# Initial Decision Release No. 1394 > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/agency%3Asec%3A2d06debfb3420b67 ## Record - **Collection:** Agency decision - **Document type:** Agency decision ## Text Initial Decision Release No. 1394 Administrative Proceeding File No. 3-16386 UNITED STATES OF AMERICA Before the SECURITIES AND EXCHANGE COMMISSION Washington, D.C. 20549 In the Matter of Traci J. Anderson, CPA, Timothy W. Carnahan, and CYIOS Corporation Appearances: Initial Decision January 10, 2020 Matthew J. Gulde, Chris Davis, and B. David Fraser for the Division of Enforcement, Securities and Exchange Commission Timothy W. Carnahan, pro se, and for CYIOS Corporation Before: James E. Grimes, Administrative Law Judge Summary This initial decision resolves allegations of material misstatements and reporting violations against Respondents Timothy W. Carnahan and CYIOS Corporation. CYIOS is a former public company that had a class of securities registered with the Securities and Exchange Commission, and Carnahan is its sole officer and director. For several years, CYIOS’s public, periodic filings misrepresented that the company’s management had assessed the effectiveness of its internal controls over financial reporting for each period using an established framework. The evidence establishes that CYIOS had no documented internal controls and Carnahan did not use any suitable framework to assess the company’s internal controls. Indeed, Carnahan admitted during his investigative testimony that he was the company’s internal control and acted as his own quality assurance. Carnahan caused CYIOS’s filings to be made with the Commission and signed multiple certifications misrepresenting that the filings contained no untrue statements of material fact. Additionally, CYIOS failed to make numerous required periodic filings while its securities were registered. I find that CYIOS violated, and Carnahan caused its violations of, Section 17(a)(3) of the Securities Act of 1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange Act Rules 13a-1 and 13a-13. I also find that Carnahan violated Exchange Act Rules 13a-14 and 13a-15(c). I order appropriate sanctions below.1 Procedural Background The Commission initiated this proceeding in February 2015, when it issued an order instituting proceedings (OIP) under Securities Act Section 8A, Exchange Act Sections 4C and 21C, and Commission Rule of Practice 102(e). 2 In relevant part, the OIP alleges the following facts and violations: Carnahan failed to assess CYIOS’s internal controls and CYIOS misrepresented in its periodic filings that management had assessed its internal controls using the criteria set forth in the Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO framework). As a result, CYIOS violated, and Carnahan caused its violations of, Securities Act Section 17(a)(3), which makes it unlawful to engage in any transaction, practice, or course of business which operates or would operate as a fraud or deceit upon the purchaser.3 Also as a result of this misconduct, Carnahan violated Exchange Act Rule 13a-14, which requires an issuer’s principal executive and principal financial officer to attest that the company’s “report does not contain any untrue statement of a material fact”; and Exchange Act Rule 13a-15(c), which requires an issuer’s management to perform an evaluation of the company’s internal controls as of the end of each fiscal year.4 Further, due to its failure to file multiple periodic reports while its A prior initial decision dismissed the proceeding as to Respondent Traci J. Anderson, CPA, and that decision has become the final decision of the Commission. Traci J. Anderson, CPA, Initial Decision Release No. 930, 2015 WL 9297356, at *1, *24 (ALJ Dec. 21, 2015), finality order, Securities Act Release No. 10032, 2016 SEC LEXIS 380 (Feb. 2, 2016). 1 2 See 15 U.S.C. §§ 77h-1, 78d-3, 78u-3; 17 C.F.R. § 201.102(e). 3 15 U.S.C. § 77q(a)(3). 4 17 C.F.R. §§ 240.13a-14, .13a-15(c). 2 securities were registered, CYIOS violated, and Carnahan caused its violations of, Exchange Act Section 13(a) and Rules 13a-1 and 13a-13.5 In 2015, an administrative law judge held a hearing and issued an initial decision in which he found against Respondents on these charges but dismissed two other charges that the Division is no longer pursuing. 6 Respondents appealed to the Commission. In August 2018, following the Supreme Court’s decision in Lucia v. SEC, the Commission remanded this proceeding, ordered that it be reassigned to an administrative law judge who had not previously participated in the matter, and directed that Respondents be given the opportunity for a new hearing.7 On remand, the newly assigned administrative law judge ordered the parties to submit a proposal for the conduct of further proceedings.8 In November 2018, the parties represented that they were unable to agree to a proposal and Respondents sought dismissal. This case was reassigned to me in March 2019.9 Following a prehearing conference, I adopted the parties’ jointly proposed schedule with modest amendments.10 In late April 2019, I denied in part and deferred ruling in part on Respondents’ motion for a ruling on the pleadings.11 In doing so, I directed the Division to submit supplemental briefing on whether, following remand, charges under Section 105(c)(7)(B) of the Sarbanes-Oxley Act of 2002 and 5 15 U.S.C. § 78m(a); 17 C.F.R. §§ 240.13a-1, .13a-13. Anderson, 2015 WL 9297356, at *1, *9–20; see also Anderson, Admin. Proc. Rulings Release No. 6549, 2019 SEC LEXIS 961, at *15–16 (ALJ Apr. 24, 2019); Anderson, Admin. Proc. Rulings Release No. 6613, 2019 SEC LEXIS 1482, at *2–3 (ALJ June 24, 2019). 6 Pending Admin. Proc., Securities Act Release No. 10536, 2018 WL 4003609, at *1 (Aug. 22, 2018); see also Lucia v. SEC, 138 S. Ct. 2044 (2018). 7 Anderson, Admin. Proc. Rulings Release No. 6126, 2018 SEC LEXIS 2705, at *2 (ALJ Oct. 1, 2018). 8 Anderson, Admin. Proc. Rulings Release No. 6474, 2019 SEC LEXIS 295 (ALJ Mar. 4, 2019). 9 Anderson, Admin. Proc. Rulings Release No. 6519, 2019 SEC LEXIS 632 (ALJ Mar. 26, 2019). 10 11 Anderson, 2019 SEC LEXIS 961. 3 Securities Act Section 17(a)(2) were still at issue. 12 The Division responded that it would not pursue “these charges further and w[ould] not offer evidence supporting them.”13 In July, I ruled on various motions and denied Respondents’ motions seeking dismissal.14 I held the hearing in this matter in July 2019. During the hearing, the Division called three witnesses, Carnahan rested without calling any witnesses or offering any exhibits, and I admitted 23 of the Division’s offered exhibits. Carnahan refused to testify on Fifth Amendment grounds and I instructed the Division to file a motion regarding whether I should draw adverse inferences from Carnahan’s refusal to testify.15 I gave Respondents ten days to respond to the Division’s motion.16 After the Division briefed the issue but Carnahan failed to respond, I determined that I would draw adverse inferences from Carnahan’s silence subject to the Division identifying specific questions and inferences in its post-hearing brief.17 I also admitted four exhibits that the Division was prevented from introducing through Carnahan’s testimony by his refusal to testify.18 The Division filed its post-hearing brief in September 2019. Respondents have made no filings since the hearing. 12 See id. at *11–16. 13 Div. Supplemental Br. 1–2 (Apr. 30, 2019). See, e.g., Anderson, Admin. Proc. Rulings Release No. 6620, 2019 SEC LEXIS 1622 (ALJ July 2, 2019); Anderson, Admin. Proc. Rulings Release No. 6626, 2019 SEC LEXIS 1724 (ALJ July 11, 2019). 