Initial Decision Release No. 1394

Agency decision

Ask Donna

What actually matters in this document.

Text

Administrative Proceeding

File No. 3-16386

UNITED STATES OF AMERICA

Before the

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

In the Matter of

Traci J. Anderson, CPA,

Timothy W. Carnahan, and

CYIOS Corporation

Appearances:

Initial Decision

January 10, 2020

Matthew J. Gulde, Chris Davis, and B. David Fraser

for the Division of Enforcement,

Securities and Exchange Commission

Timothy W. Carnahan, pro se, and for CYIOS Corporation

Before:

James E. Grimes, Administrative Law Judge

Summary

This initial decision resolves allegations of material misstatements and

reporting violations against Respondents Timothy W. Carnahan and CYIOS

Corporation. CYIOS is a former public company that had a class of securities

registered with the Securities and Exchange Commission, and Carnahan is its

sole officer and director. For several years, CYIOS’s public, periodic filings

misrepresented that the company’s management had assessed the

effectiveness of its internal controls over financial reporting for each period

using an established framework. The evidence establishes that CYIOS had no

documented internal controls and Carnahan did not use any suitable

framework to assess the company’s internal controls. Indeed, Carnahan

admitted during his investigative testimony that he was the company’s

internal control and acted as his own quality assurance. Carnahan caused

CYIOS’s filings to be made with the Commission and signed multiple

certifications misrepresenting that the filings contained no untrue statements

of material fact. Additionally, CYIOS failed to make numerous required

periodic filings while its securities were registered.

I find that CYIOS violated, and Carnahan caused its violations of, Section

17(a)(3) of the Securities Act of 1933, Section 13(a) of the Securities Exchange

Act of 1934, and Exchange Act Rules 13a-1 and 13a-13. I also find that

Carnahan violated Exchange Act Rules 13a-14 and 13a-15(c). I order

appropriate sanctions below.1

Procedural Background

The Commission initiated this proceeding in February 2015, when it

issued an order instituting proceedings (OIP) under Securities Act Section 8A,

Exchange Act Sections 4C and 21C, and Commission Rule of Practice 102(e). 2

In relevant part, the OIP alleges the following facts and violations: Carnahan

failed to assess CYIOS’s internal controls and CYIOS misrepresented in its

periodic filings that management had assessed its internal controls using the

criteria set forth in the Internal Control-Integrated Framework issued by the

Committee of Sponsoring Organizations of the Treadway Commission (COSO

framework). As a result, CYIOS violated, and Carnahan caused its violations

of, Securities Act Section 17(a)(3), which makes it unlawful to engage in any

transaction, practice, or course of business which operates or would operate as

a fraud or deceit upon the purchaser.3 Also as a result of this misconduct,

Carnahan violated Exchange Act Rule 13a-14, which requires an issuer’s

principal executive and principal financial officer to attest that the company’s

“report does not contain any untrue statement of a material fact”; and

Exchange Act Rule 13a-15(c), which requires an issuer’s management to

perform an evaluation of the company’s internal controls as of the end of each

fiscal year.4 Further, due to its failure to file multiple periodic reports while its

A prior initial decision dismissed the proceeding as to Respondent Traci J.

Anderson, CPA, and that decision has become the final decision of the

Commission. Traci J. Anderson, CPA, Initial Decision Release No. 930, 2015

WL 9297356, at *1, *24 (ALJ Dec. 21, 2015), finality order, Securities Act

Release No. 10032, 2016 SEC LEXIS 380 (Feb. 2, 2016).

See 15 U.S.C. §§ 77h-1, 78d-3, 78u-3; 17 C.F.R. § 201.102(e).

15 U.S.C. § 77q(a)(3).

17 C.F.R. §§ 240.13a-14, .13a-15(c).

securities were registered, CYIOS violated, and Carnahan caused its violations

of, Exchange Act Section 13(a) and Rules 13a-1 and 13a-13.5

In 2015, an administrative law judge held a hearing and issued an initial

decision in which he found against Respondents on these charges but

dismissed two other charges that the Division is no longer pursuing. 6

Respondents appealed to the Commission.

In August 2018, following the Supreme Court’s decision in Lucia v. SEC,

the Commission remanded this proceeding, ordered that it be reassigned to an

administrative law judge who had not previously participated in the matter,

and directed that Respondents be given the opportunity for a new hearing.7 On

remand, the newly assigned administrative law judge ordered the parties to

submit a proposal for the conduct of further proceedings.8 In November 2018,

the parties represented that they were unable to agree to a proposal and

Respondents sought dismissal.

This case was reassigned to me in March 2019.9 Following a prehearing

conference, I adopted the parties’ jointly proposed schedule with modest

amendments.10 In late April 2019, I denied in part and deferred ruling in part

on Respondents’ motion for a ruling on the pleadings.11 In doing so, I directed

the Division to submit supplemental briefing on whether, following remand,

charges under Section 105(c)(7)(B) of the Sarbanes-Oxley Act of 2002 and

15 U.S.C. § 78m(a); 17 C.F.R. §§ 240.13a-1, .13a-13.

Anderson, 2015 WL 9297356, at *1, *9–20; see also Anderson, Admin. Proc.

Rulings Release No. 6549, 2019 SEC LEXIS 961, at *15–16 (ALJ Apr. 24,

2019); Anderson, Admin. Proc. Rulings Release No. 6613, 2019 SEC LEXIS

1482, at *2–3 (ALJ June 24, 2019).

Pending Admin. Proc., Securities Act Release No. 10536, 2018 WL

4003609, at *1 (Aug. 22, 2018); see also Lucia v. SEC, 138 S. Ct. 2044 (2018).

Anderson, Admin. Proc. Rulings Release No. 6126, 2018 SEC LEXIS 2705,

at *2 (ALJ Oct. 1, 2018).

Anderson, Admin. Proc. Rulings Release No. 6474, 2019 SEC LEXIS 295

(ALJ Mar. 4, 2019).

Anderson, Admin. Proc. Rulings Release No. 6519, 2019 SEC LEXIS 632

(ALJ Mar. 26, 2019).

Anderson, 2019 SEC LEXIS 961.

Securities Act Section 17(a)(2) were still at issue. 12 The Division responded

that it would not pursue “these charges further and w[ould] not offer evidence

supporting them.”13

In July, I ruled on various motions and denied Respondents’ motions

seeking dismissal.14

I held the hearing in this matter in July 2019. During the hearing, the

Division called three witnesses, Carnahan rested without calling any

witnesses or offering any exhibits, and I admitted 23 of the Division’s offered

exhibits. Carnahan refused to testify on Fifth Amendment grounds and I

instructed the Division to file a motion regarding whether I should draw

adverse inferences from Carnahan’s refusal to testify.15 I gave Respondents ten

days to respond to the Division’s motion.16 After the Division briefed the issue

but Carnahan failed to respond, I determined that I would draw adverse

inferences from Carnahan’s silence subject to the Division identifying specific

questions and inferences in its post-hearing brief.17 I also admitted four

exhibits that the Division was prevented from introducing through Carnahan’s

testimony by his refusal to testify.18

The Division filed its post-hearing brief in September 2019. Respondents

have made no filings since the hearing.

See id. at *11–16.

Div. Supplemental Br. 1–2 (Apr. 30, 2019).

