FOIA Requests Reveal Perils and Possibilities of the Consolidated Audit Trail, aka “Mass Surveillance”
Imagine a time when anyone might be able to file a Freedom of Information Act request with the Securities and Exchange Commission for a complete audit-trail report on someone else’s stock trades – the who, what, where, when, and how of any transaction, timed down to the millisecond and then easily retrieved in a vast database.
It’s already happened.
The database that at least one FOIA requester has already asked about is known as the SEC’s Consolidated Audit Trail, or “CAT” for short. More about that later in this story. For now, what’s important to know is that the CAT might be the biggest government data repository ever.
To some, the CAT is the scariest of all Big Brother creations. To the SEC, it’s an essential fraud-fighting tool. One thing that both sides would probably agree on: The whole project is dizzyingly complex, highly fraught, and investors ultimately will be stuck with the bill. Read all about it: The CAT has its own explanatory website with answers to hundreds of FAQs.
In a sprawling Eleventh Circuit appeals court case that has received scant coverage outside of the business press, powerful players on Wall Street and in Congress are fighting to kill the CAT. And last month’s Supreme Court decisions curbing regulatory agency powers just gave them an edge.
The lead plaintiffs in the CAT challenge are the American Securities Association and Citadel Securities. Both are forces to be reckoned with.
The Tampa-based ASA, which represents regional brokerage players, has emerged as a formidable advocate for curbing what it deems to be SEC regulatory excesses. (We’ll be reporting more next week about the ASA’s recent FOIA requests and litigation.)
Deep-pocketed Citadel is one of the world’s biggest hedge funds, averaging more than $467 billion in daily trading volume. The two are represented in the CAT case by law firm Jones Day. The firm’s partner, former Trump White House counsel Donald McGahn, led the drive to put conservatives on the Supreme Court. Last week, McGahn hailed the Court’s recent decisions that corralled what he called “the runaway bureaucracy.”
As the case slowly makes its way through the federal appeals court, CAT opponents got a powerful boost last week from the array of Supreme Court decisions paring back the SEC’s powers and otherwise reining in the so-called administrative state. Soon after the Supreme Court overturned the Chevron doctrine, lawyers for the principal litigants sent a letter to the court arguing, in essence, that the CAT must die: “The Supreme Court’s decision in Loper Bright Enterprises v. Raimondo underscores that the CAT exceeds the Commission’s authority.”
So far, there are 159 interested parties who’ve intervened or otherwise sought to have a voice in the CAT case: the NYSE, NASDAQ, brokerage houses, state attorneys general, legislators. The list goes on.
The SEC is asking for an oral argument to be scheduled.
Now, the CAT’s up a tree. Whether it can be saved may depend on the outcome of that Eleventh Circuit case.
As the SEC envisions it, the CAT will gather every scrap of trading data in real time – as many as 500 billion records per day – to catch insider trading and diagnose the causes of future market disruptions.
The SEC fostered CAT’s creation in 2010 and mandated its build-out, by a third party created for the task, in stages. But as expenses mounted – estimates range from $500 million to $1 billion so far, with an ongoing annual run rate of $200 million – there was no clear answer about how those costs would be recouped.
Finally, late last year, the SEC resolved that question in a party-line 3-to-2 vote, creating a complex formula to essentially put the costs back on the broker-dealers that the SEC regulates. That is what triggered the Eleventh Circuit challenge by the ASA and Citadel soon thereafter. Bolstered by the recent Supreme Court decision gutting Chevron, the two are arguing that costs can’t be pushed on to the securities industry without explicit Congressional approval.
Cost isn’t the only issue; privacy is another. In the words of Sen. John Kennedy (R-La.),
“The CAT is a ticking time bomb of sensitive personal information that hackers cannot wait to detonate. The scope of the CAT takes your breath away. Investors make billions of trades each day. The CAT will be, if it isn’t already, the largest database in the world. It will contain a treasure trove of information that is specific enough to identify the purchases made by every single investor. Managing that data would be difficult enough if we only needed to worry about the SEC’s access to the database, but that’s not the case. Government contractors have access to the CAT, too. In total, roughly 3,000 people will have access to the database. Malicious hackers couldn’t design a more vulnerable database if they tried.”
In a Wall Street Journal opinion piece, former Trump Attorney General William Barr called the CAT a form of unconstitutional “mass surveillance.”
All that got our attention. We wondered how the SEC might handle requests for all the sensitive, personally identifiable trading information that will be in the CAT. Digging into PoliScio Analytics’ competitive-intelligence database FOIAengine, which tracks FOIA requests in as close to real-time as their availability allows, we found some FOIA requests of interest.
