Trid Improvement Act of 2017

Floor Speech

BREAK IN TRANSCRIPT

Mr. DUFFY. Madam Speaker, I thank the chairman for all of his work and support on this legislation, as well as the gentleman from Arkansas (Mr. Hill), for which my provision is made part of a larger package.

I also thank the gentlemen from Georgia and Illinois, my good friends across the aisle, David Scott and Bill Foster, both of whom are cosponsors of the Protection of Source Code Act. It is a bipartisan bill.

The recent cyber incidents at Equifax, SEC, and even at the NSA, has shown that all organizations are vulnerable to security risks. These incidents are a timely reminder of the risks that we face in this digital age.

Given this reality, it is important for government agencies such as the SEC to rethink what they collect, how they collect it, how it is stored, and what they do with this information in the long run.

The Protection of Source Code Act is a bipartisan bill intended to reduce some of the cybersecurity risks to our financial markets posed by the SEC when it gathers highly sensitive trading or source code information as part of their oversight duties.

The Protection of Source Code Act establishes a process for the SEC with respect to requesting source code and other intellectual property that forms the basis of source code.

It does not preclude the SEC from requesting data that it determines it needs for market oversight. It merely puts a process in place for how the SEC seeks access to certain intellectual property.

Having a process in place for how the SEC requests source code and similar intellectual property will better protect registrants and their clients and investors from inadvertent disclosure or cyber theft of their most valuable and important intellectual property.

Such disclosure or theft could destroy the American businesses that own the intellectual property. Worse, it could undermine investor confidence and create significant volatility in our financial markets.

In general, the SEC should not be requesting source code or intellectual property that forms the basis of source code. They shouldn't be collecting that on a regular basis. Such information is generally unnecessary for the SEC to perform its market oversight function and, as we have learned from recent cyber hacks, could create a very inviting treasure trove of sensitive data for computer hackers.

This bill ensures that the SEC will gather source code when it is truly needed, under a subpoena process that provides appropriate due process for the information.

Under this bill, the SEC, in conducting an exam, may continue to ask a registrant for general information about a registrant's trading system or trading strategies.

So let's break this down a little bit. We have source code that is highly sensitive. It is intellectual property. If you are the SEC, you can actually go onsite and look at the source code. I am fine with that.

But if you are going to collect the source code and take it back to the SEC and store it and you have a whole bunch of intellectual property from American businesses stored at the SEC, this is one-stop shopping for hackers. You have just got to do it once. Get in the SEC and you get it all.

My friend across the aisle, the ranking member, wants to talk about volatility. Wait and see if there is an SEC hack where they get all this information, all this source code. That is a risk we don't want to have.

We want due process. If you want to come in and take the source code, get a subpoena.

Do we believe in due process in America?

For the most sensitive data, the most sensitive information, get a subpoena and you can take it. But those are basic measurers, basic protections that we offer in America that we should employ at the SEC when they want this intellectual property that is of great value to these firms.

My bill, contrary to the ranking member's point, Madam Speaker, doesn't offer exemptions to exams. Exams will still happen. Also, it is still illegal to manipulate markets. Those things haven't changed.

This is just about due process.

BREAK IN TRANSCRIPT

Mr. DUFFY. It is important that we have truthful and honest information on the floor. This does not prohibit exams. This doesn't make legal manipulation of the markets. It is still illegal. All we are saying is we have sensitive source code, and if you want to take it to the SEC, you get a subpoena.

Frankly, we think there are problems with that. The SEC has been hacked. The NSA has been hacked. Everybody has been hacked. If you compile all this information, the risk that poses to our markets and volatility to our markets, I think, is unacceptable. That is why it is bipartisan.

I would encourage all Members of this House to take a step forward for due process.

BREAK IN TRANSCRIPT

Source