Legal Report: SEC Drops Case Against SolarWinds and Its CISO
Security Management’s Legal Report is a monthly column that highlights the instances where legal matters intersect with the security industry. Our team tracks court cases, new and evolving legislation, and regulatory decisions and investigations that impact private organizations and security professionals worldwide.
To share a tip or notify Security Management about emerging legal issues, email Associate Editor Sara Mosqueda at [email protected].
Regulations
United States
Cybersecurity. The U.S. Securities and Exchange Commission (SEC) dropped its civil enforcement action against SolarWinds Corp and its chief information security officer (CISO). The commission was investigating how the company and its CISO, Timothy Brown, dealt with allegations of a massive Russian cyberattack that was discovered in 2020.
The SEC announced in a press release that it had dismissed the case with prejudice, permanently closing the action despite the parties having reached a settlement agreement in July 2025.
The SEC filed a lawsuit in October 2023 in response to allegations that SolarWinds and Brown failed to adequately disclose information about risks that left the company’s IT systems vulnerable to breaches, such as the 2020 SUNBURST attack. (Re: SolarWinds Corp. and Timothy G. Brown, U.S. Securities and Exchange Commission, Litigation Release No. 26423, 2025; SEC v. SolarWinds Corp., et al., U.S. District Court for the Southern District of New York, No. 23-cv-09518-PAE, 2025)
Judicial Decisions
United States
Corporate espionage. A federal judge sentenced a former engineer to nearly four years in prison for stealing trade secret technologies designed for missile launch detection.
Chenguang Gong, 59, a dual citizen of China and the United States, pled guilty to stealing the information, specifically U.S. government capabilities for tracking nuclear, ballistic, and hypersonic missiles, and allowing U.S. fighter planes to detect and outmaneuver heat-seeking missiles.
Gong admitted to transferring more than 3,600 files from a California research and development company to personal storage devices while he was employed with the company in 2023.
“Gong also transferred files containing trade secrets relating to the development of ‘next generation’ sensors, as well as the blueprints for the mechanical assemblies used to house and cryogenically cool the victim company’s sensors. This information was among the victim company’s most important trade secrets that are worth hundreds of millions of dollars,” according to the U.S. Department of Justice.
The court fined Gong $100,000 and ordered him to pay $77,408 in restitution to the victim company, specifically for expenses accrued during the government’s investigation into the crime.
The intended economic loss from Gong’s conduct exceeds $3.5 million. (United States v. Chenguang Gong, U.S. District Court for Central District of California, No. 24-cr-00127-JFW, 2025)
School shooting. A Virginia jury awarded Abby Zwerner—a former elementary school teacher who was shot by one of her students in school on 6 January 2023—$10 million in damages.
The jury in the civil case decided that on the day of the shooting, which occurred in Zwerner’s classroom, assistant principal Ebony Parker was grossly negligent in response to multiple reports that the first-grade student might possess a firearm while at Richneck Elementary School.
During the civil trial, Zwerner’s attorneys alleged that the student who shot her had a history of violent behavior while at the school, including against other students and at least one teacher. At trial, witnesses testified that four different staff members informed Parker that they suspected the student had a gun, but Parker refused to authorize a search of the boy. Later that day, the student shot Zwerner in her hand and chest while she was teaching the class. Zwerner was treated for her injuries and later retired from teaching.
The civil case Zwerner filed in April 2023 initially sought $40 million in damages from Parker, as well as the Newport News Public School District’s superintendent and school principal. The latter two defendants were dismissed from the case.
Parker resigned from her position after the shooting. She has since been charged with eight counts of felony child abuse and neglect in connection with the shooting. (Abigail Zwerner v. Ebony Parker et al., Newport News Circuit Court, No. CL2301446H-00, 2025)
Vandalism. A federal court sentenced climate activist Timothy Martin to serve 18 months in prison for smearing paint on the case that protects an Edgar Degas sculpture at the National Gallery of Art in Washington, D.C.
Martin was found guilty of one count of conspiracy to injure government property and two counts of injuring that property. Martin and another activist smeared black and red paint over the case that houses Little Dancer, Age Fourteen in April 2023.
Besides the prison sentence, Martin will have to pay $4,062 in restitution to the National Gallery, plus $200 for a special assessment. The restitution was based on the National Gallery’s estimate of the cost to repair and reinstall the exhibit, including hiring a contractor to remove and clean the case and repair other parts of the exhibit where the sculpture is displayed.
The court also ordered Martin to perform 150 hours of community service, with 20 of those hours dedicated to cleaning up graffiti or vandalism and the remainder to a “constructive effort” for a legitimate organization fighting climate change or eliminating waste, according to sentencing documents. The prison sentence includes the time already served since Martin was found guilty. (United States v. Timothy Martin, U.S. District Court for the District of Columbia, No. 23cr182-1, 2025)
United Kingdom
Negligence. A High Court ruled that global mining company BHP Group’s negligence was responsible for the worst environmental disaster in Brazil’s history.
