“The SEC’s rationale, under which the statute must be construed to broadly cover all systems public companies use to safeguard their valuable assets, would have sweeping ramifications,” Engelmayer wrote in a 107-page choice.
“It could empower the agency to regulate background checks used in hiring nighttime security guards, the selection of padlocks for storage sheds, safety measures at water parks on whose reliability the asset of customer goodwill depended, and the lengths and configurations of passwords required to access company computers,” he wrote.
The federal decide in Manhattan additionally dismissed SEC claims that SolarWinds’ disclosures after it realized its clients had been affected improperly lined up the gravity of the breach, in which Russian intelligence brokers had been accused of burrowing by means of SolarWinds software program for greater than a yr to get inside a number of federal companies and large tech corporations. U.S. authorities described the operation, disclosed in December 2020, as one of essentially the most critical in latest years, and its ramifications are nonetheless taking part in out for the federal government and trade.
In an period when deeply damaging hacking campaigns have change into commonplace, the swimsuit alarmed enterprise leaders, some safety executives and even former authorities officers, as expressed in friend-of-the-court briefs asking that it’s thrown out. They argued that including legal responsibility for misstatements would discourage hacking victims from sharing what they know with clients, traders and security authorities.
Austin-based Solar Winds mentioned it was happy that the decide “largely granted our motion to dismiss the SEC’s claims,” including in an announcement that it was “grateful for the support we have received thus far across the industry, from our customers, from cybersecurity professionals, and from veteran government officials who echoed our concerns.”
The SEC didn’t instantly reply to a request for remark.
Engelmayer didn’t dismiss the case totally, permitting the SEC to attempt to present that SolarWinds and high safety govt Timothy Brown dedicated securities fraud by not warning in a public “security statement” earlier than the hack that it knew it was extremely susceptible to assaults.
The SEC “plausibly alleges that SolarWinds and Brown made sustained public misrepresentations, indeed many amounting to flat falsehoods, in the Security Statement about the adequacy of its access controls,” Engelmayer wrote. “Given the centrality of cybersecurity to SolarWinds’ business model as a company pitching sophisticated software products to customers for whom computer security was paramount, these misrepresentations were undeniably material.”