See, e.g., Anderson, Admin. Proc. Rulings Release No. 6620, 2019 SEC

LEXIS 1622 (ALJ July 2, 2019); Anderson, Admin. Proc. Rulings Release No.

6626, 2019 SEC LEXIS 1724 (ALJ July 11, 2019).

Anderson, Admin. Proc. Rulings Release No. 6632, 2019 SEC LEXIS 1782

(ALJ July 18, 2019).

Id.

Anderson, Admin. Proc. Rulings Release No. 6650, 2019 SEC LEXIS 1955

(ALJ Aug. 5, 2019).

Id. at *8.

Procedural Issues

I base the following factual findings and legal conclusions on the entire

record and on facts officially noticed, applying preponderance of the evidence

as the standard of proof.19 I have given no weight to and have not presumed

the correctness of any opinions, orders, or rulings issued in this matter prior

to the Commission’s post-Lucia remand order of August 22, 2018.20 All

arguments that are inconsistent with this decision are rejected.

At the July hearing, I reserved ruling on the admissibility of Exhibit 43,

which contained Carnahan’s testimony from the pre-Lucia hearing held in

2015. The 2015 hearing was presided over by a judge who, at the time of the

hearing, was not properly appointed.21 Admission of the prior hearing

testimony would arguably contravene the Commission’s post-Lucia directive

to provide respondents with the opportunity for a new hearing before a judge

who did not previously participate in the matter, unless the parties expressly

agreed otherwise.22 Carnahan exercised his right to a new hearing but then

refused to testify. Nonetheless, the prior testimony is unnecessary given the

record developed at the July hearing, and the Division does not rely on it or

make any argument regarding its admissibility in its brief. I now determine

that Exhibit 43 is not admitted.23

During the hearing, Carnahan appeared to object to the entire

administrative proceeding on statute of limitations grounds. I instructed

Carnahan that he could address this argument in his post-hearing brief, but

he did not do so.24 Carnahan’s argument seeking dismissal on this basis has

See Rita J. McConville, Exchange Act Release No. 51950, 2005 WL

1560276, at *14 (June 30, 2005), pet. denied, 465 F.3d 780 (7th Cir. 2006); see

also 17 C.F.R. § 201.323; Anderson, Admin. Proc. Rulings Release No. 6622,

2019 SEC LEXIS 1706, at *1 (ALJ July 10, 2019) (taking official notice under

Rule 323 of CYIOS’s public filings with the Commission and their content).

See Pending Admin. Proc., 2018 WL 4003609, at *1.

Tr. 17; see also Lucia, 138 S. Ct. at 2055.

Pending Admin. Proc., 2018 WL 4003609, at *1.

17 C.F.R. §§ 201.111(c), .320(a).

Tr. 138–40.

previously been denied.25 The OIP was filed on February 13, 2015, and the

relevant misconduct began with CYIOS’s 2009 Form 10-K filed on February

26, 2010, which is within the five-year limitations period in 28 U.S.C. § 2462.26

Regarding adverse inferences, the Division summarily referenced the

topics about which Carnahan refused to testify in its brief, without identifying

“the specific questions and inferences it seeks,” as I directed it to do.27 In any

event, the record provides sufficient proof of Respondents’ violations, without

regard to any adverse inference.28 It is therefore unnecessary to base my

findings and conclusions on adverse inferences drawn from Carnahan’s refusal

to testify.29

Findings of Fact

1. Relevant Persons and Entities

CYIOS is incorporated in Nevada and headquartered in Washington,

D.C.30 CYIOS operates two subsidiaries that provide technology services and

products to U.S. government entities.31 One of CYIOS’s subsidiaries offers a

product called CYIPRO, which is described as “a business transformation tool”

that was built “to complement knowledge management and business

See Anderson, Admin. Proc. Rulings Release No. 6223, 2018 SEC LEXIS

2894, at *7 (ALJ Oct. 18, 2018); Anderson, Admin. Proc. Rulings Release No.

6620, 2019 SEC LEXIS 1622 (ALJ July 2, 2019).

OIP ¶¶ 11, 16, 20; CYIOS Corp., Annual Report (Form 10-K) (Feb. 26,

2010); see also Gabelli v. SEC, 568 U.S. 442, 447–48 (2013).

Anderson, 2019 SEC LEXIS 1955, at *8.

I did rely on adverse inferences to admit four of the Division’s exhibits

after the hearing. See supra note 18 and accompanying text.

See Guy P. Riordan, Securities Act Release No. 9085, 2009 WL 4731397,

at *16 (Dec. 11, 2009) (concluding that the evidence against the respondent

was “persuasive and more than sufficient to support findings of violations,

without regard to any adverse inference”), pet. denied, 627 F.3d 1230 (D.C. Cir.

2010), abrogated on other grounds by Kokesh v. SEC, 137 S. Ct. 1635 (2017).

Div. Ex. 21 at 490. Citations to an exhibit’s Bates numbers are to the

numerical digits only, excluding any alphabetical prefix and leading zeros.

Id. at 500.

transformation for agencies and commercial business.”32 This product

“provides a virtual work space for collaboration, project management, and

document management to help manage people, processes and information.”33

CYIOS has represented in its public filings that CYIPRO “provides key

solutions for compliance with Securities and Exchange Commission (‘SEC’)

Sarbanes-Oxley regulations,” but it is unclear how this aspect of the product

functioned or what regulations it addressed.34

Carnahan earned a bachelor of science degree in computer science from

Old Dominion University in 1989.35 He has no formal education in accounting

or financial statement preparation.36 After college graduation, Carnahan

worked for the U.S. Senate Sergeant at Arms where he “ran all the computer

systems for every Senator.”37 Carnahan founded CYIOS in 1995 and took the

company public through a reverse merger in 2005.38 Since the merger, he has

served as the company’s CEO, treasurer, and board chairman; and, since July

2007, he has served as its sole officer and director. 39 He signed company filings

as its CEO, president, principal financial officer, and principal accounting

officer.40

After serving as the company’s independent auditor for several years,

Traci J. Anderson resigned as its auditor and performed full-time accountingrelated work for CYIOS from at least 2010 until 2015.41 She interacted directly

with Carnahan and saw how the company functioned.42

Id.

Div. Ex. 3 at 100.

See id.

Div. Ex. 12 at 281; Div. Ex. 2 at 16.

Div. Ex. 2 at 16–18.

Id. at 18–19.

Id. at 20; Div. Ex. 3 at 100.

Div. Ex. 2 at 20–21.

Div. Ex. 2 at 67.

Tr. 33–34, 64–65; Div. Ex. 2 at 33–34, 83–84, 88–89.

Tr. 37.

