CMR is the leading provider of funding and management support for small to medium-sized businesses and entrepreneurs 

Read more.....

Gold & Silver long-term trends have been lower since highs back in 2011. Counter trend rallies have continued to frustrate metals bulls as they continue to fizzle out. Are current counter trend rallies in Gold & Silver about to fizzle out again?

Below looks at Gold and Silver on a monthly basis over the past decade-

CLICK ON CHART TO ENLARGE

Gold and Silver this month tested resistance lines that were based on old highs/lows at (1). As both were testing the underside of this resistance, both have created large bearish reversal patterns (bearish wicks) at each (1).

Metals bulls do not want to see this type of pattern at resistance, while in long-term downtrends. This could also be concerning news for metals bulls, as traders have established positions where historically Gold and Silver were closer to highs than lows.

The Power of the Pattern has been sharing this chart for the past few months with Premium and Metals members, preparing them for this key level. If patterns in the metals complex is of interest to you, we would be honored if you were a member.

The Power of the Pattern at work to save people time, improve decision-making & results.   

We identify high probability big pattern reversals and breakouts in global indices, sectors, commodities, several metals and select individual stocks

Send us an email if you would like to see sample reports or a trial period to test drive our Premium or Weekly Research

Email services@kimblechartingsolutions.com 

Call us Toll free 877-721-7217 international 714-941-9381

Website: KIMBLECHARTINGSOLUTIONS.COM

Update: According to Bloomberg, Trump won't be declaring war (yet), and instead the announcement is sanctions related.

• TRUMP'S N. KOREA ANNOUNCEMENT TO BE SANCTIONS-RELATED: OFFICIAL

* * *

Following yesterday's anticlimatic Rex Tillerson press conference in which the Secretary of State was expected, by some, to make an important announcement only to disappoint, moments ago National Security Adviser H.R. McMaster said Read more.....

Update: According to Bloomberg, Trump won't be declaring war (yet), and instead the announcement is sanctions related.

• TRUMP'S N. KOREA ANNOUNCEMENT TO BE SANCTIONS-RELATED: OFFICIAL

* * *

Following yesterday's anticlimatic Rex Tillerson press conference in which the Secretary of State was expected, by some, to make an important announcement only to disappoint, moments ago National Security Adviser H.R. McMaster said on CNN that "the president will make an important announcement today about the continuation of our efforts to resolve this problem with North Korea short of war."

McMaster added that Trump will "make that announcement as he meets with our very close allies South Korea and Japan.”

As Bloomberg reminds us, President Trump is set to meet with South Korea President Moon Jae-inat 11:30am and Japan Prime Minister Shinzo Abe at 12:15pm in New York.

McMaster said Trump has also made a decision about Iran deal. "I know what the decision is - but when the president reveals that, when he talks about it he’ll place it context of the broader approach to Iran” and what we have to do to keep Iran from continuing destabilizing efforts.

National Security Adviser H.R. McMaster: The Iran nuclear deal is “fundamentally flawed” https://t.co/4Wzs1IfTcY

— CNN Politics (@CNNPolitics) September 21, 2017

Separately, Vice President Mike Pence says on Fox "we don’t want a military option" on North Korea. “I met yesterday with the foreign minister of China and we made it very clear that we expect them to do more.”

Authored by Mike Shedlock via MishTalk.com,

In response to Janet Yellen’s "everything is OK" speech following today’s balance sheet reduction notice by the FOMC committee, I received an interesting set of comments from P Read more.....

Authored by Mike Shedlock via MishTalk.com,

In response to Janet Yellen’s "everything is OK" speech following today’s balance sheet reduction notice by the FOMC committee, I received an interesting set of comments from Pater Tenebrarum at the Acting Man Blog regarding rate hike cycles, gold, and stock market peaks.

“Rule of Total Morons”

A new bull market in gold started in late 2015 concurrently with the Fed’s first rate hike. That is no coincidence. The gold market is highly sensitive to future changes in liquidity. The more tightening moves the Fed undertakes (which it does in the face of collapsing money supply growth, because its decisions are based on lagging economic indicators), the more gold bullish and the more stock market bearish the fundamental backdrop becomes. Anyone long stocks should actually ask himself how it is possible that gold is up nearly 30% from its low, despite an ostensibly “gold bearish” rate hike cycle.

 

But they never do ask the right questions, which is why stocks peak with a big lag, particularly in major bubbles. Economic historians found out that the economy was technically very likely already in recession when the stock market peaked in 1929. In the 2007 to 2009 bust, NBER backdated the beginning of the recession to December 2007, but in May of 2008 Bernanke was still talking about how well the economy was doing and how the high oil price was “creating inflation” (thereafter he began to shut up about all that, but not before demonstrating for everyone to see how utterly clueless he was). And of course, stocks peaked in October of 2007, practically two seconds before the economy fell into recession.

 

In bubble regimes, the final stage is always characterized by the “rule of total morons”. That’s just how it is.

Missing Inflation

Central banks cannot see inflation because they are totally clueless how to measure it: Central Banks Puzzled as Global Inflation Hits Lowest Level Since 2009: Solving the Puzzle

How Much Gold Should the Common Man Own?

Understanding Bubbles

If you wish to understand the nature of the bubbles we are in, a few recent articles of mine will help.

1. Bubblicious Debate: Greenspan Says “Bond Bubble About to Break”, No Stock Market Bubble
2. Median Price-to-Revenue Ratio Higher in All Deciles vs 2007, 90% vs Dot-Com Bubble: THE Choice
3. Debunking MMT, Keynesianism, Monetarism: Reader asks “What theories do you believe?” Mish Reading List

Gold vs. Faith in Central Banks

The above chart also shows the bottom in gold right as the Fed started hiking, in agreement with the analysis of Tenebrarum.

For additional images, please see my 38 slide powerpoint Venture Alliance Presentation on trends in sentiment, asset bubbles, and gold from June 24, 2017.

The hype surrounding the credit-fueled resurgence in base metals in the first half of 2017 has crashed and burned on the altar of reality in China's slowdown with industrial metals from copper to iron ore and zinc all plunging in the last two weeks. Odd that we don't hear much from mainstream business media discussing the implications for a global coordinated economic growth narrative...

Since the start of September, industrial metals have been hammered (as sto Read more.....

The hype surrounding the credit-fueled resurgence in base metals in the first half of 2017 has crashed and burned on the altar of reality in China's slowdown with industrial metals from copper to iron ore and zinc all plunging in the last two weeks. Odd that we don't hear much from mainstream business media discussing the implications for a global coordinated economic growth narrative...

Since the start of September, industrial metals have been hammered (as stocks soared)...

Iron Ore prices have crashed into a bear market...

As Citi describes it, complete carnage in Iron Ore today down over 6% on day as local specs reduce length ahead of holiday in China on the first week of October as bearish sentiment continues to gather pace. After peaking in August at $80 as we saw surging demand for high grade ores. Iron Ore started to trend down in early September, which reflected that fundamentals had begun to turn weaker. The tightness of high-grade ore market I referred to is now starting to gradually resolve as more supply coming online from Brazil and Australia. Demand is softer, as we see little improvement in China's steel consumption . Steel inventory also built as environmental inspections and steel mills' enter maintenance. We remain bearish on the long-term outlook of iron ore and expect 2018 prices to average $53/t so a ways to go. Needless to say today's move in IO has driven base prices lower with Nickel and Zinc taking the brunt.

Even Dr.Copper has given up...

And here’s some more grist for the doubters who scoffed at copper’s rally to a three-year high earlier this month.

The metal for immediate delivery on the London Metal Exchange cost $40.75 less than benchmark three-month futures on Tuesday, the biggest discount since 2009.

That market structure, known ascontango, shows “there’s no part of the world where copper is really scarce,” said Rene van der Kam, Singapore-based managing director of trader Viant Commodities Pte Ltd. He says to expect more losses after a pullback in prices this week.

