The SEC’s CAT has hidden in alleys long enough

Rarely does a federal agency concede that the program it is defending in court needs to be drastically overhauled. As Advancing American Freedom has stated in its amicus brief, the Securities and Exchange Commission (SEC) created a serious constitutional contravention with its Consolidated Audit Trail (CAT), a massive, invasive database of Americans’ personal information. The agency has spent the past year quietly rewriting CAT’s rules while trying to avoid defending its legality in court. While the SEC seeks delays in Davidson v. Atkins, the case challenging CAT, the database continues to swell.CAT is the SEC’s database that tracks every single stock and options order, execution, and cancellation in the U.S. financial markets in real time. The SEC wields an illegal tool that peeks into the personal lives of every single American who owns stock. But the SEC is yet again asking a federal court in Texas to forestall its consideration of a case challenging CAT for another six months. The courts should not allow the SEC to delay again.The SEC implemented CAT after the 2010 “flash crash” as a tool to help regulators reconstruct chaotic trading days. Ostensibly, a simple way to track and stop illegal activity in the market became something else: a permanent, centralized ledger that compels broker-dealers and exchanges to report the personal, completely lawful trading activity of tens of millions of Americans without a warrant, without even a suspicion of illegal activity, and without meaningful limits on how long the government keeps or uses the data. CAT imposes overwhelming costs, and it does so without Congressional appropriations. What was originally supposed to cost $37.5 million to $65 million in build-out costs rose to roughly $500–518 million. Further, it initially cost $55.8 million per year to operate, but would have cost at least $248 million for 2025 alone, if not for emergency cuts mid-year. CAT LLC — the governing entity created at the direction of the SEC by U.S. national securities exchanges and FINRA to build and operate the system — carries over $660 million in debt. CAT has not only created financial concerns but has also raised broader questions about accountability and potential misuse. David R. Burton, a senior research fellow at Advancing American Freedom, warned in a June 22 comment to the SEC, “The extremely odd, opaque, and unaccountable governance structure of the FINRA CAT, LLC means that abuse by private individuals and firms for competitive advantage is quite possible.” The risk extends beyond internal misuse. In 2016, the SEC disclosed that its filing system, EDGAR, had been hacked and that the information obtained had been used to make illegal trades. While CAT has cybersecurity measures, the sheer size of a system that collects the valuable data of investors and market participants invites illegal intrusions from hackers or foreign adversaries. That information can serve as a tool for foreign governments to engage in industrial espionage, suppress political opponents, or dismantle NGOs seeking to promote human rights. Low angle view of the U.S. Securities and Exchange Commission headquarters building in Washington, D.C., in the evening from 2022. (Getty Images) Not least, CAT violates the Fourth Amendment. In Carpenter v. United States, the Supreme Court ruled that a warrant is required when the government seeks to access the kind of detailed digital records that can reveal the intimate details of a person’s life — even when those records are held by a third party.The government cannot lawfully compile records of all Americans’ financial investments. And yet CAT does so in the absence of specific suspicion, a warrant, or a single judicial determination of criminal conduct. Plaintiffs in Davidson v. Atkins have also invoked NAACP v. Alabama (1958), the foundational case holding that compelled disclosure of private records to the government can chill protected associational and expressive activity even without an outright ban.None of this is news to the SEC. SEC Chairman Paul Atkins has called for a “comprehensive review” of CAT’s scope, cybersecurity, and cost; instead of litigating the merits, the SEC asked Judge Alan Albright in the Western District of Texas to pause the case last summer while it reviewed CAT internally. Judge Albright agreed, staying the case through Jan. 15, on the condition that CAT reporting requirements would remain fully in effect throughout — meaning the alleged constitutional violation continued unabated while the case sat dormant. Since then, the SEC has approved a data-storage amendment permitting deletion of some older CAT records, narrowed the personally identifiable information the system collects, and made other cost-reduction changes.But an agency cannot cure a constitutional defect through rulemaking. Only a court can decide whether CAT, as designed and operated, exceeds the protections of the Fourth Amendment and the First Amendment’s freedom of association. WHY TRUMP V. SLAUGHTER WON’T SCARE OFF AI INVESTMENTEvery day the case remains delayed is another day of mandatory, warrantless data collection continues under a cloud of unresolved constitutionality — and another day in which the government’s own conduct postpones any argument that the harm is speculative. Without judicial action now, CAT will remain in place, leaving a future administration free to invade the privacy of citizens and let its costs balloon again.The SEC is entitled to fix what it admits is broken, but only if the system is even legal. It is not entitled to use that fix as a substitute for defending CAT in court. CAT was neither authorized nor funded by Congress and operates without search warrants. It is time for the courts to rule on whether it is constitutional at all.J. Marc Wheat is General Counsel at Advancing American Freedom. Connor Bolster is an Intern at Advancing American Freedom.