2. Delinquent Filings, Misstatements as to Internal Controls, and Stock

Issued in Exchange for Consulting Services

CYIOS was a public company with its common stock registered with the

Commission under Exchange Act Section 12(g).43 CYIOS’s last periodic filing

was an amended Form 10-Q for the third quarter of 2012, which was filed

November 21, 2012.44 CYIOS filed a Form 15-12G to terminate its common

stock’s registration on May 30, 2014, which became effective ninety days later

on August 28, 2014.45

Carnahan was responsible for CYIOS’s periodic filings with the

Commission and their content, filed them with the Commission through its

electronic filing system, drafted responses to Commission staff’s comment

letters regarding the filings, and knew CYIOS had failed to make required

public filings between November 2012 and May 2014.46 Due to a downturn in

the company’s financial condition, Carnahan decided to stop making CYIOS’s

required periodic filings, prioritizing other bills instead of paying fees

necessary to complete the filings.47

In its Forms 10-K for the fiscal years 2009, 2010, and 2011, as well as in

its Forms 10-Q covering first quarter 2010 through third quarter 2012, CYIOS

represented that management had: (1) assessed the effectiveness of its internal

controls using the criteria set forth in the COSO framework, and (2) concluded

that its internal controls were effective.48 Attached to the reports were

Carnahan’s certifications under Exchange Act Rule 13a-14 that the reports did

not contain any untrue statements of material fact.49

See 15 U.S.C. § 78l(g); Div. Ex. 44; see, e.g., Div. Ex. 3 at 99.

CYIOS Corp., Amended Quarterly Report (Form 10-Q/A) (Nov. 21, 2012);

Div. Ex. 21.

CYIOS Corp., Certification and Notice of Termination of Registration

(Form 15) (May 30, 2014); Div. Ex. 44; see also 17 C.F.R. § 240.12g-4(a).

Tr. 40–42, 56–58; Div. Ex. 2 at 40, 58–60.

Div. Ex. 2 at 40–41; Tr. 56–57; Answer (filed Mar. 9, 2015) at 4.

Official Notice; see, e.g., Div. Ex. 3 at 118; Div. Ex. 11 at 248; Div. Ex. 12

at 281; Div. Ex. 13 at 309–10; Div. Ex. 21 at 505.

Official Notice; see, e.g., Div. Ex. 3 at 124; Div. Ex. 12 at 286; Div. Ex. 21

at 513–14.

When asked during his investigative testimony, however, Carnahan could

not explain how he evaluated the effectiveness of CYIOS’s internal controls.

He testified that: he kept track of the company’s revenue and payroll himself;

because he wrote the payroll system, “it can’t be flawed”; and he was the

company’s “internal control” and “did the internal controls” in his “mind,” so

he could not document himself.50 This testimony—which Carnahan did not

dispute, disavow, or attempt to explain during the hearing—established that

the periodic filings were the only documentation of CYIOS’s internal controls

and, as the company’s sole director and officer serving in every relevant role,

he was his “own quality assurance.”51 Carnahan also stated that he has had

“several arguments” with attorneys, auditors, and Anderson about accounting

principles related to revenue recognition, but that he makes all the decisions

on when revenue is recognized and he decides all the accounting policies.52

Although Anderson helped prepare the company’s financial statements,

Carnahan was responsible for incorporating them in the periodic filings, and

he fully controlled and was solely responsible for evaluating the company’s

internal controls.53 Anderson was familiar with the COSO framework from her

continuing education studies but was unaware of anything specifically done by

Carnahan to evaluate internal controls using the COSO framework.54

Carnahan did not perform formal risk assessments as part of maintaining

internal controls at CYIOS and, aside from checklists from auditors, had no

formally documented accounting policies or procedures for the company. 55

Anderson believed that the company’s financial information “was eventually

reported … the correct way” but only after Carnahan had many disagreements

with others as he “would prefer it to be done his way.”56

Div. Ex. 2 at 63–65, 72–73.

Id. at 63, 66–69, 72–73, 75.

Id. at 42–46.

Tr. 44–46, 53–55; Div. Ex. 38.

Tr. 45–46.

Tr. 46–47.

Tr. 48–49.

Carnahan has represented that the company’s internal controls were

assessed using CYIPRO,57 but no evidence supports this claim.

In March and October 2010, CYIOS issued common shares of its registered

securities, with a total value of $37,500, as stock compensation in exchange for

consulting services.58 This occurred during the time when the company’s

periodic filings contained the misstatements about Carnahan’s assessment of

the company’s internal controls.

3. Expert evidence

The Division introduced expert evidence from Charles R. Lundelius Jr.,

CPA.59 Lundelius earned a bachelor of science in commerce with a major in

accounting from the University of Virginia in 1978 and a master’s in business

administration with a concentration in finance from Tulane University in

1980.60 Early in his career, he worked as an investment banker and ran a

broker-dealer.61 Lundelius was the senior vice president and chief financial

officer of a leading marketer of long-term insurance and its affiliate from 1989

to 1992, and also served as chief investment officer.62 He worked as a forensic

accountant at Coopers & Lybrand, Deloitte, and FTI Consulting, Inc., between

1992 and 2012.63 Lundelius also served on the NASDAQ Listing Qualifications

Panel from 1999 to 2006.64 Since 2012, he has been the managing director of

the capital markets group at Berkeley Research Group, LLC.65 Lundelius

authored Financial Reporting Fraud: A Practical Guide to Detection and

Internal Control, a textbook published by the American Institute of Certified

Public Accountants.66 He has testified as an expert in more than fifty cases

Div. Ex. 22 at 5; Div. Ex. 40.

Div. Ex. 12 at 274, 277.

Tr. 102, 133; see generally Div. Ex. 42.

Div. Ex. 42, App. A at 29.

Tr. 108.

Div. Ex. 42 at 1 & n.1; Tr. 106.

Div. Ex. 42 at 1.

Id.

Id. at 2.

over the past twenty-five years and has participated in numerous

investigations relating to internal controls and corporate governance.67

Lundelius’s expert report, which comprised the bulk of his direct

testimony, offered three main opinions: (1) disclosures indicating whether or

not an issuer has implemented effective internal controls are material;

(2) disclosures indicating whether or not an issuer has implemented “a

suitable, recognized control framework that is established by a body or group

that has followed due-process procedures, including the broad distribution of

the framework for public comment,” are material; and (3) CYIOS’s failure to

assess the effectiveness of its internal controls using the COSO framework, as

stated in its filings, made those statements material misrepresentations. 68

Lundelius also opined on related issues. He testified that suitable,

recognized frameworks for evaluating issuers’ internal controls, such as COSO,

are frameworks that were publicly circulated and presented for comment from

the accounting profession.69 Lundelius also gave his opinion that CYIOS’s

CYIPRO product was not a suitable, recognized framework for evaluating

internal controls.70 He elaborated on the five components of COSO and gave

his opinion on how Carnahan’s internal controls assessment of CYIOS did not

appear to appropriately address any of those elements.71

Carnahan did not move to exclude Lundelius’s testimony, challenge his

expertise, or present contrary evidence. Although he objected when the

Division elicited testimony to correct an error in Lundelius’s report, I overruled

Carnahan’s objection.72 Carnahan did little on cross-examination to discredit

Lundelius’s testimony, choosing to chiefly focus on whether Lundelius had

Id. at 1 & App. A at 1.

Id. at 3, 7–12. As discussed further in my legal conclusions, Exchange Act

Rule 13a-15(c) contains an explicit requirement that management’s evaluation

of the issuer’s internal controls must be based on a suitable, recognized control

framework.

Tr. 110–12; see also Div. Ex. 42 at 4, 7–8.

Tr. 113–14; see also Div. Ex. 42 at 8–9.

Tr. 121–24; see also Div. Ex. 42 at 5–6.