In November 2015, the Fundão dam on the Doce River in southeastern Brazil collapsed. The toxic waste from BHP iron ore mines—enough to fill 13,000 Olympic-size swimming pools—then rushed through the area, destroying the village of Bento Rodrigues, killing 19 people and 14 tons of fisth, and damaging roughly 370 miles of waterway. The river, which the Krenak indigenous people worship as a god, still has not recovered.
The mining company did not own the dam at the time of the burst, but the judge found that BHP was “directly and/or indirectly responsible” for the activity of the dam’s owner and operator, Samarco. Because of this, the judge ruled that
“BHP are strictly liable as ‘polluters’ in respect of damage caused by the collapse,” according to the judgment.
Later trials that are expected to be completed in 2028 or 2029 will assess the damages BHP owes.
BHP said in a statement that it plans to appeal the court’s decision, noting that the company has already supported remediation and compensation efforts since the disaster. (Municipio de Mariana et al v. BHP Group (UK) Limited et al, High Court of Justice, No. EWHC 3001 (TCC), 2025)
Legislation
United Kingdom
Human smuggling. King Charles II approved the Border Security, Asylum, and Immigration Act at the beginning of December.
The law enhances UK border security and improves response coordination to border threats. It also creates provisions to apply counter-terrorism measures to combat organized crime, with a specific focus on human smuggling.
The act allows immigration enforcement, police, and the National Crime Agency to access illegal migrants’ mobile phone data for intelligence on and prosecution of human smugglers. It also criminalizes actions related to human smuggling, including supplying boat parts (which would result in up to 14 years in prison), downloading or recording smuggling data (up to five years in prison), and importing or modifying vehicles to hide migrants (up to five years). Anyone who endangers lives during small boat crossings or creates online material that promotes illegal migration could be sentenced up to six years in prison.
The new law expands regulation and enforcement powers for the Immigration Advice Authority (IAA), which provides advice on immigration applications. IAA’s new powers include the ability to fine regulated organizations up to £15,000 ($20,000) for compliance failures and require repayment of fees and compensation up to £250,000 ($333,600).
Additionally, IAA can immediately cancel individual’s or organization’s registration if they are a serious risk to advice seekers or the immigration system. IAA also has the ability to suspend an individual or organization from its register if serious harm is suspected during an investigation, or where someone is charged with an offence of dishonesty, deception, or an indictable offence. The law further gives IAA the ability to fine individuals who are the subject of a complaint and fail to cooperate with an IAA investigation.
U.S. States
Firearms in schools. North Carolina select private school employees and volunteers are now permitted to carry firearms and stun guns on school grounds.
This new authority comes with the enactment of SL 2025-81, which took effect 1 December and was introduced as HB 193.
To carry weapons on school property, employees and volunteers must obtain a concealed handgun permit, written permission from the school’s administrative director or board of trustees, and complete at least eight hours of gun safety and appropriate use training annually. These individuals may also carry weapons into worship sties that are connected to the school property.
Private schools must also adopt and maintain standard operating procedures about the possession and carrying of weapons on educational property. These procedures must be distributed to parents of students who attend the school each year.
Also of Interest
Security Management follows court cases, bills, laws, and regulatory issues that impact the security industry. Here are some of the developing stories that are of current interest.
Car ramming. Taleb al-Abdulmohsen is on trial for a car-ramming attack on a Christmas market in Magdeburg, Germany, in 2024. While the German legal system does not include formal pleas, al-Abdulmohsen reportedly told the court that he was the driver in the attack.
Cyber resilience. Legislators in the United Kingdom introduced the Cyber Security and Resilience Bill in the House of Commons. If enacted, the law would place new regulations on data centers and managed service providers.
Extremists. The U.S. federal grand jury returned a 29-count indictment against Baron Cain Martin, 21, the alleged leader of the nihilistic violent extremist group 764. Among the charges are participating in a child exploitation enterprise; conspiring to kill, kidnap, or maim persons in a foreign country; producing child pornography; and conspiring to provide material support to terrorists. If convicted of the crimes, Martin could be sentenced to life in prison.
Flash flooding. The families of Camp Mystic campers and counselors who died during the July 2025 floods in Texas filed a suit alleging camp leadership—including the Eastland family owners—of gross negligence. The suit contends that the Eastland family wasted crucial time responding to alerts about flash flooding, which led to the deaths of campers and staff members.
Graphic content. A 17-year-old girl joined a lawsuit against UK Education Secretary Bridget Phillipson that claims the current government guidance allowing school officials to determine appropriate smartphone use in education settings is unsafe for minors. The plaintiffs said that the policy allows other people to show them unwanted content at school, including pornographic and violent imagery.
Security guards. Baltimore, Maryland, City Councilman Jermaine Jones introduced the Security Officers Compensation Bill, which would increase wages and improve standard benefits for law enforcement and court security officers.
Wildfire. Jonathan Rinderknecht pled not guilty to deliberately setting a fire in January 2025 that resulted in the Palisades Fire in California, one the U.S. state’s most destructive wildfires.
Sara Mosqueda is associate editor for Security Management. Connect with her on LinkedIn or email her at [email protected].
