC's Edgar website, Berkshire Hathaway Inc
filings, https://www.sec.gov/Archives/edgar/data/1067983/000095012316022377/xslForm13F_X01/form13fInfoTable.xml accessed
November 2020.
    \86\ American Airlines had 518,130,000 shares of stock
outstanding as of November 14, 2016. See Refinitiv website, https://www.refinitiv.com/en/about-us. 21,770,555/518,130,000 = 4.2%.
    \87\ American Airlines stock price closed at $43.40 on November
14, 2016, just prior to the SEC making Berkshire's American Airlines
stock acquisition public. See Refinitiv website, https://www.refinitiv.com/en/about-us.
    \88\ 21,770,555 shares times 10% times $1.36 = $2,960,795.
American Airlines stock price close prior to the announcement was
$43.40 (November 14, 2016) and $44.76 after the announcement
(November 15, 2016). $44.76-$43.40 = $1.36. This is an illustration,
and we did not perform an event study to determine whether the full
price increase is attributable to the announcement.
---------------------------------------------------------------------------

    The hacker also could access the CAT trade data to look for new
stock positions being taken in an account in a particular company
that approaches 5%. This is referred to as a ``toehold'' position
and could be an indicator that a takeover bid is likely.\89\ The
hacker could then take a long position in the stock of the target
firm to benefit from the takeover announcement, after which stock
prices of the target can jump substantially.\90\ The

hacker would not know with certainty that the entity building the
position will continue to make purchases but by pursuing this
strategy across multiple examples, they have a high likelihood of
success.
---------------------------------------------------------------------------

    \89\ Investopedia website, Toehold Purchase definition, https://www.investopedia.com/terms/t/toeholdpurchase.asp accessed November
2020.
    \90\ Jensen and Ruback (1983) review several empirical papers
that empirically estimate the abnormal returns that accrued to the
shareholders of the target firms around the announcement dates
associated with unexpected tender offers to be approximately 30%.
See Jensen and Ruback, ``The Market for Corporate Control,'' Journal
of Financial Economics, 11, (1983).
---------------------------------------------------------------------------

    As discussed above, we know hackers are motivated to find and
monetize non-public information (earnings announcements hacked from
press release services). Such non-public information has also been
obtained by hackers on the SEC's company filing website, Edgar. In
2016, bad actors hacked into the SEC's Edgar company filing system
to access the data in company filings before the SEC made then
public.\91\ Such filings include earnings releases and the filings
related to stock positions that exceeds 5% of the stock of the
company being purchased (discussed above).\92\
---------------------------------------------------------------------------

    \91\ See NPR website, Barbara Campbell, ``SEC Says
Cybercriminals Hacked Its Files, May Have Used Secret Data for
Trading,'' September 20, 2017, https://www.npr.org/sections/thetwo-way/2017/09/20/552500948/sec-says-cybercriminals-hacked-its-files-may-have-used-secret-data-for-trading accessed September 2020.
    \92\ See SEC website, https://www.sec.gov/forms accessed
September 2020.
---------------------------------------------------------------------------

    In summary, we believe that a hacker could use CAT trade data to
successfully trade on non-public information. The payoffs could be
high enough to motivate a bad actor. Of course, the hacker would
need to gain access to the encrypted and anonymized CAT trade data.
If the trade data was obtained, it would be relatively easy to
determine if an account was building a position in a particular
stock. Thus, we believe this scenario would be relatively less
difficult to implement, could occur relatively frequently across
multiple stocks, and have medium to high severity if successful.

(7) Competitive Intelligence--Customer Lists

    Another possible use of hacked CAT data would be to gather
competitive information. A bad actor could hack into the CAT trade
data and CAT CAIS data to determine which brokerage firms had which
clients. For example, it could be useful to firm A to know that most
of a particular pension fund's trading activity is being done at
firm B, and how much trading that comprises. With that information,
trading firm A could target the most profitable clients and avoid
spending time on others. Access to CAT information could notably
increase the scope and precision of competitive intelligence above
that already available from other, more standard sources.
    While this information could provide an advantage, we deem this
scenario unlikely. First, as discussed above, there is difficulty in
hacking two sources of encrypted and separately kept data, the CAIS
(for the account owner associated with the CCID used in the trade
database) and trade data as well as associating all of this to learn
who the best customers are. Second, merely knowing who is working
with whom does not, in and of itself, generate profits; therefore,
the incentive to pursue this activity is low. In addition, taking
advantage of this information would need to be undertaken by a
regulated firm, and if the hacking was uncovered it would lead to
severe consequences for that firm. Therefore, the combination of low
value of the information and high risk for the user leads us to
conclude this scenario is very unlikely. What seems a little more
plausible is a bad actor asking the brokerage firm for a ransom and,
if not received, the bad actor releasing the information into a
public forum. Thus, we believe this scenario would be very difficult
to implement, will occur infrequently, and have medium to high
severity if successful.

(8) Discovery of Regulatory Investigation That Could be Used To Harm
Someone's Reputation

    It is our understanding that queries made by regulators on the
CAT system will be saved, and that the party (e.g., the SEC) making
the query will be associated with the query.\93\ If a hacker were
able to view those queries and also had the Customer and Account
Attribute data to identify the firm that is the subject of the
query, he or she would be able to determine which firms were under
regulatory scrutiny.
---------------------------------------------------------------------------

    \93\ See SEC, Order Approving CAT, The Limited Liability Company
Agreement of CAT LLC, Appendix D-25 to D-27.
---------------------------------------------------------------------------

    This information could be used to ransom the firm as well as
purchase or sell securities to take advantage of a potential
announcement of an investigation (or a resolution of an
investigation) later in time. To accomplish this scheme, the hacker
would need to gain access to the queries as well as the encrypted
CAIS database (Customer and Account Attribute data). Importantly,
access to the CAIS is on a ``need to know'' and ``least privileged''
basis and cannot be obtained from public internet connectivity.
Additionally, the hacker would not know with certainty that the
queries would turn into a publicly announced SEC investigation, but
by pursuing this strategy across multiple examples, they have a
higher likelihood of success. A hacker with access to the queries
would likely need to implement a trading strategy across multiple
companies to ensure at least one or more investigations were
ultimately disclosed. We conclude this scenario will be of average
difficulty to implement, will be of average frequency, and have
medium to high severity.

[GRAPHIC] [TIFF OMITTED] TN06JA21.009

III. Economic and Public Policy Analysis of Cyber Security for CAT LLC
---------------------------------------------------------------------------

    \94\ See discussion in Section D for an explanation of each
column.
---------------------------------------------------------------------------

    In this section, we review the law and economics literature that
provides normative analysis of whether the preferred method to
influence the management of risky activities is via regulation or
litigation. Our goal is to apply the lessons from this literature to
address the question of whether it is economically optimal to
mitigate CAT LLC's cyber risk exposure (and the potential resulting
harm to third parties) through regulation or through litigation, or
through some combination of the two methods. We start by providing a
rationale for why one would want to influence the loss-producing
behavior of economic agents. We then characterize the differences
between regulation as an ex-ante method of exercising control versus
litigation as a method that influences behaviors before the loss-
producing event occurs by assigning liability ex post. The
discussion proceeds by comparing the relative advantages of
disadvantages of each method, contrasting one relative to the other.
    In reviewing CAT LLC's proposed plan amendment for a limitation
of liability, the Commission is faced with the choice of whether to
supplement the cyber regulatory regime that the Commission has
already imposed by affording Industry Members the ability to bring
private litigation against CAT LLC and the Participants. Based on
our application of the economic literature, we conclude that
regulation alone is preferable to regulation plus litigation. As
discussed below, the approach that relies largely on regulation
alone would be an improvement in economic efficiency and a benefit
to the investing public over a regulation plus litigation approach
as proposed by Industry Members. Accordingly, the limitation on
liability proposed by the Participants is appropriate from the
perspective of economic theory.

A. The Choice Between Regulation and Litigation

    The standard (legal, economic, and moral) reason for seeking to
control the actions of economic agents who engage in risky
activities is to maximize the social welfare of the activity. Steven
Shavell, the Samuel R. Rosenthal Professor of Law and Economics at
Harvard Law School, provides a useful definition of social welfare
as ``the benefits [each] party derives from engaging in their
activities, less the sum of the costs of precautions, the harms
done, and the administrative expenses associated with the means of
social control.'' \95\
---------------------------------------------------------------------------

    \95\ Steven Shavell, ``Liability for Harm Versus Regulation of
Safety,'' The Journal of Legal Studies, Vol. 13, No. 2 (June 1984),
pp. 357-374.
---------------------------------------------------------------------------

    Regulation is one of the primary ``means of social control''
referenced in Shavell's definition. Regulatory control is
characterized by its reliance upon rules designed to reduce to some
acceptable level the likelihood of occurrence of a loss, or to
minimize the size of the loss, should one occur. These rules are
most often defined by professionals who are experts in the
underlying risk exposure, and they are promulgated before the
economic activity commences. Each party to the activity is required
to follow the rules and enforcement is typically conducted using
publicly observable mechanisms.
    Litigation is a second ``means of social control.'' Economists
(and others) have long recognized that the prospect of being held
legally liable for harm ex post provides incentives for the relevant
parties to take care ex-ante, thereby reducing the likelihood or the
expected severity of an adverse event injuring either the first
party or third parties. Litigation is characterized by the use of
legal

standards to assign liability after the loss producing event has
occurred that are applied and adjudicated by non-experts in the
underlying risk using private enforcement mechanisms (e.g., civil
lawsuits involving private lawyers, judges and jurors) that may
involve informing the non-experts using testimony provided by
experts (i.e., by expert witnesses, professionals, etc.).
    One-way economists examine which method of social control may be
preferable is in the context of ``incentive alignment'' among the
parties to the economic activity. That is, how do you get each party
to recognize and address not only the damages they might suffer, but
the damages that other parties (customers, vendors, employees, etc.)
might incur because the first party suffered an adverse event?
    We focus on comparing regulation vs. litigation and on systems
of social control that employ the joint use of each tool for the
purposes of this White Paper.

