At SEC: Porn Surfing Down, Waste Up, Stunning Disregard For Basic Computer Security

from the 'password'-is-not-a-good-password dept

An internal investigative report of the SEC’s Trading and Markets division has been recently been reviewed by Reuters. After reading its rundown of the misdeeds and abuses uncovered, I’m left with the urge to laugh maniacally in the manner of someone having just cleared the tipping point and now sliding irretrievably into insanity. The sheer irresponsibility on display here springs from the sort of irredeemable carelessness that comes with spending other people’s money (taxes) and operating without any credible oversight or accountability (a large percentage of government entities).

Bess Levin at Dealbreaker points out that while the SEC’s internal investigation may have turned up several misdeeds, ranging from the merely stupid to the positively horrendous, it is quite a step up from the insatiable pornhounds that used to populate the Commission:

If you had asked us two years or two months or two days ago if we thought that there would be a time in the near future when Securities and Exchange employees would not be regularly reprimanded for watching porn on their work-issued computers for 98 percent of the workday, we would have said absolutely not. No judgment, but in our professional opinion, people do not go from, among other things:

* Receiving “over 16,000 access denials for Internet websites classified by the Commission’s Internet filter as either “Sex” or “Pornography” in a one-month period”

* Accessing “Internet pornography and downloading pornographic images to his SEC computer during work hours so frequently that, on some days, he spent eight hours accessing Internet pornography…downloading so much pornography to his government computer that he exhausted the available space on the computer hard drive and downloaded pornography to CDs or DVDs that he accumulated in boxes in his office.”

…to living a porn-free existence at l’office.

Truly a mind-boggling set of employees. One regional staff accountant ran into the “no-porn” wall 1,800 times in a two week period, yet remained undeterred. Those caught accessing porn with ridiculous frequency cited the “stress” of their jobs as the underlying reason for the nearly uninterrupted pornathons.

But this porn-heavy chapter in the SEC’s history is now behind them, according to an internal investigative report viewed by Reuters. Moving boldly forward, the SEC has apparently ushered in a new wave of semi-competence, the sort befitting an agency that is entrusted with keeping our financial systems free of corruption. So, how is the New, Improved SEC doing?

Several Securities and Exchange Commission staffers responsible for monitoring the markets and exchanges broadly misused computer equipment to download music and failed to properly safeguard sensitive information, a report has found.

Well, that’s one strike for infringement and one strike for not securing sensitive information. “Securing information” seems to be something the SEC’s Trading and Markets division is particularly bad at. To say this is ironic would be a colossal understatement, considering the government’s current obsession with all things “cyber.”

The report also found that the staffers failed to protect their computers and devices from hackers, even as they were urging exchanges and clearing agencies to do just that.

Although no breaches occurred, the staffers left sensitive stock exchange data exposed to potential cyber attacks because they failed to encrypt the devices or even install basic virus protection programs.

The report says the staff may have brought the unprotected laptops to a Black Hat convention where hacking experts discuss the latest trends. They also used them to tap into public wireless networks and brought the devices along with them during exchange inspections.

Considering the amount of sensitive information the SEC has access to, it’s stunning that the barest minimum of precautionary measures were never taken. This protection-free era of SEC computing occurred during the same period the SEC was issuing guidelines for public companies to follow when reporting security breaches to investors.

In addition to this complete disregard for basic security, the SEC Tradings & Market Division was handed a blank check to purchase equipment, leading to some unsurprising abuse.

[T]he full report… details an even broader array of problems, from misleading the SEC about the office’s need to buy Apple Inc products, to cases in which staffers took iPads and laptops home and used them primarily for pursuits such as personal banking, surfing the Web and downloading music and movies.

Rymer found that the office did not have any planning or oversight into its purchases of computer equipment. From 2006 through 2010, the office got permission to spend $1.8 million on technology devices.

As Levin points out, it’s an upgrade from the staff’s former pornaholic ways but this report gives off the impression that staffers have simply found new ways to screw up. Would that this report contained anything truly surprising, but it’s more of the same. It’s not that all government entities are shot through with bumbling fools and opportunists looking for some power to abuse. Individually, there are plenty of good, hardworking public servants. But as an aggregate, nearly every derogatory cliche of government work (and government employees) can be proven true.

At the very least, I suppose we (the people and the taxpayers) can be grateful that someone is looking into this and, better yet, ushering it out of the darkened hallways of regrettable governance and into the harsh sunlight of public appraisal. But with progress so incremental it barely fits the definition, there’s still a long, hard road ahead that will demand the full attention of those tasked with shepherding the (mostly) unwilling herd.