14 Anderson, Admin. Proc. Rulings Release No. 6632, 2019 SEC LEXIS 1782 (ALJ July 18, 2019). 15 16 Id. Anderson, Admin. Proc. Rulings Release No. 6650, 2019 SEC LEXIS 1955 (ALJ Aug. 5, 2019). 17 18 Id. at *8. 4 Procedural Issues I base the following factual findings and legal conclusions on the entire record and on facts officially noticed, applying preponderance of the evidence as the standard of proof.19 I have given no weight to and have not presumed the correctness of any opinions, orders, or rulings issued in this matter prior to the Commission’s post-Lucia remand order of August 22, 2018.20 All arguments that are inconsistent with this decision are rejected. At the July hearing, I reserved ruling on the admissibility of Exhibit 43, which contained Carnahan’s testimony from the pre-Lucia hearing held in 2015. The 2015 hearing was presided over by a judge who, at the time of the hearing, was not properly appointed.21 Admission of the prior hearing testimony would arguably contravene the Commission’s post-Lucia directive to provide respondents with the opportunity for a new hearing before a judge who did not previously participate in the matter, unless the parties expressly agreed otherwise.22 Carnahan exercised his right to a new hearing but then refused to testify. Nonetheless, the prior testimony is unnecessary given the record developed at the July hearing, and the Division does not rely on it or make any argument regarding its admissibility in its brief. I now determine that Exhibit 43 is not admitted.23 During the hearing, Carnahan appeared to object to the entire administrative proceeding on statute of limitations grounds. I instructed Carnahan that he could address this argument in his post-hearing brief, but he did not do so.24 Carnahan’s argument seeking dismissal on this basis has See Rita J. McConville, Exchange Act Release No. 51950, 2005 WL 1560276, at *14 (June 30, 2005), pet. denied, 465 F.3d 780 (7th Cir. 2006); see also 17 C.F.R. § 201.323; Anderson, Admin. Proc. Rulings Release No. 6622, 2019 SEC LEXIS 1706, at *1 (ALJ July 10, 2019) (taking official notice under Rule 323 of CYIOS’s public filings with the Commission and their content). 19 20 See Pending Admin. Proc., 2018 WL 4003609, at *1. 21 Tr. 17; see also Lucia, 138 S. Ct. at 2055. 22 Pending Admin. Proc., 2018 WL 4003609, at *1. 23 17 C.F.R. §§ 201.111(c), .320(a). 24 Tr. 138–40. 5 previously been denied.25 The OIP was filed on February 13, 2015, and the relevant misconduct began with CYIOS’s 2009 Form 10-K filed on February 26, 2010, which is within the five-year limitations period in 28 U.S.C. § 2462.26 Regarding adverse inferences, the Division summarily referenced the topics about which Carnahan refused to testify in its brief, without identifying “the specific questions and inferences it seeks,” as I directed it to do.27 In any event, the record provides sufficient proof of Respondents’ violations, without regard to any adverse inference.28 It is therefore unnecessary to base my findings and conclusions on adverse inferences drawn from Carnahan’s refusal to testify.29 Findings of Fact 1. Relevant Persons and Entities CYIOS is incorporated in Nevada and headquartered in Washington, D.C.30 CYIOS operates two subsidiaries that provide technology services and products to U.S. government entities.31 One of CYIOS’s subsidiaries offers a product called CYIPRO, which is described as “a business transformation tool” that was built “to complement knowledge management and business See Anderson, Admin. Proc. Rulings Release No. 6223, 2018 SEC LEXIS 2894, at *7 (ALJ Oct. 18, 2018); Anderson, Admin. Proc. Rulings Release No. 6620, 2019 SEC LEXIS 1622 (ALJ July 2, 2019). 25 OIP ¶¶ 11, 16, 20; CYIOS Corp., Annual Report (Form 10-K) (Feb. 26, 2010); see also Gabelli v. SEC, 568 U.S. 442, 447–48 (2013). 26 27 Anderson, 2019 SEC LEXIS 1955, at *8. I did rely on adverse inferences to admit four of the Division’s exhibits after the hearing. See supra note 18 and accompanying text. 28 See Guy P. Riordan, Securities Act Release No. 9085, 2009 WL 4731397, at *16 (Dec. 11, 2009) (concluding that the evidence against the respondent was “persuasive and more than sufficient to support findings of violations, without regard to any adverse inference”), pet. denied, 627 F.3d 1230 (D.C. Cir. 2010), abrogated on other grounds by Kokesh v. SEC, 137 S. Ct. 1635 (2017). 29 Div. Ex. 21 at 490. Citations to an exhibit’s Bates numbers are to the numerical digits only, excluding any alphabetical prefix and leading zeros. 30 31 Id. at 500. 6 transformation for agencies and commercial business.”32 This product “provides a virtual work space for collaboration, project management, and document management to help manage people, processes and information.”33 CYIOS has represented in its public filings that CYIPRO “provides key solutions for compliance with Securities and Exchange Commission (‘SEC’) Sarbanes-Oxley regulations,” but it is unclear how this aspect of the product functioned or what regulations it addressed.34 Carnahan earned a bachelor of science degree in computer science from Old Dominion University in 1989.35 He has no formal education in accounting or financial statement preparation.36 After college graduation, Carnahan worked for the U.S. Senate Sergeant at Arms where he “ran all the computer systems for every Senator.”37 Carnahan founded CYIOS in 1995 and took the company public through a reverse merger in 2005.38 Since the merger, he has served as the company’s CEO, treasurer, and board chairman; and, since July 2007, he has served as its sole officer and director. 39 He signed company filings as its CEO, president, principal financial officer, and principal accounting officer.40 After serving as the company’s independent auditor for several years, Traci J. Anderson resigned as its auditor and performed full-time accountingrelated work for CYIOS from at least 2010 until 2015.41 She interacted directly with Carnahan and saw how the company functioned.42 32 Id. 33 Div. Ex. 3 at 100. 34 See id. 35 Div. Ex. 12 at 281; Div. Ex. 2 at 16. 36 Div. Ex. 2 at 16–18. 37 Id. at 18–19. 38 Id. at 20; Div. Ex. 3 at 100. 39 Div. Ex. 2 at 20–21. 40 Div. Ex. 2 at 67. 41 Tr. 33–34, 64–65; Div. Ex. 2 at 33–34, 83–84, 88–89. 42 Tr. 37. 7 2. Delinquent Filings, Misstatements as to Internal Controls, and Stock Issued in Exchange for Consulting Services CYIOS was a public company with its common stock registered with the Commission under Exchange Act Section 12(g).43 CYIOS’s last periodic filing was an amended Form 10-Q for the third quarter of 2012, which was filed November 21, 2012.44 CYIOS filed a Form 15-12G to terminate its common stock’s registration on May 30, 2014, which became effective ninety days later on August 28, 2014.45 Carnahan was responsible for CYIOS’s periodic filings with the Commission and their content, filed them with the Commission through its electronic filing system, drafted responses to Commission staff’s comment letters regarding the filings, and knew CYIOS had failed to make required public filings between November 2012 and May 2014.46 Due to a downturn in the company’s financial condition, Carnahan decided to stop making CYIOS’s required periodic filings, prioritizing other bills instead of paying fees necessary to complete the filings.47 In its Forms 10-K for the fiscal years 2009, 2010, and 2011, as well as in its Forms 10-Q covering first quarter 2010 through third quarter 2012, CYIOS represented that management had: (1) assessed the effectiveness of its internal controls using the criteria set forth in the COSO framework, and (2) concluded that its internal controls were effective.48 Attached to the reports were Carnahan’s certifications under Exchange Act Rule 13a-14 that the reports did not contain any untrue statements of material fact.49 43 See 15 U.S.C. § 78l(g); Div. Ex. 44; see, e.g., Div. Ex. 3 at 99. CYIOS Corp., Amended Quarterly Report (Form 10-Q/A) (Nov. 21, 2012); Div. Ex. 21. 