B. Economic Determinants of the Relative Attractiveness of
Regulation or Litigation To Control Risk

    A well-established literature has developed over several decades
that discusses the circumstances when regulation or litigation will
be the preferred means of control to minimize the social cost of
loss producing events.\96\ This subsection examines general economic
considerations underlying a mix of regulation and litigation that
minimizes the overall expected costs of adverse events such as cyber
breaches. Subsequently, we apply the insights of this literature to
the issue at hand--the optimal control of cyber risk for CAT LLC,
and whether the Commission should supplement the existing regulatory
regime by allowing Industry Members to sue CAT LLC and the
Participants in the event of a breach.
---------------------------------------------------------------------------

    \96\ In addition to the 1984 Shavell article referenced in the
prior footnote, the following articles are of particular note:
Ronald H. Coase, ``The Problem of Social Cost,'' Journal of Law and
Economics, Vol 3 (1960), pp. 1-44; Harold Demsetz, ``When Does the
Rule of Liability Matter?'' Journal of Legal Studies, Vol. 1, No. 1,
(January 1972) pp. 13-28; and Steven Shavell, ``Liability for
Accidents,'' Chapter 2 in Handbook of Law and Economics, Vol. 1,
Mitchell Polinsky and Steven Shavell, eds., Elsevier, 2007. There
are many additional references in the latter chapter.
---------------------------------------------------------------------------

    A first consideration relates to the rules-based nature of
regulation. Regulation relies upon each party having a clear
understanding of the legal obligation they must perform before they
conduct the economic activity. Regulation tends to be preferred to
litigation in circumstances where the rules can be written with
precision, when the marginal compliance costs associated with the
rules are low, and when compliance can be transparently verified by
all parties, including the first party, all third parties, and by
the regulator.\97\
---------------------------------------------------------------------------

    \97\ The compliance transparency condition is complicated in the
case of cyber security by the need to prevent cyber criminals from
understanding and evading cyber defenses and by the fact that cyber
criminals themselves operate with great secrecy to avoid detection.
A litigation approach, however, offers no advantage over regulation
in compliance transparency and may actually increase the risk of
cybercrime elsewhere by inadvertently disclosing information on
cyber defenses. It is also germane to note that Industry Members sit
on the Advisory Committee and SEC representatives have substantial
visibility into the operations of the CAT and the Plan Processor. We
discuss this latter point in detail later in the White Paper.
---------------------------------------------------------------------------

    One way that the reliance upon rules becomes problematic is when
it is difficult to write a precise ex-ante rule that considers all
possible circumstances that might be associated with the context of
the loss. In such cases, it is likely the resulting standard will
either be vague, highly complex, or will not consider every possible
situation that might arise when the loss producing event occurs. Ex
post litigation may be preferred in these situations so that
judgement regarding the circumstances of the loss can be more easily
considered as part of the adjudication process.
    Regulatory rules that cannot be precisely written are also
problematic to the extent they cause the parties to the activity to
inadvertently not follow the rule or to have different
interpretations of the rule. In either circumstance, it may be
possible that all parties incur the administrative costs of
designing the rule and of attempting to comply with the vague rule,
and then also incur the administrative costs associated with
interpreting the application of the vague rule once the loss has
occurred. This duplication of administrative costs, both ex-ante and
ex post, reduces the attractiveness of regulation in favor of
litigation where the administrative costs are borne only once.
    Regulatory systems tend to dominate when compliance with the
rule(s) can be monitored by the regulator with low marginal cost and
there is high transparency regarding the effort taken to comply with
the rules. Litigation dominates in situations when there are
significant informational asymmetries between the parties or between
the parties and the regulator to determine compliance. The
adversarial nature of proceedings where courts can compel the
parties to reveal private case-specific information that has already
taken place leads to more accurate liability assignment ex post and,
therefore, incentives to mitigate the risk ex-ante. As a result, a
litigation regime provides stronger incentives for each party to
internalize the private information they have about the effort they
take to minimize losses about the damages they might suffer, or
about the damages they might impose on the third party relative in
situations where it is costly for the parties to become informed
about each other's actions ex-ante or in real-time.
    Regulatory systems are preferable when the activity can result
in so-called ``judgment proof problems.'' A judgment proof problem
is synonymous with the classic externality where the actions of a
responsible party imposes costs on a third party (or parties) that
the responsible party is unable or unlikely to pay despite being the
source of those costs. Agents can be judgement proof for several
reasons. A responsible party may be judgment proof if the losses it
produces are spread amongst many third parties and no single entity
has a large enough incentive to hold the first party accountable for
the damages it produced--the so-called ``disappearing defendant''
problem. A responsible party may also be judgment proof when the
adverse event produces a catastrophic loss that exceeds the first
party's available assets to provide compensation. Litigation
systems, by definition, allow for the possibility that the
catastrophic loss may happen and thereby permit the prospect that
full recovery by the injured party may not be possible. Knowing the
effects of a possible catastrophic event will not be fully realized
by the first party reduces the first party's up-front incentives to
take care.
    The ex-ante approach of regulation mitigates judgement proof
problems by seeking to avoid the loss itself. Appropriately
designed, regulations can compel the first party to internalize
expected social costs of losses suffered by third parties,
incorporating those third-party costs into the first-party's
decision making.
    It is also important to consider the joint use of each policy
tool. For example, drug manufacturers are subject to testing regimes
(ex-ante regulation) before a new drug can be licensed and sold on
the market and can be held liable for damages (ex post litigation)
for drugs that cause injury to consumers, sometimes even in cases
where the manufacturer followed all the up-front testing regimes.
    From an economic perspective, the joint use of both regulation
and litigation should be considered only when there is sufficient
incremental efficiency that can be gained by using both methods of
social control collectively. In these situations, one method--either
or regulation or litigation--will be the primary method, and the
relevant question is whether adding the other method will improve
incremental efficiency. For example, an article in the leading
economics journal argues litigation supplemented by regulation can
resolve a form a judgment proof problem that arises when it is
possible a third party may be unable to recover damages because
courts can make errors by incorrectly applying a negligence
standard. Adding regulation, ex-ante, to the ex post liability
regime can help mitigate the litigation uncertainty by ensuring the
negligence standard established by the court is not too low.\98\
---------------------------------------------------------------------------

    \98\ Kolstad, Charles D., Thomas S. Ulen, and Gary V. Johnson,
``Ex Post Liability for Harm vs. Ex Ante Safety Regulation:
Substitutes or Complements?'' The American Economic Review Vol. 80,
No. 4 (Sep. 1990), pp. 888-901.
---------------------------------------------------------------------------

    Similarly, there are circumstances where it is advantageous to
add litigation to mitigate the informational limitations of the
regulatory policy tool. For example, the efficacy of regulation
declines when a regulator monitoring a firm can observe compliance
with certain rules but not others. In this case, adding liability
through litigation to the regulatory regime can increase the
efficiency of the entire system because ex post litigation is better
suited to consider context-specific information after the loss has
occurred focused on the rules for which compliance cannot easily be
verified ex-ante.\99\ A second area where regulatory

systems suffer is when the regulator faces differential ability to
monitor the firms in the industry it is overseeing or the firms have
heterogenous assets such that it is difficult to write precise rules
and standards. Both circumstances can create ex post judgement proof
problems. In this case, using a regulation approach with relatively
low compliance standards helps to avoid some of the losses while
adding the liability regime can serve to provide additional
incentives to mitigate the risks that are tailored to the specific
circumstances of the individual loss-producing entity.\100\
---------------------------------------------------------------------------

    \99\ Bhole, Bharat, and Jeffrey Wagner, ``The Joint Use of
Regulation and Strict Liability with Multidimensional Care and
Uncertain Conviction,'' International Review of Law and Economics
Vol. 28 (2008) pp. 123-132.
    \100\ De Geest, Gerrit, Giusseppe Dari-Mattiacci, ``Soft
Regulators, Tough Judges,'' Supreme Court Economic Review Vol. 15
(2007) pp. 119-140.
---------------------------------------------------------------------------

