Category Archives: Employee Misconduct

The Newest Form of the Romance Scam: Corporate Insider Fraud Through Outsider Threat – How AI is Allowing Scammers to Make it Appear that Authorized Employees are Conducting Authorized Activity When the Opposite is True

by Tom Melvin, Rich Kando, and Kevin Madura

Left to right: Tom Melvin, Rich Kando, and Kevin Madura (photos courtesy of AlixPartners LLP)

Today’s most-concerning corporate romance is not on Coldplay’s kiss cam. Artificial-intelligence (AI)-enabled document creation, synthetic IDs, face swapping, and impersonated voice overlays have made online scams more dangerous and more ubiquitous than ever. Armed with those new tools, scammers once used them primarily to defraud individuals, with an estimated loss of $75 billion[1] is targeting corporate bank accounts and data repositories. Enter the corporate romance scam as a direct threat to two of a company’s most highly valuable assets: cash and data.

Continue reading →

Takeaways from the Dismissal of Most of the Government’s Case Against the SolarWinds CISO

by Ilona Cohen

Photo courtesy of the author

Last year, the government filed a landmark lawsuit alleging that SolarWinds and its Chief Information Security Officer (CISO) misled the public about the company’s cybersecurity practices before and after a major cyberattack. The charges surprised leaders in the industry and forced many companies to reevaluate their own security programs. In a recent development, however, a judge in New York dismissed most of the charges against the company and SolarWinds’ CISO, leaving many to wonder what these developments mean for them.

The case against SolarWinds was filed by the Securities and Exchange Commission (SEC), a government agency that has interpreted its authority broadly to regulate publicly traded companies. The court did not agree with the SEC’s use of that authority in key respects and dismissed allegations that the statements in SolarWinds’ press releases, blog posts, podcasts, and certain SEC filings, misrepresented the company’s cybersecurity risks and controls.

Continue reading →

DOJ National Security Division Issues First-Ever Declination Under Enforcement Policy

by Satish M. Kini, David A. O’Neil, Jane Shvets, Rick Sofield, Douglas S. Zolkind, Carter Burwell, Connor R. Crowley, and Hillary Hubley

Top left to right: Satish M. Kini, David A. O’Neil, Jane Shvets, and Rick Sofield. Bottom left to right: Douglas S. Zolkind, Carter Burwell, Connor R. Crowley, and Hillary Hubley. (Photos courtesy of Debevoise & Plimpton LLP)

Key Takeaways

Even in criminal national security matters, early self-reporting, remediation and cooperation can enable companies to avoid prosecution and penalties.
Federal enforcement agencies are continuing to collaborate in investigating and prosecuting criminal cases at the intersection of national security and corporate crime.
Multinational corporations and academic institutions should be aware of the risk of outsiders fraudulently affiliating themselves with legitimate institutions to skirt export control laws.

Continue reading →

Head of DOJ Criminal Division Announces Voluntary Self-Disclosure Program for Individuals at PCCE’s 10th Anniversary Conference

On April 15, 2024, the NYU Law Program on Corporate Compliance and Enforcement (PCCE) held its 10th Anniversary Conference, featuring keynote speakers Nicole Argentieri, Principal Deputy Assistant Attorney General and Head of DOJ’s Criminal Division; Gurbir Grewal, Director of Enforcement, SEC; and Andrea Griswold, Deputy U.S. Attorney, SDNY, among other distinguished speakers. More information on the conference can be found here. At the conference, Principal Deputy Assistant Attorney General Argentieri first announced a new voluntary self-disclosure program for individuals. A blog post by her, which describes the program and provides links to more information, is republished below.

©Myaskovsky: Courtesy of NYU Photo Bureau

Continue reading →

Implications of the SEC’s “Shadow Trading” Verdict

by John F. Savarese, Wayne M. Carlin, and David B. Anders

From left to right: John F. Savarese, Wayne M. Carlin, and David B. Anders (photos courtesy of Wachtell, Lipton, Rosen & Katz).

Last week, a jury in San Francisco returned a verdict in SEC v. Panuwat, finding that a corporate executive engaged in insider trading when he learned about an impending acquisition of his employer and then traded in the securities of an unrelated company in the same industry. The case has widely been described as “novel” but, in bringing this case, the SEC did not seek to extend existing law. Panuwat simply applied well-established principles of insider trading law to a new fact pattern. Yet in doing so, this action may well have implications for corporate trading policies.