44 CYIOS Corp., Certification and Notice of Termination of Registration (Form 15) (May 30, 2014); Div. Ex. 44; see also 17 C.F.R. § 240.12g-4(a). 45 46 Tr. 40–42, 56–58; Div. Ex. 2 at 40, 58–60. 47 Div. Ex. 2 at 40–41; Tr. 56–57; Answer (filed Mar. 9, 2015) at 4. Official Notice; see, e.g., Div. Ex. 3 at 118; Div. Ex. 11 at 248; Div. Ex. 12 at 281; Div. Ex. 13 at 309–10; Div. Ex. 21 at 505. 48 Official Notice; see, e.g., Div. Ex. 3 at 124; Div. Ex. 12 at 286; Div. Ex. 21 at 513–14. 49 8 When asked during his investigative testimony, however, Carnahan could not explain how he evaluated the effectiveness of CYIOS’s internal controls. He testified that: he kept track of the company’s revenue and payroll himself; because he wrote the payroll system, “it can’t be flawed”; and he was the company’s “internal control” and “did the internal controls” in his “mind,” so he could not document himself.50 This testimony—which Carnahan did not dispute, disavow, or attempt to explain during the hearing—established that the periodic filings were the only documentation of CYIOS’s internal controls and, as the company’s sole director and officer serving in every relevant role, he was his “own quality assurance.”51 Carnahan also stated that he has had “several arguments” with attorneys, auditors, and Anderson about accounting principles related to revenue recognition, but that he makes all the decisions on when revenue is recognized and he decides all the accounting policies.52 Although Anderson helped prepare the company’s financial statements, Carnahan was responsible for incorporating them in the periodic filings, and he fully controlled and was solely responsible for evaluating the company’s internal controls.53 Anderson was familiar with the COSO framework from her continuing education studies but was unaware of anything specifically done by Carnahan to evaluate internal controls using the COSO framework.54 Carnahan did not perform formal risk assessments as part of maintaining internal controls at CYIOS and, aside from checklists from auditors, had no formally documented accounting policies or procedures for the company. 55 Anderson believed that the company’s financial information “was eventually reported … the correct way” but only after Carnahan had many disagreements with others as he “would prefer it to be done his way.”56 50 Div. Ex. 2 at 63–65, 72–73. 51 Id. at 63, 66–69, 72–73, 75. 52 Id. at 42–46. 53 Tr. 44–46, 53–55; Div. Ex. 38. 54 Tr. 45–46. 55 Tr. 46–47. 56 Tr. 48–49. 9 Carnahan has represented that the company’s internal controls were assessed using CYIPRO,57 but no evidence supports this claim. In March and October 2010, CYIOS issued common shares of its registered securities, with a total value of $37,500, as stock compensation in exchange for consulting services.58 This occurred during the time when the company’s periodic filings contained the misstatements about Carnahan’s assessment of the company’s internal controls. 3. Expert evidence The Division introduced expert evidence from Charles R. Lundelius Jr., CPA.59 Lundelius earned a bachelor of science in commerce with a major in accounting from the University of Virginia in 1978 and a master’s in business administration with a concentration in finance from Tulane University in 1980.60 Early in his career, he worked as an investment banker and ran a broker-dealer.61 Lundelius was the senior vice president and chief financial officer of a leading marketer of long-term insurance and its affiliate from 1989 to 1992, and also served as chief investment officer.62 He worked as a forensic accountant at Coopers & Lybrand, Deloitte, and FTI Consulting, Inc., between 1992 and 2012.63 Lundelius also served on the NASDAQ Listing Qualifications Panel from 1999 to 2006.64 Since 2012, he has been the managing director of the capital markets group at Berkeley Research Group, LLC.65 Lundelius authored Financial Reporting Fraud: A Practical Guide to Detection and Internal Control, a textbook published by the American Institute of Certified Public Accountants.66 He has testified as an expert in more than fifty cases 57 Div. Ex. 22 at 5; Div. Ex. 40. 58 Div. Ex. 12 at 274, 277. 59 Tr. 102, 133; see generally Div. Ex. 42. 60 Div. Ex. 42, App. A at 29. 61 Tr. 108. 62 Div. Ex. 42 at 1 & n.1; Tr. 106. 63 Div. Ex. 42 at 1. 64 Id. 65 Id. 66 Id. at 2. 10 over the past twenty-five years and has participated in numerous investigations relating to internal controls and corporate governance.67 Lundelius’s expert report, which comprised the bulk of his direct testimony, offered three main opinions: (1) disclosures indicating whether or not an issuer has implemented effective internal controls are material; (2) disclosures indicating whether or not an issuer has implemented “a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment,” are material; and (3) CYIOS’s failure to assess the effectiveness of its internal controls using the COSO framework, as stated in its filings, made those statements material misrepresentations. 68 Lundelius also opined on related issues. He testified that suitable, recognized frameworks for evaluating issuers’ internal controls, such as COSO, are frameworks that were publicly circulated and presented for comment from the accounting profession.69 Lundelius also gave his opinion that CYIOS’s CYIPRO product was not a suitable, recognized framework for evaluating internal controls.70 He elaborated on the five components of COSO and gave his opinion on how Carnahan’s internal controls assessment of CYIOS did not appear to appropriately address any of those elements.71 Carnahan did not move to exclude Lundelius’s testimony, challenge his expertise, or present contrary evidence. Although he objected when the Division elicited testimony to correct an error in Lundelius’s report, I overruled Carnahan’s objection.72 Carnahan did little on cross-examination to discredit Lundelius’s testimony, choosing to chiefly focus on whether Lundelius had 67 Id. at 1 & App. A at 1. Id. at 3, 7–12. As discussed further in my legal conclusions, Exchange Act Rule 13a-15(c) contains an explicit requirement that management’s evaluation of the issuer’s internal controls must be based on a suitable, recognized control framework. 68 69 Tr. 110–12; see also Div. Ex. 42 at 4, 7–8. 70 Tr. 113–14; see also Div. Ex. 42 at 8–9. 71 Tr. 121–24; see also Div. Ex. 42 at 5–6. 72 Tr. 104–05. 