    Financial services and health and safety are two areas where the
informational limitations and differential ability to monitor has
corroborated the co-existence of regulation and litigation as means
of ex-ante risk control. Financial institutions, for example, are
regulated regarding the risk they might pose in the areas of
solvency and consumer disclosure. But they are still subject to
litigation over specific transactions where the information
requirements to make certain decisions are high. We see similar
strategies employed in the food and drug industries. There exist
baseline regulatory requirements, but harmed parties are still
permitted to sue based on specific circumstances giving rise to
their harm.
    The CAT is different from the examples cited here that support
the co-existence of regulation and litigation to control risky
behavior. The CAT does not face numerous customers with different
fact-specific conditions. There are a relatively small handful of
parties involved, all of whom are already regulated by the SEC. In
the situation faced by the CAT, the SEC has already concluded that
the existing cyber security framework is adequate and they can amend
the regulatory scheme to require additional cyber security measures
to enhance the ex-ante protection against cyber breaches, to the
extent permitted by applicable laws and regulations. Indeed, the SEC
has pursued this path on multiple occasions.\101\ The Industry
Members, even though they do not run the day-to-day operations of
CAT, have the opportunity to comment on this proposal (as they do
with all proposed CAT NMS Plan amendments). Similarly, in May 2020
the SEC amended the CAT NMS Plan with the goal of increasing
operational transparency and financial accountability.\102\
---------------------------------------------------------------------------

    \101\ For a recent proposal, see SEC, Amendments to the National
Market System Plan Governing the Consolidated Audit Trail to Enhance
Data Security, RIN 3235-AM62, Release No. 34-89632, File No. S7-10-
20, August 21, 2020.
    \102\ SEC, Amendments to the National Market System Plan
Governing the Consolidated Audit Trail, RIN 3235-AM60, Release No.
34-88890, File No. S7-13-19, May 15, 2020.
---------------------------------------------------------------------------

    The SEC can also file enforcement actions to compel compliance
with the extensive cyber security requirements for the CAT.
Enforcement action brought by the SEC against the CAT would be
highly informed by the SEC's pre-existing regulatory supervision and
is potentially informed by Industry Members through their ability to
monitor CAT via their role on the Advisory Committee. The SEC,
therefore, is uniquely positioned to consider the costs and benefits
of taking enforcement action, and to tailor the scope and nature of
enforcement proceedings in a way that best balances the competing
stakeholder and public interests the CAT is designed to serve. The
SEC is also able to use information that it acquires through
multiple sources including its own examinations and, potentially,
investigations of the CAT in conducting that cost-benefit analysis.
    The litigation ability sought by Industry Members, however, is
of a substantially different nature than that held by the SEC. The
possibility of the CAT being forced by Industry Member initiated
litigation to take actions either in conflict with or uncoordinated
with the SEC's regulatory requirements is not trivial.\103\
Furthermore, adding litigation to regulation does not resolve
judgement proof problems, and in fact, for some judgment proof
problems, it may not be the preferred solution.
---------------------------------------------------------------------------

    \103\ Litigation on the part of Industry Members, if successful,
could result in a court decision that addresses one type of risk but
then distorts cyber hygiene for the CAT away from other, now more
pressing risks. The court decision, by its nature, remediates past
problems with little, or no, regard to the problems arising in the
future. A litigated solution could address a particular risk, but
then inhibit the adoption of newer cyber hygiene methods.
---------------------------------------------------------------------------

    Shavell suggests compulsory insurance is a potential solution to
the judgment proof problem of inadequate assets as a way to
compensate injured victims.\104\ He cautions, however, the problem
of inadequate assets that leads to inadequate incentives to take
care will not be ameliorated if the insurer is unable to design an
insurance contract where the insurance premium reflects the
insurer's ability to monitor the insured's readiness (the premium
recognizes investments by the policyholder to reduce the likelihood
of loss), if the insurance is only available at limits well below
the potential loss, or if the insurance is priced above the
actuarially fair premium.
---------------------------------------------------------------------------

    \104\ Shavell, Steven, ``The Judgement Proof Problem,''
International Review of Law and Economics Vol. 6, No. 1 (June 1
1986), pp. 45-48.
---------------------------------------------------------------------------

C. Special Considerations Arising for the CAT's Cyber Security

    There are certain special considerations when examining the
roles of regulation and litigation in aligning incentives
appropriately for CAT's cyber risk. While regulation has a long
history in public policy towards economic activity, cyber risk
presents features that transcend prior regulatory endeavors. Much of
regulation, for example, addresses relations between regulated
entities and their customers or vendors--parties that enter into
legal transactions willingly. Health and safety regulation, as
another example, focuses on decisions and actions that are solely
under the control of the regulated entities. Safety regulation of
nuclear power plants, for example, is designed to avoid accidents
that would create considerable harm to those living within the
vicinity of the plant but for which there does not exist a
contractual relationship between the parties.
    The question of how best to encourage investment in protection
against cybercrime is challenging because the parties harmed are
varied, there exist circumstances where it may not immediately be
known that a loss has occurred, and holding the perpetrators liable
for their actions, even if they can be identified, is often not
possible. On a very general level, entities that may be targets of
cybercriminals have incentives to invest in cyber security measures
up to the point where the last dollar of expenditures is expected to
prevent at least that level of cyber loss to the entity. Cyber
losses consist of direct costs to the breached entity and the costs
that the entity expects it would pay to other parties harmed by the
entity's cyber breach. The concern, therefore, is that entities may
choose to not invest at a socially optimal level of protection if
they do not internalize the expected direct costs of the potentially
breached entity as well as the costs of all other affected parties.
System administrators who have the responsibility to maintain and
enhance the integrity of information assets and the systems that
protect them may face situations where the benefits that might
accrue from an investment in security may accrue to others outside
the firm but may not be fully internalized to the firm. In these
cases, markets do not provide sufficient incentive for the optimal
investment in protection. Without an intervention of some sort to
correct the externality, such as the cyber security regulatory
regime mandated by the SEC, there may be insufficient incentive to
invest in security at the economically optimal level.
    Regulation of cyber security adds an additional dimension that
is novel and difficult to manage--protection against malicious
actors that have incentives and abilities to wreak havoc against
parties with whom they have no consensual relationship while
simultaneously avoiding legal sanction. Importantly, litigation
against the first-party breach victims by third-party victims of
cybercrime adds little, if any, incentive or ability to mitigate the
frequency or severity of cybercrime when the first party is subject
to an extensive, transparent, and well-functioning regulatory
approach to overseeing cyber security.
    For the reasons discussed in Section II, possible cyber breaches
of the CAT can cause the CAT, the Plan Processor, and the
Participants themselves to all experience significant harm (e.g.,
loss of data or access to regulatory capabilities). The adverse
effects on this group as first-party operators are already
incorporated into the decisions the CAT and the Plan Processor
regarding cyber security. Moreover given the fact that: The SEC is
another party affected by the CAT's cyber risk, the Plan Processor
is required to comply with the SEC's cyber mandates, and the
Industry Member's role on the Advisory Committee,\105\ there is
little, if

any, additional harm to third parties that is not already
incorporated into the decision making of the CAT and the Plan
Processor. In economic terms, adding the threat of litigation would
do nothing to further internalize into the CAT's decision making the
possible losses suffered by the Industry Members. Indeed, it is
possible that efforts to reduce the cyber risks that most concern
Industry Members in an effort to avoid litigation may take resources
from the CAT that would be better used to improve overall cyber
hygiene.
---------------------------------------------------------------------------

    \105\ ``Members of the Advisory Committee shall have the right
to attend meetings of the Operating Committee or any Subcommittee,
to receive information concerning the operation of the Central
Repository (subject to Section 4.13(e)), and to submit their views
to the Operating Committee or any Subcommittee on matters pursuant
to this Agreement prior to a decision by the Operating Committee on
such matters. . . .'' See SEC, Order Approving CAT, The Limited
Liability Company Agreement of CAT LLC, Section 4.13(d).
---------------------------------------------------------------------------

    Another notable information asymmetry in the cyber security
arena is the ability of perpetrators to hide methods, intentions,
and targets from scrutiny. Even with diligent cyber security efforts
on the part of potential targets, cyber breaches may not be detected
promptly enough, and first-party breach victims may not know they
have been breached. Even though there are now extensive breach
notification requirements (including in the CAT NMS Plan), it takes
time and effort to understand the scope of the breach and the scale
of the required notifications. Relatedly, breached entities may have
incentives to not reveal they have been hacked. Cyber breaches occur
often because of weaknesses in software design and implementation
that are then exploited by the bad actors. Relevant software is most
often purchased from non-parties and affected parties rely on the
integrity of the purchased software. There is also a public goods
nature for information about cyber breaches. Knowledge of a
particular cyber breach at one victim can help other targets avoid
becoming victims. The incentive to disclose a breach to support
others for no private gain is a classic common goods problem.
    The concerns about disclosing a cyber breach with the CAT are
substantially, if not completely, mitigated. CAT LLC exists only
because of an SEC mandate that a centralized database is essential
to improving the monitoring and supervision of U.S. securities
trading activity. The SEC has closely supervised the formation and
operation of the CAT, and there are no other entities similar to the
CAT to diffuse the SEC's attention. The SEC has imposed extensive
and specific requirements on the CAT regarding its cyber security
operations. ``The security and confidentiality of CAT Data has
been--and continues to be--a top priority of the Commission. The CAT
NMS Plan approved by the Commission already sets forth a number of
requirements regarding the security and confidentiality of CAT
Data.'' \106\ Numerous SEC personnel and regulatory personnel at the
Participants will access the CAT's Central Repository on a daily
basis. The SEC's knowledge of the CAT's cyber security standards and
operations is extensive and precise. Finally, CAT is a not a for-
profit entity and its fundamental mission is to serve the public
good as defined by the SEC. As a result, its incentives to withhold
information are minimized relative to for-profit entities.
---------------------------------------------------------------------------