Filed Under: , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “At SEC: Porn Surfing Down, Waste Up, Stunning Disregard For Basic Computer Security”

Subscribe: RSS Leave a comment
19 Comments
Anonymoussays:

i dont understand why they dont just let them have the porn… a session takes what 20 minutes? then youre done, get back to work. no need for 8 hour marathons trying to defeat their blocking.

also a couple people spending their whole day being totally unproductive at work is likely waaaaaaay cheaper than data being compromised. this isnt a step up its a step down.

iambinarymindsays:

Of Course...

The SEC is an organization that is funded via coercion/theft (“taxation”), so they are paid whether they do a good job or not; meaning they are not exposed to market forces.

There is no market incentive to keep the data secure and do a good job.

This is just another of the miriad of examples of why laws against theft should be applied universally, no matter what organization you are a part of/what color clothes you wear/or what euphemism you use to rename theft (“taxation”).

I prefer consensual relationships. Try Voluntaryism instead.

btr1701says:

IT

Although no breaches occurred, the
staffers left sensitive stock exchange
data exposed to potential cyber attacks
because they failed to encrypt the
devices or even install basic virus
protection programs.

Seems to me the problem isn’t that these staffers failed to do these things, it’s that the SEC apparently has no competent IT department. In my agency, the average employee is not responsible for encryption protocols or installing virus checkers. It’s the IT people who do that, and a good thing, too, because some people are so cyber-ignorant that for them just booting up their machine in the morning is a Herculean task.

If the SEC is relying on its secretaries, file clerks, and admin personnel to implement the agency’s IT security, they’re even more fundamentally screwed than the article portrays.

RDsays:

So where is...

So where is OutOfTheAverageJoeBob to raise the rallying cry for the heads of the “thieves” of music? Oh thats right, they only jump in and post within the first 5 comments if its an average person accused. For Govt/BigMedia/Corp/RightsHolders, its silence or a constant barrage of excuses and hand-waving passes, with plenty of “there must be more to the story” and “this is not the same” and “lets wait to see how it plays out in court” (HA! good one! It only takes the barest accusation against a normal person file sharing for them to call for them to be immediately cut off from the net, fined and imprisoned, but when its their Corporate Masters, its “benefit of the doubt.”)

When its not a regular person, they can’t bend over fast enough to take the Big Media Shaft and spit out all kinds of tolerance and understanding.

John Fendersonsays:

Incompetence

Those caught accessing porn with ridiculous frequency cited the “stress” of their jobs as the underlying reason for the nearly uninterrupted pornathons.

Yes, 8 hour pornathons can be incredibly stressful. Pro tip: you don’t actually have to masturbate to every picture you see.

But the porn stats and the security problems are connected. These people were triggering their web filter thousands of times, but none of them thought to google for “web proxy” to circumvent the filter? They just kept running into the wall over and over?

People with that little amount of problem-solving ability cannot be expected to adhere to even the simplest of security protocols. If I were their managers, I would be reconsidering their employment on the grounds that they just don’t appear smart enough for the job.

PTsays:

“One regional staff accountant ran into the “no-porn” wall 1,800 times in a two week period, yet remained still employed.”

There, restated the problem in two words. I doubt if an individual in private industry would get much further than a tenth of that block total before he was asked to step into the boss’s office. The problem with government jobs is they’re all carrot, no stick.

cosmicratsays:

Very concerning...

First of all I have to wonder about how definitions are applied. When the article says “used their work computers to access unauthorized music” I am reminded of a place I used to work at. A lot of us liked to listen to Pandora while we worked, but then the bosses banned that, so then we were listening to “unauthorized” music. (and some people will purposefully obfuscate the meanings of “download” and “obfuscate”). I also wonder how their “porn” filters are actually set up.

But my main reaction is OMG! This is obviously a bureau with some problems. Now, granted, we need to hire highly intelligent specialists for a job like this, not mindless worker drones, and make no mistakes their job is genuinely stressful, but still WTF!

Also, to those of you suggesting we should gut the agency because of their inefficiency, that would be a huge mistake. In fact we really need to increase their funding (along with the banking arms of the consumer protection agency, if such a thing exists). You see Reagan and his successors already gutted this agency, and we got unregulated derivatives trading, the financial crisis and the bailout as a result.

