Speech by SEC Staff:
Conflicts Between Public Accountability and Individual Privacy in SEC Enforcement Actions

Remarks By

Thomas C. Newkirk, Associate Director
Richard C. Sauer, Assistant Director
Robert J. Keyes, Branch Chief

Division of Enforcement
U.S. Securities and Exchange Commission
Washington, D.C.

The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by any of its employees. The views expressed herein are those of Mr. Roye and do not necessarily reflect the views of the Commission, the Commissioners, or other members of the Commission's staff.

In the United States, as elsewhere in the world, the public interest in effective law enforcement is often in conflict with the public's concern for the privacy of personal financial and other sensitive information. During recent decades, the federal government has compiled increasing quantities of data on its citizens. This has proven necessary to determine who qualifies for various benefit programs, to monitor compliance with anti-discrimination statutes and to pursue various other social goals. In addition, improved technology has greatly improved the capability of the government to compile and retrieve information about individuals. This burgeoning governmental information gathering, however, has brought with it an increasing concern over its potential to intrude into the private lives of the citizenry.

The concern over the possible erosion of personal privacy through government action appears in many current controversies that do not directly implicate the enforcement mission of the Securities and Exchange Commission (SEC). It deeply informs, for example, the debate over when law enforcement agencies should be able to defeat electronic message encryption technology.¹ It also appears in the heated resistance to attempts by U.S. banking regulators to codify certain Know Your Customer regulations intended to prevent money laundering.²

This policy conflict has also been reflected, however, in various limitations placed by Congress on the powers of the SEC to investigate instances of securities fraud. Certain of these limitations are not found in specific statutory prohibitions, but are matters of congressional omission. For example, Congress has never deigned to provide the SEC, a civil agency, with certain powers it has granted federal criminal authorities (such as the power to use wiretaps or mail covers or to obtain search warrants or grand jury subpoenas).

Other limitations on the SEC's investigative reach are matters of affirmative statutory provision. For example, the SEC is barred from obtaining federal income tax returns from the Internal Revenue Service, although it may obtain returns directly from taxpayers or their accountants.³ In addition, the Fair Credit Reporting Act⁴ restricts the SEC's access to information held by credit bureaus by prohibiting them from releasing information for other than business purposes (to determine credit worthiness, for example), except pursuant to a court order, which the SEC can obtain only in the context of district court litigation, or a federal grand jury subpoena, which, as a civil agency, the SEC cannot obtain at all.⁵

The three federal statutes that most significantly affect the SEC's access to information about individuals,⁶ however, are the Privacy Act of 1974,⁷ which mandates that the SEC staff make certain disclosures to individuals from whom we solicit information; the Right To Financial Privacy Act,⁸ which concerns access to certain financial records; and the Electronic Communications Privacy Act,⁹ which protects the contents of certain electronic communications. This article describes the operation of these three statutes and their consequences for the SEC's enforcement program. Our emphasis throughout will be on the practical question of how the SEC staff adheres to the requirements of these statutes without sacrificing our effectiveness as a law enforcement agency. We conclude with a case study illustrating the effect of these three statutes on one recent enforcement action.

The Privacy Act

The Privacy Act of 1974 does not place substantive limitations on the types of information that may be obtained by the SEC staff. It does, however, require that we make certain disclosures whenever we seek personal information from members of the public. Specifically, we must notify every individual from whom we request information:

(a) the authority for the request;

(b) whether providing the information is mandatory or voluntary;

(c) the purpose for which the information is being gathered;

(d) the uses to which the information may be put; and

(e) the effects, if any, of the individual's failure to provide the information.

In compliance with this statute, the staff routinely includes a printed notice of "routine uses" with every subpoena and document request,¹⁰ and recites a litany of warnings when contacting people for information over the telephone.

The primary, and indeed only substantial, effect of the Privacy Act on our investigations is that it precludes the staff from conducting covert inquiries. Because the required disclosures include the agency's authority for the request, and hence its identity, the Privacy Act effectively hangs a bell on us announcing our presence as a law enforcement agency. In the great majority of cases, our identity is the first thing we wish to communicate to individuals from whom we seek information, and this requirement is therefore of little consequence. It does prove problematic, however, in certain cases in which we wish to obtain and document false statements made to prospective investors.¹¹ Unlike the criminal authorities, the SEC cannot, for example, place a staff member undercover at a penny stock firm to determine what its brokers are telling investors to induce them to purchase dubious securities. In the area of internet stock offerings, the requirement that we announce who we are can be particularly frustrating. It has become common for "investment opportunities" to be offered over the internet through two stage communications. In the first, glowing but vague representations are made about the nature of the company and its business. Interested parties are invited to submit basic personal information to receive additional materials about the offering. Clearly, receiving an inquiry labeled as coming from the SEC is likely to alert all but the most obtuse fraud artists that they should be careful in what they say. Thus it may be difficult for the SEC staff to determine what representations are being made to actual investors.