    \106\ SEC, Amendments to the National Market System Plan
Governing the Consolidated Audit Trail to Enhance Data Security, RIN
3235-AM62, Release No. 34-89632, File No. S7-10-20, August 21, 2020,
I. Background, pp. 9-10.
---------------------------------------------------------------------------

    These considerations present challenging obstacles to an
effective litigation approach to cyber security for the CAT. An
advantage of the regulatory approach to the CAT's cyber security is
the ability of the SEC to require the CAT and the Plan Processor to
implement cyber security initiatives, standards, policies, and
procedures promulgated by entities with deep knowledge and
experience in cyber matters--thereby internalizing the social
benefits of investing in cyber security into their decision making.
The SEC can also require CAT LLC and the Participants to amend their
cyber policies, procedures, systems and controls in response to
subsequent developments or newly identified vulnerabilities, to the
extent consistent with applicable laws and regulations. In addition,
it is important to recognize that the SEC may bring enforcement
actions against Participants and the CAT should they fail to comply
with best practices embodied in the CAT NMS Plan or SEC regulations,
including Regulation SCI.\107\ An SEC enforcement action
(litigation) would likely be settled with the non-complying
party(ies). This has the benefit of penalizing non-compliance
without the added cost of protracted litigation. Adding a third-
party litigation approach as proposed by Industry Members on top of
existing regulation and potential enforcement action runs the risk
of incurring marginal costs without adding any incremental benefit.
We elaborate on this point in Section D.2 below.
---------------------------------------------------------------------------

    \107\ Regulation SCI (Regulation Systems Compliance and
Integrity and Form SCI) was adopted by the SEC in November 2014 ``to
strengthen the technology infrastructure of the U.S. securities
markets.'' Regulation SCI applies to the Participants and is
designed to ``Reduce the occurrence of systems issues; Improve
resiliency when systems problems do occur; [and] Enhance the
Commission's oversight and enforcement of securities market
technology infrastructure.'' See SEC website, ``Spotlight on
Regulation SCI,'' https://www.sec.gov/spotlight/regulation-sci.shtml
accessed November 2020.
---------------------------------------------------------------------------

D. Assessment of Regulation and Litigation Approaches as Applied to
a Potential CAT LLC Cyber Breach

    In this section, we apply the economic considerations discussed
in Sections A through C above to analyze whether CAT's cyber
security risk should be addressed through regulation, litigation, or
a combination of both methods. We conclude that affording Industry
Members the ability to sue CAT LLC and the Participants for damages
suffered as a result of a potential CAT data breach would not
meaningfully increase the incentives for CAT LLC to take appropriate
cyber precautions but would increase the costs to various market
participants, including the Participants, Industry Members, and
individual investors. Under these circumstances, the Participants'
proposed limitation of liability amendment to the CAT Reporter
Agreement would serve important policy goals.

1. Recapitulation of CAT's Risks, Standards, Policies, and Practices

    The potential for cyber breaches at the CAT exists and can
result in harm to some parties is acknowledged by all, including the
SEC. ``The Commission acknowledges that the costs of a breach,
including breach management, could be quite high, especially during
periods of market stress. Furthermore, the Commission understands
that a breach could seriously harm not only investors and
institutions but also the broader financial markets.'' \108\ In its
Order Approving CAT, the SEC ``explained its belief that it is
difficult to form reliable economic expectations for the costs of
security breaches'' \109\ and that ``the form of the direct costs
resulting from a security breach will vary across market
participants and could be significant.'' \110\ The SEC continued,
``The Commission is unable to provide quantitative estimates of
those costs because there are few examples of security breaches
analogous to the type that could occur under the Plan and because
the Plan Processor has some discretion in developing its breach
management plan.'' \111\
---------------------------------------------------------------------------

    \108\ SEC, Order Approving CAT, Section V.F.4. Economic
Analysis, Expected Costs of Security Breaches, p. 708.
    \109\ SEC, Order Approving CAT, Section V.F.4. Economic
Analysis, Expected Costs of Security Breaches, p. 704.
    \110\ SEC, Order Approving CAT, Section V.F.4. Economic
Analysis, Expected Costs of Security Breaches, p. 705.
    \111\ SEC, Order Approving CAT, Section V.F.4. Economic
Analysis, Expected Costs of Security Breaches, p. 708.
---------------------------------------------------------------------------

    The SEC has mandated that the CAT and the Plan Processor (FINRA
CAT) implement a number of specific cyber security protocols.\112\
The SEC's regulation of the CAT, therefore, focuses appropriately on
ex-ante risk reduction requiring a variety of cyber best practices
by the CAT and its users.
---------------------------------------------------------------------------

    \112\ Consolidated Audit Trail website, Security: FAQs, https://www.catnmsplan.com/faq. Response to questions S1, S10, and S11
accessed August 2020.
---------------------------------------------------------------------------

    The SEC can employ a variety of regulatory enforcement measures
to compel the CAT (and other market participants) to establish and
maintain a high level of cyber security. With these and other
protocols, practices, and procedures in place, ``[t]he Commission
discussed . . . its belief that the risks of a security breach may
not be significant because certain provisions of Rule 613 and the
CAT NMS Plan appear reasonably designed to mitigate these risks.''
\113\ In its Order Approving CAT, the SEC anticipated and resolved
many of SIFMA's concerns regarding the public interest aspect of the
proposed CAT Report Agreement amendment.\114\ It is worth quoting

extensively from the SEC's Discussion and Commission Findings
section in the Order Approving CAT to understand the approach
adopted by the SEC.
---------------------------------------------------------------------------

    \113\ SEC, Order Approving CAT, Section V.F.4. Economic
Analysis, Expected Costs of Security Breaches, p. 708.
    \114\ The Commission notes that the Participants' proposed
governance structure--with both an Operating Committee and an
Advisory Committee--is similar to the governance structure used
today by other NMS plans, and the Commission believes that this
general structure is reasonably designed to allow the Participants
to fulfill their regulatory obligations and, at the same time,
provide an opportunity for meaningful input from the industry and
other stakeholders.
    SEC, Order Approving CAT, Section IV.B.1, pp. 139-140, emphasis
added.

    Rule 613 tasks the Participants with the responsibility to
develop a CAT NMS Plan that achieves the goals set forth by the
Commission. Because the Participants will be more directly
responsible for the implementation of the CAT NMS Plan, in the
Commission's view, it is appropriate that they make the judgment as
to how to obtain the benefits of a consolidated audit trail in a way
that is practicable and cost-effective in the first instance. The
Commission's review of an NMS plan is governed by Rule 608 and,
under that rule, approval is conditioned upon a finding that the
proposed plan is ``necessary or appropriate in the public interest,
for the protection of investors and the maintenance of fair and
orderly markets, to remove impediments to, and perfect the mechanism
of, a national market system, or otherwise in furtherance of the
purposes of the Act.'' Further, Rule 608 provides the Commission
with the authority to approve an NMS plan, ``with such changes or
subject to such conditions as the Commission may deem necessary or
appropriate.'' In reviewing the policy choices made by the
Participants in developing the CAT NMS Plan, the Commission has
sought to ensure that they are supported by an adequate rationale,
do not call into question the Plan's satisfaction of the approval
standard in Rule 608, and reasonably achieve the benefits of a
consolidated audit trail without imposing unnecessary burdens. In
addition, because of the evolving nature of the data captured by the
CAT and the technology used, as well as the number of decisions
still to be made in the process of implementing the CAT NMS Plan,
the Commission has paid particular attention to the structures in
place to guide decision-making going forward. These include the
governance of the Company, the provisions made for Commission and
other oversight, the standards established, and the development
milestones provided for in the Plan.\115\
---------------------------------------------------------------------------

    \115\ SEC, Order Approving CAT, Section IV., Discussion and
Commission Findings, pp. 126-127, emphasis added, internal footnotes
omitted.

    The SEC, therefore, after an extensive consideration of the
overall costs and benefits of the CAT, already has expressed its
judgment that the cyber security requirements it imposed on the CAT
sufficiently serve the public interest. In its November 15, 2016
Joint Industry Plan; Order Approving the National Market System Plan
Governing the Consolidated Audit Trail, Supplementary Information,
the SEC concluded, ``[T]hat the [CAT NMS] Plan, as amended, is
necessary and appropriate in the public interest, for the protection
of investors and the maintenance of fair and orderly markets, to
remove impediments to, and perfect the mechanism of a national
market system, or is otherwise in furtherance of the purposes of the
[Securities Exchange] Act [of 1934].'' \116\
---------------------------------------------------------------------------

    \116\ SEC, Order Approving CAT, Section I. Introduction, p. 8,
emphasis added. Nearly identical wording was repeated in Section IV.
Discussion and Commission Findings, p. 129 and Section VII.
Conclusion, p. 979.
---------------------------------------------------------------------------

2. Alignment of Incentives

    As explained in Sections A through C above, and mentioned in
SIFMA's Memorandum of Law, the issue here is the ``allocation of
risk (and resulting incentives) relating to a potential CAT data
breach to ensure that data is not misused, misappropriated or
lost.'' \117\ Industry Members, through SIFMA, assert that the
Participants' proposed limitation on liability would impose
significant burdens on them. In essence, by advocating against the
inclusion of a limitation of liability provision in the Reporter
Agreement, Industry Members have argued that the risks associated
with a CAT cyber breach are best addressed through litigation they
can initiate as opposed to regulation and, if necessary, enforcement
action by the SEC. But an application of the economic principles
discussed above to an examination of the CAT fundamentally
challenges Industry Members' interpretation.
---------------------------------------------------------------------------

