Should the Consolidated Audit Trail Have a Future?

Norbert Michel and Christian Kruse

Recently, three members of the House Financial Services Committee—Chairman Hill, Rep. Loudermilk, and Rep. Wagner—sent a letter to Securities and Exchange Commission (SEC) Chairman Paul Atkins outlining their continuing concerns with the Consolidated Audit Trail (CAT). A surveillance system that records every order, cancellation, and trade made on national stock exchanges, the CAT maintains one of the largest databases collecting information on Americans. The CAT is so large that it takes in an estimated 58 billion records per day.

Given the scope of the CAT and its ballooning costs, Chairman Atkins has directed his staff to “undertake a comprehensive review” of the program. The SEC’s review focuses on finding ways to cut expenses and decrease security risks. So far, the SEC has made some progress by reducing the collection of personally identifiable information and the amount of stored data but has yet to complete the promised review of the CAT.

Understandably, the representatives want clarification on the review’s progress and goals, calling for more “limited surveillance approaches [and] enhancements to existing systems…while mitigating privacy and security risks.” Mitigating privacy and security risks should be the top priority for the SEC when conducting its review of the CAT, so the representatives are right to press the SEC on these issues. However, these risks are fundamental flaws of the CAT, flaws that can only be resolved by halting the program in its entirety.

Security Concerns

In 2012, following the 2010 “flash crash,” the SEC required national securities exchanges and associations to create and maintain the CAT for the entire national market system. As a result, those organizations founded Consolidated Audit Trail, LLC (CAT, LLC) to standardize data collection and maintain a repository of all trading data. But concentrating billions of records on Americans’ investment habits in a single location makes them an attractive target for bad actors.

Given past security breaches of the SEC and national securities exchanges, a breach of the CAT is a real possibility. And according to a recent Inspector General report, the “risks of unauthorized disclosure and misuse of CAT data were elevated.” The report also found that while the SEC implemented security standards and controls, it had no way to monitor whether a user disclosed sensitive CAT data outside the SEC. Moreover, the SEC has limits on the file size a user can extract at one time, which the report found were ignored on at least four occasions.

The report recommends that the SEC increase oversight of CAT, LLC, but it’s hard to see where it will find the funds to improve its compliance with SEC standards. CAT, LLC is over $660 million in debt. With its previous funding model vacated by a court order last year, it’s unclear how CAT, LLC, will raise enough money to pay off outstanding debt and increase security compliance. Yet any increase in security measures, while reducing the risk of an external breach, would still leave the program’s deeper-seated problems unaddressed.

Privacy Problems

Even if the CAT’s security vulnerabilities were completely remedied, the program would remain a financial privacy nightmare: it forces exchanges and broker-dealers to hand over customers’ personal information and investment habits through mass data collection. While a breach could expose millions of Americans’ personal information, the greater concern is not a hack but the SEC’s unfettered access to Americans’ data.

The Fourth Amendment guarantees Americans protection “against unreasonable searches and seizures.” However, the CAT collects and stores data records without a judicial warrant. Despite apparent Fourth Amendment violations, the CAT continues to operate under the legal doctrine that private information voluntarily disclosed to a third party is no longer considered private—a principle known as the Third-Party Doctrine.

When this doctrine was founded in the 1970s, the ability for government agencies to collect massive amounts of records was limited in scope. However, the third-party doctrine was always suspect and controversial and is now outdated for the digital age. Modern technology now allows the government to retrieve Americans’ financial records with unprecedented ease and represents the type of problem the Supreme Court originally warned against when it developed the third-party doctrine in the 1970s. 

Separately, proponents of the CAT argue it’s needed to detect market manipulation, but regulators already have tools to collect trading data without it. While a lawsuit is currently challenging the application of the third-party doctrine to the CAT, Americans’ personal information and investing habits continue to be laid bare to the government with no warrant required.

A Return to Privacy

There is little doubt that the CAT invades Americans’ privacy. The scope of information available to the SEC goes far beyond what most Americans would consider reasonable and creates a serious security risk for the SEC and CAT, LLC. Even SEC Commissioners Hester Peirce and Mark Uyeda have repeatedly voiced concerns with the size and scope of the CAT, calling the program “a tool one would expect to find in a dystopian surveillance state.”

Such a dystopian program has no place in America. Thankfully, dismantling the CAT is well within reach. The CAT was created in 2012 by a rule, not a statute, and it can be undone the same way. Chairman Atkins’ review offers a rare opportunity to do exactly that. But even if the SEC stops short of eliminating the CAT, Congress has the authority to decide whether the program should exist. Legislation such as the Saving Privacy Act has already laid the groundwork to end it. The Act would force the SEC to shut down the CAT and prevent it from establishing a similar program without congressional approval.

Regardless of the path taken, the destination must be the same: the end of the CAT. Reps. Hill, Loudermilk, and Wagner are right to demand answers and clarity. The CAT poses a massive security risk for investors’ data and allows the SEC to monitor trading activity with impunity. Until the CAT is a footnote in the history of financial privacy incursions, every American invests with the government prying right over their shoulder and the risk that a bad actor could too.