11 reviewed CYIOS’s patent.73 Carnahan, however, failed to present any evidence about CYIOS’s patent or whether it had one.74 Conclusions of Law 1. Carnahan caused CYIOS’s violation of Securities Act Section 17(a)(3). The Division charged CYIOS with violating Securities Act Section 17(a)(3), and Carnahan with causing that violation. Section 17(a)(3) makes it “unlawful for any person in the offer or sale of any securities,” by use of interstate means or the mails, “to engage in any transaction, practice, or course of business which operates or would operate as a fraud or deceit upon the purchaser.”75 Repeatedly making or disseminating material misstatements may constitute a fraudulent practice or course of business under Section 17(a)(3).76 The Division need not demonstrate scienter to establish a violation 73 Tr. 125–26. When he cross-examined Lundelius, Carnahan asked Lundelius whether he evaluated CYIOS’s patent and asserted that “the patent is in the 10-Ks” CYIOS filed. Tr. 125–29. But CYIOS’s Forms 10-K do not establish the existence of a patent; they represent merely that one of CYIOS’s subsidiaries had applied for registration of CYIPRO’s logo with the U.S. Patent and Trademark Office, and that CYIOS claims copyright protection for CYIPRO. See, e.g., Div. Ex. 3 at 102. Moreover, Carnahan’s questions and statements during cross-examination, as opposed to sworn testimony on the witness stand, are not evidence. Sims v. Greene, 161 F.2d 87, 88 (3d Cir. 1947). 74 75 15 U.S.C. § 77q(a)(3). See Dennis J. Malouf, Securities Act Release No. 10115, 2016 WL 4035575, at *12 (July 27, 2016), aff’d, 933 F.3d 1248 (10th Cir. 2019). The Tenth Circuit held in Malouf that liability for misconduct involving material misstatements may lie under Securities Act Section 17(a)(3) given the Supreme Court’s interpretation of similar language under Exchange Act Rule 10b-5(c) in Lorenzo v. SEC, 139 S. Ct. 1094 (2019). See 933 F.3d at 1259–60; see also Lorenzo, 139 S. Ct. at 1101 (“By sending emails he understood to contain material untruths, Lorenzo . . . ‘engage[d] in a[n] act, practice, or course of business’ that ‘operate[d] . . . as a fraud or deceit’ under subsection (c) of the Rule.” (alterations in original)). 76 12 of Section 17(a)(3); negligence is sufficient to establish a violation of Section 17(a)(3).77 A misstatement is material if there is a substantial likelihood that a reasonable investor would view “disclosure of the omitted fact … as having significantly altered the ‘total mix’ of information made available.”78 Misconduct occurs “in the offer or sale” of securities when, for instance, misstatements are material and are contained in documents on which an investor would presumably rely, such as public filings made with the Commission, at the time when the issuer offered or sold its securities.79 The interstate commerce requirement is satisfied when the misstatements are contained in filings made with the Commission via EDGAR, a system maintained by the Commission for the electronic filing of documents.80 To establish Carnahan’s liability for causing CYIOS’s violation of Section 17(a)(3), the Division must show: (1) a primary violation; (2) an act or omission by Carnahan that caused the violation; and (3) that Carnahan knew, or should have known, that his conduct would contribute to the violation. 81 Negligence is See Aaron v. SEC, 446 U.S. 680, 701–02 (1980); Malouf, 2016 WL 4035575, at *11 n.74. 77 Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 38 (2011) (quoting Basic Inc. v. Levinson, 485 U.S. 224, 231–32 (1988)). 78 See, e.g., SEC v. Wolfson, 539 F.3d 1249, 1262–63 (10th Cir. 2008); cf. United States v. Naftalin, 441 U.S. 768, 773 (1979) (explaining that “Congress expressly intended to define broadly” language in Section 17(a) that the fraud occur in the offer or sale of any securities). 79 See SEC v. Straub, No. 11-cv-9645, 2016 WL 5793398, at *11 (S.D.N.Y. Sep. 30, 2016) (“a company uses an instrumentality of interstate commerce when it files documents publicly on the EDGAR website”); Anthony Fields, CPA, Securities Act Release No. 9727, 2015 WL 728005, at *6 & n.17 (Feb. 20, 2015) (“use of the Internet … is per se sufficient to satisfy the interstate jurisdictional element of the securities laws”); McConville, 2005 WL 1560276, at *10 (“misstatements and omissions in … financial statements … electronic[ally] fil[ed]” with the Commission meet interstate commerce requirement). 80 Robert M. Fuller, Securities Act Release No. 8273, 2003 WL 22016309, at *4 (Aug. 25, 2003), pet. denied, 95 F. App’x 361 (D.C. Cir. 2004). 81 13 enough to demonstrate causing liability if the primary violation does not require a showing of scienter.82 CYIOS’s statements that management had evaluated the company’s internal controls using the COSO framework were false. Carnahan’s undisputed investigative testimony established that he was the only so-called “internal control” and the statements in the periodic filings were the only support for his assessment of the company’s internal controls.83 CYIOS employed no process meeting the COSO framework.84 CYIOS’s misstatements were made in multiple periodic reports uploaded to the Commission’s EDGAR database for the investing public to see and rely upon. Further, CYIOS obtained consulting services in exchange for its publicly traded stock while these misstatements were in its periodic reports. As to materiality, CYIOS was legally required to report on its internal controls in its filings and to include management’s annual report on internal controls that contained, among other items, a “statement identifying the framework used by management to evaluate the effectiveness of ” its internal controls.85 By Commission regulation, internal controls must be assessed using a suitable, recognized framework that meets certain standards.86 When disclosures are required by law, those disclosures are presumed material. 87 That presumption is justified with respect to disclosures about internal KPMG Peat Marwick LLP, Exchange Act Release No. 43862, 2001 WL 47245, at *19 (Jan. 19, 2001), recons. denied, Exchange Act Release No. 44050, 2001 WL 223378 (Mar. 8, 2001), pet. denied, 289 F.3d 109 (D.C. Cir. 2002). 82 83 Div. Ex. 2 at 63–69, 72–73, 75. Tr. 45–47, 113–14, 121–24; see also Div. Ex. 42 at 5–6, 8–12; see generally COSO Internal Control – Integrated Framework – 1992 and 1994, CCH Accounting Research Manager (Wolters Kluwer). 84 See 17 C.F.R. §§ 229.308(a) (requiring companies to disclose information regarding its internal controls in Forms 10-K), .601(b)(31)(i) (requiring management certification regarding internal controls as an exhibit to a periodic report). 85 See 17 C.F.R. § 240.13a-15(c); see infra discussion on Rule 13a-15(c) accompanying notes 103–06. 86 See Craftmatic Sec. Litig. v. Krafstow, 890 F.2d 628, 641 n.17 (3d Cir. 1989); cf. United States v. Bilzerian, 926 F.2d 1285, 1298 (2d Cir. 1991) (“[T]he fact that the information is required to be revealed under § 13(d) is evidence of its materiality.”). 87 14 controls because internal controls provide assurance that an issuer’s financial statements—the heart of a public company’s periodic reports—are reliable and comply with applicable standards.88 And it is further supported in this case because CYIOS was a federal contractor and a false disclosure of this nature could threaten its business—as the company recognized in its periodic reports, “failure to comply with applicable laws or regulations could have a material adverse effect on [its] business and reputation” with the government.89 Moreover, the stark difference between the representations that Carnahan repeatedly included in multiple reports and his failure to use any suitable framework leads to the inescapable conclusion that he knew that the representations regarding internal controls were false. In other words, he made the false statements with scienter, “a mental state embracing intent to deceive, manipulate, or defraud.”90 These knowingly false statements impugn See In re Insys Therapeutics, Inc. Sec. Litig., No. 17-cv-1954, 2018 WL 2943746, at *5 (S.D.N.Y. June 12, 2018) (“When assurance that a company complies with its accounting policies, or that a company has effective internal controls, turns out to be false, that would be viewed by the reasonable investor as having significantly altered the total mix of information made available.” (internal quotation marks omitted)); In re Equimed, Inc., No. 98-cv-5374, 2000 WL 562909, at *7 (E.D. Pa. May 9, 2000) (“The adequacy of internal controls would be material to a shareholder’s decision to buy and sell.”); see also In re Grupo Televisa Sec. Litig., 368 F. Supp. 3d 711, 720–21 (S.D.N.Y. 2019) (“Misstatements made in [an issuer’s] certifications concerning the design and efficacy of internal controls are actionable.”); accord Div. Ex. 42 at 7, 8 (Lundelius opined that “the lack of effectiveness of internal controls calls into question the accuracy of an issuer’s public disclosures” and “a reasonable investor would consider the lack of a suitable, recognized framework for internal control important when making investment decisions”). 