And finally, as we warned previously, bear in mind that the lagged response to China's credit impulse is about to hit base metals... The rise and fall in China's credit impulse that has been so highly correlated (on a lagged basis) with industrial metals for the last eight years...

It appears "Dr.Copper" and his economics afficcianados are about to be relegated to "ignore" status once again.

Authored by Lance Roberts via RealInvestmentAdvice.com,

When I was growing up my father, probably much like yours, had pearls of wisdom that he would drop along the way. It wasn’t until much later in life that I learned that such knowledge did not come from books, but through experience. One of my favorite pieces of “wisdom” was:

Read more.....

Authored by Lance Roberts via RealInvestmentAdvice.com,

When I was growing up my father, probably much like yours, had pearls of wisdom that he would drop along the way. It wasn’t until much later in life that I learned that such knowledge did not come from books, but through experience. One of my favorite pieces of “wisdom” was:

“Exactly how many warnings do need before you figure out that something bad is about to happen?”

Of course, back then, he was mostly referring to warnings he issued for me “not” to do something I was determined to do. Generally, it involved something like jumping off the roof with a queen-sized bedsheet convinced it was a parachute.

After I had broken my wrist, I understood what he meant.

With that in mind, there are currently plenty of warning signs individuals might want to consider before taking that leap. Here are four to consider.

Warning 1: Investor Confidence

There are several different surveys of retail investors which all currently show the same thing. Individuals have never been as hopeful as they are currently that the stock market will continue to grind higher. Last week, I discussed the Gallup poll which showed investor optimism at the highest levels since 1999.

The latest survey comes from the University of Michigan survey courtesy of Business Insider.

The preliminary survey of consumer sentiment for September showed a record 65% expected probability that stocks would rise in the next year. The data goes back to 2002.

As BI noted:

“The report in February noted that people who were most bullish for the year ahead, and could invest more in stocks, were in the top third of income distribution and in the top tier of stock ownership. In other words, the respondents to this survey have reaped strong gains on a riskier asset class in a short period of time and are hoping this continues.”

As I have discussed many times previously, the stock market rise has NOT lifted all boats equally. More importantly, the surge in confidence is a coincident indicator and more suggestive, historically, of market peaks as opposed to further advances.

As David Rosenberg, the chief economist at Gluskin Sheff noted:

‘For an investment community that typically lives in the moment and extrapolates the most recent experience into the future, it would only fall on deaf ears to suggest that peak confidence like this and peak market pricing tend to coincide with each other.”

He is absolutely correct. As shown below in the consumer composite confidence index (an average of the Census Bureau and University Of Michigan surveys), previous peaks in confidence have been generally associated with peaks in the market.

Warning 2 – All Hat, No Cattle

For those of you unfamiliar with Texas sayings, “all hat, no cattle” means that someone is acting the part without having the “stuff” to back it up. Just wearing a “cowboy hat,” doesn’t make you a “cowboy.”

I agree with the premise that leverage alone is not a problem for stocks in the short-term. In fact, it is the increase in leverage which pushes stock prices higher. As shown in the chart below, there is a direct correlation between stock price and margin debt growth.

But, margin debt is NOT a benign contributor. As I discussed previously in “The Passive Indexing Trap:”

“At some point, that reversion process will take hold. It is then investor ‘psychology’ will collide with ‘margin debt’ and ETF liquidity. It will be the equivalent of striking a match, lighting a stick of dynamite and throwing it into a tanker full of gasoline.”

Not surprisingly, the expansion of leverage to record levels coincides with the drop in investor cash levels to record lows. As noted by Pater Tenebrarum via Acting-Man blog: (The following also reinforces Warning #1)

 “Sentiment has become even more lopsided lately, with the general public joining the party. It may not ‘feel’ like the mania of the late 1990s to early 2000, but in terms of actually measurable data, the overall bullish consensus seems to be even greater than it was back then.

 

Along similar lines, here is a recent chart that aggregates the relative cash reserves of several groups of market participants (including individual investors, mutual fund managers, fund timers, pension fund managers, institutional portfolio managers, retail mom-and-pop type investors). It shows that there is simply no fear of a downturn:”

So much for the “cash on the sidelines” theory.

When investors believe the market can’t possibly go down, it is generally time to start worrying. As Pater concludes:

“As a rule, such extremes in complacency precede crashes and major bear markets, but they cannot tell us when precisely the denouement will begin.”

Warning 3 – Valuations

In an extensive, must-read report at Zerohedge, Deutsche Bank’s Jim Reid, the credit strategist unveiled an extensive analysis of the “Next Financial Crisis”, and specifically what may cause it, when it may happen, and how the world could respond assuming it still has means to counteract the next economic and financial crash. The bottom line is simple:

“With the global levels of over-valuation of stocks and bonds, combined with excessive optimism and leverage as noted above, has set the stage for exceedingly low returns over the next decade or longer.”

As noted in the report:

“With that baseline in mind, what happens next should be obvious: unless one assumes that the laws of economics and finance are irreparably broken, a deep recession and a market crash are inevitable, especially after the third biggest and second longest central bank-sponsored bull market in history.”

Valuations, as discussed most recently here, are a very poor market timing device for short-term investors. However, from a long-term investment perspective, valuations mean a great deal as it relates to expected returns.

As I addressed in “Shiller’s CAPE – Is There A Better Measure:”

“The need to smooth earnings volatility is necessary to get a better understanding of what the underlying trend of valuations actually is. For investor’s, periods of ‘valuation expansion’ are where the bulk of the gains in the financial markets have been made over the last 114 years. History shows, that during periods of ‘valuation compression’ returns are much more muted and volatile.

 

Therefore, in order to compensate for the potential ‘duration mismatch’ of a faster moving market environment, I recalculated the CAPE ratio using a 5-year average as shown in the chart below.”

“There is a high correlation between the movements of the CAPE-5 and the S&P 500 index. However, you will notice that prior to 1950 the movements of valuations were more coincident with the overall index as price movement was a primary driver of the valuation metric. As earnings growth began to advance much more quickly post-1950, price movement became less of a dominating factor. Therefore, you can see that the CAPE-5 ratio began to lead overall price changes.

 

As I stated in yesterday’s missive, a key ‘warning’ for investors, since 1950, has been a decline in the CAPE-5 ratio which has tended to lead price declines in the overall market.”

Notice the downturn in the CAPE-5 ratio preceded the 2016 market swoon. However, thanks to rapid Central Bank interventions, that valuation slide was rapidly reversed is now approaching previous highs. With earnings estimates being revised lower, economic growth remaining weak, and monetary policy being reigned in, the danger to investors longer-term is mounting.

Warning 4 – Share Buy Backs

The use of “share buybacks” to win the “beat the estimate” game should not be readily dismissed by investors.

“One of the primary tools used by businesses to increase profitability has been through the heavy use of stock buybacks. The chart below shows outstanding shares as compared to the difference between operating earnings on a per/share basis before and after buybacks.”

The problem with this, of course, is that stock buybacks create an illusion of profitability. If a company earns $0.90 per share and has one million shares outstanding – reducing those shares to 900,000 will increase earnings per share to $1.00. No additional revenue was created, no more product was sold, it is simply accounting magic. Such activities do not spur economic growth or generate real wealth for shareholders.

As noted by Business Insider that strategy deployed to boost share prices since the financial crisis is on the decline.

“Spending on buybacks, however, has slipped over the past six months. Investment-grade-rated corporations repurchased $64 billion worth of stock in the second quarter, down from $84 billion in the fourth quarter of 2016, according to data compiled by Bank of America Merrill Lynch.

 

The decline puts added pressure on the stock market, which has become accustomed to buybacks pushing shares higher during lean times when real fundamental catalysts aren’t present.”

Like margin debt, exuberance and valuations, investors have little need to worry about the decline in share buybacks in the short-term.

