Securities Industry Commentator by Bill Singer Esq

In 2019, OCIE will prioritize certain practices, products, and services that it believes present potentially heightened risk to investors or the integrity of the U.S. capital markets. Designed to support the SEC's mission to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation, the six themes for OCIE's 2019 Examination Priorities, which include perennial risk areas and developing products and services, are:

1. Matters of importance to retail investors, including seniors and those saving for retirement;

2. Compliance and risk in registrants responsible for critical market infrastructure;

3. Select areas and programs of FINRA and MSRB;

4. Digital Assets;

5. Cybersecurity; and

6. Anti-Money Laundering

[B]between 2016 and 2018, GRACEY posed as a British billionaire with degrees from the London School of Economics and Oxford University.  He drove expensive cars such as Bentleys and Ferraris and claimed to own expensive homes in Clyde Hill, Mercer Island, and Newcastle, Washington, as well as in Beverly Hills and San Diego, California.  GRACEY also used falsified bank statements to make it appear he had hundreds of millions of dollars of cash on hand.  The investigation revealed that GRACEY is Canadian, not British, and rented expensive homes and cars to make it appear he was wealthy. 

GRACEY told potential investors he had special access to millions of shares of "pre IPO" stock that would produce returns of as much as 60 times the initial investment.  Some investors gave GRACEY as much as $745,000, believing that they were purchasing stock.  In fact, GRACEY did not own any of the stock he was pretending to sell, and simply stole the victims' money.  According to the complaint, investigators have identified more than 25 investors who transferred over $3.4 million to Gracey through bank wires.

Booter and stresser services are a form of DDoS-for-hire--- advertised in forum communications and available on Dark Web marketplaces--- offering malicious actors the ability to anonymously attack any Internet-connected target. These services are obtained through a monetary transaction, usually in the form of online payment services and virtual currency. Criminal actors running booter and stresser services sell access to DDoS botnets, a network of malware-infected computers exploited to make a victim server or network resource unavailable by overloading the device with massive amounts of fake or illegitimate traffic.

These services can be used legitimately to test the resilience of a network; however, criminal actors use this capability to take down Web sites. Established booter and stresser services offer a convenient means for malicious actors to conduct DDoS attacks by allowing such actors to pay for an existing network of infected devices, rather than creating their own. Booter and stresser services may also obscure attribution of DDoS activity.

Through their involvement with the APT10 Group, from at least in or about 2006 up to and including in or about 2018, ZHU and ZHANG conducted global campaigns of computer intrusions targeting, among other data, intellectual property and confidential business and technological information at managed service providers ("MSPs"), which are companies that remotely manage the information technology infrastructure of businesses and governments around the world, more than 45 technology companies in at least a dozen U.S. states, and U.S. government agencies. The APT10 Group targeted a diverse array of commercial activity, industries, and technologies, including aviation, satellite, and maritime technology, industrial factory automation, automotive supplies, laboratory instruments, banking and finance, telecommunications and consumer electronics, computer processor technology, information technology services, packaging, consulting, medical equipment, healthcare, biotechnology, pharmaceutical manufacturing, mining, and oil and gas exploration and production.  Among other things, ZHU and ZHANG registered IT infrastructure that the APT10 Group used for its intrusions and engaged in illegal hacking operations.

We are adopting a rule to implement a provision of the Dodd-Frank Wall Street Reform and Consumer Protection Act. The new rule requires a company to describe any practices or policies it has adopted regarding the ability of its employees (including officers) or directors to purchase financial instruments, or otherwise engage in transactions, that hedge or offset, or are designed to hedge or offset, any decrease in the market value of equity securities granted as compensation, or held directly or indirectly by the employee or director. The new rule requires a company to describe the practices or policies and the categories of persons they affect. If a company does not have any such practices or policies, the company must disclose that fact or state that hedging transactions are generally permitted. The new disclosure is required in a proxy statement or information statement relating to an election of directors.

• Securities Industry Commentator
• Bill Singer