88 89 See, e.g., Div. Ex. 12 at 262–63. Aaron, 446 U.S. at 686 n.5 (quoting Ernst & Ernst v. Hochfelder, 425 U.S. 185, 194 n.12 (1976)); see also Ades v. Deloitte & Touche, 799 F. Supp. 1493, 1499 (S.D.N.Y. 1992) (“An inference of recklessness satisfying the scienter requirement may be drawn from facts demonstrating conduct that the defendant disseminated material knowing it was false . . . .” (internal quotation marks and brackets omitted)). Because Carnahan’s scienter is imputed to CYIOS, CYIOS acted with scienter. Clarke T. Blizzard, Advisers Act Release No. 2253, 2004 WL 1416184, at *5 (June 23, 2004) (“A company’s scienter may be imputed from that of the individuals who control it.”). Although scienter is not required for a Section 17(a)(3) violation, it is nonetheless relevant because evidence sufficient to establish scienter 90 15 CYIOS’s management’s integrity, which further supports the determination that they are material.91 As reasonable investors would consider the integrity of a public company’s management important, outright false statements included in periodic filings by management indicate a lack of reliability and would affect investors’ decisions regarding that company’s securities.92 The false statements about CYIOS’s internal controls were material. CYIOS violated Section 17(a)(3) through its repeated material misstatements in its periodic filings. As the person responsible for those filings and their content, Carnahan caused CYIOS’s violation.93 2. Carnahan caused CYIOS’s violations of Exchange Act Section 13(a) and Rules 13a-1 and 13a-13. The Division charged CYIOS with violating Exchange Act Section 13(a) and Exchange Act Rules 13a-1 and 13a-13. Carnahan is charged with causing those violations. Exchange Act Section 13(a) and Rules 13a-1 and 13a-13 require issuers of securities registered under Section 12 to file annual and quarterly reports with the Commission.94 Compliance with these requirements is mandatory.95 Scienter is not required to establish violations of these provisions.96 As CYIOS’s sole officer and director, Carnahan was responsible necessarily establishes a lesser mental state. The existence of scienter is also relevant to sanctions. See United States v. Hatfield, 724 F. Supp. 2d 321, 328 (E.D.N.Y. 2010); In re Monster Worldwide, Inc. Sec. Litig., 251 F.R.D. 132, 139 (S.D.N.Y. 2008). 91 Cf. S.W. Hatfield, CPA, Exchange Act Release No. 73763, 2014 WL 6850921, at *6 (Dec. 5, 2014) (holding that a “misrepresentation that audit reports appearing in … periodic reports filed with the Commission have been signed by a CPA is material”). 92 93 See Fuller, 2003 WL 22016309, at *4. 94 15 U.S.C. § 78m(a); 17 C.F.R. §§ 240.13a-1, .13a-13. Am.’s Sports Voice, Inc., Exchange Act Release No. 55511, 2007 WL 858747, at *4 (Mar. 22, 2007), recons. denied, Exchange Act Release No. 55867, 2007 WL 1624611 (June 6, 2007). 95 See SEC v. McNulty, 137 F.3d 732, 740–41 (2d Cir. 1998); SEC v. Wills, 472 F. Supp. 1250, 1268 (D.D.C. 1978). 96 16 for the content of the periodic filings and filed them with the Commission via EDGAR.97 As noted above, CYIOS had a class of securities registered under Exchange Act Section 12 and did not file any periodic reports between November 21, 2012, and May 30, 2014, the date it filed the Form 15 to terminate its registration. By failing to make required periodic filings during that time, CYIOS violated Exchange Act Section 13(a) and Rules 13a-1 and 13a-13. Given that Carnahan was responsible for CYIOS’s periodic filings as the company’s sole officer and director, he caused these violations.98 In fact, as I found above, Carnahan decided to stop making the filings. 3. Carnahan violated Exchange Act Rule 13a-14. The Division charged Carnahan with violating Exchange Act Rule 13a-14, which requires that an issuer’s periodic reports, including those filed on Forms 10-K and 10-Q, include certifications by the issuer’s principal executive and principal financial officers, as specified in the filing requirements of such reports.99 Carnahan, who served in these officer roles for CYIOS, was required to certify in an exhibit to each periodic report that, based on his knowledge, the report “does not contain any untrue statement of material fact.” 100 And a person who makes this certification violates Rule 13a-14 if the periodic report subject to the certification contains materially false statements.101 For purposes of this decision, I assume that to establish a violation of Rule 13a-14, the Division must show that a respondent knew his certification was false or acted recklessly in making a false certification.102 97 Div. Ex. 2 at 58–60; Tr. 40–42. See Gateway Int’l Holdings, Inc., Exchange Act Release No. 53907, 2006 WL 1506286, at *8 (May 31, 2006); Phlo Corp., Exchange Act Release No. 55562, 2007 WL 966943, at *11 & n.66 (Mar. 30, 2007). As explained above, CYIOS violated Section 13(a), Carnahan did not make the periodic filings for which he was responsible, and he knew or should have known that if he did not make those filings, CYIOS would fail to file its periodic reports. 98 99 17 C.F.R. § 240.13a-14(a). 100 17 C.F.R. § 229.601(b)(31)(i). 101 See SEC v. Jensen, 835 F.3d 1100, 1112–13 (9th Cir. 2016). See id. at 1113 n.6 (declining to reach the question of the mental state required for a violation of Rule 13a-14); id. at 1118 (Bea, J. concurring) (“I would hold that liability for false certification under Rule 13a-14 may lie only 102 17 CYIOS’s Forms 10-K for fiscal years 2009, 2010, and 2011 and Forms 10Q for the first quarter of 2010 through the third quarter of 2012 all falsely indicated that management had assessed the company’s internal controls using the COSO framework. Nevertheless, Carnahan signed certifications attached as exhibits to those periodic reports stating there were no untrue statements of material fact in the reports. As the reports contained materially false statements, Carnahan violated Exchange Act Rule 13a-14. Being the only control person of the company, Carnahan knew that no one had assessed CYIOS’s internal controls using the COSO framework. 