The Right to Financial Privacy Act

Congress enacted the Right to Financial Privacy Act (RFPA) in 1978¹² in response to a U.S. Supreme Court decision, U.S. v. Miller,¹³ holding that individuals have no constitutional right to privacy in the account records maintained by their banks. Unhappy with this result, Congress through the RFPA conferred limited rights of privacy on certain bank customers. These include the right to be informed whenever a federal agency subpoenas their account records, and to challenge such subpoenas in federal court. In addition, a federal agency may not transfer to another federal agency any bank customer records obtained pursuant to the RFPA without further notice to the customer.

The statute, however, is subject to many limitations. The RFPA defines "customer" narrowly as including only individuals and small partnerships. Corporations are not within the statute's purview.¹⁴ Also, the "financial institutions" whose records are covered by the RFPA are generally banks and similar depository institutions, and not securities firms. Thus, the SEC does not need to comply with any provisions of the RFPA to obtain the brokerage account records of individuals.

Moreover, the RFPA narrowly circumscribes the grounds on which a "customer" may challenge a subpoena for his bank account records. These grounds are that:

• the financial records sought are not relevant to the investigation, or

• the procedural requirements of the RFPA were in some manner violated.¹⁵

In fact, so narrow are these criteria that RFPA subpoenas are rarely contested. In those cases in which motions to quash RFPA subpoenas are filed, the SEC has generally prevailed for two reasons. First, the SEC subpoenas personal financial information only when there exists a clear need for the information, and then strictly adheres to the procedural requirements of the statute. Second, the courts have generally been disinclined to second guess the SEC staff on questions of relevancy. For example, in connection with an insider trading investigation, the SEC issued RFPA subpoenas to two New York banks for the records of a resident of England. The SEC believed that the New York bank records would show fund transfers relating to the suspected insider trading. The District Court for the Southern District of New York denied the account holder's motion to quash, holding that the SEC's burden under the RFPA is satisfied if it shows "a reasonable belief that the records sought are relevant."¹⁶ Similarly, in denying a motion to quash an SEC subpoena in the recent investigation concerning Solv-Ex Corporation, the District Court for the District of Connecticut concluded that "[i]nformation sought pursuant to an agency subpoena is relevant if it `touches a matter under investigation.'"¹⁷

Therefore the RFPA, like the Privacy Act, affects the SEC's process largely through the imposition of notice requirements. And even these requirements are subject to qualification. In extending the protections of the RFPA to SEC investigations, Congress expressly authorized that customer notice may be delayed upon a showing of necessity made to a U.S. District Court. This permits the SEC to obtain bank records without first alerting the account holder by showing that, for example, notice would likely result in the transfer of funds outside the U.S.¹⁸

The Electronic Communications Privacy Act

To address privacy concerns raised by new forms of communications technology, Congress in 1986 enacted the Electronic Communications Privacy Act. "ECPA" protects from disclosure the contents of e-mails and other forms of communications that are stored by "electronic communications service providers," such as Microsoft's MSN, America Online and other commercial providers of internet access.¹⁹

Under ECPA, if an electronic communication has been stored less than 180 days, its disclosure by a service provider may be compelled only pursuant to a criminal warrant.²⁰ Because the SEC has no ability to procure criminal warrants, this statute effectively precludes it from obtaining e-mail messages from service providers when the messages are less than 180 days old. The SEC can subpoena messages older than 180 days, after notice to the customer.²¹ Few service providers store e-mail messages for more than six months, however, so this power is of limited utility unless they prove willing to store messages past the 180 period when notified of the SEC's interest.

Voice-mail messages are placed completely out of bounds by ECPA. Although telephone companies in the United States did not typically provide voice-mail services at the time ECPA was originally enacted, many do now. Under ECPA, electronically stored voice messages are wire communications that may be obtained by the government only with court authorization under the wiretap provisions of the statute. This effectively prevents the SEC from obtaining the contents of voice-mail messages from third party service providers.

ECPA does permit the SEC to obtain from electronic communication service providers certain transactional information. Specifically, the SEC may, without notice to the customer, subpoena a customer's name, address, billing records, and various other identifying information, not including, of course, the actual content of the customer's electronic messages.²² Such transactional information may be highly significant when investigating internet stock manipulations. For example, ECPA permits the SEC to obtain the identity of individuals who post messages on internet bulletin boards or participate in real-time discussions in chat rooms while using "screen names" that conceal who they are.

Moreover, nothing in ECPA prevents the SEC from using its subpoena power to obtain e-mails and voice-mails from sources other than an electronic communication service provider, such as, for example, the sender or the recipient of the message. Similarly, ECPA does not pose an obstacle to governmental access to voice-mail messages maintained by a business entity on its own recording system, or to e-mails stored by an entity on its own local area network.

