Regulators last year issued the SEC’s first-ever privacy fine against broker-dealer GunnAllen for failing to protect customer data. But former IT staffers say regulators didn’t seem to know half of this cautionary tale of outsourcing and oversight gone wrong.
Mathew J. Schwartz adds some mind-boggling details to the case:
Dan Saccavino, a former Revere Group employee who at the time served at GunnAllen as the IT manager in charge of the help desk, laptops, and desktops, says he and another network engineer eventually pinpointed the cause of the slowdown: A senior network engineer had disabled the company’s WatchGuard firewalls and routed all of the broker-dealer’s IP traffic–including trades and VoIP calls–through his home cable modem. As a result, none of the company’s trades, emails, or phone calls were being archived, in violation of Securities and Exchange Commission regulations.
Despite the fact that at least five people at The Revere Group knew about the engineer’s action, it’s unclear whether it was reported at the time to GunnAllen or regulators. The SEC didn’t reference the incident in a subsequent announcement about a settlement with GunnAllen for unrelated privacy and data security violations, and interviews with former Revere Group employees reveal that regulators may have known about only a fraction of the data security failures at the firm.
Read more on InformationWeek. There was just so much wrong, and it’s not clear whether government regulators did a thorough enough job in a timely fashion that might have better protected consumers.