4. Carnahan violated Exchange Act Rule 13a-15(c). The Division charged Carnahan with violating Exchange Act Rule 13a15(c), which requires a public company’s management to evaluate the effectiveness of the company’s internal controls at each fiscal year’s end.103 The rule requires that “[t]he framework on which management’s evaluation of the issuer’s internal control over financial reporting is based must be a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment.”104 It also states that “[a]lthough there are many different ways to conduct an evaluation of ” internal controls, “an evaluation that is conducted in accordance with the interpretive guidance issued by the Commission in Release No. 34-55929 will satisfy the evaluation required by this paragraph.”105 Commission Release No. 34-55929 cites the COSO framework as a suitable control framework and further makes clear that management must maintain sufficient evidential matter to support its assessment.106 Carnahan was the only member of CYIOS’s management during the relevant time period. The evidence establishes that Carnahan did not assess where a CEO or CFO acts with knowledge or at least recklessness as to the falsity of a certification.”). 103 17 C.F.R. § 240.13a-15(c). 104 Id. 105 Id. See Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, 72 Fed. Reg. 35,324, 35,326 nn.23 & 24, 35,329, 35,332 (June 27, 2007). 106 18 CYIOS’s internal controls using any suitable framework, let alone the COSO framework, as the periodic reports claimed.107 Carnahan was aware of the statements in CYIOS’s periodic filings and indeed was responsible for those filings and their content.108 Accordingly, Carnahan violated Rule 13a-15(c). Sanctions 1. Cease-and-Desist Order Securities Act Section 8A and Exchange Act Section 21C authorize the Commission to issue a cease-and-desist order against any person found to have violated, or caused a violation of, a provision of those acts or a rule or regulation promulgated under either act.109 To issue such an order, “there must be some likelihood of future violations.”110 But the “risk” of future violations “need not be very great to warrant issuing a cease-and-desist order. Absent evidence to the contrary, a finding of violation raises a sufficient risk of future violation.” 111 Additionally, the Commission considers the public-interest factors described in Steadman v. SEC112 when determining whether to issue a ceaseand-desist order.113 These factors include: the egregiousness of the respondents’ actions, the isolated or recurrent nature of the infraction, the degree of scienter involved, the sincerity of the respondents’ assurances against future violations, the respondents’ recognition of the wrongful nature of their conduct, and the likelihood that the respondents’ occupations will present opportunities for future violations.114 The Commission also considers 107 See supra notes 83 and 84 and accompanying text. 108 See supra notes 46, 90, and 91 and accompanying text. 109 See 15 U.S.C. §§ 77h-1(a), 78u-3(a). 110 KPMG Peat Marwick, 2001 WL 47245, at *24. 111 Id.; see also id. at *26. 603 F.2d 1126, 1140 (5th. Cir. 1979), aff’d on other grounds, 450 U.S. 91 (1981). 112 KPMG Peat Marwick, 2001 WL 47245, at *23 & n.114, *26; see Timothy S. Dembski, Securities Act Release No. 10326, 2017 WL 1103685, at *14 (Mar. 24, 2017), pet. denied, 726 F. App’x 841 (2d Cir. 2018). 113 KPMG Peat Marwick, 2001 WL 47245, at *26; see also Steadman, 603 F.2d at 1140. 114 19 “whether the violation is recent, the degree of harm to investors or the marketplace resulting from the violation, and the remedial function to be served by the cease-and-desist order in the context of any other sanctions being sought in the same proceedings.”115 No single factor in this analysis is dispositive, and the entire record is considered when deciding whether to issue a cease-and-desist order.116 The fact CYIOS and Carnahan committed the charged violations shows the likelihood of future violations. Their misconduct was egregious. CYIOS violated the antifraud provision of Securities Act Section 17(a)(3) by falsely representing in its periodic filings that its management followed an established framework when assessing its internal controls.117 The misstatements appeared in numerous periodic filings over a period of about three years, highlighting the misconduct’s recurrent nature. Carnahan was fully responsible for CYIOS’s filings and admitted that he was the company’s only internal control. He acted with scienter by knowingly making false statements in those filings, and his scienter is imputed to CYIOS.118 Carnahan also repeatedly included false certifications with those filings and failed to assess CYIOS’s internal controls using any suitable framework, in violation of Exchange Act Rules 13a-14 and 13a-15(c). This had the potential to cause “serious harm to investors and the marketplace.”119 Further, Carnahan decided to stop making CYIOS’s required periodic filings. He thus caused CYIOS’s violation of “a central provision of the Exchange Act, … depriv[ing] both existing and prospective holders of its registered stock of the ability to make informed investment decisions based on 115 KPMG Peat Marwick, 2001 WL 47245, at *26. 116 Id. See Peter Siris, Exchange Act Release No. 71068, 2013 WL 6528874, at *6 (Dec. 12, 2013) (“[The Commission has] repeatedly held that conduct that violates the antifraud provisions of the securities laws is especially serious and subject to the severest of sanctions under the securities laws.” (internal quotation marks omitted)), pet. denied, 773 F.3d 89 (D.C. Cir. 2014). 117 118 See Aaron, 446 U.S. at 686 n.5; Blizzard, 2004 WL 1416184, at *5. Rockies Fund, Inc., Exchange Act Release No. 54892, 2006 WL 3542989, at *5 (Dec. 7, 2006) (“The dissemination of false and misleading financial information, such as in the periodic reports at issue, causes serious harm to investors and the marketplace.”), pet. denied, 298 F. App’x 4 (D.C. Cir. 2008). 119 20 current and reliable information.”120 CYIOS and Carnahan’s “long history of ignoring … reporting obligations evidences a high degree of culpability.”121 Moreover, Carnahan’s own decision shows that the “violations here were intentional.”122 Respondents have made no assurances against future violations. Further underscoring the significant risk of future violations, Carnahan has not recognized the wrongfulness of the misconduct and in his closing argument simply claimed the Division did not present evidence of wrongdoing.123 As the control person for CYIOS, Carnahan’s occupation presents the opportunity for CYIOS to again become public and resume its misconduct. The Steadman factors thus weigh in favor of strong sanctions. The factors specific to issuing a cease-and-desist order further show that such an order is appropriate. Although the violations are not recent, “this consideration is outweighed by the other factors previously discussed.”124 There is no evidence quantifying monetary losses to investors; however, investors were deprived of current information when CYIOS stopped filing its reports and were misled into believing that CYIOS’s management evaluated its internal controls using a recognized framework.125 Instructing Carnahan Accredited Bus. Consolidators Corp., Exchange Act Release No. 75840, 2015 WL 5172970, at *2 (Sept. 4, 2015); see also Phlo Corp., 2007 WL 966943, at *13 (describing a respondent’s repeated failure to timely file its periodic reports as “serious”). 120 Citizens Capital Corp., Exchange Act Release No. 67313, 2012 WL 2499350, at *5 (June 29, 2012) (internal quotation marks omitted). 121 122 Id. See Tr. 131; see also Geiger v. SEC, 363 F.3d 481, 489 (D.C. Cir. 2004) (“[The respondent] still thinks he did nothing wrong, which casts doubts on his promise that he will mend his ways.”); Jose P. Zollino, Exchange Act Release No. 55107, 2007 WL 98919, at *6 (Jan. 16, 2007) (“[F]ailure to acknowledge guilt or show remorse indicates that there is a significant risk that, given the opportunity, [the respondent] would commit further misconduct in the future.”). 