As BI concludes:

“The real test will come at the first sign of downward turbulence.”

If They Don’t “Buy & Hold” – Why Should You?

Of course, these are just “warning signs.” None them suggest that the markets, or the economy, are immediately plunging into the next recession-driven market reversion.

But they are warning signs nonetheless. Past experience suggests that future returns are likely to be far less than historical averages suggest. Furthermore, there is a dramatic difference between investing for 30 years, and whatever time you personally have left to your financial goals.

While much of the mainstream media suggests that you “invest for the long-term” and “buy and hold” regardless of what the market brings, that is not what professional investors are doing.

The point here is simple. No professional, or successful investor, every bought and held for the long-term without regard, or respect, for the risks that are undertaken. If the professionals are looking at “risk,” and planning on how to protect their capital from losses when things go wrong, then why aren’t you?

Exactly how many warnings do you need?

Close

For those still unsure what Yellen's rambling, disjointed press conference meant yesterday, or are still in shock over the Fed's admitted confusion by the "mystery" that is inflation, here is a quick recap courtesy of Deutsche Bank and Goldman, explaining what we (probably) learned from the Fed and Yellen yesterday.

First, here is DB's Jim Reid:

So what did we learn from Read more.....

For those still unsure what Yellen's rambling, disjointed press conference meant yesterday, or are still in shock over the Fed's admitted confusion by the "mystery" that is inflation, here is a quick recap courtesy of Deutsche Bank and Goldman, explaining what we (probably) learned from the Fed and Yellen yesterday.

First, here is DB's Jim Reid:

So what did we learn from the Fed and Yellen last night? Firstly we learnt that stopping reinvestment is a sideshow for now and that the market still cares more about the probability of a December hike and where the Fed thinks inflation is heading. Just briefly on the balance sheet run-off, they have committed to the plan from the June meeting of $10bn per month ($6bn USTs and $4bn Mortgages) with an incremental increase every 3 months until we get to $50bn. However on the rates and inflation outlook the committee and Yellen were on the hawkish side. As DB's Peter Hooper discusses in his note, barring negative surprises in the months just ahead, the Fed is on track to raise rates once more this year and three times in 2018. Yellen recognised that inflation has been running low recently but put a higher blame on one-off factors than was perhaps anticipated. At the same time she noted that monetary policy operates with a lag and that labour market tightness will eventually push inflation up.

 

The complication for markets though is that beyond 2017, the FOMC will see a huge upheaval in its membership which could easily mean current member's thoughts are meaningless in a few months time and also that Mr Trump's fiscal plans (or lack of them) have the ability to completely change the debate. So its difficult to read too much into the current FOMC's forecasts. However for now December is very much live with the probability of a December rate hike moving from a shade under 50% to 64% by the US close (using Bloomberg's calculator).

Here are three additional takeaways from DB's Peter Hooper:

1. Inflation: Yellen emphasized in her statement and in answers to questions
   that, barring negative surprises in the months just ahead, the Fed is on
   track to raise rates once more this year and three times in 2018. She
   recognized that inflation has been running low recently, and that while
   there was some uncertainty around this performance, one-off factors that
   are not expected to persist, and which have not been associated with the
   performance of the broader economy, have been important. At the same
   time, Yellen noted that monetary policy operates with a lag and that labor
   market tightness will eventually push inflation up. The Fed wants to avoid
   having to tighten policy aggressively to deal with an inflation problem and
   thereby cause a recession. The current low level of inflation allows the
   Fed to move relatively slowly and cautiously. At the same time, as Yellen
   noted a couple times, the labor market has continued to tighten at an
   impressive pace, well above the pace needed to stabilize unemployment.
   With unemployment already below NAIRU and expected to fall further, it
   is seen as prudent to make further progress in a tightening direction.
2. Balance sheet versus fed funds rate: The preferred monetary policy tool, if
   needed, is the fed funds target. Yellen stated clearly several times during
   the press conference that balance sheet rundown will not be stopped or
   reversed unless the economy takes enough of a significant hit to cause
   the FOMC to move the fed funds rate back close to zero.
3. Regulation and who will be the next Chair: When asked what message she
   had meant to give the Administration and Congress in her Jackson Hole
   speech, Yellen said first that it was important to keep in place progress that had been made in strengthening the financial system via enhanced
   capital and liquidity requirements, stress testing, and resolution plans.
   But she also emphasized that regulators should look for ways to ease
   excessive regulatory burden and simplify standards where appropriate.
   She seemed to give proportionately more time to the second part of this
   message in her answer today than she did in her Jackson Hole speech.
   She also noted that she would welcome and work very well with the new
   Vice Chair for regulation, Randall Quarles, if his appointment is approved
   by the Senate. And she gave a fairly accommodative answer to a question
   about the burden that the slow progress in getting vacant governor seats
   filled (especially following Vice Chairman Fischer’s departure) imposes
   on the Board. Finally, she gave a relatively gentle answer to a question
   about fiscal policy (suggesting it would be desirable to make progress on
   measures that would support productivity growth). Summing up Yellen’s
   various comments in these areas, it strikes us that this is a person who
   would accept a second term as Fed chair if the Administration chooses
   to move in that direction.

Finally, here is a Q&A from Goldman's Jan Hatzius, who now gives 75% odds to a December rate hike:

Q: Will the FOMC hike the funds rate in December?

 

A: Yes, probably. Fully 12 out of 16 FOMC participants—the same number as in June and almost certainly including the leadership—think another hike this year looks appropriate. Given the calendar, this amounts to fairly strong forward guidance for a December hike. Consistent with this, the committee upgraded the 2017 growth outlook from 2.2% to 2.4% and lowered the 2018-2019 unemployment forecast from 4.2% to 4.1%. And Chair Yellen again downplayed the significance of the weak core inflation data this year, saying that this “primarily reflects developments that are largely unrelated to broader economic conditions” and “as long as inflation expectations remain reasonably well anchored [these developments] are not a concern because their effects fade away.” Given this relatively strong message, we have increased our subjective probability of a hike in December from 60% before the meeting to 75% now. A hike is not assured, but we would now probably need a meaningful downside surprise in the inflation data relative to the Fed’s reduced expectations and/or a big market deterioration to forestall it.

 

Q: Was the longer-term message similarly hawkish?

 

A: No, on the contrary. The longer-term dots moved down by more than we (and we think most others) expected. The median pace of hikes was unchanged at three for 2018 but fell to just over two in 2019, and the longer term funds rate came down from 3% to 2.75%. Again, these moves were consistent with the message from Chair Yellen in the press conference. She said that the neutral real federal funds rate, r*, had fallen substantially and was likely to remain low, rising only to 0.75% in the longer term. And she also said that the risks to the (actual) path of the funds rate relative to the modal forecasts in the dot plot were tilted to the downside, rationalizing the very depressed market-implied path of the funds rate, at least in part.

 

Q: If the message was so mixed, why did the bond market take today’s news as clearly hawkish across the yield curve?

 

A: Three reasons. First, the dots represent a form of forward guidance in the near term—especially this late in the year, when a 2017 hike would almost certainly occur in December—but are only an opinion in the longer term, albeit a well-informed one. Second, the committee will see a substantial amount of turnover in coming years, and new participants could come with very different views. And third, the dots remain considerably above market pricing, even after Wednesday's downward revisions.

 

Q: Are you lowering your own longer-term funds rate projections along with the FOMC?

 

A: No, we have kept our working estimate of the terminal funds rate at 3¼%-3½% in nominal terms and 1¼%-1½% in real terms. We are more skeptical than the committee that the notion of a depressed neutral funds rate is a useful concept for predicting monetary policy in the medium and longer term. It may well be that r* will remain below the historical norm, and our projections do, in fact, build that in to some degree. There is a solid economic rationale for the idea that lower potential GDP growth should imply a lower equilibrium interest rate. But while the idea is intuitive, the empirical support for it is weak—much weaker than assumed in the well-known Laubach-Williams model of equilibrium interest rates as well as large swaths of the current macroeconomic debate. So we would put less weight on that link in projecting interest rates several years into the future, and more weight on the historical average real rate of about 2%.