We need more people in the SEC, and we need them to do their jobs.

Lokisays:

Although no breaches occurred, the staffers left sensitive stock exchange data exposed to potential cyber attacks because they failed to encrypt the devices or even install basic virus protection programs.

“We have no clue about even the most rudimentary security, but we can assure you nobody much more knowledgeable than us hasn’t waltzed right in an helped themselves to our data.”

I feel so comforted.

Filters Sucksays:

The filtering systems used by government & corporations very often misclassify non-porn sites as porn sites. I’ve seen one of them, OptiNet, classify the Miami Herald newspaper as a porn site, along with many other well-known daily newspaper websites and large numbers of other obviously non-porn sites. To take the word of a filtering program that what it alleges to be a porn site actually IS a porn site is just ludicrous.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...
Older Stuff
13:40 It's Great That Winnie The Pooh Is In The Public Domain; But He Should Have Been Free In 1982 (Or Earlier) (35)
12:06 Norton 360 Now Comes With Crypto Mining Capabilities And Sketchy Removal Process (28)
10:45 Chinese Government Dragnet Now Folding In American Social Media Platforms To Silence Dissent (14)
10:40 Daily Deal: The 2022 Ultimate Cybersecurity Analyst Preparation Bundle (0)
09:29 A Fight Between Facebook And The British Medical Journal Highlights The Difficulty Of Moderating 'Medical Misinformation' (9)
06:29 Court Ruling Paves The Way For Better, More Reliable Wi-Fi (4)
20:12 Eighth Circuit (Again) Says There's Nothing Wrong With Detaining Innocent Minors At Gunpoint (15)
15:48 China's Regulatory War On Its Gaming Industry Racks Up 14k Casualties (10)
13:31 Chinese Government Fines Local Car Dealerships For Surveilling While Not Being The Government (5)
12:08 Eric Clapton Pretends To Regret The Decision To Sue Random German Woman Who Listed A Bootleg Of One Of His CDs On Ebay (29)
10:44 ICE Is So Toxic That The DHS's Investigative Wing Is Asking To Be Completely Separated From It (29)
10:39 Daily Deal: The 2022 Complete Raspberry Pi And Arduino Developer Bundle (0)
09:31 Google Blocked An Article About Police From The Intercept... Because The Title Included A Phrase That Was Also A Movie Title (24)
06:22 Wireless Carriers Balk At FAA Demand For 5G Deployment Delays Amid Shaky Safety Concerns (16)
19:53 Tenth Circuit Denies Qualified Immunity To Social Worker Who Fabricated A Mother's Confession Of Child Abuse (35)
15:39 Sci-Hub's Creator Thinks Academic Publishers, Not Her Site, Are The Real Threat To Science, And Says: 'Any Law Against Knowledge Is Fundamentally Unjust' (34)
13:32 Federal Court Tells Proud Boys Defendants That Raiding The Capitol Building Isn't Covered By The First Amendment (25)
12:14 US Courts Realizing They Have A Judge Alan Albright Sized Problem In Waco (17)
10:44 Boston Police Department Used Forfeiture Funds To Hide Purchase Of Surveillance Tech From City Reps (16)
10:39 Daily Deal: The Ultimate Microsoft Excel Training Bundle (0)
09:20 NY Senator Proposes Ridiculously Unconstitutional Social Media Law That Is The Mirror Opposite Of Equally Unconstitutional Laws In Florida & Texas (25)
06:12 Telecom Monopolies Are Exploiting Crappy U.S. Broadband Maps To Block Community Broadband Grant Requests (7)
12:00 Funniest/Most Insightful Comments Of 2021 At Techdirt (17)
10:00 Gaming Like It's 1926: Join The Fourth Annual Public Domain Game Jam (6)
09:00 New Year's Message: The Arc Of The Moral Universe Is A Twisty Path (33)
19:39 DHS, ICE Begin Body Camera Pilot Program With Surprisingly Good Policies In Place (7)
15:29 Remembering Techdirt Contributors Sherwin And Elliot (1)
13:32 DC Metro PD's Powerful Review Panel Keeps Giving Bad Cops Their Jobs Back (6)
12:11 Missouri Governor Still Expects Journalists To Be Prosecuted For Showing How His Admin Leaked Teacher Social Security Numbers (39)
10:48 Oversight Board Overturning Instagram Takedown Of Ayahuasca Post Demonstrates The Impossibility Of Content Moderation (10)
More arrow
This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it