PairGain: A Case Study

Many of the points mentioned above are illustrated by the recent internet hoax case involving the stock of the U.S. company PairGain Corporation.²³ In that matter an individual, later identified as PairGain employee Gary Dale Hoke, posted a message on an internet bulletin board maintained by Yahoo! stating that PairGain had announced its pending acquisition by an Israeli company. That message provided an electronic link to a purported Bloomberg News Service web page describing the acquisition. Although very plausible in appearance, the page was a fraud. It had been created by Hoke and the pending merger it announced was pure fiction. The share price of PairGain stock rose about 31% on heavy volume in reaction to Hoke's postings before PairGain and Bloomberg issued press releases stating that the postings were bogus.

Seeking to identify the person behind the postings, the SEC sent subpoenas to Yahoo! and to Angelfire, the provider of the web page on which the false Bloomberg story was posted, to obtain transactional and customer identifying information. As noted, ECPA does not restrict the SEC's access to this type of information. Although Hoke had used a false name and address in opening his accounts with both Yahoo and Angelfire, he inadvertently provided information to them that led to his identification.

First, Angelfire provided information indicating that the web page had been created by an individual using the free internet e-mail service HotMail. The customer information provided to open that account was also fictional, but HotMail's records included the Internet Protocol Address used to set up the account. Analogous to a telephone number, an "IP" address is a numerical code that tells the internet how to route messages. In this case it denoted a computer at PairGain itself. Specifically, it was the computer used by the company as a "firewall" between its internal computer system and the internet. Nothing in ECPA prohibits the SEC from tracing internet communications through IP addresses, even if the content of those messages is protected. The SEC's inquiry spurred an internal inquiry by PairGain that examined, among other things, the content of company hard-drives. Information produced by this inquiry and provided to the SEC indicated that the Yahoo! posting had come from an employee of PairGain's North Carolina office, Gary Hoke. Because PairGain is not an electronic communication service provider, ECPA did not restrict our ability to obtain this information.

The Angelfire web page, after its creation, had been accessed over 30 times from three IP addresses to put up and edit the phony Bloomberg page. One of these addresses was, again, the PairGain firewall. The second belonged to a high-tech company in North Carolina where Hoke was employed on a part time basis. Company records established that Hoke had been on the premises at the critical time. (None of this information engaged the protections of any federal privacy statute.)

The third IP address was from the internet service provider Mindspring. A subpoena to Mindspring specifying the activity time on the account revealed the account holder to be Gary Hoke. Mindspring had also captured the telephone number used to access the account. It was that of Hoke's residence. Again, this type of transactional and customer identifying information is available by subpoena under ECPA.

Tracing the Yahoo! posting back to its source was a similar process. The Yahoo! account was opened through the same HotMail account used to create the fake Bloomberg page. Again HotMail's system revealed that the communication had come from the internet service provider Mindspring, and again Mindspring's records tied the specific activity time for the communication to the account of Hoke.

With the subpoenas to HotMail, Angelfire, Yahoo! and Mindspring, we included a printed statement of the disclosures mandated by the Privacy Act. Otherwise that statute had no substantive effect on the investigation.

In pursuing the investigation further, we were able to obtain Hoke's brokerage account records without implicating the Right to Financial Privacy Act because a brokerage firm is not a "financial institution" covered by that Act. These records revealed that although Hoke owned PairGain stock, he had not sold any of it during the brief spike in its share price. We also obtained Hoke's telephone records to determine if he had been communicating with anyone else who might have traded stock on his behalf. Section 2703(c) of ECPA confirms the SEC's ability to subpoena such records.²⁴ Finally, we obtained Hoke's bank records to see if he had obtained funds from any other person who might have traded in PairGain stock during the period of the manipulation and shared his profits with Hoke. Here we complied with the customer notice and other procedural requirements of the RFPA.²⁵

The only information relevant to this investigation that we were not able to obtain by subpoena was the content of Hoke's e-mails stored at HotMail. Because these messages were less than 180 days old during the investigation, ECPA put them out of our reach. However, the FBI, which was conducting a parallel investigation, obtained those e-mails with a search warrant and was not legally precluded from making them available to the SEC.²⁶ Illustrating that compliance with all applicable privacy requirements need not seriously impede the SEC's investigations, the staff filed a civil injunctive action against Hoke, based on an extensive evidentiary record, less than two weeks after his fraudulent internet postings.

Conclusion

The statutory protections of the privacy rights of individuals described above come into play in a substantial number of SEC inquiries. Nevertheless, compliance with these statutes does not, in all but a few cases, seriously impede the SEC's investigative reach. In its own investigations and in the assistance it renders to the regulators of other nations, the SEC has succeeded in respecting legitimate claims of privacy without significantly compromising its effectiveness in its law enforcement mission.

Footnotes