 

Q: Any surprises on balance sheet normalization?

 

A: Not as far as the near term is concerned, but Chair Yellen indicated that the hurdle for stopping balance sheet rolloff is very high indeed. Our read of her discussion in the Q&A was that full reinvestment would only resume once the committee had cut the funds rate back to the effective lower bound. This would be consistent with a sentence from the March 2017 FOMC minutes that read: “A number of participants indicated that the Committee should resume asset purchases only if substantially adverse economic circumstances warranted greater monetary policy accommodation than could be provided by lowering the federal funds rate to the effective lower bound.” In the March 2017 minutes, this view was still contrasted with an alternative view held by “some” that reinvestment should resume before the committee returned to rate cuts. But Yellen’s comment today suggests that at least the current FOMC thinks balance sheet normalization is now truly on “autopilot”, barring a very bad economic outcome.

• Mark Zuckerberg’s Political Awakening (BBG)
• Bank of Japan Sticks With Easy-Money Settings (WSJ)
• Bank of Japan board member demands more stimulus (FT)
• S&P downgrades China, says ri Read more.....

• Mark Zuckerberg’s Political Awakening (BBG)
• Bank of Japan Sticks With Easy-Money Settings (WSJ)
• Bank of Japan board member demands more stimulus (FT)
• S&P downgrades China, says rising debt is stoking economic, financial risks (Reuters)
• Boston’s Fate Lies With a Zombie Hurricane as Maria Moves North (BBG)
• SEC says hackers may have traded using stolen insider information (Reuters)
• Equifax Hackers Roamed Its System Undetected for Months (WSJ)
• Spanish crackdown has undermined Catalan independence bid, regional leader says (Reuters)
• Nestlé Makes Billions Bottling Water It Pays Nearly Nothing For (BBG)
• Home Prices Soar in Disaster-Prone Areas (BBG)
• Mexican Schoolchildren Trapped After Quake (WSJ)
• Distrustful U.S. allies force spy agency to back down in encryption fight (Reuters)
• Energy Alliance Propels Russia-Saudi Cooperation (WSJ)
• Russia set to pipe more oil to China, stepping up race with Saudis (Reuters)
• Kimmel Spat Shows Confusion Over Rushed Health Bill’s Effects (BBG)
• Beat or Miss? MiFID Will Make It Harder to Tell on Earnings Day (BBG)
• Amazon Puts Whole Foods on Fast Track to Conventional Supermarket (WSJ)
• U.S. Airports Are More Popular Than Ever, Except in New York (BBG)
• Secret of Merkel’s Longevity: Strategic Flip-Flops (WSJ)

Overnight Media Digest

WSJ

- Alphabet Inc's Google said it would buy part of Taiwanese smartphone maker HTC Corp, including its team that helped develop Google's flagship Pixel smartphone, for $1.1 billion in cash. on.wsj.com/2xxyzG7

- The Securities and Exchange Commission (SEC) disclosed Wednesday that hackers penetrated its electronic system for storing public-company filings last year and may have traded on the information. on.wsj.com/2xwEdID

- Toshiba Corp's board on Wednesday voted to sell its memory-chip business to a group led by U.S. private-equity firm Bain Capital and includes Apple Inc and Dell Technologies Inc for 2 trillion yen ($17.79 billion). on.wsj.com/2xwv5DW

- Pfizer Inc filed suit against Johnson & Johnson , alleging J&J's "exclusionary contracts" for Remicade with health insurers, hospitals and clinics effectively prevented them from offering Pfizer's lower-priced copy. on.wsj.com/2xxeOyt

- Facebook Inc is adding more human reviewers to oversee its advertising system after a report showed that people could target ads at users interested in anti-Semitic and other hateful topics. on.wsj.com/2xx8eIb

- Albertsons Cos is buying the Plated meal-kit service, the first acquisition of a prepared-meals company by a national grocery chain. on.wsj.com/2xwELhF

- Hurricane Maria slammed into Puerto Rico, pounding the U.S. territory with huge waves, massive rain and fierce winds and shutting down the power grid across the entire island of 3.4 million people. on.wsj.com/2xxxIFk

- Soldiers, rescue workers and volunteers worked Wednesday to find the living and the dead beneath rubble left by a 7.1-magnitude earthquake that destroyed scores of buildings in Mexico's capital and surrounding states, and killed at least 230 people. on.wsj.com/2xxrrtm

FT

Ryanair Holdings Plc pilots have dismissed an offer of a 12,000-pound ($16,184) payment to waive days off and stay for a year with the business, a move that could compound serious rota problems at the airline.

The UK is to invest 65 million pounds in a U.S. mega-physics project designed to investigate neutrinos, mysterious subatomic particles that pervade the universe.

Former CBI head Digby Jones is facing questions over his value to the House of Lords after claiming 15,000 pounds of expenses and allowances in a period when he did not speak in any debates or ask any questions.

Antony Jenkins, the former Barclays Plc chief executive, is planning to expand his bank technology service into Asia after gaining backing from Chinese insurer Ping An Insurance Co Ltd and consultancy firm Oliver Wyman.

NYT

- Special Counsel Robert Mueller has asked the White House for documents about some of U.S. President Donald Trump's most scrutinized actions since taking office, including the firing of his national security adviser and F.B.I. director, according to White House officials. nyti.ms/2fBnzOq

- Less than two weeks after Hurricane Irma, a new storm, Hurricane Maria, made a direct hit on Puerto Rico, knocking out its power grid. nyti.ms/2xooPh9

- Alphabet Inc's Google said late Wednesday it is spending $1.1 billion to hire a team of engineers from the smartphone business of struggling Taiwanese manufacturer HTC Corp in a bid to bring more hardware expertise to its own mobile technology operations. nyti.ms/2xgPHjD

- The Securities and Exchange Commission said it was a victim of a computer hack last year in which attackers could have exploited private information for trading purposes. nyti.ms/2wBfh3G

- The board of Japanese conglomerate Toshiba Corp has approved a plan to sell its microchip business to a group of American and Japanese buyers. nyti.ms/2wzr2aC

- Sheryl Sandberg, Facebook's chief operating officer, promised to add more oversight to the company's automated systems to make sure offensive terms are not used to target ads. nyti.ms/2xhhHUy

Canada

THE GLOBE AND MAIL

** The winds are blowing against Bombardier Inc in its trade war with Boeing Co as some analysts expect a preliminary ruling from the U.S. Department of Commerce early next week to go against the Canadian planemaker. tgam.ca/2hkRjip

** A Canadian Federation of Independent Business survey of small-business owners shows strong opposition to the federal government's proposed tax rules. tgam.ca/2hl06B2

** Opposition Members of Parliament are accusing Canadian Prime Minister Justin Trudeau and Finance Minister Bill Morneau of shielding their family assets from the tax hikes they want to impose on small businesses. tgam.ca/2hlk1zZ

NATIONAL POST

** The stain of bankruptcy protection filings on both sides of the border could confuse Toys R Us (IPO-TOYS.N) Canada customers and spook toy suppliers already worried about the debt-plagued U.S. division, industry analysts say. bit.ly/2hkJo4I

** Canadian retail landlord First Capital Realty Inc and its partners have hired real estate firm CBRE Group Inc to sell a collection of 19 key urban assets. bit.ly/2hlbkW6

Britain

The Times

Indian billionaire Anil Agarwal is raising his stake in Anglo American Plc after announcing plans to buy up to 1.5 billion pounds-worth of new shares in the company. (bit.ly/2fC7V5m)

About 480 jobs will be cut at Mitie Group Plc as the struggling outsourcer responds to a series of setbacks including profit warnings, restated accounts, the overhaul of its board and regulatory inquiries. (bit.ly/2fBRNkp)