In 2021, a requester named Sarah Benton made a straightforward request “for all the audit trails from the CAT database that correspond to insider sale transactions by Amazon.com Executive Chairman Jeffrey Bezos on 11/1/21 and 11/3/21.” The requester, whose other identifying details were redacted by the SEC, pointed out that Amazon had already disclosed the insider transactions, totaling upwards of a billion dollars or more. But those cryptic filings with the SEC, known in agency parlance as “Form 4s”, provided no other detail about the scores of transactions in which Bezos unloaded big blocks of Amazon stock.
The CAT would have told the whole story: trading times down to the millisecond, the buyers on the other side, whether other buyers or sellers were disadvantaged by front running, and so forth. The whole idea of the CAT is for the SEC to be able to track all those details in real time.
An SEC FOIA officer quickly disposed of Benton’s request, telling her the agency couldn’t locate any responsive information.
Benton soon replied: “The SEC almost certainly has responsive records to my request.” She laid out a step-by-step approach for the FOIA officer to follow in querying the CAT, and also suggested that “speaking to a subject matter expert will also likely yield helpful results.”
In response, the SEC’s FOIA officer came back with a different answer. “We consulted with the SEC staff and we are withholding the requested information. To the extent that the requested data is in the CAT database and is able to be associated with a specific beneficial owner, [the] CAT audit trail data is confidential regulatory information that is protected from disclosure.”
A few months later, another CAT-related FOIA request came in, from David Isenberg of the Financial Times.
Isenberg was curious about an unusual last-minute change to the SEC’s open-meeting schedule on June 7, 2023. The Commission’s agenda previewed that there would be a vote on the highly controversial issue of levying fees on the financial industry to pay for the CAT. At the last minute, the item was dropped from the agenda. Isenberg’s FOIA request was simple: “I’d like any and all information on why the SEC decided to cancel consideration.”
Given the party-line 3-to-2 vote that eventually occurred three months later, in which even one of the Yes-voting Democratic commissioners expressed reservations, the answer to Isenberg’s question might have been obvious. But when an SEC FOIA specialist replied to Isenberg on June 27, he simply asked Isenberg to provide “keywords to assist in the search.” Isenberg replied the same day with 36 keywords.
Isenberg’s request received priority processing since it came from a member of the media. Still, it was on a slow roll. Five months after the Commission’s vote, the SEC sent a response that indicated the depth of the CAT controversy. There were “approximately 92,640 pages of records that may be responsive to your request.”
It would be about three years, the FOIA officer continued, before someone at the SEC could even start looking at the documents, to see what might be releasable. “Therefore, you may want to consider narrowing the scope of your request.”
Meanwhile, Citadel and the ASA are pressing ahead with their Eleventh Circuit challenge to the CAT. The case’s 110-and-counting docket entries constitute their own version of an audit trail, foretelling what’s to come.
FOIAengine access now is available for all professional members of Investigative Reporters and Editors, a non-profit organization dedicated to improving the quality of journalism. IRE is the world’s oldest and largest association of investigative journalists. Following the federal government’s shutdown of FOIAonline.gov last year, FOIAengine is the only source for the most comprehensive, fully searchable archive of FOIA requests across dozens of federal departments and agencies. FOIAengine has more robust functionality and searching capabilities, and standardizes data from different agencies to make it easier to work with. PoliScio Analytics is proud to be partnering with IRE to provide this valuable content to investigative reporters worldwide.
To see all the requests mentioned in this story, log in or sign up to become a FOIAengine user.
Next from FOIAengine: A new federal court case reveals how the American Securities Association uses FOIA.
John A. Jenkins, co-creator of FOIAengine, is a Washington journalist and publisher whose work has appeared in The New York Times Magazine, GQ, and elsewhere. He is a four-time recipient of the American Bar Association’s Gavel Award Certificate of Merit for his legal reporting and analysis. His most recent book is The Partisan: The Life of William Rehnquist. Jenkins founded Law Street Media in 2013. Prior to that, he was President of CQ Press, the textbook and reference publishing enterprise of Congressional Quarterly. FOIAengine is a product of PoliScio Analytics (PoliScio.com), a new venture specializing in U.S. political and governmental research, co-founded by Jenkins and Washington lawyer Randy Miller. Learn more about FOIAengine here. To review FOIA requests mentioned in this article, subscribe to FOIAengine.
Write to John A. Jenkins at [email protected].