Tr. 104–05.

reviewed CYIOS’s patent.73 Carnahan, however, failed to present any evidence

about CYIOS’s patent or whether it had one.74

Conclusions of Law

1. Carnahan caused CYIOS’s violation of Securities Act Section 17(a)(3).

The Division charged CYIOS with violating Securities Act Section

17(a)(3), and Carnahan with causing that violation. Section 17(a)(3) makes it

“unlawful for any person in the offer or sale of any securities,” by use of

interstate means or the mails, “to engage in any transaction, practice, or course

of business which operates or would operate as a fraud or deceit upon the

purchaser.”75 Repeatedly making or disseminating material misstatements

may constitute a fraudulent practice or course of business under Section

17(a)(3).76 The Division need not demonstrate scienter to establish a violation

Tr. 125–26.

When he cross-examined Lundelius, Carnahan asked Lundelius whether

he evaluated CYIOS’s patent and asserted that “the patent is in the 10-Ks”

CYIOS filed. Tr. 125–29. But CYIOS’s Forms 10-K do not establish the

existence of a patent; they represent merely that one of CYIOS’s subsidiaries

had applied for registration of CYIPRO’s logo with the U.S. Patent and

Trademark Office, and that CYIOS claims copyright protection for CYIPRO.

See, e.g., Div. Ex. 3 at 102. Moreover, Carnahan’s questions and statements

during cross-examination, as opposed to sworn testimony on the witness stand,

are not evidence. Sims v. Greene, 161 F.2d 87, 88 (3d Cir. 1947).

15 U.S.C. § 77q(a)(3).

See Dennis J. Malouf, Securities Act Release No. 10115, 2016 WL

4035575, at *12 (July 27, 2016), aff’d, 933 F.3d 1248 (10th Cir. 2019). The

Tenth Circuit held in Malouf that liability for misconduct involving material

misstatements may lie under Securities Act Section 17(a)(3) given the

Supreme Court’s interpretation of similar language under Exchange Act Rule

10b-5(c) in Lorenzo v. SEC, 139 S. Ct. 1094 (2019). See 933 F.3d at 1259–60;

see also Lorenzo, 139 S. Ct. at 1101 (“By sending emails he understood to

contain material untruths, Lorenzo . . . ‘engage[d] in a[n] act, practice, or

course of business’ that ‘operate[d] . . . as a fraud or deceit’ under subsection

of Section 17(a)(3); negligence is sufficient to establish a violation of Section

17(a)(3).77

A misstatement is material if there is a substantial likelihood that a

reasonable investor would view “disclosure of the omitted fact … as having

significantly altered the ‘total mix’ of information made available.”78

Misconduct occurs “in the offer or sale” of securities when, for instance,

misstatements are material and are contained in documents on which an

investor would presumably rely, such as public filings made with the

Commission, at the time when the issuer offered or sold its securities.79 The

interstate commerce requirement is satisfied when the misstatements are

contained in filings made with the Commission via EDGAR, a system

maintained by the Commission for the electronic filing of documents.80

To establish Carnahan’s liability for causing CYIOS’s violation of Section

17(a)(3), the Division must show: (1) a primary violation; (2) an act or omission

by Carnahan that caused the violation; and (3) that Carnahan knew, or should

have known, that his conduct would contribute to the violation. 81 Negligence is

See Aaron v. SEC, 446 U.S. 680, 701–02 (1980); Malouf, 2016 WL 4035575,

at *11 n.74.

Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 38 (2011) (quoting

Basic Inc. v. Levinson, 485 U.S. 224, 231–32 (1988)).

See, e.g., SEC v. Wolfson, 539 F.3d 1249, 1262–63 (10th Cir. 2008); cf.

United States v. Naftalin, 441 U.S. 768, 773 (1979) (explaining that “Congress

expressly intended to define broadly” language in Section 17(a) that the fraud

occur in the offer or sale of any securities).

See SEC v. Straub, No. 11-cv-9645, 2016 WL 5793398, at *11 (S.D.N.Y.

Sep. 30, 2016) (“a company uses an instrumentality of interstate commerce

when it files documents publicly on the EDGAR website”); Anthony Fields,

CPA, Securities Act Release No. 9727, 2015 WL 728005, at *6 & n.17 (Feb. 20,

2015) (“use of the Internet … is per se sufficient to satisfy the interstate

jurisdictional element of the securities laws”); McConville, 2005 WL 1560276,

at *10 (“misstatements and omissions in … financial statements …

electronic[ally] fil[ed]” with the Commission meet interstate commerce

requirement).

Robert M. Fuller, Securities Act Release No. 8273, 2003 WL 22016309, at

*4 (Aug. 25, 2003), pet. denied, 95 F. App’x 361 (D.C. Cir. 2004).

enough to demonstrate causing liability if the primary violation does not

require a showing of scienter.82

CYIOS’s statements that management had evaluated the company’s

internal controls using the COSO framework were false. Carnahan’s

undisputed investigative testimony established that he was the only so-called

“internal control” and the statements in the periodic filings were the only

support for his assessment of the company’s internal controls.83 CYIOS

employed no process meeting the COSO framework.84 CYIOS’s misstatements

were made in multiple periodic reports uploaded to the Commission’s EDGAR

database for the investing public to see and rely upon. Further, CYIOS

obtained consulting services in exchange for its publicly traded stock while

these misstatements were in its periodic reports.

As to materiality, CYIOS was legally required to report on its internal

controls in its filings and to include management’s annual report on internal

controls that contained, among other items, a “statement identifying the

framework used by management to evaluate the effectiveness of ” its internal

controls.85 By Commission regulation, internal controls must be assessed using

a suitable, recognized framework that meets certain standards.86 When

disclosures are required by law, those disclosures are presumed material. 87

That presumption is justified with respect to disclosures about internal

KPMG Peat Marwick LLP, Exchange Act Release No. 43862, 2001 WL

47245, at *19 (Jan. 19, 2001), recons. denied, Exchange Act Release No. 44050,

2001 WL 223378 (Mar. 8, 2001), pet. denied, 289 F.3d 109 (D.C. Cir. 2002).

Div. Ex. 2 at 63–69, 72–73, 75.

Tr. 45–47, 113–14, 121–24; see also Div. Ex. 42 at 5–6, 8–12; see generally

COSO Internal Control – Integrated Framework – 1992 and 1994, CCH

Accounting Research Manager (Wolters Kluwer).

See 17 C.F.R. §§ 229.308(a) (requiring companies to disclose information

regarding its internal controls in Forms 10-K), .601(b)(31)(i) (requiring

management certification regarding internal controls as an exhibit to a

periodic report).

See 17 C.F.R. § 240.13a-15(c); see infra discussion on Rule 13a-15(c)

accompanying notes 103–06.

See Craftmatic Sec. Litig. v. Krafstow, 890 F.2d 628, 641 n.17 (3d Cir.

1989); cf. United States v. Bilzerian, 926 F.2d 1285, 1298 (2d Cir. 1991) (“[T]he

fact that the information is required to be revealed under § 13(d) is evidence of

its materiality.”).

controls because internal controls provide assurance that an issuer’s financial

statements—the heart of a public company’s periodic reports—are reliable and

comply with applicable standards.88 And it is further supported in this case

because CYIOS was a federal contractor and a false disclosure of this nature

could threaten its business—as the company recognized in its periodic reports,

“failure to comply with applicable laws or regulations could have a material

adverse effect on [its] business and reputation” with the government.89

Moreover, the stark difference between the representations that

Carnahan repeatedly included in multiple reports and his failure to use any

suitable framework leads to the inescapable conclusion that he knew that the

representations regarding internal controls were false. In other words, he

made the false statements with scienter, “a mental state embracing intent to

deceive, manipulate, or defraud.”90 These knowingly false statements impugn

See In re Insys Therapeutics, Inc. Sec. Litig., No. 17-cv-1954, 2018 WL

2943746, at *5 (S.D.N.Y. June 12, 2018) (“When assurance that a company

complies with its accounting policies, or that a company has effective internal

controls, turns out to be false, that would be viewed by the reasonable investor

as having significantly altered the total mix of information made available.”