123 Robert W. Armstrong, III, Exchange Act Release No. 51920, 2005 WL 1498425, at *15 (June 24, 2005). 124 See McConville, 2005 WL 1560276, at *16 (“Fraudulent misstatements and omissions in financial statements and periodic reports mislead investors who buy or sell stock based on the information contained therein.”); see also 125 21 and CYIOS to not violate the securities laws in the future does not prejudice them and, in conjunction with the sanctions discussed below, is an appropriate remedy. Based on the entire record, a cease-and-desist order is warranted against CYIOS and Carnahan. 2. Civil Penalties Securities Act Section 8A(g) and Exchange Act Section 21B(a)(2) authorize civil penalties in cease-and-desist proceedings against any person who has violated, or caused a violation of, a provision of those acts or a rule or regulation promulgated under either act.126 These provisions both outline a three-tiered system for determining the maximum civil penalty for each act or omission. First-tier penalties are available based on the fact of the violation alone.127 Second-tier penalties may be imposed if the misconduct involved fraud, deceit, manipulation, or deliberate or reckless disregard of a regulatory requirement.128 Third-tier penalties require the additional finding that the misconduct, directly or indirectly, “resulted in substantial losses or created a significant risk of substantial losses to other persons or resulted in substantial pecuniary gain” to the respondent who committed the violation.129 The Division requests that I impose seventeen third-tier penalties.130 The basis for the number is clear; it is derived from the number of periodic filings containing misstatements, plus the required filings that were not made.131 The basis for the tier is less clear, however. Although the Division asserts SEC v. Dresser Indus., Inc., 628 F.2d 1368, 1377 (D.C. Cir. 1980) (“Dissemination of false or misleading information by companies to members of the investing public may distort the efficient workings of the securities markets and injure investors who rely on the accuracy and completeness of the company’s public disclosures.”). 126 15 U.S.C. §§ 77h-1(g)(1), 78u-2(a)(2). 127 15 U.S.C. §§ 77h-1(g)(2)(A), 78u-2(b)(1). 128 15 U.S.C. §§ 77h-1(g)(2)(B), 78u-2(b)(2). 129 15 U.S.C. §§ 77h-1(g)(2)(C), 78u-2(b)(3). 130 Div. Br. 19–20. 131 Div. Br. 20. 22 Respondents “created a ‘significant risk of substantial losses,’” it does not explain why this is the case.132 The record nonetheless supports second-tier penalties for Respondents’ misconduct. Respondents’ misconduct relating to the false statements in CYIOS’s periodic filings was committed with scienter and was deceitful. 133 Respondents also deliberately disregarded regulatory requirements when they failed to file periodic reports. Indeed, Carnahan was aware of those requirements yet decided to stop making the filings. When determining whether civil penalties are in the public interest, the Commission considers six factors listed in the securities statutes: (1) whether the violation involved fraud, deceit, manipulation, or deliberate or reckless disregard of a regulatory requirement; (2) the resulting harm, directly or indirectly, to other persons; (3) any unjust enrichment and prior restitution; (4) the respondent’s prior regulatory record; (5) the need for deterrence; and (6) such other matters as justice may require.134 As I have already found, the first factor is satisfied. As discussed in determining that a cease-and-desist order is appropriate, while investor harm cannot be quantified, Respondents’ misconduct harmed investors in that it deprived investors of current information about CYIOS and misled them due to repetitive misstatements about the company’s internal controls. CYIOS was unjustly enriched by obtaining consulting services in exchange for its stock. There is no evidence that either Carnahan or CYIOS have a disciplinary history. There is, however, a need to deter them and others from future misconduct. There are no Div. Br. 20. The only record evidence of the trading volume and price of CYIOS’s stock suggests that on all but a few days total trading volume was well under $5,000, see generally Div. Ex. 26, which makes the potential losses to investors less likely to be characterized as substantial. Moreover, although the Division points to Carnahan’s income as substantial, Div. Br. 19; Div. Ex. 3 at 119, it has made no showing that his income resulted from his misconduct. 132 See SEC v. M&A W., Inc., 538 F.3d 1043, 1054 (9th Cir. 2008) (“[T]he imposition of second-tier penalties requires an assessment of scienter.”). 133 See, e.g., 15 U.S.C. § 78u-2(c). When assessing the public interest under the Securities Act, the Commission considers the factors listed under the other securities statutes as the Securities Act does not contain a statutory list of public-interest factors. See Dembski, 2017 WL 1103685, at *15 & n.70; Thomas C. Gonnella, Securities Act Release No. 10119, 2016 WL 4233837, at *14 & n.70 (Aug. 10, 2016), pet. argued, No. 16-3433 (2d Cir. Sept. 9, 2019); see generally 15 U.S.C. § 77h-1. 134 23 indications that Respondents understand the gravity of their misconduct. Carnahan ran a public company without proper internal controls and knowingly caused that company to make false statements to the investing public indicating otherwise. On balance, significant penalties are warranted. Although the securities statutes provide that a penalty may be imposed for each act or omission, they leave the precise unit of violation undefined.135 Based on the record, two second-tier penalties are appropriate against each Respondent. The first is imposed for the misconduct relating to the misstatements about CYIOS’s internal controls, and the second is imposed for the failure to make required periodic filings. These violations are aptly considered as two courses of misconduct. Imposing a penalty for each filing that contained a misstatement and each missed filing, as the Division proposes, would be unduly punitive in the circumstances of this case. Although I could also impose penalties for each of Carnahan’s false certifications, I decline to do so, as I consider those certifications part of the same course of misconduct as the misstatements. Maximum second-tier penalties of $75,000 for each violation by an individual and $375,000 for each violation by an entity may be imposed for violations occurring during the misconduct’s timeframe. 136 Particularly in view of the deceitful nature of the misstatement-related misconduct, the maximum amount against each Respondent is appropriate for that misconduct. But as to the missed periodic filings, it is appropriate to impose lesser penalties of $125,000 against CYIOS and $25,000 against Carnahan. Accordingly, I will order that Carnahan pay a total civil monetary penalty of $100,000 and that CYIOS pay a total civil monetary penalty of $500,000. 3. Disgorgement and Prejudgment Interest Securities Act Section 8A(e) and Exchange Act Section 21C(e) authorize disgorgement in cease-and-desist proceedings, and Exchange Act Section 21B(e) authorizes disgorgement in proceedings where civil monetary penalties may be imposed.137 “Disgorgement is an equitable remedy designed to deprive a wrongdoer of [its] unjust enrichment and to deter others from violating the 135 Fields, 2015 WL 728005, at *24 n.162. 