Oops! Gone Phishing: The SEC’s Accidental Data Dump

For many years, a significant portion of the cryptocurrency community would have cited Gary Gensler as a primary figure of concern.

If you’re new to the world of crypto:

Before the Securities and Exchange Commission (SEC) adopted a more collaborative approach with crypto firms, Gary Gensler directed its actions.

And his leadership style was notably distinct.

During his four-year term, Gensler oversaw a remarkable 125 enforcement actions focused on cryptocurrency-related matters.

This could have been viewed positively if the SEC had prioritized genuine instances of fraud, such as deceptive schemes and Ponzi structures.

However, a considerable number of these legal challenges targeted legitimate businesses – including exchanges, token issuers, and lending platforms – accused of offering unregistered securities based on the Howey test.

As a reminder, the Howey test originated in the 1940s concerning citrus groves 🙃

It’s comparable to referencing an old-fashioned user guide for outdated technology to troubleshoot a modern smartphone.

So, in essence, rather than establishing transparent guidelines for cryptocurrency enterprises to adhere to, the Gensler-led SEC employed a strategy of “regulation by enforcement,” initiating legal proceedings against companies and subsequently using those cases as precedents to establish regulatory standards.

Consequently, businesses lacked clear means to ascertain whether their token qualified as a security until they faced legal action.

Moreover, the targets weren’t obscure startups; prominent entities such as Binance, Coinbase, and Ripple were involved.

The outcome fostered an atmosphere of uncertainty, prompted project relocation abroad, constrained trading volumes, and discouraged participation from institutional investors.

“Hmm… things have evolved? 🤨 Why is this being discussed? 🤨” – you may be wondering.

Well, there are developments in this unfolding narrative – and they are intriguing 👀

In January 2024, the SEC’s technology division made a noteworthy discovery: almost a year’s worth of Gary Gensler’s text communications had been expunged.

These missing communications spanned from October 2022 to September 2023, coinciding with the peak intensity of his regulatory enforcement efforts.

One cannot ignore the potential insight those deleted texts could have offered on pivotal questions, such as:

Were the SEC’s enforcement actions impartial? Were decisions swayed by political considerations rather than legal principles? What transpired behind closed doors?

Unfortunately, those answers may forever remain elusive.

Intriguingly, the explanation behind this comprehensive data loss is rather perplexing.

Reportedly, in July 2023, the SEC’s tech department seemingly labeled Gensler’s mobile device as “inactive.” Despite the cessation of communication between the phone and the agency’s device management system, the anomaly went unnoticed.

Subsequently, in August 2023, a new organizational protocol was instituted, mandating that any device identified as inactive be wiped after a period of 45 days.

In September 2023, this directive was activated, resulting in the automatic erasure of Gensler’s phone.

Adding to the peculiarity, the device had not undergone a backup procedure since October 18, 2022.

Consequently, nearly a year’s worth of correspondence has been lost.

Following this event:

Kevin Muhlendorf, the SEC’s inspector general, issued a report on the matter, deeming the situation “avoidable.”

The report highlighted missed notifications, flawed emergency protocols, inadequate backup mechanisms, and insufficient coordination with external vendors.

In essence, the occurrence signifies a substantial level of operational deficiency.

The SEC has since implemented various changes, including disabling text messaging on most government-issued phones, informing the National Archives about the lost data, and committing to five corrective actions recommended by the inspector general.

These include amplified supervision of device wipe processes, improved record maintenance practices, verified backup protocols for senior personnel, and mandating managerial authorization prior to factory resetting any device.

So, there you have it. The communications are irrecoverable, the unresolved inquiries linger, and the cryptocurrency sector advances under new leadership, with hopes of improved IT infrastructure.