(internal quotation marks omitted)); In re Equimed, Inc., No. 98-cv-5374, 2000

WL 562909, at *7 (E.D. Pa. May 9, 2000) (“The adequacy of internal controls

would be material to a shareholder’s decision to buy and sell.”); see also In re

Grupo Televisa Sec. Litig., 368 F. Supp. 3d 711, 720–21 (S.D.N.Y. 2019)

(“Misstatements made in [an issuer’s] certifications concerning the design and

efficacy of internal controls are actionable.”); accord Div. Ex. 42 at 7, 8

(Lundelius opined that “the lack of effectiveness of internal controls calls into

question the accuracy of an issuer’s public disclosures” and “a reasonable

investor would consider the lack of a suitable, recognized framework for

internal control important when making investment decisions”).

See, e.g., Div. Ex. 12 at 262–63.

Aaron, 446 U.S. at 686 n.5 (quoting Ernst & Ernst v. Hochfelder, 425 U.S.

185, 194 n.12 (1976)); see also Ades v. Deloitte & Touche, 799 F. Supp. 1493,

1499 (S.D.N.Y. 1992) (“An inference of recklessness satisfying the scienter

requirement may be drawn from facts demonstrating conduct that the

defendant disseminated material knowing it was false . . . .” (internal

quotation marks and brackets omitted)). Because Carnahan’s scienter is

imputed to CYIOS, CYIOS acted with scienter. Clarke T. Blizzard, Advisers

Act Release No. 2253, 2004 WL 1416184, at *5 (June 23, 2004) (“A company’s

scienter may be imputed from that of the individuals who control it.”).

Although scienter is not required for a Section 17(a)(3) violation, it is

nonetheless relevant because evidence sufficient to establish scienter

CYIOS’s management’s integrity, which further supports the determination

that they are material.91 As reasonable investors would consider the integrity

of a public company’s management important, outright false statements

included in periodic filings by management indicate a lack of reliability and

would affect investors’ decisions regarding that company’s securities.92

The false statements about CYIOS’s internal controls were material.

CYIOS violated Section 17(a)(3) through its repeated material misstatements

in its periodic filings. As the person responsible for those filings and their

content, Carnahan caused CYIOS’s violation.93

2. Carnahan caused CYIOS’s violations of Exchange Act Section 13(a) and

Rules 13a-1 and 13a-13.

The Division charged CYIOS with violating Exchange Act Section 13(a)

and Exchange Act Rules 13a-1 and 13a-13. Carnahan is charged with causing

those violations. Exchange Act Section 13(a) and Rules 13a-1 and 13a-13

require issuers of securities registered under Section 12 to file annual and

quarterly reports with the Commission.94 Compliance with these requirements

is mandatory.95 Scienter is not required to establish violations of these

provisions.96 As CYIOS’s sole officer and director, Carnahan was responsible

necessarily establishes a lesser mental state. The existence of scienter is also

relevant to sanctions.

See United States v. Hatfield, 724 F. Supp. 2d 321, 328 (E.D.N.Y. 2010);

In re Monster Worldwide, Inc. Sec. Litig., 251 F.R.D. 132, 139 (S.D.N.Y. 2008).

Cf. S.W. Hatfield, CPA, Exchange Act Release No. 73763, 2014 WL

6850921, at *6 (Dec. 5, 2014) (holding that a “misrepresentation that audit

reports appearing in … periodic reports filed with the Commission have been

signed by a CPA is material”).

See Fuller, 2003 WL 22016309, at *4.

15 U.S.C. § 78m(a); 17 C.F.R. §§ 240.13a-1, .13a-13.

Am.’s Sports Voice, Inc., Exchange Act Release No. 55511, 2007 WL

858747, at *4 (Mar. 22, 2007), recons. denied, Exchange Act Release No. 55867,

2007 WL 1624611 (June 6, 2007).

See SEC v. McNulty, 137 F.3d 732, 740–41 (2d Cir. 1998); SEC v. Wills,

472 F. Supp. 1250, 1268 (D.D.C. 1978).

for the content of the periodic filings and filed them with the Commission via

EDGAR.97

As noted above, CYIOS had a class of securities registered under

Exchange Act Section 12 and did not file any periodic reports between

November 21, 2012, and May 30, 2014, the date it filed the Form 15 to

terminate its registration. By failing to make required periodic filings during

that time, CYIOS violated Exchange Act Section 13(a) and Rules 13a-1 and

13a-13. Given that Carnahan was responsible for CYIOS’s periodic filings as

the company’s sole officer and director, he caused these violations.98 In fact, as

I found above, Carnahan decided to stop making the filings.

3. Carnahan violated Exchange Act Rule 13a-14.

The Division charged Carnahan with violating Exchange Act Rule 13a-14,

which requires that an issuer’s periodic reports, including those filed on Forms

10-K and 10-Q, include certifications by the issuer’s principal executive and

principal financial officers, as specified in the filing requirements of such

reports.99 Carnahan, who served in these officer roles for CYIOS, was required

to certify in an exhibit to each periodic report that, based on his knowledge,

the report “does not contain any untrue statement of material fact.” 100 And a

person who makes this certification violates Rule 13a-14 if the periodic report

subject to the certification contains materially false statements.101 For

purposes of this decision, I assume that to establish a violation of Rule 13a-14,

the Division must show that a respondent knew his certification was false or

acted recklessly in making a false certification.102

Div. Ex. 2 at 58–60; Tr. 40–42.

See Gateway Int’l Holdings, Inc., Exchange Act Release No. 53907, 2006

WL 1506286, at *8 (May 31, 2006); Phlo Corp., Exchange Act Release

No. 55562, 2007 WL 966943, at *11 & n.66 (Mar. 30, 2007). As explained above,

CYIOS violated Section 13(a), Carnahan did not make the periodic filings for

which he was responsible, and he knew or should have known that if he did

not make those filings, CYIOS would fail to file its periodic reports.

17 C.F.R. § 240.13a-14(a).

100

17 C.F.R. § 229.601(b)(31)(i).

101

See SEC v. Jensen, 835 F.3d 1100, 1112–13 (9th Cir. 2016).

See id. at 1113 n.6 (declining to reach the question of the mental state

required for a violation of Rule 13a-14); id. at 1118 (Bea, J. concurring) (“I

would hold that liability for false certification under Rule 13a-14 may lie only

102

CYIOS’s Forms 10-K for fiscal years 2009, 2010, and 2011 and Forms 10Q for the first quarter of 2010 through the third quarter of 2012 all falsely

indicated that management had assessed the company’s internal controls

using the COSO framework. Nevertheless, Carnahan signed certifications

attached as exhibits to those periodic reports stating there were no untrue

statements of material fact in the reports. As the reports contained materially

false statements, Carnahan violated Exchange Act Rule 13a-14. Being the only

control person of the company, Carnahan knew that no one had assessed

CYIOS’s internal controls using the COSO framework.