The Guardian

India's Tata Steel Ltd has paved the way for a merger of its European operations with the German steel manufacturer ThyssenKrupp AG, creating Europe's second largest steel group after ArcelorMittal. (bit.ly/2fBS4Ut)

Bidders for UK stock market listed companies must lay out more detailed plans for their target, including location of its head office and research and development investment, under proposed rules put forward by the takeover watchdog and backed by the government. (bit.ly/2fCabcN)

The Telegraph

The City's top lobby group has urged Theresa May to get a move on with a Brexit transition deal as she prepares for a landmark speech in Italy on Friday. TheCityUK has slammed the lack of progress made on agreeing a transitional arrangement since the EU referendum and called for urgent action to limit damage to the City. (bit.ly/2fALmh9)

German energy giant Eon is in talks to sell its stake in the fossil fuel and trading company Uniper to Finnish utility Fortum for 3.8 billion euros ($4.51 billion). (bit.ly/2fBUu5v)

Sky News

Dominic Chappell, the businessman at the helm of BHS when it collapsed last year, has denied charges linked to an investigation by The Pensions Regulator. (bit.ly/2fBVeHP)

The finance director of the Co-operative Bank, John Worth, is to step down weeks after the lender concluded a 700 million pound ($944.58 million) rescue deal designed to secure its long-term future. (bit.ly/2fzUeDN)

The Independent

A London and San Francisco-based cyber security firm, Digital Shadows, has raised $26 million in a funding round led by Octopus Ventures, an early backer of Zoopla and LOVEFilm, to support its expansion into markets such as Asia. (ind.pn/2fBIJfm)

There is no love lost in the endlessly escalating war of words and delightful soundbites between Trump and North Korea, and after the President threatened to “totally destroy” North Korea, the country's foreign minister said Trump's UN speech amounted to “the sound of a dog barking,” adding that Trump’s warnings are just a nonsensical “dog dream."

“If he was thinking he could scare us with the sound of a dog barking, that's really a dog dream,” North K Read more.....

There is no love lost in the endlessly escalating war of words and delightful soundbites between Trump and North Korea, and after the President threatened to “totally destroy” North Korea, the country's foreign minister said Trump's UN speech amounted to “the sound of a dog barking,” adding that Trump’s warnings are just a nonsensical “dog dream."

“If he was thinking he could scare us with the sound of a dog barking, that's really a dog dream,” North Korean Foreign Minister Ri Yong-ho told reporters in New York on Wednesday, as cited by the Yonhap news agency. Along with other world diplomats, Ri was in New York to attend the UN General Assembly. In his debut speech to the UN on Tuesday, Trump vowed to "totally destroy" North Korea if the US was forced to defend its allies. Referring North Korean leader Kim Jong Un by a nickname he first used in in a tweet Sunday, Trump said: "Rocket man is on a suicide mission for himself and for his regime."

Responding to Trump’s new nickname for North Korean leader Kim Jong-un, 'Rocket Man', Ri said: “I feel sorry for his aides.”

North Korean diplomats were not present for Trump's speech.

According to CNN, US Secretary of State Rex Tillerson, who is also in New York, played down the possibility of a meeting with his North Korean counterpart. Pyongyang and Washington do not maintain formal diplomatic relations and the presence of North Korea's top diplomat in the US could have afforded a rare chance for high-level, face-to-face dialogue.

Tillerson told reporters he did not believe he could have a "matter-of-fact discussion with North Korea because we don't know how their means of communication and behavior will be.

Tillerson claimed there were signs that increased international pressure on North Korea was starting to bear fruit. He said there was evidence of fuel shortages in the country after the passage of recent UN sanctions, which targeted oil imports among other things. However, analysts pointed out that fuel shortages did not necessarily prove that sanctions were having an effect, as most North Koreans don't own cars or use fuel at anywhere near the rate of the rest of the world.

Separately, Trump is scheduled to meet with Japanese Prime Minister Shinzo Abe and South Korean President Moon Jae-in Thursday, two important US allies on North Korea's doorstop. On the top of the agenda is likely to be South Korea's surprise decision to send an $8 million aid package to North Korea. According to Reuters, the move, which runs contrary to the US and Japan's calls for an increase in economic and diplomatic pressure, marks a resumption in South Korean aid after a break of almost two years.

The South said it planned to send $4.5 million worth of medical treatments, nursery facilities and nutritional products for children and pregnant women through the World Food Programme, and $3.5 million worth of medicinal treatments and nutritional products through UNICEF.

"We have consistently said we would pursue humanitarian aid for North Korea in consideration of the poor conditions children and pregnant women are in there, apart from political issues,” said Unification Minister Cho Myong-gyon.

 

UNICEF’s regional director for East Asia and the Pacific Karin Hulshof said in a statement before the decision the problems North Korean children face “are all too real”.

 

“Today, we estimate that around 200,000 children are affected by acute malnutrition, heightening their risk of death and increasing rates of stunting,” Hulshof said. “Food and essential medicines and equipment to treat young children are in short supply,” she said.

However as Reuters adds, the decision to send aid to North Korea "was not popular in South Korea, hitting President Moon Jae-in’s approval rating. It also raised concerns in Japan and the United States, and followed new U.N. sanctions against North Korea over its sixth nuclear test earlier this month."

South Korea’s efforts aimed at fresh aid for North Korea dragged down Moon’s approval rating. Realmeter, a South Korean polling organization, said on Thursday Moon’s approval rating stood at 65.7 percent, weakening for a fourth straight month.

The last time the South had sent aid to the North was in December 2015 through the United Nations Population Fund (UNFPA) under ex-president Park Geun-hye.

Meanwhile, Chinese Foreign Minister Wang Yi said the situation on the Korean peninsula was getting more serious by the day and could not be allowed to spin out of control. “We call on all parties to be calmer than calm and not let the situation escalate out of control,” Wang said, according to a report from the state-run China News Service on Thursday.

Meeting separately with his South Korean counterpart, Kang Kyung-wha, Wang reiterated a call for South Korea to remove the U.S.-built THAAD anti-missile system, which China says is a threat to its own security. “China hopes South Korea will make efforts to reduce tension,” a report on China’s official Xinhua news agency quoted Wang as saying.

Gold Investment "Compelling" As Fed Likely To Create Next Recession

- Is the Fed abo Read more.....

Over two years ago, on an otherwise uneventful Thursday in May 2015, shares of Avon Products suddenly jumped 20% leaving investors stunned. The catalyst was quickly discovered: a filing recently uploaded to Edgar, the SEC’s public filings database and purportedly from London-based “PTG Capital”, claimed that the "private-equity" Read more.....

Over two years ago, on an otherwise uneventful Thursday in May 2015, shares of Avon Products suddenly jumped 20% leaving investors stunned. The catalyst was quickly discovered: a filing recently uploaded to Edgar, the SEC’s public filings database and purportedly from London-based “PTG Capital”, claimed that the "private-equity" firm was bidding to take Avon private. Upon closer inspection, investors noticed a series of glaring, suspicious errors. For one, the document was riddled the spelling mistakes – the firm’s own name, consisting of a three-letter acronym – was repeatedly misspelled. The address listed for the firm was quickly revealed to be fake. And, as it turned out, there was no PTG capital operating in London – or anywhere, for that matter.

Investors quickly concluded that the filing was a hoax, and Avon shares crashed back to earth. US authorities eventually blamed it on a Bulgarian hacker who the agency claimed earned a meager profit of $5,000 for his efforts.

Now, two years later, the SEC has revealed that the Avon hoax - and possibly a handful of other scams involving fraudulent Edgar filings - was made possible thanks to an "intrusion" into Edgar's test-filing system. According to a statement released overnight by the SEC, the vulnerability that made the Avon hoax possible was discovered in 2016, and quickly patched. But it was only in August that the agency learned the vulnerability had been exploited by criminals, who likely used it to make countless illegal trades, generating an unknown amount of insider-trading profits. 

