Intel recently disclosed security flaws in its widely-used microprocessors that could allow hackers to steal sensitive information from computers, phones and other devices. Software makers issued patches to protect against vulnerabilities, but Intel is facing a class action lawsuit claiming that the patches would slow computers and essentially force consumers to buy new hardware.

Although no data breaches have been reported yet, Intel's shares have dropped three percent since it confirmed the security flaw, and it appears that CEO Brian Krzanich tried to dodge this bullet, having sold $24 million of his stock options in December before disclosing the flaw. This raises the question, will a Securities and Exchange Commission, or even U.S. Department of Justice, investigation be launched?

Intel will likely have to compensate large customers for any software or hardware fixes, however, this could be the least of Intel's worries, according to Joshua M. Robbins, chair of  Greenberg Gross LLP's white collar defense and governmental investigations practice groups, who sat down with Inside Counsel for an exclusive interview. Robbins provided insight on recent data breaches involving Equifax, Yahoo, Microsoft and Uber.

“Intel could face hard questions about whether and why it concealed this flaw for more than six months before disclosing it to the public,” he explained. “Shareholders and regulators will be considering whether Intel made misleading statements about their chips within that time frame, and it certainly does not bode well for the company that their CEO sold off as much stock as he was legally allowed to, right before the flaw was made public.”

According to Robbins, the SEC may well be interested in opening at least an informal initial inquiry. The high-profile nature of the case and the unusual fact pattern–the CEO selling most of his shares one month before a major product flaw is disclosed–will make it tempting for investigators. A DOJ investigation is less likely, at least for now, but the DOJ might simply wait to see what the SEC uncovers, and whether the SEC makes a criminal referral.

“Intel and Krzanich are sophisticated players who would have been advised by highly competent securities counsel or other advisers, so it would be surprising if the risk of such an investigation were not considered at the time the trading plan was devised,” Robbins said. “If Krzanich informed his attorneys about the security flaw and was advised that the plan and sales were permitted, that could be a strong defense and discourage further investigation. But if he did not make full disclosure of the issue to counsel, that defense might not be available.”

The SEC has rarely investigated companies for delayed disclosures of cybersecurity incidents. Yahoo and Equifax were exceptions, but the former involved a delay of some two years, while the latter involved suspicions of insider trading. If there is an indication that Intel's senior management knew of the full extent of the security flaw issue by mid-2017 and deliberately chose not to mention it in its later public filings, or if it made statements about the security features of its chips that could now be viewed as misleading, the SEC may consider the case. However, according to Robbins, it is possible that the materiality of the security issue did not become apparent until later in the year, such that disclosure was not improperly delayed. A DOJ investigation seems unlikely, unless evidence is uncovered indicating a deliberate and coordinated effort to conceal the flaw from investors.

As to Krzanich, per Robbins, any investigation would likely concern insider trading under the Securities Exchange Act of 1934 and SEC Rule 10b-5, as well as the securities fraud statutes enacted in the Sarbanes-Oxley Act, and could be undertaken by the SEC, the DOJ, or both. As to Intel, a securities investigation could involve several different provisions of the Securities Act of 1933 or the Securities Exchange Act.

An interesting question is whether the FTC might consider an enforcement action under Section 5 of the FTC Act, which the agency has used to punish companies that mislead consumers by failing to maintain security for their sensitive information. Most prior cases have involved companies who held sensitive customer data and were hacked or otherwise allowed the data to leak out.

He said, “In this case, Intel did not host customer data, but rather produced chips whose design flaw could be exploited to enable that data, stored on customers' computers or those of other companies, to be compromised. If Intel made misleading statements about the security of its chips, the FTC might look to take action.”

So, what are the hard questions Intel could face? Robbins thinks that Intel has a duty to its shareholders not to mislead them about, and to inform them of, factors that could seriously impact the value of its shares. It has a duty to its customers not to mislead them about the quality of its products, including their security qualities.

He added, “If it knew about a major flaw in a core product, which could greatly impact its customers and the disclosure of which could equally impact its shareholders, it had a duty to speak accurately about that issue. Regulators, shareholders and the public will want to know how long Intel waited before disclosing the problems with its chips and why.”

Amanda G. Ciccatelli is a Freelance Journalist for Corporate Counsel and InsideCounsel, where she covers intellectual property, legal technology, patent litigation, cybersecurity, innovation, and more.