SEC’s Tech Blunders Erase Key Crypto Regulation Conversations

The U.S. Securities and Exchange Commission (SEC) has acknowledged that a series of avoidable errors by its IT department led to the permanent loss of nearly a year’s worth of text messages from former Chair Gary Gensler’s government-issued mobile device between October 2022 and September 2023. According to a report from the SEC’s Office of Inspector General (OIG), the loss occurred when a poorly understood and automated policy was implemented, triggering an enterprise wipe of Gensler’s device. This policy deleted stored text messages and operating system logs, compounding the issue with poor change management, a lack of proper backups, ignored system alerts, and unresolved vendor software flaws. The SEC’s IT department also failed to maintain necessary log data, which prevented the commission from determining why Gensler’s smartphone ceased communication with the agency’s mobile device management system [1].

The OIG report highlights that some of the lost messages contained key communications about the SEC’s enforcement actions against crypto companies and their founders. This loss could hinder transparency regarding how and when the SEC pursued these cases, potentially affecting judicial, congressional, and public oversight. Investigators recovered approximately 1,500 messages from Gensler’s colleagues and other records, of which 38% were deemed mission-related. These included a May 2023 conversation between Gensler, his staff, and the Director of the Division of Enforcement about the timing of an SEC action against certain crypto asset trading platforms and their founder. The report notes that the loss of such communications may impact the SEC’s responses to Freedom of Information Act (FOIA) requests and future investigations [1].

In response to the incident, the SEC has taken several measures, including disabling text messaging on most government-issued devices, notifying the National Archives and Records Administration of the lost records, and implementing Capstone-specific records training for senior officials. Additionally, the agency is improving its backup practices for senior officials’ devices. The OIG report outlines five key recommendations to prevent future incidents, including updating IT policies to ensure thorough documentation and understanding of system changes, maintaining accurate device inventories, and ensuring that device logs and forensic data are collected and retained before any troubleshooting activities that involve factory resets [2].

The loss of Gensler’s texts occurred during a period of heightened regulatory activity in the crypto sector, with the SEC’s enforcement actions against crypto firms reaching a 10-year high in 2023. Gensler, who left the agency in January 2024, was known for his aggressive stance on crypto regulation, including a controversial offer to encourage firms to “come in and get registered,” a move that was seen as a precursor to enforcement actions. The timing of the data loss, coinciding with major developments in the crypto space—such as the collapse of FTX and the Grayscale spot BTC ETF lawsuit—has raised concerns about the potential loss of critical decision-making context [1].

Industry observers have expressed concern over the implications of the incident for transparency and accountability. Nate Geraci, President of NovaDius Wealth Management, noted the significance of the timeframe, stating that it encompassed key crypto events, while Caitlin Long, founder of Custodia Bank, remarked on the irony of the situation with a quip about the messages being lost in a “boating accident.” These comments underscore the broader concern that internal communications involving high-stakes regulatory decisions may be at risk of being erased or lost due to inadequate IT policies [1].

The report serves as a wake-up call for the SEC to strengthen its IT governance and record-keeping protocols. With the agency currently undergoing a broader overhaul of its regulatory approach to crypto assets—including potential rule proposals on digital asset sales and trading—ensuring the integrity of internal communications is crucial for maintaining public trust and regulatory credibility. The lessons drawn from this incident may shape future policies not only for Gensler’s successor but also for the broader regulatory landscape as the SEC navigates the complexities of governing the fast-evolving crypto market [1].

Source: [1] SEC Report Faults Errors For Loss Of Gensler's Texts (https://cointelegraph.com/news/avoidable-errors-led-to-the-loss-of-gary-gensler-text-messages-sec) [2] Avoidable Errors Led to the Loss of Former SEC Chair (https://www.oversight.gov/reports/special-review-avoidable-errors-led-loss-former-sec-chair-gary-genslers-text-messages)