136 See 17 C.F.R. § 201.1001, tbl. I. 137 See 15 U.S.C. §§ 77h-1(e), 78u-2(e), 78u-3(e). 24 securities laws.”138 To establish the appropriate amount of disgorgement, the Division need only show “a reasonable approximation of profits causally connected to the violation” in question.139 Ordinarily, once the Division makes the required showing, the burden shifts to the respondent to show that the disgorgement figure was not a reasonable approximation.140 The Division has shown, and CYIOS has not disputed, that CYIOS received $37,500 worth of consulting services by exchanging its publicly traded stock for such services while the company’s periodic filings contained material misstatements in violation of Section 17(a)(3).141 Because CYIOS’s misstatements about its internal controls were material—for the reasons discussed earlier in this decision—a provider of consulting services would consider those false disclosures important in deciding whether to accept stock compensation. The receipt of these services in exchange for the company’s stock was thus causally connected to the violation.142 The value of these consulting services is an unjust enrichment subject to disgorgement, as otherwise CYIOS would retain a free benefit it gained while violating the law.143 The Division reasonably approximated the value of these services based on CYIOS’s stated Montford, 2014 WL 1744130, at *22 (quoting SEC v. First City Fin. Corp., 890 F.2d 1215, 1230 (D.C. Cir. 1989)). 138 First City Fin., 890 F.2d at 1231; see also Montford & Co. v. SEC, 793 F.3d 76, 83–84 (D.C. Cir. 2015). 139 140 SEC v. Calvo, 378 F.3d 1211, 1217 (11th Cir. 2004). 141 Div. Ex. 12 at 274, 277. See Jay T. Comeaux, Securities Act Release No. 9633, 2014 WL 4160054, at *3 (Aug. 21, 2014) (“The Division need only show but-for causation between a defendant’s violations and profits.”). 142 Cf. SEC v. Contorinis, 743 F.3d 296, 306 (2d Cir. 2014) (rejecting the principle that disgorgement is limited to the amount of direct pecuniary benefit to the wrongdoer, and recognizing that a “wrongdoer’s unlawful action may create illicit benefits for the wrongdoer that are indirect or intangible”); SEC v. Great Lakes Equities Co., 775 F. Supp. 211, 214 (E.D. Mich. 1991) (“The benefit or unjust enrichment of a defendant includes not only what it gets to keep in its pocket after the fraud, but also the value of the other benefits the wrongdoer receives through the scheme.”), aff’d, 12 F.3d 214 (6th Cir. 1993) (unpublished). 143 25 value of its stock issued in exchange for the services.144 CYIOS has made no contrary showing.145 Accordingly, CYIOS will be ordered to disgorge $37,500 in ill-gotten gains, with interest due from December 1, 2012, which is the first day of the month after CYIOS’s last periodic filing—an amended Form 10-Q—that contained a material misstatement. 146 Record Certification I certify that the record includes the items set forth in the record index issued by the Secretary of the Commission on September 9, 2019.147 Order Under Section 8A of the Securities Act of 1933 and Section 21C of the Securities Exchange Act of 1934: CYIOS Corporation must CEASE AND DESIST from committing any violations or future violations of Section 17(a)(3) of the Securities Act of 1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange Act Rules 13a-1 and 13a-13; and Timothy W. Carnahan must CEASE AND DESIST from causing any violations or future violations of Section 17(a)(3) of the Securities Act of 1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange Act Rules 13a-1 and 13a-13; and from committing any violations or future violations of Exchange Act Rules 13a-14 and 13a-15. See SEC v. Bilzerian, 814 F. Supp. 116, 123 (D.D.C. 1993) (“A reasonable approximation of defendant’s illicit profit is the amount he gained while in violation of the law.”), aff’d, 29 F.3d 689 (D.C. Cir. 1994); see also id. at 121 (“As it is nearly impossible and speculative to determine the market price but for the illicit conduct, a reasonable approximation of this amount must suffice.” (internal citation omitted)). 144 See Zacharias v. SEC, 569 F.3d 458, 473 (D.C. Cir. 2009) (“[T]he burden of uncertainty in calculating ill-gotten gains falls on the wrongdoers who create that uncertainty.”). 145 146 See 17 C.F.R. § 201.600(a). 147 See 17 C.F.R. § 201.351(b). 26 Under Section 8A(g) of the Securities Act of 1933 and Section 21B(a) of the Securities Exchange Act of 1934: CYIOS Corporation must PAY A CIVIL MONEY PENALTY in the amount of $500,000; and Timothy W. Carnahan must PAY A CIVIL MONEY PENALTY in the amount of $100,000. Under Section 8A(e) of the Securities Act of 1933 and Sections 21B(e) and 21C(e) of the Securities Exchange Act of 1934: CYIOS Corporation must DISGORGE $37,500.00, plus prejudgment interest. The prejudgment interest owed will be calculated from December 1, 2012, to the last day of the month preceding the month in which payment of disgorgement is made. Prejudgment interest will be computed at the underpayment rate of interest established under Section 6621(a)(2) of the Internal Revenue Code, 26 U.S.C. § 6621(a)(2), and compounded quarterly.148 Payment of civil penalties, disgorgement, and interest must be made no later than 21 days following the day this initial decision becomes final, unless the Commission directs otherwise. Payment must be made in one of the following ways: (1) transmitted electronically to the Commission, which will provide detailed ACH transfer/Fedwire instructions upon request; (2) direct payments from a bank account via Pay.gov through the SEC website at http://www.sec.gov/ofm; or (3) by certified check, bank cashier’s check, bank money order, or United States postal money order made payable to the Securities and Exchange Commission and hand-delivered or mailed to the following address alongside a cover letter identifying Respondent(s) and Administrative Proceeding No. 3-16386: Enterprise Services Center, Accounts Receivable Branch, HQ Bldg., Room 181, AMZ-341, 6500 South MacArthur Blvd., Oklahoma City, Oklahoma 73169. A copy of the cover letter and instrument of payment must be sent to the Commission’s Division of Enforcement, directed to the attention of counsel of record. This initial decision will become effective in accordance with and subject to the provisions of Rule 360.149 Under that rule, a party may file a petition for review of this initial decision within 21 days after service of the initial decision. Under Rule of Practice 111, a party may also file a motion to correct a manifest 148 See 17 C.F.R. § 201.600(b). 149 See 17 C.F.R. § 201.360. 27 error of fact within ten days of the initial decision.150 If a motion to correct a manifest error of fact is filed by a party, then a party has 21 days to file a petition for review from the date of the order resolving such motion to correct a manifest error of fact. The initial decision will not become final until the Commission enters an order of finality. The Commission will enter an order of finality unless a party files a petition for review or motion to correct a manifest error of fact or the Commission determines on its own initiative to review the initial decision as to a party. If any of these events occur, the initial decision will not become final as to that party. _______________________________ James E. Grimes Administrative Law Judge 150 See 17 C.F.R. § 201.111. 28 --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/agency%3Asec%3A2d06debfb3420b67. Public record. Not legal advice.