Statement Summary
The Commission has released a concept paper as part of its review of the Consolidated Audit Trail (CAT), which has faced significant cost overruns and privacy concerns since its inception. Initially budgeted at $55 million, the cost ballooned to $250 million annually, leading to delays and dissatisfaction among stakeholders. This release seeks public feedback on various governance and security issues related to CAT, highlighting the need to balance market oversight with civil liberties. Key concerns include the potential for misuse of the extensive data collected, as it may infringe on privacy and individual rights. The Commission invites the public to consider alternatives that could safeguard these values while maintaining effective market surveillance. This initiative represents a crucial opportunity to address systemic issues within the CAT framework, emphasizing privacy and civil liberties in the context of financial regulation.
Original Statement
Today, the Commission issued a long-awaited concept release as part of its comprehensive review of the Consolidated Audit Trail (“CAT”). I hope that the comments we receive will meaningfully inform the Commission’s reassessment of the troubled and troubling CAT and prompt a broader reconsideration of our approach to financial surveillance.
The CAT, now in its teenage years, is expensive, contentious, and perilous to privacy. CAT cost overruns have been massive: the estimated annual budget of $55 million in 2016 expanded to, until very recently, an actual annual budget of almost $250 million. CAT progress has been slow; it is years behind schedule.
CAT’s greatest success is its ability to generate extensive fighting among regulated entities and between regulated entities and the Commission. Over the past year the Commission has taken several important steps to address some of these longstanding concerns with the CAT. It has reduced some of the financial costs of the CAT, ceased mandated collection and storage of personally identifiable information, and begun reevaluating the collection of certain unnecessary and overly burdensome data fields. This concept release is another meaningful step. It poses serious, substantive questions on CAT governance, technology infrastructure, data security, and funding models—questions that reflect the extensive and persistent engagement we have heard from the public in recent years. I look forward to reviewing the full range of comments.
My deepest concerns, however, remain squarely in the realms of liberty and privacy. Regulators need to be able to oversee the markets, but appropriate limits on how regulators gather, store, use, and dispose of information are essential. No matter how much the CAT’s budget is trimmed or how many data fields are pared back, the core reality remains unchanged: the CAT is a government-mandated repository of every equity and options order and trade made by every single investor in the U.S. markets.
And no matter how many procedural steps we add before a regulator can access the personally identifiable information linked to those trades, an ill-intentioned regulator at the Commission or one of the many self-regulatory organizations with access to the data may be able to navigate those steps to stalk personal or political enemies.
Most regulatory users will not do such things, but restraints on government power have to contemplate the few who might. The premise underlying the CAT—that the government has the right to monitor every purchase and sale decision without suspicion of wrongdoing—should trouble all of us. Americans should not have to prove their innocence by submitting their daily financial lives to comprehensive government monitoring.
Why should you who have nothing to hide care? You should care because the same government that collects this data also decides what counts as wrongdoing. You should care because defending yourself against even unfounded allegations can be enormously costly in time, money, and stress. You should care if you fear a government that might use such a tool to single out individuals for personal or political reasons. You should care because complacency about a government that can scrutinize every one of your financial transactions may cultivate acceptance of a government that also peers into other areas of your private life that you may not be so willing to leave open to examination.
You should care because a government that has built a backdoor into every broker may not hesitate to build backdoors elsewhere. You should care because, though I have the utmost confidence in this Commission staff and their commitment to using the CAT for appropriate regulatory purposes, a tool like the CAT inevitably creates the opportunity for future abuse by someone in government or at one of the many SROs with access to it.
This concept release gives the Commission, for the first time, a genuine opportunity to confront these fundamental concerns head-on.
Can the CAT be restructured to resolve the serious questions about privacy and civil liberty, and if so, how? Would an alternative model, one that does not rely on a centralized repository, better safeguard these values? The introduction of the CCID as a substitute for social security numbers helps, but CCIDs are still linked to individual traders. Would further restricting the ability of regulators to link personally identifiable information with transaction data mitigate some of these risks? Could the Commission or the self-regulatory organizations continue to conduct effective market surveillance if the CAT were eliminated? What type of system would best protect people’s privacy?
If a system like the CAT remains in place, what robust and durable safeguards could prevent its potential weaponization against personal or political enemies? Or must we acknowledge that the very concept of a massive surveillance database may simply be incompatible with the principles of civil liberty that are foundational to our society? I hope commenters will take advantage of this opportunity to help us fundamentally rethink the architecture of market oversight with an eye not only toward cost, convenience, and efficacy, but also toward the basic rights of people to participate in the market unwatched absent suspicion of wrongdoing.
My harsh criticisms of the CAT and my broader concerns about what it represents should not be mistaken for criticisms of the Commission staff. For more than a decade, the staff of the Division of Trading and Markets, the Office of General Counsel, and the Division of Economic and Risk Analysis have worked tirelessly through extraordinarily complex issues amidst relentless criticism from all sides, shifting priorities, and the constant threat and reality of litigation. The CAT team has been consistently thoughtful, patient, and responsive in engaging with my concerns on this release, and other CAT projects. Working on the CAT can often feel like a thankless endeavor, but I sincerely appreciate the team’s sustained commitment to this project. In particular, I would like to thank Erika Berg for her remarkable efforts in bringing this release to completion without neglecting the never-ending flow of daily CAT tasks.