“In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading.  Specifically, a software vulnerability in the test filing component of the Commission’s EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information. It is believed the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk. An internal investigation was commenced immediately at the direction of the Chairman.”  

The timing of the SEC’s revelation is notable. Less than two weeks ago, credit-monitoring firm Equifax disclosed what’s believed to be the most damaging hack in US history after thieves absconded with sensitive personal and financial data of 143 million Americans.

In his statement, SEC Chairman Jay Clayton, who has been leading the agency for only a few months, essentially said that intrusions like the Avon hoax are inevitable. What matters, he said, is how companies and government agencies handle the response.

“Cybersecurity is critical to the operations of our markets and the risks are significant and, in many cases, systemic,” said Chairman Clayton. “We must be vigilant. We also must recognize—in both the public and private sectors, including the SEC—that there will be intrusions, and that a key component of cyber risk management is resilience and recovery.”

Precisely for this reason, executives at the major stock exchanges have, in recent months, warned that they might reconsider launching the Consolidated Audit Trail – a consolidated data feed that would aggregate the order books of US equity and options exchange. Such a target, the executives say, would present a tantalizing target for hackers, who could easily reap massive profits from the data, according to WSJ. The feed was expected to launch in November.

Here’s more from WSJ:

“Mr. Clayton’s statement acknowledged that the planned data repository, known as the Consolidated Audit Trail, could be targeted by cyber thieves looking to steal personal information of stockbrokers’ customers. The audit trail has been in the works for nearly seven years and the SEC approved its final design last year. However, exchange executives have recently cited the Equifax hack as evidence that the audit trail should be pared back, even if that takes away information that could help regulators spot manipulative traders more quickly.

Stock and options exchanges, as well as the Financial Industry Regulatory Authority, which oversees brokers, are due to begin reporting data to the repository in November. Robert Cook, chief executive of Finra, also has questioned whether the audit trail should be scaled back in light of the Equifax data breach. Speaking Wednesday at a banking luncheon in Washington, Mr. Cook questioned whether the database designed to help regulators sort through flash crashes and spot market manipulation should include personal information about stockbrokers’ customers.

 

“Especially post-Equifax when we are trying to win back investor confidence in the markets, it seems to be a useful question to ask whether we’ve got the right approach here or we need to revisit it,” he said.”

Data breaches and cyberattacks have been a fact of life for years. But, as criminals grow increasingly adept at using stolen information to game financial markets, we can't help but wonder what kind of long-term impact this troubling trend will have on markets?

Finally, how long before this too is Putin's fault?

* * *

Read the SEC's full statement below (link):

Introduction

Data collection, storage, analysis, availability and protection (including security, validation and recovery) have become fundamental to the function and performance of our capital markets, the individuals and entities that participate in those markets, and the U.S. Securities and Exchange Commission ("Commission" or "SEC").  As a result of these and other developments, the scope and severity of risks that cyber threats present have increased dramatically, and constant vigilance is required to protect against intrusions.  The Commission is focused on identifying and managing cybersecurity risks and ensuring that market participants – including issuers, intermediaries, investors and government authorities – are actively and effectively engaged in this effort and are appropriately informing investors and other market participants of these risks.

I recognize that even the most diligent cybersecurity efforts will not address all cyber risks that enterprises face.  That stark reality makes adequate disclosure no less important.  Malicious attacks and intrusion efforts are continuous and evolving, and in certain cases they have been successful at the most robust institutions and at the SEC itself.  Cybersecurity efforts must include, in addition to assessment, prevention and mitigation, resilience and recovery.

In today's environment, cyberattacks are perpetrated by identity thieves, unscrupulous contractors and vendors, malicious employees, business competitors, prospective insider traders and market manipulators, so-called "hacktivists," terrorists, state-sponsored actors and others.  Cyber intrusions can create significant risks to the operational performance of market participants and of markets as a whole.  These risks can take the form of denials of service and the destruction of systems, potentially resulting in impediments to account access and transaction execution, and disruption of other important market system functionalities.  The risks associated with cyber intrusions may also include loss or exposure of consumer data, theft or exposure of intellectual property, and investor losses resulting from the theft of funds or market value declines in companies subject to cyberattacks, among others.  Market participants also face regulatory, reputational and litigation risks resulting from cyber incidents, as well as the potential of incurring significant remediation costs.

Ultimately, a large portion of the costs incurred in connection with these risks, including the costs of mitigation, are borne by investors, consumers, and other important constituents.

Cybersecurity risks extend beyond data storage and transmission systems.  Maintaining reliability of data operations also depends on the continued functioning of other services that themselves face significant cyber risks, including, most notably, critical infrastructure such as electric power and communications grids.

In May 2017, I initiated an assessment of our internal cybersecurity risk profile and our approach to cybersecurity from a regulatory and oversight perspective.  Components of this initiative build on prior agency efforts in this area and include establishing a senior-level cybersecurity working group to coordinate information sharing, risk monitoring, and incident response efforts throughout the agency.  This Statement is one part of our effort to analyze, improve and communicate our work in this area to market participants and the American public more generally.  In more detail below we provide an overview of our approach to cybersecurity as an organization and as a regulatory body, including:

the types of data we collect, hold and make publicly available;

how we manage cybersecurity risks and respond to cyber events related to our operations;
how we incorporate cybersecurity considerations in our risk-based supervision of the entities we regulate;
how we coordinate with other regulators to identify and mitigate cybersecurity risks; and
how we use our oversight and enforcement authorities in the cybersecurity context, including to pursue cyber threat actors that seek to harm investors and our markets.
This Statement describes various specific cybersecurity risks that we and our regulated entities face, as well as cybersecurity events that we have experienced.  These descriptions provide context, but are not exhaustive.

We also expect to provide a discussion of internal cybersecurity matters each year in our annual Agency Financial Report.

I. Collection and Use of Data by the Commission

In support of its mission, the Commission receives, stores and transmits data falling under three broad categories.  These activities are critical to our tri-partite mission of investor protection, the maintenance of fair, orderly and efficient markets, and the facilitation of capital formation.

The first category of data includes public-facing data that is transmitted to and accessed through Commission systems.  Since its creation in 1934, a critical part of the SEC's mission has been its oversight of the system of public reporting by issuers and other registrants, and in 1984 the Commission began collecting, and making publicly available, disclosure documents through its EDGAR system.  In 2017, on a typical day, investors and other market participants access more than 50 million pages of disclosure documents through the EDGAR system, which receives and processes over 1.7 million electronic filings per year.

The second category of data the Commission receives, stores and transmits includes nonpublic information, including personally identifiable information, generally related to our supervisory and enforcement functions.  This data, which relates to the operations of issuers, broker-dealers, investment advisers, investment companies, self-regulatory organizations ("SROs"), alternative trading systems ("ATSs"), clearing agencies, credit rating agencies, municipal advisors and other market participants, may be sensitive to individuals, organizations and our markets generally.   

For example, staff in our Division of Trading and Markets often receive nonpublic drafts of proposed rule filings by SROs, and staff in our Division of Investment Management and Division of Corporation Finance often receive drafts of applications for exemptive relief under the federal securities laws.  Staff in our Office of Compliance Inspections and Examinations ("OCIE"), among other divisions and offices, receive nonpublic data, including personally identifiable information, in connection with their ongoing oversight and examinations of broker-dealers, investment advisers, and other regulated entities.  Staff in our Division of Enforcement receive nonpublic and personally identifiable information in connection with their investigations into potential violations of the federal securities laws.

In addition, at this time it is expected that the Commission will have access to significant, nonpublic, market sensitive data and personally identifiable information in connection with the implementation of the Consolidated Audit Trail ("CAT").  CAT is intended to provide SROs and the Commission access to comprehensive data that will facilitate the efficient tracking of trading activity across U.S. equity and options markets.  CAT, which is being developed and operationalized by the SROs, is in the later stages of its multi-year development, and its first stage of operation is scheduled to commence in November 2017.  Cybersecurity has been and will remain a key element in the development of CAT systems.