    \117\ Memorandum of Law in Support of SIFMA's Motion to Stay SRO
Action Pending Commission Review of SIFMA's Application Pursuant to
Exchange Act Sections 19(d) and 19(f), April 22, 2020, p. 15.
---------------------------------------------------------------------------

    Relying primarily upon a regulatory regime, as proposed by
Participants, is reasonable based upon our analysis for several
reasons.
     CAT LLC is a legal entity jointly owned by the
Participants. The Participants, as SROs, are already overseen by the
SEC and are therefore subject to significant regulatory requirements
to limit their exposure to cyber risk. The SROs also use the CAT to
fulfill their regulatory functions under supervision of the SEC. A
cyber breach at the CAT would affect the SROs' ability to perform
their regulatory function--meaning that the SROs, as users of the
CAT, have a strong interest in the CAT's cyber security. As
discussed above, the SEC can impose--and has in fact imposed--
additional cyber regulations in response to subsequent developments
or to address newly identified threats. As meaningfully regulated
entities, the Participants are obligated to comply with regulatory
requirements or face consequences. The Participants have already
implemented cyber security standards, policies and procedures to
protect their information from successful attack. Further, similar
to the CAT, SROs have in place liability limitations with Industry
Members for cyber loss.\118\ If Industry Members have already
accepted limitations on liability for cyber loss with individual
SROs, imposing limitations on liability for cyber loss applied to an
SEC-mandated consortium composed of those individual SROs
substantially works to negate the pre-existing individual
limitations on liability.
---------------------------------------------------------------------------

    \118\ See the discussion in Section 4 for some useful examples.
---------------------------------------------------------------------------

     CAT LLC's funding principles seek to cover the annual
operating costs of the company, and the financial assets are
designed to be minimal and substantially lower than the maximum
possible loss due to several extreme possible cyber breach
scenarios. There is presently no asset reserve, and no plans to
build one, on the balance sheet of CAT LLC that could cover a
substantial cyber loss. Dispensing with the liability exposure will,
therefore, not likely change CAT LLC's incentive to avoid losses
beyond its existing minimal asset base.
     The efficiency of regulatory systems to achieve
economically optimal outcomes declines when the monitor is required
to oversee an industry consisting of heterogeneous firms where it is
difficult to promulgate rules that apply with equal precision to all
firms. As discussed in Section B above, efficiency gains may be
possible in such an industry by supplementing the regulatory system
with a liability system that can add context-specific information
should a loss occur. In this case, however, CAT LLC is the only firm
being overseen. As a result, the regulatory system is tailored
specifically on an ex-ante basis with rules targeted to this
particular firm. Thus, adding litigation initiated by Industry
Members in this case, where context specific information can be
considered ex post, is difficult to justify as there is an ongoing
dialogue where the regulatory rules can be revised and tailored as
circumstances change over time through the monitoring mechanisms
available to the Industry Members and to the SEC through its
examination of the CAT by the Office of Compliance Inspections and
Examinations.
     Regulatory arrangements can also be enhanced in
situations where the monitoring costs associated with compliance are
high and when the regulated activity is composed of heterogenous
firms. Again, this circumstance is unique, however, as CAT LLC is
the only firm being monitored. Importantly, representatives of the
SEC attend all Operating Committee meetings, participate in the
Security Working Group and Interpretations Working Group, and
receive updates regarding various aspects of the project and system
on a daily basis. In addition, the Industry Members are designated
members of the Advisory Committee, which gives them access to
substantial information about the cyber security circumstances at
the CAT and the Plan Processor. The Industry Members' role on the
Advisory Committee also provides them an ability to attend all
Operating Committee meetings as well as meetings of other
subcommittees and working groups and, therefore, the ability to
advocate for their interests on the cyber security policy and
procedures and other issues related to CAT LLC. While the Industry
Members' role is advisory in nature, there is no restriction that
prevents any Industry Member from raising specific concerns
regarding CAT LLC's cyber security directly with the SEC. In
addition, Industry Members transfer large amounts of data into the
CAT, thereby contributing to the risk of a breach (e.g.,

malicious data could be inserted, knowingly or not, through an
Industry Member data upload). Thus, Industry Members are active
participants in the cyber mitigation activities of CAT LLC and
active enforcement monitors of the Plan Processor and the
Participants.
    The SEC has required that CAT LLC and the Plan Processor
implement and maintain an extensive cyber security regimen.
Importantly, both the SEC and Industry Members can monitor and
provide input on the cyber security hygiene of the CAT and the Plan
Processor, and the SEC can bring enforcement actions against the
Participants if they fail to meet the standards in the regulatory
regime. Under these conditions, adding an ability for Industry
Members to sue CAT LLC or the Plan Processor in the event of a cyber
breach will not meaningfully improve the incentives to implement and
maintain the security of the data residing at CAT. Those incentives
already exist based on ex-ante regulation. Consequently, our
analysis suggests removing the limitation of liability provision
will not lead to increases in the safety of the cyber security
program or reductions in expected losses due to successful cyber-
attacks.

3. Additional Costs of Litigation

    In addition to considering the potential benefits of litigation
(which appear to be minimal for the reasons discussed above), an
economic analysis must also consider costs of allowing litigation by
Industry Members.
    At a minimum, any means of social control of a risky activity
comes with administrative expense. It is important, therefore, to
determine if the incremental control that comes with the associated
set of benefits justifies the additional expense. The additional
costs of cyber security protection or remediation (or of
compensation paid to adversely affected parties who successfully
litigate should a loss occur) that would be funded by CAT LLC need
to be examined relative to the expected marginal benefits.
    More substantively, the threat of litigation without concomitant
benefits can lead to significant extra-marginal costs that reduce
social welfare. For example, the threat of medical malpractice
litigation has been cited as a motivation for excess medical
testing.\119\ In this case, the prospect of litigation arising from
the absence of the limitation on liability provision has the
prospect for prompting overpayment for cyber security on the part of
the CAT and the Plan Processor beyond the economically optimal level
of protection, despite the analysis we present above suggesting that
such litigation would provide no incremental benefit. The prospect
of third-party litigation may prompt CAT LLC to expend resources on
cyber security systems that supplement the detailed (and regularly
updated) framework implemented by the Commission, but that do not
reduce the cyber risk commensurate with the costs. The threat of
litigation from Industry Members arising from a cyber breach at the
CAT could also affect decisions on the implementation of new
protocols at CAT. One can easily imagine the Plan Processor,
responding to perceived concerns from Industry Members, might adopt
an overly risk averse posture and not pursue new opportunities to
decrease costs or increase efficiencies at the CAT as new
technologies become available given an overemphasis on certain
courses of action and underinvestment in others. It could actually
result in an overinvestment in cyber security and an underinvestment
in productivity-enhancing projects where the costs of these
decisions would ultimately be passed on to the investors in the form
of higher costs of trading, higher costs of securing capital, etc.
---------------------------------------------------------------------------

    \119\ By one estimate, Mello, Chandra, Gawande, and Studdert
(2010) suggest between 2-3 percent of health care spending in the
United States, or $55.6 billion (in 2008), is related to the costs
of defensive medicine. See Mello, Michelle M., Amitabh Chandra, Atul
A. Gawande, and David M. Studdert, ``National Costs of the Medical
Liability System,'' Health Affairs Vol. 8, No. 29 (Sep. 2010) pp.
1569-1577.
---------------------------------------------------------------------------

    An over-investment in cyber security, moreover, could make the
CAT less effective in achieving the Commission's goals. A CAT system
burdened by excess security measures could slow down database
searches, surveillance programs, and other essential functions.
Security measures added to hedge against litigation risk, for
example, might limit the number of records that could be returned in
a single query, restrict access to a less-than-optimal pool of
regulatory personnel (at the SEC and the SROs), or require
importation of outside data into CAT environments that would expand
the CAT's overall attack surface. Indeed, as noted above, allowing
third-party litigation would run the risk that a court would mandate
security protocols that conflict or interfere with those adopted by
the SEC.
    Extending the CAT's asset base (i.e., increasing CAT LLC's
assets or broadening the number of firms potentially liable in the
event of a loss) may have the theoretical advantages of reducing the
judgment proof problem discussed earlier and provide compensation to
those negatively impacted by a cyber event. However, as conceived,
CAT LLC is run on a cost-only basis, so there is currently no
mechanism to establish safety reserves that might allow the it to
build up a cash to pre-fund losses from a cyber breach. One could
imagine adopting an alternative funding principle that would permit
those harmed by a cyber loss to seek compensation from a fund that
could be established on the CAT's balance sheet. Policies and
procedures could be developed that would prescribe the source that
would finance the fund, that would describe how those funds would be
invested, that would define a covered loss, that promulgate how
approved claims would be settled, etc.
    Although building a pool of capital in this manner might provide
some level of compensation to a few entities who could suffer a loss
supplying the CAT with the required information, we caution that
this course of action has notable possible disadvantages. Beyond the
administrative expenses associated with establishing such a business
function within CAT, there are well known challenges associated with
creating a largely unencumbered pool of capital within organizations
as there is considerable evidence doing so can lead to substantially
misaligned incentives between managers and the providers of that
capital that ultimately lead to significant costs.\120\ We provide
several alternative ways that would allow the CAT to pre-fund cyber
losses in Section E below that we judge would lead to substantially
better outcomes than establishing a cyber loss pool on CAT LLC's own
balance sheet.
---------------------------------------------------------------------------

