MBAs Hire Moving Company To Provide Cybersecurity

In 2015, some of the finest minds on Wall Street went to work on a knotty problem: How to dispose of old computers containing hard drives stuffed with personal identifying information belonging to clients of their company, Morgan Stanley. They tried their usual approach, devising a finite sequence of rigorous instructions to compute an automated decision. That didn’t work, so they hired a moving company and told them to get rid of the computers. Apparently that didn’t work either. Early in September the SEC accused Morgan Stanley of “astonishing” failures that led to the mishandling of sensitive data on about 15 million customers. The movers had been instructed to decommission the hard drives, a task for which they had “no experience or expertise.” Instead they sold the computers to a third party, who resold them on an internet auction site. Morgan Stanley was able to recover some of the devices, which contained “thousands of pieces of unencrypted customer data,” but not “the majority of them,” according to the SEC. The company’s “failures in this case are astonishing,” said Gurbir Grewal, director of the SEC’s enforcement division. Morgan Stanley, in a statement written by an algorithm, said it was pleased to have resolved the issue, and expressed confidence that no sensitive data was exploited. They agreed to pay a $35 million fine without admitting or denying the findings.