The third category of data includes nonpublic data, including personally identifiable information, related to the Commission's internal operations.  This includes, for example, personnel records, records relating to internal investigations, and data relating to our risk management and internal control processes.  This category also includes materials that Commission staff generate in connection with their daily roles and responsibilities, including work papers and internal memoranda.

As required by the Privacy Act of 1974 (5 U.S.C. § 552a), the Commission discloses on its website the types of personally identifiable information it receives, whether in connection with its outward-facing or internal operations.  The Commission also publishes privacy impact assessments to inform the public about the information it collects and the safeguards that have been put in place to protect it.[1]

II. Management of Internal Cybersecurity Risks

As described above, the Commission receives, stores and transmits substantial amounts of data, including sensitive and nonpublic data.  Like many other governmental agencies, financial market participants and other private sector entities, we are the subject of frequent attempts by unauthorized actors to disrupt access to our public-facing systems, access our data, or otherwise cause damage to our technology infrastructure, including through the use of phishing, malware and other attack vectors.  For example, with respect to our EDGAR system, we face the risks of cyber threat actors attempting to compromise the credentials of authorized users, gain unauthorized access to filings data, place fraudulent filings on the system, and prevent the public from accessing our system through denial of service attacks.  We also face the risks of actors attempting to access nonpublic data relating to our oversight of, or enforcement actions against, market participants, which could then be used to obtain illicit trading profits.  Similarly, with respect to CAT, we expect we will face the risk of unauthorized access to the CAT's central repository and other efforts to obtain sensitive CAT data.[2]  Through such access, intruders could potentially obtain, expose and profit from the trading activity and personally identifiable information of investors and other market participants.

Notwithstanding our efforts to protect our systems and manage cybersecurity risk, in certain cases cyber threat actors have managed to access or misuse our systems.  In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading.  Specifically, a software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information.  We believe the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk.  Our investigation of this matter is ongoing, however, and we are coordinating with appropriate authorities.  As another example, our Division of Enforcement has investigated and filed cases against individuals who we allege placed fake SEC filings on our EDGAR system in an effort to profit from the resulting market movements.[3]

In addition, like other organizations, we are subject to the risk of unauthorized actions or disclosures by Commission personnel.  For example, a 2014 internal review by the SEC's Office of Inspector General ("OIG"), an independent office within the agency, found that certain SEC laptops that may have contained nonpublic information could not be located.[4]  The OIG also has found instances in which SEC personnel have transmitted nonpublic information through non-secure personal email accounts.[5]  We seek to mitigate this risk by requiring all personnel to complete privacy and security training and we have other relevant risk mitigation controls in place.  

Similarly, we are subject to cybersecurity risk in connection with vendors we utilize.  For example, a weakness in vendor systems or software products may provide a mechanism for a cyber threat actor to access SEC systems or information through trusted paths.  Recent global supply chain security incidents such as compromises of reputable software update services are illustrative of this type of occurrence.

In light of the nature of the data at risk and the cyber-related threats faced by the SEC, the Commission employs an agency-wide cybersecurity detection, protection and prevention program for the protection of agency operations and assets.  This program includes cybersecurity protocols and controls, network protections, system monitoring and detection processes, vendor risk management processes, and regular cybersecurity and privacy training for employees.  That said, we recognize that cybersecurity is an evolving landscape, and we are constantly learning from our own experiences as well as the experiences of others.  To aid in this effort, and notwithstanding limitations on our hiring generally, we expect to hire additional expertise in this area.

Governance

It is our experience, consistent with the President's Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, that a focus by senior management on cybersecurity is an important contributor to the effective identification and mitigation of cybersecurity risks.[6]  To that end, SEC Commissioners and senior management have emphasized cybersecurity awareness and compliance.  Senior management across the SEC's offices and divisions are required to coordinate with respect to cybersecurity efforts, including through risk reporting and the development and testing of agency-wide procedures and exercises for responding to both internal and external cyber threats.

Although all SEC personnel are responsible for employing practices that minimize cybersecurity risks, the SEC's Office of Information Technology has overall management responsibility for the agency's information technology program, including cybersecurity.  The Chief Information Officer and Chief Information Security Officer lead cybersecurity efforts within the agency, including with respect to maintaining and monitoring adherence to the agency's Information Security Program Plan (described further below).

The SEC periodically assesses the effectiveness of its cybersecurity efforts, including through penetration testing of internal and public-facing systems, ongoing monitoring by the Department of Homeland Security, independent verification and validation, and security assessments conducted by impartial third parties.

Policies and procedures

The SEC maintains a number of internal policies and procedures related to cybersecurity, as set forth in the agency's Information Security Program and Program Plan.  These documents, which are developed in accordance with standards set forth by the National Institute of Standards and Technology ("NIST"), delineate the roles and responsibilities of various agency officials, offices, committees and system owners in carrying out the SEC's information security objectives, including our training efforts.

The Commission also is in the process of implementing the NIST Framework for Improving Critical Infrastructure Cybersecurity.[7]  Among other things, the NIST Framework is expected to help the agency define and achieve appropriate cybersecurity goals and outcomes, including identifying key assets, protecting against intrusions, detecting incidents, containing impacts and planning for recovery.

Independent audits and reviews

The SEC's cybersecurity program is subject to review from internal and external independent auditors.  The SEC's OIG audits the agency's information technology systems, and components of these audits have included cybersecurity controls.  The OIG also audits compliance with applicable federal cybersecurity requirements in accordance with the Federal Information Security Modernization Act of 2014 ("FISMA").[8]  

In addition, the Government Accountability Office ("GAO"), an external audit agency, performs annual audits of the effectiveness of the Commission's internal control structure and procedures for financial reporting.  In connection with these audits, the GAO has examined the effectiveness of information security controls designed to protect the confidentiality, integrity, and availability of key financial systems and information.[9]  The Commission takes seriously identified deficiencies, documents the corrective actions it undertakes, and provides documentation to auditors to close out recommendations.

External reporting

The SEC submits reports on its cybersecurity performance to the Office of Management and Budget.  The agency also reports privacy and cybersecurity incidents to the Department of Homeland Security's Computer Emergency Readiness Team ("US-CERT") in accordance with established protocols.  Further, the SEC has established relationships with the National Cybersecurity and Communications Integration Center ("NCCIC"), the Financial and Banking Information Infrastructure Committee ("FBIIC"), and Financial Services Information Sharing and Analysis Center ("FS-ISAC") to share information regarding cybersecurity threats.

III. Incorporation of Cybersecurity Considerations in the Commission's Disclosure-Based and Supervisory Efforts

Promoting effective cybersecurity practices by market participants is critical to all three elements of the SEC's mission.  As described in more detail below, the Commission incorporates cybersecurity considerations in its disclosure and supervisory programs, including in the context of the Commission's review of public company disclosures, its oversight of critical market technology infrastructure, and its oversight of other regulated entities, including broker-dealers, investment advisers and investment companies.

Promoting effective public company disclosures

With respect to U.S. public company issuers, the SEC's primary regulatory role is disclosure based.  To that end, the staff of the Division of Corporation Finance has issued disclosure guidance to help public companies consider how issues related to cybersecurity should be disclosed in their public reports.[10]

The staff guidance discusses, among other things, cybersecurity considerations relevant to a company's risk factors, management's discussion and analysis of financial condition and results of operations ("MD&A"), description of business, discussion of legal proceedings, financial statements, and disclosure controls and procedures.  The staff guidance is principles based and, while issued in 2011, remains relevant today.  Accordingly, issuers should consider whether their publicly filed reports adequately disclose information about their risk management governance and cybersecurity risks, in light of developments in their operations and the nature of current and evolving cyber threats.  The Commission also will continue to evaluate this guidance in light of the cybersecurity environment and its impacts on issuers and the capital markets generally.