    \120\ See Jensen, Michael, ``Agency Costs of Free Cash Flow,
Corporate Finance, and Takeovers,'' American Economic Review, Vol.
76, No. 2 (May 1986) pp. 323-329. If the capital pool exists within
regulated entities, that, at least potentially, raises additional
complications. See, for example, the regulation of insurance company
general accounts.
---------------------------------------------------------------------------

    It is well-understood that litigation in general is an expensive
and highly uncertain process. This holds with particular
persuasiveness for the new, highly technical, and rapidly changing
area of cyber security. The level of expertise required to establish
what went wrong, who was responsible, and then the calculation of
relevant losses is extremely high, placing large information burdens
on the triers-of-fact. In the case of CAT LLC, there would be an
additional burden of demonstrating either that the SEC's cyber
security mandates were inadequately implemented or were insufficient
to the task. Discovery in such litigation also runs the risk of
revealing crucial cyber security information to malicious actors.
There are, therefore, substantial unquantifiable direct costs
associated with litigating cyber security breaches at the CAT.
    We identified several marginal operating costs that would likely
emanate (with no corresponding marginal benefits) if the limitation
of liability provision were eliminated. These extra costs are either
associated with inefficient litigation, with extra-marginal
defensive investments in cyber risk protection, with reduced
efficacy of the CAT system due to excess, litigation-driven security
measures, or a cash build-up scheme that would be borne by the
Participants/SROs and Industry Members who would ultimately pass
those higher costs on to their customers, employees or owners.
Research on the incidence of extra-marginal costs and taxes on
organizations generally shows that these higher costs tend to fall
on employees and customers rather than the owners of the
organization.\121\ The Industry

Members' desire to dispense with the limitation of liability
provision may, at best, result in avoiding some losses or, possibly,
providing compensation for cyber breaches to a handful of Industry
Members and their clients. But our analysis suggests the costs will
likely be far higher and spread throughout the system as a whole,
likely leading to reduced trading levels, reduced participation in
markets by investors, or increased costs of raising capital.
Moreover, since any benefits, if they exist at all, will be
negligible, the lifting the limitation on liability will likely lead
to less socially desirable outcomes.
---------------------------------------------------------------------------

    \121\ There is an extensive literature on the incidence of the
corporate income tax supporting this proposition. In this
literature, owners have a greater ability to adjust their decisions
(especially how they invest their capital) than employees or
customers. See, for example, William M. Gentry, ``A Review of the
Evidence on the Incidence of the Corporate Income Tax,'' U.S.
Department of the Treasury OTA Paper 101, December 2007 (https://www.treasury.gov/resource-center/tax-policy/tax-analysis/Documents/WP-101.pdf accessed August 2020); Jennifer C. Gravelle, ``Corporate
Tax Incidence: A Review of Empirical Estimates and Analysis,''
Congressional Budget Office Working Paper 2011-01, June 2001
(https://www.cbo.gov/sites/default/files/cbofiles/ftpdocs/122xx/doc12239/06-14-2011-corporatetaxincidence.pdf accessed August 2020);
and Stephen Entin, ``Labor Bears Much of the Cost of the Corporate
Tax,'' Tax Foundation Special Report No. 238, October 2017 (https://files.taxfoundation.org/20181107145034/Tax-Foundation-SR2382.pdf
accessed August 2020). For a more comprehensive treatment of tax
incidence, see Don Fullerton and Gilbert E. Metcalf, ``Tax
Incidence,'' Chapter 26 (pp. 1787-1872) in Alan Auerbach and Martin
Feldstein, Handbook of Public Economics, 2002. A working paper
version of this chapter can be found at https://www.nber.org/papers/w8829.pdf accessed August 2020.
    We contend that this literature is applicable to adding
litigation exposure from cyber breaches to CAT and the Plan
Processor with minor modifications in the analysis. As noted above,
litigation is an additional expense for CAT and the Plan Processor.
For CAT and the Plan Processor to operate, expenses must be paid. By
CAT's funding principles, the extra funds will be passed along as
higher fees to the Participants and the Industry Members.
---------------------------------------------------------------------------

4. Examples of Existing Limitation on Liability Provisions

    Limitations on liability provisions are ubiquitous in commercial
relations and in the securities and finance businesses. While the
SEC-regulated relationship between the SROs and the Industry Members
limit the applicability of general commercial contractual
considerations to limitations on liability regarding cyber security
at CAT, there are multiple examples where public (and private)
interests have been served by limitations on liability provisions
imposed by regulation. Some of these instances are common in the
investment business while others are in areas remote from investment
but exhibit informative parallels.
    Perhaps most relevant are the limitations of liability provision
imposed by existing trade reporting facilities, regulatory reporting
systems, and Industry Member agreements with their customers. Here,
the Industry Members routinely (and unremarkably) specifically limit
their liability to their respective customers, even though Industry
Members hold important and sensitive customer information in their
systems. The May 6, 2020 Consolidated Audit Trail, LLC's and
Participants' Memorandum of Law in Opposition to SIFMA's Motion to
Stay documents,

[T]he Limitation of Liability Provision is similar in substance and
scope to provisions that Industry Members routinely use when they
are in possession of customer data (including order and trade data).
Finally, each exchange has rules, approved by the Commission, that
broadly provide that the Participants shall not be liable to
Industry Members.\122\
---------------------------------------------------------------------------

    \122\ Consolidated Audit Trail, LLC's and Participants'
Memorandum of Law in Opposition to SIFMA's Motion to Stay, May 6,
2020, pp. 6-7. Also see, pp. 16-17 and Appendix A: Limitation of
Liability Provisions. Internal references to Exhibit A containing
the specific examples are omitted.
---------------------------------------------------------------------------

    One finds limitations of liability elsewhere in the U.S. economy
where the threat of litigation would raise costs and regulation
exists. The examples presented below limit liability while
simultaneously providing another mechanism to compensate injured
parties.
    The federal government, for example, has established a
limitation of liability for vaccine producers. The National
Childhood Vaccine Injury Act of 1986 \123\ established the National
Vaccine Injury Compensation Program ``after lawsuits against vaccine
manufacturers and healthcare providers threatened to cause vaccine
shortages and reduce vaccination rates.'' \124\ This legislation
limited the liability of vaccine manufacturers for unavoidable
adverse side effects and for failure to provide direct
warnings.\125\ The liability limitation was intended ``[t]o ensure a
stable vaccine supply by limiting liability for vaccine
manufacturers and vaccine administrators.'' \126\
---------------------------------------------------------------------------

    \123\ Public Health Service Act, January 5, 2017, As Amended
Through Public Law 114-255, Enacted December 13, 2016, https://www.hrsa.gov/sites/default/files/hrsa/vaccine-compensation/about/title-xxi-phs-vaccines-1517.pdf accessed July 2020.
    \124\ Health Resources & Services Administration, About the
National Vaccine Injury Compensation Program, https://www.hrsa.gov/vaccine-compensation/about/index.html accessed July 2020.
    \125\ No vaccine manufacturer shall be liable in a civil action
for damages arising from a vaccine-related injury or death
associated with the administration of a vaccine after October 1,
1988, if the injury or death resulted from side effects that were
unavoidable even though the vaccine was properly prepared and was
accompanied by proper directions and warnings.
    No vaccine manufacturer shall be liable in a civil action for
damages arising from a vaccine-related injury or death associated
with the administration of a vaccine after October 1, 1988, solely
due to the manufacturer's failure to provide direct warnings to the
injured party (or the injured party's legal representative) of the
potential dangers resulting from the administration of the vaccine
manufactured by the manufacturer.
    42 U.S. Code Sec.  300aa-22, https://www.law.cornell.edu/uscode/text/42/300aa-22 accessed November 2020.
    \126\ Health Resources & Services Administration, The National
Vaccine Injury Compensation Program (VICP), https://www.hrsa.gov/sites/default/files/hrsa/vaccine-compensation/vaccine-injury-infographic-2017.pdf accessed August 2020.
---------------------------------------------------------------------------

    In 2005, Congress passed the ``Public Readiness and Emergency
Preparedness Act'' (``PREP Act'').\127\ This act extended targeted
liability protections for pandemic and epidemic products and
security countermeasures:
---------------------------------------------------------------------------

    \127\ 42 U.S. Code Sec.  247d-6d at Health Resources & Services
Administration, https://www.hrsa.gov/sites/default/files/gethealthcare/conditions/countermeasurescomp/covered_countermeasures_and_prep_act.pdf accessed July 2020.

Subject to the other provisions of this section, a covered person
shall be immune from suit and liability under Federal and State law
with respect to all claims for loss caused by, arising out of,
relating to, or resulting from the administration to or the use by
an individual of a covered countermeasure if a declaration under
subsection (b) has been issued with respect to such
countermeasure.\128\
---------------------------------------------------------------------------

    \128\ 42 U.S. Code Sec.  247d-6d at Health Resources & Services
Administration, https://www.hrsa.gov/sites/default/files/gethealthcare/conditions/countermeasurescomp/covered_countermeasures_and_prep_act.pdf accessed July 2020.