4. Carnahan violated Exchange Act Rule 13a-15(c).

The Division charged Carnahan with violating Exchange Act Rule 13a15(c), which requires a public company’s management to evaluate the

effectiveness of the company’s internal controls at each fiscal year’s end.103 The

rule requires that “[t]he framework on which management’s evaluation of the

issuer’s internal control over financial reporting is based must be a suitable,

recognized control framework that is established by a body or group that has

followed due-process procedures, including the broad distribution of the

framework for public comment.”104 It also states that “[a]lthough there are

many different ways to conduct an evaluation of ” internal controls, “an

evaluation that is conducted in accordance with the interpretive guidance

issued by the Commission in Release No. 34-55929 will satisfy the evaluation

required by this paragraph.”105 Commission Release No. 34-55929 cites the

COSO framework as a suitable control framework and further makes clear

that management must maintain sufficient evidential matter to support its

assessment.106

Carnahan was the only member of CYIOS’s management during the

relevant time period. The evidence establishes that Carnahan did not assess

where a CEO or CFO acts with knowledge or at least recklessness as to the

falsity of a certification.”).

103

17 C.F.R. § 240.13a-15(c).

104

Id.

105

Id.

See Commission Guidance Regarding Management’s Report on Internal

Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities

Exchange Act of 1934, 72 Fed. Reg. 35,324, 35,326 nn.23 & 24, 35,329, 35,332

(June 27, 2007).

106

CYIOS’s internal controls using any suitable framework, let alone the COSO

framework, as the periodic reports claimed.107 Carnahan was aware of the

statements in CYIOS’s periodic filings and indeed was responsible for those

filings and their content.108 Accordingly, Carnahan violated Rule 13a-15(c).

Sanctions

1. Cease-and-Desist Order

Securities Act Section 8A and Exchange Act Section 21C authorize the

Commission to issue a cease-and-desist order against any person found to have

violated, or caused a violation of, a provision of those acts or a rule or regulation

promulgated under either act.109 To issue such an order, “there must be some

likelihood of future violations.”110 But the “risk” of future violations “need not

be very great to warrant issuing a cease-and-desist order. Absent evidence to

the contrary, a finding of violation raises a sufficient risk of future violation.” 111

Additionally, the Commission considers the public-interest factors

described in Steadman v. SEC112 when determining whether to issue a ceaseand-desist order.113 These factors include: the egregiousness of the

respondents’ actions, the isolated or recurrent nature of the infraction, the

degree of scienter involved, the sincerity of the respondents’ assurances

against future violations, the respondents’ recognition of the wrongful nature

of their conduct, and the likelihood that the respondents’ occupations will

present opportunities for future violations.114 The Commission also considers

107

See supra notes 83 and 84 and accompanying text.

108

See supra notes 46, 90, and 91 and accompanying text.

109

See 15 U.S.C. §§ 77h-1(a), 78u-3(a).

110

KPMG Peat Marwick, 2001 WL 47245, at *24.

111

Id.; see also id. at *26.

603 F.2d 1126, 1140 (5th. Cir. 1979), aff’d on other grounds, 450 U.S. 91

(1981).

112

KPMG Peat Marwick, 2001 WL 47245, at *23 & n.114, *26; see Timothy S.

Dembski, Securities Act Release No. 10326, 2017 WL 1103685, at *14 (Mar. 24,

2017), pet. denied, 726 F. App’x 841 (2d Cir. 2018).

113

KPMG Peat Marwick, 2001 WL 47245, at *26; see also Steadman, 603 F.2d

at 1140.

114

“whether the violation is recent, the degree of harm to investors or the

marketplace resulting from the violation, and the remedial function to be

served by the cease-and-desist order in the context of any other sanctions being

sought in the same proceedings.”115 No single factor in this analysis is

dispositive, and the entire record is considered when deciding whether to issue

a cease-and-desist order.116

The fact CYIOS and Carnahan committed the charged violations shows

the likelihood of future violations. Their misconduct was egregious. CYIOS

violated the antifraud provision of Securities Act Section 17(a)(3) by falsely

representing in its periodic filings that its management followed an established

framework when assessing its internal controls.117 The misstatements

appeared in numerous periodic filings over a period of about three years,

highlighting the misconduct’s recurrent nature. Carnahan was fully

responsible for CYIOS’s filings and admitted that he was the company’s only

internal control. He acted with scienter by knowingly making false statements

in those filings, and his scienter is imputed to CYIOS.118 Carnahan also

repeatedly included false certifications with those filings and failed to assess

CYIOS’s internal controls using any suitable framework, in violation of

Exchange Act Rules 13a-14 and 13a-15(c). This had the potential to cause

“serious harm to investors and the marketplace.”119

Further, Carnahan decided to stop making CYIOS’s required periodic

filings. He thus caused CYIOS’s violation of “a central provision of the

Exchange Act, … depriv[ing] both existing and prospective holders of its

registered stock of the ability to make informed investment decisions based on

115

KPMG Peat Marwick, 2001 WL 47245, at *26.

116

Id.

See Peter Siris, Exchange Act Release No. 71068, 2013 WL 6528874, at *6

(Dec. 12, 2013) (“[The Commission has] repeatedly held that conduct that

violates the antifraud provisions of the securities laws is especially serious and

subject to the severest of sanctions under the securities laws.” (internal

quotation marks omitted)), pet. denied, 773 F.3d 89 (D.C. Cir. 2014).

117

118

See Aaron, 446 U.S. at 686 n.5; Blizzard, 2004 WL 1416184, at *5.

Rockies Fund, Inc., Exchange Act Release No. 54892, 2006 WL 3542989,

at *5 (Dec. 7, 2006) (“The dissemination of false and misleading financial

information, such as in the periodic reports at issue, causes serious harm to

investors and the marketplace.”), pet. denied, 298 F. App’x 4 (D.C. Cir. 2008).

119

current and reliable information.”120 CYIOS and Carnahan’s “long history of

ignoring … reporting obligations evidences a high degree of culpability.”121

Moreover, Carnahan’s own decision shows that the “violations here were

intentional.”122

Respondents have made no assurances against future violations. Further

underscoring the significant risk of future violations, Carnahan has not

recognized the wrongfulness of the misconduct and in his closing argument

simply claimed the Division did not present evidence of wrongdoing.123 As the

control person for CYIOS, Carnahan’s occupation presents the opportunity for

CYIOS to again become public and resume its misconduct. The Steadman

factors thus weigh in favor of strong sanctions.

The factors specific to issuing a cease-and-desist order further show that

such an order is appropriate. Although the violations are not recent, “this

consideration is outweighed by the other factors previously discussed.”124

There is no evidence quantifying monetary losses to investors; however,

investors were deprived of current information when CYIOS stopped filing its

reports and were misled into believing that CYIOS’s management evaluated

its internal controls using a recognized framework.125 Instructing Carnahan

Accredited Bus. Consolidators Corp., Exchange Act Release No. 75840,

2015 WL 5172970, at *2 (Sept. 4, 2015); see also Phlo Corp., 2007 WL 966943,

at *13 (describing a respondent’s repeated failure to timely file its periodic

reports as “serious”).