Oversight of market infrastructure

The Commission's regulatory role with respect to market infrastructure such as exchanges and clearing agencies extends beyond compliance with applicable disclosure requirements and includes ongoing supervision and oversight.  In furtherance of its statutory objectives, the Commission adopted Regulation Systems Compliance and Integrity ("Regulation SCI") and Form SCI in November 2014 to strengthen the technology infrastructure of the U.S. securities markets.  The regulation applies to "SCI entities," a term which includes SROs (including stock and options exchanges, registered clearing agencies, FINRA and the MSRB), ATSs that exceed specified trading volume thresholds, disseminators of consolidated market data, and certain exempt clearing agencies.[11]

Regulation SCI is designed to reduce the occurrence of systems issues, improve resiliency when systems problems do occur, and enhance the Commission's ability to oversee and enforce rules governing market infrastructure.  In addition to requiring SCI entities to maintain policies and procedures reasonably designed to ensure operational resiliency, the regulation requires SCI entities to take corrective action with respect to systems disruptions, compliance issues and intrusions (e.g., cybersecurity breaches).  SCI entities are also required to provide notification, including to the Commission, of such events.  SCI entities are subject to examinations by OCIE, and OCIE's Technology Controls Program reviews Regulation SCI filings as part of CyberWatch, OCIE's internal program responsible for triaging all system events reported to the SEC under Regulation SCI.

Oversight of broker-dealers, investment advisers and other market participants

The SEC also conducts supervisory oversight of broker-dealers, investment advisers, investment companies, credit rating agencies and other market participants registered with the Commission.  Many of these entities act as the primary interface between the securities markets and investors, including Main Street investors.  Not only do their systems provide investors access to their securities accounts, but those systems in many cases also hold customers' personally identifiable information.

Certain SEC regulations directly implicate information security practices of regulated entities.  For example, Regulation S-P requires registered broker-dealers, investment companies and investment advisers to adopt written policies and procedures governing safeguards for the protection of customer information and records.[12]  Similarly, Regulation S-ID requires these firms, to the extent they maintain certain types of covered accounts, to establish programs addressing how to identify, detect and respond to potential identity theft red flags.[13]  In addition, SEC staff engage with regulated firms to provide guidance on cybersecurity practices.  For example, in April 2015, the SEC's Division of Investment Management issued staff guidance to highlight the importance of cybersecurity and discuss measures for funds and advisers to consider when addressing cybersecurity risks.[14]

The risk-based examinations of registered entities conducted by OCIE staff have included reviews of risk management programs and other operational components in order to evaluate compliance with Regulations S-P and S-ID, as well as with other federal securities laws and regulations.  In recent years, OCIE has placed increasing emphasis on cybersecurity practices and has included cybersecurity in its examination priorities.[15]  In August 2017, OCIE published a summary of observations from its second major initiative to assess cybersecurity preparedness in the securities industry.[16]  The initiative focused its review on the content and implementation of firms' written cybersecurity policies and was part of a series of OCIE publications on cybersecurity.[17]  Recognizing that there is no single correct approach to cybersecurity, the publication was not intended to provide a checklist of required practices, but rather to share information about practices the staff identified that may be useful to firms as they engage in cybersecurity planning.

IV. Coordination With Other Governmental Entities

Effective interagency coordination facilitates the identification, mitigation and remediation of broad and potentially systemic cybersecurity risks, and it also can sharpen the focus by regulated entities on risk management efforts.  As a general matter, the Commission shares oversight responsibility for large financial institutions with other financial regulators, which in the U.S. include the Board of Governors of the Federal Reserve System, the Commodity Futures Trading Commission, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation, among others.  Our oversight may also require coordination with other regulatory agencies.  For example, consumer protection matters with respect to SEC registrants are largely overseen by other federal regulators, including the Federal Trade Commission and the Consumer Financial Protection Bureau.

The Commission coordinates on cybersecurity matters with the Department of the Treasury and other federal financial regulatory agencies within the framework of the FBIIC, an interagency working group.  The FBIIC was designed to improve coordination and communication among financial regulators, enhance financial sector resiliency and promote private-public partnership.  In addition to being a vehicle for federal agencies to communicate timely alerts regarding cyber threats or vulnerabilities in the financial sector, the FBIIC identifies and assesses critical infrastructure assets and holds periodic cyber incident response simulations with the FBIIC members, law enforcement and industry.

The FBIIC also engages with the private sector on regulatory harmonization and critical cybersecurity and other infrastructure issues, primarily through industry groups such as the Financial Services Sector Coordinating Council ("FSSCC").[18]  FBIIC and FSSCC members coordinate exercises to identify critical issues that could impact the resiliency of the U.S. financial system and that may need to be addressed by private industry, the public sector, or both.   

With respect to cyber-related issues that could pose a systemic risk to our markets or U.S. financial stability, we also coordinate with other financial regulators through the Financial Stability Oversight Council.  In addition, we seek to coordinate with non-U.S. regulators both bilaterally and through international organizations such as the International Organization of Securities Commissions.

V. Enforcement of the Federal Securities Laws

Issuers and other market participants must take their periodic and current disclosure obligations regarding cybersecurity risks seriously, and failure to do so may result in an enforcement action.

In addition, the Commission has used its enforcement authority under the federal securities laws to vigorously pursue cyber threat actors who seek to harm investors and our markets.  The use of innovative technology and analytical tools, many of which were developed internally, has enabled the Division of Enforcement to increasingly identify suspicious trading activity across multiple issuers, traders and geographic locations.

The Commission recently has brought several cases alleging the hacking and stealing of nonpublic information in connection with illicit trading activity.  For example, in December 2016, the Commission charged three traders for allegedly participating in a scheme to hack into two prominent New York-based law firms to steal information pertaining to clients that were considering mergers or acquisitions, which the hackers then used to trade.[19]  The Commission also brought charges against two defendants who allegedly hacked into newswire services to obtain non-public information about corporate earnings announcements, as well as dozens of other defendants who allegedly traded on the information.[20]

In another type of case, the Commission brought charges concerning a scheme to gain unauthorized access to online brokerage accounts of U.S. investors and make unauthorized stock trades, thereby driving up share prices and allowing those who allegedly perpetrated the scheme to generate profits in other trading accounts.[21]

In an effort to proactively and efficiently address securities fraud in connection with cyberattacks, the Division of Enforcement has developed substantial expertise in the detection and pursuit of fraudulent conduct across the increasingly technological and data-driven landscape, devotes substantial resources to this effort, and works closely with its law enforcement counterparts.

VI. Looking Forward

The Commission will continue to prioritize its efforts to promote effective cybersecurity practices within the Commission itself and with respect to the markets and market participants it oversees.  This requires an ongoing, thoughtful evaluation of the data we obtain.  When determining when and how to collect data, we must continue to thoughtfully evaluate our approach in light of the importance to our mission of each type of data we receive, particularly in the case of sensitive data, such as personally identifiable and nonpublic information.

There are certain types of sensitive data that we must obtain from market participants in order to fulfill our mission.  When determining when and how to collect data, it is important that we regularly review whether our related data protections are appropriate in light of the sensitivity of the data and the associated risks of unauthorized access.  We should also continue to evaluate whether alternatives exist that may allow us to further our mission while reducing the sensitivity of data we collect.  For example, one way in which we have reduced the market sensitivity of certain data we collect has been to obtain it on a delayed basis when appropriate.

Cybersecurity is critical to investors, market participants, our markets, and the Commission itself.  By promoting effective cybersecurity practices in connection with both the Commission's internal operations and its external regulatory oversight efforts, it is our objective to contribute substantively to a financial market system that recognizes and addresses cybersecurity risks and, in circumstances in which these risks materialize, exhibits strong mitigation and resiliency.