    In a declaration effective February 4, 2020, the Secretary of
Health and Human Services ``invoked the PREP Act and declared
Coronavirus Disease 2019 (COVID-19) to be a public health emergency
warranting liability protections for covered countermeasures.''
\129\ There is currently substantial discussion regarding a
legislative proposal to limit the liability of entities recommencing
operations in the face of the COVID-19 pandemic.\130\
---------------------------------------------------------------------------

    \129\ Congressional Research Service, The PREP Act and COVID-19:
Limiting Liability for Medical Countermeasures, at https://crsreports.congress.gov/product/pdf/LSB/LSB10443 accessed July 2020.
    \130\ See, for example, Andrew Duehren, ``Senate GOP Aims to
Funnel Covid Liability Cases to Federal Courts,'' The Wall Street
Journal, July 16, 2020, https://www.wsj.com/articles/gop-senators-move-ahead-with-coronavirus-liability-plan-11594929198?mod=searchresults&page=1&pos=3 (accessed December 2020)
and a version of this article on page A4 of the July 17, 2020 print.
    The proposal, which the White House is reviewing, temporarily
offers schools, businesses, health-care providers and nonprofit
organizations legal protections when people allegedly exposed to the
coronavirus sue them, according to a summary seen by The Wall Street
Journal.
    Under the proposal, defendants in those cases would only be held
liable if they didn't make reasonable efforts to comply with public-
health guidelines and instead demonstrated gross negligence or
intentional misconduct, according to the summary. The defendants
would have the right to move the case to federal court if they so
choose, offering a potentially more favorable alternative to state
courts.
    For coronavirus-related personal injury and medical liability
cases, the plan also sets a clear-and-convincing-evidence burden of
proof, places a cap on damages and heightens pleading standards. . .
.
    The legislation from Messrs. McConnell and Cornyn also shields
employers from lawsuits arising from coronavirus testing in the
workplace and from agency probes for steps they took to comply with
stay-at-home orders. The Republicans also want to limit liability
for new types of personal protective equipment if the equipment
meets certain federal standards.
---------------------------------------------------------------------------

    The parallel between the public policy for vaccines and the role
of CAT LLC to improve investor protection and promote market
integrity, particularly during times of market stress, while not
exact, is useful. In this metaphor, cyber criminals play the role of
viruses. Society has an interest to promote the development of a
vaccine to combat the pandemic or to use the CAT to help regulate
financial markets to promote the public good. Limiting liability is
one way to do so.
    There is a third, simultaneously more expansive and more focused
example--financial solvency regulation. This is again ubiquitous and
multifaceted--deposit insurance, pension guaranty coverage,
insurance guaranty associations, etc. working across many types of
financial institutions and products. These programs provide various
customers and other stakeholders the

ability to seek compensation for claims they have against the assets
of a financial institution that is declared insolvent by the
regulator overseeing the firm. Bank deposit insurance is a pre-
funded plan financed through fees paid by regulated entity. State
insurance guaranty funds are generally financed by ex post
assessments required of insurers still solvent in a state after
another insurer is declared insolvent by the regulator. Several
other programs exist with varying details. It is possible a
mechanism could be established that would create a pool of funds
that could be used to compensate those who suffer losses due to a
cyber breach of CAT. While developing a specific recommendation is
beyond the scope of this assignment, we present several initial
ideas in the next section of this White Paper.
    Finally, there are risks that are just part of doing business
that cannot be avoided or transferred to other parties through
contract or insurance. The mere act of investing entails risk, for
example, and the SEC is charged with managing and mitigating this
risk for investors and the economy while simultaneously obtaining
the benefits of the capital markets. Industry Members, for example,
assume risks associated with transacting with their customers. While
most are legal and legitimate, malicious parties do transact in the
securities markets. The SEC has mandated that broker-dealers ``know
their customer'' and although broker-dealers make extensive efforts
to comply with this mandate, bad actors slip through. Industry
Members also assume counterparty risk. There are mechanisms in place
to mitigate and remediate this risk, but it can never be completely
eliminated. There are also other legislative, regulatory, and
political risks associated with the securities markets.
    A certain level of cyber risk is already present in the normal
business operations of the Industry Members. They accept (and
manage) these risks in the expectation that they will obtain a
profit from the activities that embed the risks. They have expressed
concern over a possible expansion of those cyber risks to themselves
and their clients as a result of the mandated transmission of
information to the CAT. This transmission was mandated, and is
governed, by the primary federal regulator of the Industry Members'
activities. The CAT does not exist to serve customers and obtain a
profit, but to help the SEC and the SROs in their regulation of the
U.S. equity and option markets. While the Industry Members' concern
over a possible increase in cyber risk exposure may be
understandable in certain contexts, their position that the CAT and
the Plan Processor be denied a limitation on liability essentially
shifts the burden of cyber risk onto the regulators and regulatory
process. As explained above, the SEC has already implemented
standards, policies, and practices to mitigate cyber risk in the
system as a whole.

E. Initial Thoughts on Funding Compensation Mechanisms

    While we have concluded above that the regulatory approach to
the CAT's cyber security is preferred over a litigation approach
because overall social costs of control would be lower and there is
no meaningful benefit from adding a litigation option as proposed by
Industry Members, there is still a risk that Industry Members or
their customers could be harmed in the case of a significant cyber
breach. The current regulatory approach is generally silent on the
possibility of compensating third parties in the case of a CAT cyber
breach. Of concern here is the possibility of a previously unseen
cyber event that results in a high damage/severity ``black swan''
type event.
    There are, however, several approaches to designing and funding
potential compensation mechanisms.
    The use of cyber insurance, for example, could be advantageous.
Cyber coverage can be purchased as part of a package of business
insurance (property-casualty and liability) or as a stand-alone
policy. According to information supplied to state regulatory
authorities in the U.S., in 2019 stand-alone cyber policies
exhibited somewhat higher premium receipts than cyber coverage
included in broader packages--$1.26 billion and $1 billion,
respectively.\131\ This was an 11 percent increase from 2018, with
192 insurers reporting direct cyber written premium in 2019.\132\
Between 2017 and 2019, the number of cyber claims doubled to
18,000.\133\ Over the 2015 through 2019 period, paid losses plus
defense costs ranged from just under 30% to just above 50% of
premiums.\134\ The reported 2019 expense ratio for cyber coverage
averaged just under 30% of premiums.\135\ In 2019, almost two-thirds
of the cyber claims were for first-party losses with the remaining
being for third-party losses.\136\
---------------------------------------------------------------------------

    \131\ Aon plc, US Cyber Market Update: 2019 US Cyber Insurance
Profits and Performance, June 2020, p. 3, Exhibit 2, http://thoughtleadership.aon.com/Documents/202006-us-cyber-market-update.pdf accessed July 2020. Very similar figures were reported by
A.M Best--$1.26 billion for stand-alone and $988 million for package
policies. Erin Ayers, ``US cyber market keeps growing, but pace
slowed: AM Best,'' Advisen Front Page News, July 22, 2020 accesed
August 2020.
    \132\ Aon plc, US Cyber Market Update: 2019 US Cyber Insurance
Profits and Performance, June 2020, p. 3, Exhibit 1, http://thoughtleadership.aon.com/Documents/202006-us-cyber-market-update.pdf accessed July 2020.
    \133\ Erin Ayers, ``US cyber market keeps growing, but pace
slowed: AM Best,'' Advisen Front Page News, July 22, 2020 accessed
August 2020.
    \134\ Aon plc, US Cyber Market Update: 2019 US Cyber Insurance
Profits and Performance, June 2020, pp. 4-5, Exhibits 3 and 4,
http://thoughtleadership.aon.com/Documents/202006-us-cyber-market-update.pdf accessed July 2020.
    \135\ Aon plc, US Cyber Market Update: 2019 US Cyber Insurance
Profits and Performance, June 2020, p. 7, Exhibit 7, http://thoughtleadership.aon.com/Documents/202006-us-cyber-market-update.pdf accessed July 2020. The expense ratio combines the
selling and underwriting costs of a coverage and divides that by the
premium receipts associated with that coverage.
    \136\ Aon plc, US Cyber Market Update: 2019 US Cyber Insurance
Profits and Performance, June 2020, p. 9, Exhibit 10, http://thoughtleadership.aon.com/Documents/202006-us-cyber-market-update.pdf accessed July 2020. The expense ratio combines the
selling and underwriting costs of a coverage and divides that by the
premium receipts associated with that coverage.
---------------------------------------------------------------------------

    The use of cyber insurance extends the assets available to
compensate injured parties and therefore mitigates some of the
judgement-proof problem discussed above. While the cyber insurance
market is relatively new and undeveloped compared to a number of
other coverages,\137\ it focuses on understanding and quantifying
the frequency and severity of cyber breaches along with efforts to
identify and promote methods to mitigate those risks. Reinsurance
companies, in particular, ``can help to develop products and share
underwriting know-how, including modeling experience. . . Reinsurers
can also play a role in establishing cyber ecosystems by offering
holistic cyber solutions through services and relationships with
cybersecurity companies, specialized managing general agents, or
insurtech companies.'' \138\ Assuming that an insurer's cyber
coverage premium to the CAT and the Plan Processor is related to an
informed evaluation of the risks posed, cyber premiums can provide
additional incentives to the CAT and the Plan Processor to
internalize the cost of its security decisions and actions.\139\ If
cyber insurance rates reflect anticipated costs of the cyber risks,
and CAT LLC and FINRA CAT pay the premiums, then the CAT's costs
incorporate (internalize) the expected costs of a cyber breach under
the terms of the coverage.
---------------------------------------------------------------------------