Continue reading →

SDNY Whistleblower Pilot Program Incentivizes Self-Disclosure and Cooperation

by Helen V. Cantwell, Andrew J. Ceresney, Andrew M. Levine, David A. O’Neil, Winston M. Paes, Jane Shvets, Bruce E. Yannett, Douglas S. Zolkind, Erich O. Grosz, and Rebecca Maria Urquiola

Top left to right: Helen V. Cantwell, Andrew J. Ceresney, Andrew M. Levine, David A. O’Neil, and Winston M. Paes.
Bottom left to right: Jane Shvets, Bruce E. Yannett, Douglas S. Zolkind, Erich O. Grosz, and Rebecca Maria Urquiola. (Photos courtesy of Debevoise & Plimpton LLP)

On Wednesday, January 10, 2024, the U.S. Attorney’s Office for the Southern District of New York (“SDNY”) launched the SDNY Whistleblower Pilot Program (the “Program”).[1] The Program seeks to incentivize individuals to report criminal wrongdoing—including corporate control failures, state and local bribery, and fraudulent dealings involving public funds—before SDNY learns of the conduct and to fully cooperate with any resulting investigations and prosecutions. U.S. Attorney Damian Williams encouraged individuals “to come clean, cooperate, and get on the right side of the law,” cautioning “[c]all us before we call you.”[2]

Continue reading →

United States v. Calk: The Second Circuit Construes the Bank Bribery Act

by Jonathan Rusch

Photo courtesy of the author

In any U.S. bank’s anti-bribery and anti-corruption compliance program, one of the fundamental federal criminal offenses that the program must address is the Bank Bribery Act (Act), 18 U.S.C. § 215.[1] Subsection 215(a) of the Act sets out two separate offenses:

(1) “corruptly giv[ing], offer[ing], or promis[ing] anything of value to any person, with intent to influence or reward an officer, director, employee, agent, or attorney of a financial institution in connection with any business or transaction of such institution”[2]; and

(2) “as an officer, director, employee, agent, or attorney of a financial institution, corruptly solicit[ing] or demand[ing] for the benefit of any person, or corruptly accept[ing] or agree[ing] to accept, anything of value from any person, intending to be influenced or rewarded in connection with any business or transaction of such institution.”[3]

Maximum penalties for a violation of either offense include 30 years’ imprisonment and a fine not more than $1,000,000 or three times the value of the thing given, offered, promised, solicited, demanded, accepted, or agreed to be accepted, whichever is greater.[4]

Surprisingly — given New York’s status as the world’s leading financial center[5], and the fact that section 215, with periodic revisions, has been in force for more than 75 years — the United States Court of Appeals for the Second Circuit had no occasion to construe the scope of section 215 until November 28, in United States v. Calk.[6] This post will summarize and discuss the key elements of Calk.

Continue reading →

If You Want to Contain Corruption, Promote Intrinsic Motivation!

by Johann Graf Lambsdorff, Kevin Grubiak, and Katharina Werner

From left to right: Johann Graf Lambsdorff, Kevin Grubiak, and Katharina Werner (photos courtesy of the authors)

There has been a long debate in areas such as development aid, procurement and compliance as to whether corruption or intrinsic motivation plays a greater role in determining the performance of corporate employees and public officials. One side, let us call it the deterrence-view, posits that containing corruption is a prerequisite for ensuring growth and development. Where corruption thrives, all efforts are futile. Aid money will seep into dark channels. Money intended for purchases will flow into overpriced deals. Employees sent to areas prone to dishonesty will be infected by a virus of fraud. Avoiding risks of corruption must then be the starting point for improvement. For example, the United Nations Convention Against Corruption (United Nations 2014: iii) states: “Corruption is a key element in economic underperformance and a major obstacle to poverty alleviation and development.” Many practitioners tend to adhere to this view, which emphasizes deterrence and a zero-tolerance strategy against corruption.

Continue reading →

Gatekeepers in the Dock

by Anthony O’Reilly

Photo courtesy of the author

Two recent complaints of serious misconduct against Chief Compliance Officers reminded me of a debate at one organization about whether Compliance Officers should suffer harsher consequences than others when they violate the compliance policies themselves.

To be clear, the complaints are serious. Steven Teixeira, then CCO at a global payments processing company, is alleged to have stolen material, nonpublic information that he accessed through his then-girlfriend’s work laptop, subsequently trading on the information and tipping others.[1] The second complaint by the debtors in possession of FTX Trading LTD alleges that David Friedberg, the former CCO at FTX was “indeed considered one of the key decisionmakers within the FTX group” and that Friedberg took actions including drafting, backdating and presenting to outside auditors allegedly fraudulent records to obscure the nature of funds transfers within the group. It further alleges that he bought the silence of whistleblowers and their attorneys. The complaint concludes that his roles as a gatekeeper meant he had a duty to “ensure appropriate internal controls, risk management and compliance” and yet knowingly failed to implement – and even obstructed the implementation – “of virtually any of the systems and internal controls that would be necessary”[2].

Continue reading →