120

Citizens Capital Corp., Exchange Act Release No. 67313, 2012 WL

2499350, at *5 (June 29, 2012) (internal quotation marks omitted).

121

122

Id.

See Tr. 131; see also Geiger v. SEC, 363 F.3d 481, 489 (D.C. Cir. 2004)

(“[The respondent] still thinks he did nothing wrong, which casts doubts on his

promise that he will mend his ways.”); Jose P. Zollino, Exchange Act Release

No. 55107, 2007 WL 98919, at *6 (Jan. 16, 2007) (“[F]ailure to acknowledge

guilt or show remorse indicates that there is a significant risk that, given the

opportunity, [the respondent] would commit further misconduct in the

future.”).

123

Robert W. Armstrong, III, Exchange Act Release No. 51920, 2005 WL

1498425, at *15 (June 24, 2005).

124

See McConville, 2005 WL 1560276, at *16 (“Fraudulent misstatements

and omissions in financial statements and periodic reports mislead investors

who buy or sell stock based on the information contained therein.”); see also

125

and CYIOS to not violate the securities laws in the future does not prejudice

them and, in conjunction with the sanctions discussed below, is an appropriate

remedy.

Based on the entire record, a cease-and-desist order is warranted against

CYIOS and Carnahan.

2. Civil Penalties

Securities Act Section 8A(g) and Exchange Act Section 21B(a)(2) authorize

civil penalties in cease-and-desist proceedings against any person who has

violated, or caused a violation of, a provision of those acts or a rule or regulation

promulgated under either act.126 These provisions both outline a three-tiered

system for determining the maximum civil penalty for each act or omission.

First-tier penalties are available based on the fact of the violation alone.127

Second-tier penalties may be imposed if the misconduct involved fraud, deceit,

manipulation, or deliberate or reckless disregard of a regulatory

requirement.128 Third-tier penalties require the additional finding that the

misconduct, directly or indirectly, “resulted in substantial losses or created a

significant risk of substantial losses to other persons or resulted in substantial

pecuniary gain” to the respondent who committed the violation.129

The Division requests that I impose seventeen third-tier penalties.130 The

basis for the number is clear; it is derived from the number of periodic filings

containing misstatements, plus the required filings that were not made.131 The

basis for the tier is less clear, however. Although the Division asserts

SEC v. Dresser Indus., Inc., 628 F.2d 1368, 1377 (D.C. Cir. 1980)

(“Dissemination of false or misleading information by companies to members

of the investing public may distort the efficient workings of the securities

markets and injure investors who rely on the accuracy and completeness of the

company’s public disclosures.”).

126

15 U.S.C. §§ 77h-1(g)(1), 78u-2(a)(2).

127

15 U.S.C. §§ 77h-1(g)(2)(A), 78u-2(b)(1).

128

15 U.S.C. §§ 77h-1(g)(2)(B), 78u-2(b)(2).

129

15 U.S.C. §§ 77h-1(g)(2)(C), 78u-2(b)(3).

130

Div. Br. 19–20.

131

Div. Br. 20.

Respondents “created a ‘significant risk of substantial losses,’” it does not

explain why this is the case.132

The record nonetheless supports second-tier penalties for Respondents’

misconduct. Respondents’ misconduct relating to the false statements in

CYIOS’s periodic filings was committed with scienter and was deceitful. 133

Respondents also deliberately disregarded regulatory requirements when they

failed to file periodic reports. Indeed, Carnahan was aware of those

requirements yet decided to stop making the filings.

When determining whether civil penalties are in the public interest, the

Commission considers six factors listed in the securities statutes: (1) whether

the violation involved fraud, deceit, manipulation, or deliberate or reckless

disregard of a regulatory requirement; (2) the resulting harm, directly or

indirectly, to other persons; (3) any unjust enrichment and prior restitution;

(4) the respondent’s prior regulatory record; (5) the need for deterrence; and

(6) such other matters as justice may require.134 As I have already found, the

first factor is satisfied. As discussed in determining that a cease-and-desist

order is appropriate, while investor harm cannot be quantified, Respondents’

misconduct harmed investors in that it deprived investors of current

information about CYIOS and misled them due to repetitive misstatements

about the company’s internal controls. CYIOS was unjustly enriched by

obtaining consulting services in exchange for its stock. There is no evidence

that either Carnahan or CYIOS have a disciplinary history. There is, however,

a need to deter them and others from future misconduct. There are no

Div. Br. 20. The only record evidence of the trading volume and price of

CYIOS’s stock suggests that on all but a few days total trading volume was

well under $5,000, see generally Div. Ex. 26, which makes the potential losses

to investors less likely to be characterized as substantial. Moreover, although

the Division points to Carnahan’s income as substantial, Div. Br. 19; Div. Ex.

3 at 119, it has made no showing that his income resulted from his misconduct.

132

See SEC v. M&A W., Inc., 538 F.3d 1043, 1054 (9th Cir. 2008) (“[T]he

imposition of second-tier penalties requires an assessment of scienter.”).

133

See, e.g., 15 U.S.C. § 78u-2(c). When assessing the public interest under

the Securities Act, the Commission considers the factors listed under the other

securities statutes as the Securities Act does not contain a statutory list of

public-interest factors. See Dembski, 2017 WL 1103685, at *15 & n.70; Thomas

C. Gonnella, Securities Act Release No. 10119, 2016 WL 4233837, at *14 &

n.70 (Aug. 10, 2016), pet. argued, No. 16-3433 (2d Cir. Sept. 9, 2019); see

generally 15 U.S.C. § 77h-1.

134

indications that Respondents understand the gravity of their misconduct.

Carnahan ran a public company without proper internal controls and

knowingly caused that company to make false statements to the investing

public indicating otherwise. On balance, significant penalties are warranted.

Although the securities statutes provide that a penalty may be imposed

for each act or omission, they leave the precise unit of violation undefined.135

Based on the record, two second-tier penalties are appropriate against each

Respondent. The first is imposed for the misconduct relating to the

misstatements about CYIOS’s internal controls, and the second is imposed for

the failure to make required periodic filings. These violations are aptly

considered as two courses of misconduct. Imposing a penalty for each filing

that contained a misstatement and each missed filing, as the Division

proposes, would be unduly punitive in the circumstances of this case. Although

I could also impose penalties for each of Carnahan’s false certifications, I

decline to do so, as I consider those certifications part of the same course of

misconduct as the misstatements.

Maximum second-tier penalties of $75,000 for each violation by an

individual and $375,000 for each violation by an entity may be imposed for

violations occurring during the misconduct’s timeframe. 136 Particularly in view

of the deceitful nature of the misstatement-related misconduct, the maximum

amount against each Respondent is appropriate for that misconduct. But as to

the missed periodic filings, it is appropriate to impose lesser penalties of

$125,000 against CYIOS and $25,000 against Carnahan. Accordingly, I will

order that Carnahan pay a total civil monetary penalty of $100,000 and that

CYIOS pay a total civil monetary penalty of $500,000.

3. Disgorgement and Prejudgment Interest

Securities Act Section 8A(e) and Exchange Act Section 21C(e) authorize

disgorgement in cease-and-desist proceedings, and Exchange Act Section

21B(e) authorizes disgorgement in proceedings where civil monetary penalties

may be imposed.137 “Disgorgement is an equitable remedy designed to deprive

a wrongdoer of [its] unjust enrichment and to deter others from violating the

135

Fields, 2015 WL 728005, at *24 n.162.