    \137\ ``Insured cyber losses remain a fraction of total economic
cyber losses caused by cybercrime, with about $6 billion of insured
losses in total (affirmative and nonaffirmative [e.g., ``silent'']
cyber losses), versus $600 billion of economic losses in 2018.'' S&P
Global Ratings, Global Reinsurance Highlights 2019, p. 29. See also,
Sasha Romanosky, Lillian Ablon, Andreas Kuehn and Therese Jones,
``Content Analysis of Cyber Insurance Policies: How Do Carriers
Price Cyber Risk?'' Journal of Cybersecurity, 2019, pp. 1-19.
    \138\ S&P Global Ratings, Global Reinsurance Highlights 2019, p.
31.
    \139\ Romanosky et al (2019) report that while some insurers
currently employ sophisticated pricing algorithms and incorporate
specific security information to determine the premiums they charge
for cyber insurance, at present the majority of the market uses
relatively simple rate forms and generic self-assessed risk
vulnerability categorizations (e.g., low, medium, high). As recent
demand growth has been high and profitability strong, we expect more
insurers will continue to enter this market that will then attract
additional industry vendors, capital markets risk intermediaries,
risk modeling firms, reinsurers, and brokers, etc., to also enter
the market. The increased competition will bring increasing levels
of sophistication and with it we expect insurance premiums will
become more and more risk sensitive over time. See Sasha Romanosky,
Lillian Ablon, Andreas Kuehn and Therese Jones, ``Content Analysis
of Cyber Insurance Policies: How Do Carriers Price Cyber Risk?''
Journal of Cybersecurity, 2019, pp. 1-19.
---------------------------------------------------------------------------

    For many insurers, cyber coverage entails a relatively high
degree of monitoring of the insureds. The insurers also have on
retainer cyber mitigation and remediation experts that are
independent of the insureds and focused on reducing the risk of
cyber incursion. A 2017 publication by the Organisation for Economic
Co-operation and Development (``OECD'') noted the following:

In addition to providing insurance coverage for the expenses
incurred as a result of a cyber incident, many insurance companies

provide additional services with their policies, either as risk
management advice during the underwriting process, as a means to
reduce vulnerability to cyber incidents during the period of
coverage or in order to reduce the impact of cyber incidents that
occur. The first two types of services are often referred to as pre-
breach services or risk mitigation services while the latter type is
identified as post-breach or response services. Some insurance
companies have developed significant internal expertise and offer
these types of services directly, while others have developed
networks and/or partnerships with a variety of service providers,
often involving some form of discounted pricing for its
policyholders (e.g. information technology security consultants,
legal firms, public relations firms, etc.)

. . . [S]ome insurance companies provide specific risk assessment
services as part of the underwriting process (sometimes even if no
insurance coverage is entered into) ranging from online or onsite
security assessments to advice on security policies and practices,
to vulnerability scans and penetration testing which should benefit
both the insurance company and the company's risk management
(omitted internal cites). Insurance companies are also offering an
assortment of risk mitigation services during the coverage period,
including threat and intelligence warnings and detection, access to
specialised protection technologies, preparation and testing of
contingency plans, helplines or information portals and employee
training (omitted internal cites).

A range of services for managing the impact of a cyber incident are
also being offered, including forensic investigative services
necessary to identify the source of any breach, legal assistance to
help manage legal and regulatory requirements and potential
liability, providers of call centre capacity, notification services,
credit monitoring and/or identity theft protection to support
interaction with affected clients, and public relations companies to
minimise the reputational impact of cyber incidents (omitted
internal cites).
According to one survey, 70% of insurers provide (or plan to
provide) cyber risk mitigation or response services . . . .
Seventeen of the 23 policies reviewed by the OECD advertised access
to risk mitigation and/or response services. . . .\140\
---------------------------------------------------------------------------

    \140\ Organisation for Economic Co-operation and Development,
Enhancing the Role of Insurance in Cyber Risk Management, (2017),
Chapter 3, ``The cyber insurance market,'' pp. 75-76, https://www.oecd-ilibrary.org/docserver/9789264282148-5-en.pdf?expires=1595620895&id=id&accname=guest&checksum=84A71DC31B31AD5ADA3B29E4BCA3BD62 accessed July 2020.

    A manuscripted (i.e., customized), stand-alone cyber insurance
policy for CAT could be combined with other approaches. If the SEC
were to approve such an arrangement, the CAT and/or the Plan
Processor could issue insurance linked securities, such as industry
loss warranties or catastrophe bonds that could attract capital
market investors to underwrite the losses in addition to insurers
and reinsurers. Industry loss warranties are insurance or
reinsurance contracts in which coverage is triggered by an industry-
wide loss or by an index exceeding some pre-specified amount.
Catastrophe bonds are fixed income instruments where the ``debtor''
(the CAT or the Plan Processor) pays ``interest'' (similar to
premiums) to the ``creditor'' (the ``insurer'' or the ``capital
market investor''), who does not lend the money but promises to pay
the funds should a specified cyber event happen.\141\
---------------------------------------------------------------------------

    \141\ ``The Singaporean government's plans to introduce a
commercial cyber pool with re/insurers and insurance-linked security
(ILS) backing capacity is a recent example. However, before ILS
investors will accept cyber risk as a potential investment
opportunity, the market will need to enhance its ability to model
this risk as well as have a longer track record.'' S&P Global
Ratings, Global Reinsurance Highlights 2019, p. 31.
---------------------------------------------------------------------------

    At present, we are aware of a few cyber-related industry loss
warranties that have been issued.\142\ No cyber catastrophe bond has
yet been issued, but industry observers suggest now may be the time
to see such an advance. Commenting on the state of the cyber
insurance market, the enormous potential size of the economic losses
due to cyber events, and the recent growth of cyber-related
insurance premiums, Standard & Poor's believes it is only a matter
of time before industry capacity will be insufficient alone to
satisfy demand and that governments and capital markets will come
together with the industry to create markets that can meet the
capacity requirements for cyber coverage.\143\
---------------------------------------------------------------------------

    \142\ Shah, Syed Salman, and Ben Dyson, ``Cyber insurance-linked
securities have arrived, but market still in infancy,'' S&P Global
Market Intelligence, https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/cyber-insurance-linked-securities-have-arrived-but-market-still-in-infancy-46915334
accessed September 2020.
    \143\ Bender, Johannes, Manuel Adam, Robert J Greensted, Jean
Paul Huby Klein, Milan Kakkad, and Tracy Dolin, ``Global Reinsurers
Face the Iceberg Threat Of Cyber Risk,'' Global Reinsurance
Highlights 2019 (2019) pp. 28-31.
---------------------------------------------------------------------------

    We mentioned earlier in the White Paper that several funding
mechanisms exist to compensate the customers of financial
intermediaries, subject to limits, including banks, credit unions,
and insurance companies. Under the auspices of the SEC, one could
also imagine self-funding a third-party compensation program. Some
combination of any of these approaches, and others, might be
considered. The goal here is to mitigate the damages of a cyber
breach and compensate affected third parties in the lowest cost
fashion. Industry Members should recognize that, ultimately, it is
they, the SROs, and especially their customers that will pay all the
costs of the CAT.

IV. Conclusion

    This White Paper investigates the SEC's regulatory approach to
the CAT's cyber security and conducts an economic analysis to
examine whether adding an ability for Industry Members to litigate
in the event of a CAT cyber breach creates socially optimal
incentives for controlling the cyber risk exposures faced by CAT
over a regulation alone approach.
    As explained in this White Paper, the economic role of
litigation is to provide meaningful ex-ante incentives for first
parties to internalize the harms potentially caused to third parties
by their economic activities through the threat they may face ex
post litigation filed by the injured third parties. Regulation,
however, also provides meaningful incentives for first parties to
internalize the harms they may potentially cause to third parties by
compelling first parties to follow a set of rules and procedures
proscribed by a regulator before the economic activity commences.
    An economic analysis of the circumstances attending the CAT
shows that regulation by the SEC already properly incentivizes the
Participants to recognize and address the risks that a CAT cyber
breach poses to third parties such as Industry Members. We further
show that the possibility of permitting litigation by Industry
Members in addition to the regulatory regime will not meaningfully
increase CAT's incentives to manage its exposure to cyber risk, yet
it will significantly increase the costs (which will ultimately be
passed on to retail investors) that it bears to do so. Our analysis
suggests that the ex-ante regulation approach alone leads to the
socially optimal outcome.
    Accordingly, our analysis of the respective benefits of ex-ante
regulation compared with ex post litigation indicate that the
limitation of liability in the proposed CAT Reporter Agreement will
serve the public interest.
    The authors of this paper are employed by, or affiliated with,
Charles River Associates (CRA). The conclusions set forth herein are
based on independent research and publicly available material. The
views expressed herein are the views and opinions of the authors
only and do not reflect or represent the views of Charles River
Associates or any of the organizations with which the authors are
affiliated. Any opinion expressed herein shall not amount to any
form of guarantee that the authors or Charles River Associates has
determined or predicted future events or circumstances and no such
reliance may be inferred or implied. The authors and Charles River
Associates accept no duty of care or liability of any kind
whatsoever to any party, and no responsibility for damages, if any,
suffered by any party as a result of decisions made, or not made, or
actions taken, or not taken, based on this paper. Detailed
information about Charles River Associates, a registered tradename