136

See 17 C.F.R. § 201.1001, tbl. I.

137

See 15 U.S.C. §§ 77h-1(e), 78u-2(e), 78u-3(e).

securities laws.”138 To establish the appropriate amount of disgorgement, the

Division need only show “a reasonable approximation of profits causally

connected to the violation” in question.139 Ordinarily, once the Division makes

the required showing, the burden shifts to the respondent to show that the

disgorgement figure was not a reasonable approximation.140

The Division has shown, and CYIOS has not disputed, that CYIOS

received $37,500 worth of consulting services by exchanging its publicly traded

stock for such services while the company’s periodic filings contained material

misstatements in violation of Section 17(a)(3).141 Because CYIOS’s

misstatements about its internal controls were material—for the reasons

discussed earlier in this decision—a provider of consulting services would

consider those false disclosures important in deciding whether to accept stock

compensation. The receipt of these services in exchange for the company’s stock

was thus causally connected to the violation.142 The value of these consulting

services is an unjust enrichment subject to disgorgement, as otherwise CYIOS

would retain a free benefit it gained while violating the law.143 The Division

reasonably approximated the value of these services based on CYIOS’s stated

Montford, 2014 WL 1744130, at *22 (quoting SEC v. First City Fin. Corp.,

890 F.2d 1215, 1230 (D.C. Cir. 1989)).

138

First City Fin., 890 F.2d at 1231; see also Montford & Co. v. SEC, 793 F.3d

76, 83–84 (D.C. Cir. 2015).

139

140

SEC v. Calvo, 378 F.3d 1211, 1217 (11th Cir. 2004).

141

Div. Ex. 12 at 274, 277.

See Jay T. Comeaux, Securities Act Release No. 9633, 2014 WL 4160054,

at *3 (Aug. 21, 2014) (“The Division need only show but-for causation between

a defendant’s violations and profits.”).

142

Cf. SEC v. Contorinis, 743 F.3d 296, 306 (2d Cir. 2014) (rejecting the

principle that disgorgement is limited to the amount of direct pecuniary benefit

to the wrongdoer, and recognizing that a “wrongdoer’s unlawful action may

create illicit benefits for the wrongdoer that are indirect or intangible”); SEC

v. Great Lakes Equities Co., 775 F. Supp. 211, 214 (E.D. Mich. 1991) (“The

benefit or unjust enrichment of a defendant includes not only what it gets to

keep in its pocket after the fraud, but also the value of the other benefits the

wrongdoer receives through the scheme.”), aff’d, 12 F.3d 214 (6th Cir. 1993)

(unpublished).

143

value of its stock issued in exchange for the services.144 CYIOS has made no

contrary showing.145

Accordingly, CYIOS will be ordered to disgorge $37,500 in ill-gotten gains,

with interest due from December 1, 2012, which is the first day of the month

after CYIOS’s last periodic filing—an amended Form 10-Q—that contained a

material misstatement. 146

Record Certification

I certify that the record includes the items set forth in the record index

issued by the Secretary of the Commission on September 9, 2019.147

Order

Under Section 8A of the Securities Act of 1933 and Section 21C of the

Securities Exchange Act of 1934:

CYIOS Corporation must CEASE AND DESIST from committing any

violations or future violations of Section 17(a)(3) of the Securities Act of

1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange

Act Rules 13a-1 and 13a-13; and

Timothy W. Carnahan must CEASE AND DESIST from causing any

violations or future violations of Section 17(a)(3) of the Securities Act of

1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange

Act Rules 13a-1 and 13a-13; and from committing any violations or future

violations of Exchange Act Rules 13a-14 and 13a-15.

See SEC v. Bilzerian, 814 F. Supp. 116, 123 (D.D.C. 1993) (“A reasonable

approximation of defendant’s illicit profit is the amount he gained while in

violation of the law.”), aff’d, 29 F.3d 689 (D.C. Cir. 1994); see also id. at 121

(“As it is nearly impossible and speculative to determine the market price but

for the illicit conduct, a reasonable approximation of this amount must suffice.”

(internal citation omitted)).

144

See Zacharias v. SEC, 569 F.3d 458, 473 (D.C. Cir. 2009) (“[T]he burden

of uncertainty in calculating ill-gotten gains falls on the wrongdoers who create

that uncertainty.”).

145

146

See 17 C.F.R. § 201.600(a).

147

See 17 C.F.R. § 201.351(b).

Under Section 8A(g) of the Securities Act of 1933 and Section 21B(a) of the

Securities Exchange Act of 1934:

CYIOS Corporation must PAY A CIVIL MONEY PENALTY in the amount

of $500,000; and

Timothy W. Carnahan must PAY A CIVIL MONEY PENALTY in the

amount of $100,000.

Under Section 8A(e) of the Securities Act of 1933 and Sections 21B(e) and

21C(e) of the Securities Exchange Act of 1934:

CYIOS Corporation must DISGORGE $37,500.00, plus prejudgment

interest. The prejudgment interest owed will be calculated from December

1, 2012, to the last day of the month preceding the month in which

payment of disgorgement is made. Prejudgment interest will be computed

at the underpayment rate of interest established under Section 6621(a)(2)

of the Internal Revenue Code, 26 U.S.C. § 6621(a)(2), and compounded

quarterly.148

Payment of civil penalties, disgorgement, and interest must be made no

later than 21 days following the day this initial decision becomes final, unless

the Commission directs otherwise. Payment must be made in one of the

following ways: (1) transmitted electronically to the Commission, which will

provide detailed ACH transfer/Fedwire instructions upon request; (2) direct

payments from a bank account via Pay.gov through the SEC website at

http://www.sec.gov/ofm; or (3) by certified check, bank cashier’s check, bank

money order, or United States postal money order made payable to the

Securities and Exchange Commission and hand-delivered or mailed to the

following address alongside a cover letter identifying Respondent(s) and

Administrative Proceeding No. 3-16386: Enterprise Services Center, Accounts

Receivable Branch, HQ Bldg., Room 181, AMZ-341, 6500 South MacArthur

Blvd., Oklahoma City, Oklahoma 73169. A copy of the cover letter and

instrument of payment must be sent to the Commission’s Division of

Enforcement, directed to the attention of counsel of record.

This initial decision will become effective in accordance with and subject

to the provisions of Rule 360.149 Under that rule, a party may file a petition for

review of this initial decision within 21 days after service of the initial decision.

Under Rule of Practice 111, a party may also file a motion to correct a manifest

148

See 17 C.F.R. § 201.600(b).

149

See 17 C.F.R. § 201.360.

error of fact within ten days of the initial decision.150 If a motion to correct a

manifest error of fact is filed by a party, then a party has 21 days to file a

petition for review from the date of the order resolving such motion to correct

a manifest error of fact.

The initial decision will not become final until the Commission enters an

order of finality. The Commission will enter an order of finality unless a party

files a petition for review or motion to correct a manifest error of fact or the

Commission determines on its own initiative to review the initial decision as

to a party. If any of these events occur, the initial decision will not become final

as to that party.

_______________________________

James E. Grimes

Administrative Law Judge

150

See 17 C.F.R. § 201.111.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.